Privacy Policy

HuddleEats is a software platform that helps athletic programs schedule and order team meals from independent food vendors. This policy applies to everyone who uses the platform: parents and guardians, coaches and school staff, and vendor operators.

It also covers the athlete records that adults create in the platform. Athletes themselves do not have accounts and do not use the platform — see section 9.

We collect the minimum needed to run team meal ordering. Specifically:

We use the information above to:

• Create and secure your account, and sign you in.
• Show the meal events, menus, and rosters relevant to your program and role.
• Take your meal selection, consolidate it into a single vendor order, and send that order to the vendor.
• Charge your authorized payment method for meals you select, and process refunds.
• Send order-related notifications — cutoff reminders, confirmations, and receipts.
• Give coaches and program administrators the headcount and reconciliation reporting they need.
• Detect and investigate fraud, abuse, and security incidents, and meet legal and tax obligations.

We do not use your information to build advertising profiles, and we do not make automated decisions that produce legal or similarly significant effects about you.

We disclose information only to the parties below, only for the purpose listed, and only the fields needed for that purpose. The method of each disclosure is stated so it is clear how the information travels.

• We do not sell your personal information, and we do not share it for cross-context behavioral advertising.
• We do not give athletes accounts and never contact an athlete.
• We do not store card numbers.
• We do not let one program see another program’s rosters, orders, or families.
• We do not run third-party advertising or analytics trackers on this site.

The safeguards in place today:

• Encryption. All traffic to the platform is encrypted in transit with HTTPS. Data at rest in our database and storage is encrypted.
• Authenticated, role-scoped access. Sign-in is handled by AWS Cognito. Multi-factor authentication is available, and required for administrative roles.
• Database-level isolation between programs.Access rules are enforced in the database itself, not only in application code, so a query cannot return another program’s records even if application logic is wrong.
• Restricted write access to sensitive fields.Dietary flags on an athlete can be written only by that athlete’s own parent or guardian; this is enforced by the database, and every change records who made it.
• Audit logging. Significant actions are recorded so access can be reviewed and incidents investigated.
• Least privilege. Staff access to production data is limited to what a role requires.
• Payment isolation. Card data never touches our systems, which removes an entire category of risk.

No system is perfectly secure. If we become aware of a breach affecting your information, we will notify affected users and the appropriate authorities as required by law.

Athlete records are retained for a limited window tied to the program’s season and then anonymized — by default 180 days, and never less than 150. Anonymization clears identifying fields, including dietary flags, and is not reversible.

Order, charge, and tax records are kept for as long as financial and tax law requires, since we are obligated to be able to produce them. Account records are kept while your account is active.

You can ask us to:

• Tell you what information we hold about you.
• Correct information that is wrong.
• Delete your account and associated records, subject to records we must keep by law.
• Provide a copy of your information in a portable format.

Email support@huddleeats.com from the address on your account and we will verify and action the request. We do not charge for this and we will not treat you differently for asking.

Order notification emails are part of the service rather than marketing, so they are not something you can unsubscribe from while keeping an active order — but we do not send marketing email to parents.

HuddleEats is used by adults on behalf of athletes. Athletes do not have accounts, do not sign in, and are never contacted through the platform. This is deliberate: it keeps children out of scope for online account data collection entirely.

Athlete records are created and managed only by an adult — a parent, guardian, or coach — and are minimized by design to a first name, a last initial, an optional jersey number, and optional dietary flags. Only that athlete’s own parent or guardian can set dietary information.

A parent or guardian can review, correct, or request deletion of their athlete’s record at any time using the contact address in section 10.

If we change this policy we will update the version and effective date above. For a change that materially affects how we handle your information, we will give notice in the app before it takes effect.

Questions, requests, or privacy concerns: support@huddleeats.com. See also our Terms of Service and Support pages.