Privacy Policy

• Visitors to our public website, including people who request a quote or demo.
• Coaches, staff, and administrators who use Keystone on behalf of a Customer.
• Athletes whose training information is entered into Keystone by their school, or who sign in to the athlete portal.

Information you or your school provide:

• Staff account details: name, email address, role, school or organization, and sign-in credentials (passwords are stored only in encrypted, hashed form).
• Athlete roster details: first and last name, Athlete ID, team, position, class year, and, if the school chooses to enter them, date of birth, email, phone, height, body weight, and coach notes.
• Training and performance information: programs, workouts, logged sets, weights, repetitions, RPE, working maxes, testing results, timed and measured performance results, attendance, GPS and workload data, records, calendar events, and reports.
• Quote and demo requests: name, email, school or organization, approximate athlete count, and your message.
• Feedback you send us and messages to support.
• Billing information: the subscribing organization's billing contact and subscription details. Card and bank details are entered directly with our payment processor, Stripe; Keystone never receives or stores full card numbers.

Information collected automatically:

• Basic technical data needed to run and secure the service, such as IP address, browser type, device type, and timestamps, which may appear in server and security logs.
• Activity records inside the app, such as who created, changed, or deleted a record and when, so schools can see a history of changes and recover deleted data.

Keystone is not designed to hold medical records. We ask Customers not to enter diagnoses, treatment notes, or other health records into Keystone.

We use only the browser storage needed for Keystone to work: keeping you signed in, remembering display preferences (for example, sidebar layout or filters), and saving unsent entries on your device so work is not lost if a connection drops. We do not use advertising cookies, cross-site tracking, or third-party analytics or advertising pixels. If that changes, we will update this policy before doing so.

• To provide the service: building programs, calculating loads, logging workouts, printing lift cards, and producing reports for the Customer.
• To create and secure accounts, verify identity, and prevent fraud, abuse, and unauthorized access.
• To send service emails, such as staff invitations, sign-in and password-reset messages, and billing notices.
• To respond to quote requests, demo requests, feedback, and support questions.
• To process subscription payments.
• To maintain, troubleshoot, and improve the service.
• To comply with law and enforce our agreements.

We do not sell personal information. We do not use athlete or student information for advertising, to build marketing profiles, or for any purpose other than providing the service to the Customer, unless the Customer directs us to or the law requires it.

When a school or university uses Keystone, athlete information may be part of that institution's education records under the Family Educational Rights and Privacy Act (FERPA). In that case, Keystone acts as a "school official" under the institution's direct control for the use and maintenance of those records. We use such records only to provide the service, do not re-disclose them except as the institution authorizes or the law permits, and support the institution in responding to requests to access or correct records.

Athletes, parents, and guardians who want to review, correct, or delete records should contact their school first, since the school controls those records. If you contact us directly, we will refer your request to the school and assist them.

Keystone is intended for high school, college, and adult athletic programs. We do not knowingly collect personal information directly from children under 13. Athlete portal accounts are not offered to children under 13 unless a Customer has a separate written agreement with us addressing children's privacy. If you believe a child under 13 has provided information to us without appropriate consent, contact us and we will delete it.

• Within a Customer: information is visible only to that Customer's authorized staff, based on the roles and team access the Customer assigns. Athletes who sign in see only their own information and limited team information (such as team schedules and records boards) that their school enables.
• Other Customers: one school's information is never visible to another school.

We share information only as follows:

• Service providers who host and operate Keystone for us, under contracts requiring them to protect the information and use it only to provide services to us. These include our cloud hosting and database provider, our email delivery provider, and Stripe for payments.
• With the Customer that owns the information, including through exports and reports.
• When required by law, subpoena, or court order. Where permitted, we will notify the affected Customer first so it can respond.
• To protect the safety, rights, or property of our users, the public, or Keystone.
• In a merger, acquisition, or sale of assets, where the successor must continue to honor this policy and existing Customer agreements.

We use reasonable administrative, technical, and physical safeguards, including encrypted connections (HTTPS), encrypted password storage, database-level access rules that separate each Customer's data, role-based permissions, and change history with recovery of deleted records. No system is perfectly secure. If we learn of a security incident affecting a Customer's personal information, we will notify the affected Customer without undue delay and as required by law and our agreement with that Customer.

We keep Customer information for as long as the Customer has an active subscription, or as the Customer directs. When records are deleted in Keystone, a protected recovery copy is kept for up to 180 days so mistakes can be undone, then removed. When a subscription ends, the Customer may export its data, and we delete or de-identify remaining Customer data within the period set in the Customer's agreement, except where we must keep information to comply with law, resolve disputes, or enforce agreements. Quote requests and support messages are kept as long as needed to respond and maintain business records.

• Staff and athletes can update certain account details in the app, or ask their school's administrator.
• You may ask to access, correct, or delete your personal information. For information a school controls, we will forward your request to the school.
• Depending on where you live, state law may give you additional rights. We will honor applicable requests and will not discriminate against you for making one.
• You can opt out of non-essential emails from us at any time. Service emails, such as password resets, are still sent as needed.

To make a request, email preston@keystonescos.com. We may need to verify your identity before acting.

Keystone is operated from the United States, and information is processed and stored by us and our service providers in the United States and other locations where they maintain facilities. [Confirm data storage region before publishing.]

We may update this policy from time to time. We will post the updated version with a new effective date and, for significant changes, notify Customer administrators by email or in the app before the change takes effect.

• Keystone Sports Performance Technologies, LLC (d/b/a Keystone S&C OS)
• 3712 NE Bradford St, Lawton, OK 73507
• preston@keystonescos.com