Last updated: July 10, 2026
This Privacy Policy describes how Collegiate Transition Alliance ("we", "us", or "our") collects, uses, stores, and discloses your information when you use Transfer Portal+ (the "Service"). By using the Service, you agree to the collection and use of information in accordance with this policy.
1. Information We Collect
Information You Provide Directly
When you create an account or use our Service, we collect information you provide directly, including:
- Name, email address, and role (coach or athlete)
- Password and authentication credentials (managed by Clerk)
- Profile information, including photos, bios, and contact details
- For athletes: athletic statistics, academic information, athletic history, and recruitment preferences
- For coaches: team affiliation, school information, and recruiting needs
Automatically Collected Information
When you visit or use the Service, we automatically collect certain information to help us operate and improve the platform:
- IP address, browser type, operating system, and device type
- Pages visited, features used, time spent on pages, and click patterns
- Referring URLs and search terms
- Error logs and diagnostic data for troubleshooting
Information from Third-Party APIs
With your explicit consent, we connect to third-party services to enhance your experience. We only request the minimum permissions necessary:
- Gmail (readonly access): We use the
gmail.readonly scope to read email messages and settings. When you connect your Gmail account, we read emails that match recruit email addresses on your team and import the subject line, sender name/email, date, body text, and any links into your recruit's activity timeline. We do not send, delete, or modify any emails in your inbox. - Calendly: We access your scheduled events, event types, and contacts to sync meeting data into your recruit activity feed and contact list. We do not modify your Calendly events or contacts.
Planned future integrations: We may integrate with Google Calendar and Google Contacts in the future to provide scheduling and contact management features. These integrations will require explicit user consent and will be limited to the minimum necessary scopes.
2. How We Use Your Information
We use the information we collect for the following purposes:
- To provide, operate, and maintain the Service
- To facilitate connections between athletes and coaches through the transfer process
- To import and display third-party data (emails, calendar events) within your CRM pipeline
- To personalize your experience and improve our platform
- To communicate with you about updates, security alerts, support, and billing
- To detect, prevent, and address fraud, security breaches, and technical issues
- To comply with legal obligations and enforce our Terms of Service
3. Third-Party API Data — Detailed Use
Gmail Data
When you authorize Gmail access, we store the following in our database:
- Encrypted OAuth refresh and access tokens for your Gmail account
- Email subject lines, sender names/emails, dates, and body text (up to 10,000 characters)
- Gmail message and thread IDs for deduplication and sync tracking
- Extracted links from email bodies
Your Gmail data is used solely to display recruit-related email conversations within your team's CRM. It is not shared with other users outside your team, used for advertising, or sold to third parties. You can disconnect Gmail and optionally delete all imported email data at any time from your Settings page.
Calendly Data
When you authorize Calendly access, we store:
- Encrypted OAuth access tokens
- Event details (event name, date, invitee information) synced as activity notes
- Contact information for invitees imported as recruits
You can disconnect Calendly and optionally remove all imported events and contacts at any time from your Settings page.
4. Cookies and Tracking Technologies
We use cookies and similar tracking technologies to enhance your experience and analyze usage:
- Authentication cookies: To keep you logged in (managed by Clerk)
- Preference cookies: To remember your settings and preferences
- Analytics cookies: We use PostHog and Vercel Analytics to understand how users interact with our platform. This data is aggregated and does not personally identify you.
- Error tracking: We use Sentry to monitor and fix technical errors.
You can disable cookies through your browser settings, though this may affect certain features of the Service.
5. Information Sharing and Disclosure
We do not sell your personal information. We may share information in the following limited situations:
- Within Your Team: Coaches on the same team can view shared recruit profiles, notes, and activity timelines. Athletes control what information is visible to coaches.
- Service Providers: We use third-party vendors for hosting (Supabase), authentication (Clerk), payments (Stripe), analytics (PostHog, Vercel), and error monitoring (Sentry). These providers process data on our behalf and are contractually obligated to protect it.
- Legal Compliance: We may disclose information if required by law, subpoena, or to protect our rights, property, or safety.
- Business Transfers: In connection with a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction.
6. Data Retention and Deletion
We retain your personal information for as long as your account is active or as needed to provide the Service. Specific retention practices include:
- Account data: Retained until you request deletion or close your account.
- Gmail imported data: Retained while your Gmail connection is active. Disconnecting Gmail with the "remove imported emails" option permanently deletes all imported email notes and associated threads from our database.
- Calendly imported data: Retained while your Calendly connection is active. Disconnecting with removal options permanently deletes imported events and contacts.
- OAuth tokens: Deleted immediately when you disconnect an integration.
- Analytics and logs: Retained for up to 12 months for troubleshooting and platform improvement, then anonymized or deleted.
Account Deletion: At this time, self-service account deletion is not available. To request deletion of your account and all associated data, please contact us at support@collegiatetransitionalliance.com. We will process deletion requests within 30 days.
7. Data Security
We implement industry-standard security measures to protect your information:
- All data is transmitted over HTTPS/TLS encryption
- OAuth refresh tokens for Gmail and Calendly are encrypted at rest using AES-256-GCM
- Database access is restricted and protected by Row Level Security (RLS) policies
- Regular security audits and automated vulnerability scanning
No method of transmission over the internet or electronic storage is 100% secure. While we strive to use commercially acceptable means to protect your personal information, we cannot guarantee absolute security.
8. California Consumer Privacy Act (CCPA) Rights
If you are a California resident, you have the following rights under the CCPA:
- Right to Know: You have the right to request what personal information we collect, use, disclose, and sell.
- Right to Delete: You have the right to request deletion of your personal information, subject to certain exceptions.
- Right to Opt-Out: We do not sell your personal information. If this changes, we will provide notice and an opt-out mechanism.
- Right to Non-Discrimination: We will not discriminate against you for exercising any of your CCPA rights.
To exercise your CCPA rights, contact us at support@collegiatetransitionalliance.com. We will verify your identity before processing your request.
9. Children's Privacy
The Service is not intended for use by children under the age of 13. We do not knowingly collect personal information from children under 13. If you are a parent or guardian and believe your child has provided us with personal information, please contact us immediately.
10. Changes to This Privacy Policy
We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on this page with a new "Last updated" date. For significant changes affecting how we use your data, we will also notify you via email or through the Service. We encourage you to review this Privacy Policy periodically.
11. Contact Us
If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us at:
Email: support@collegiatetransitionalliance.com
Company: Collegiate Transition Alliance