GritMetrics Privacy Policy

Effective date: October 4, 2026
This policy explains what information Benjamin Michael Tomaino, doing business as GritMetrics ("GritMetrics", "we", "us") collects through the GritMetrics app and website (the "Service"), how we use it, who we share it with, and the choices you have.
The short version: we collect what a wrestling club needs to run its program, we use it only to provide the Service, we do not sell personal information, we do not show ads, and we do not use children's information for advertising or profiling.

1. Who controls the information

Each club decides who is in the club and what is recorded about its wrestlers. For most information about a club's members, the club decides why and how it is used, and GritMetrics processes it on the club's behalf. GritMetrics decides how account and service information (such as login details and security logs) is handled. Questions about what a club recorded can go to the club or to us.

2. What we collect

Account information: name, email address, phone number, password (stored only as a secure hash by our authentication provider), and the clubs and roles you hold.
Wrestler information entered by a parent, the wrestler, or the club: name, birthdate, photo, weight class and similar details, parent/guardian and emergency contacts, attendance and check-ins, bookings, coaches' ratings and notes, progress reports, and which club documents (such as a media release) were signed, by whom, and when.
Video and photos: clips and practice footage coaches upload, and profile and coach photos.
Payment information: payments are processed by Stripe. We never receive or store full card numbers. We store the card's brand, last four digits, and expiry so you can recognize it, the amounts charged, refunded, or owed, credit paid in and spent, memberships, and how a payment was settled (including payments a club marks as paid in cash, check, or Venmo).
Messages and alerts: the notifications we send you, whether they were delivered, and your notification settings; if you use the phone app, a push token that lets us send alerts to your device.
Technical information: log data such as IP address, device and browser type, and error reports, used to keep the Service secure and working. Error reports go to Sentry, our error-monitoring service.
Location: a club's zip code and the town it is in, so families can find it. We do not collect your device's location.

3. How we use it

•
To run the Service: schedules, bookings, attendance, ratings, progress, video, documents, and payments.
•
To send the alerts and emails the Service needs (a class changed, a spot opened, a payment went through or is owed, a reminder from a coach).
•
To keep accounts secure, prevent fraud and abuse (for example, limits on paying in and refunding credit), and fix problems.
•
To comply with the law and enforce our Terms.
AI-drafted summaries. If a coach chooses to have a practice summary drafted, the coach's notes for that class, which may include wrestlers' first names, are sent to an AI model through OpenRouter and its model provider (Anthropic's Claude), to produce a draft the coach reviews.
We do not use personal information to sell, advertise, or build marketing profiles.

4. Who we share it with

•
Your club, according to roles: a club's coaches and admins see their wrestlers' information; parents see their own children's; wrestlers see their own. Names and profile photos are visible to every member of the club, so members can recognize one another. Clubs are kept separate from each other in our database.
•
Families in a class may see class clips and class notes for that class, as the club and coach choose.
•
The public, only for what a club chooses to put on its public page: the club's name, schedule, price list, and coaches who chose to appear with their public photo. Wrestlers are never shown publicly.
•
Service providers that run parts of the Service for us, under contracts that limit their use of the data:
•
Supabase (database, sign-in, file storage)
•
Stripe (payments; Stripe's own privacy policy applies to your card details)
•
Mux (video storage and streaming)
•
Expo (push notifications to phones)
•
Resend (email delivery)
•
OpenRouter and its model provider (AI-drafted summaries, only when a coach uses them)
•
Cloudflare (hosting the website)
•
Sentry (error monitoring, so we hear about crashes)
•
GritMetrics' own administrators. A small number of authorized GritMetrics staff can access all user records, and every club's information, when it is needed to run and look after the Service: to help a family or club that asks for support, fix a problem with an account, payment or club, keep the Service secure, prevent misuse, or meet a legal obligation. They do not browse information for any other reason, and access is never used for advertising or sold. Changes our staff make to an account or club are recorded, with the reason, and the person affected is told.
•
The law: when required by law, to protect someone's safety, or to report suspected child exploitation.
•
A business transfer: if GritMetrics is sold or merged, information may transfer under this policy's protections.

5. Children

GritMetrics is used by youth wrestling clubs, so it holds information about children.
•
Under 13. A child under 13 cannot create an account on their own. A child appears in the Service only because a parent or guardian added them, or a club added them and a parent confirmed. The parent controls the child's account. A parent gives consent by creating their own account and adding the child, or by accepting the club's invitation that names the child; a parent also signs the club's media release before a child's photos or clips are shared within the club.
•
13 to 17. A wrestler may have a login. A parent keeps control until the wrestler turns 16 (for example, checking in and editing details), and a wrestler under 18 may authorize payments only if a parent allows it and only on that parent's card.
•
Signatures on consent documents (such as a media release) for a wrestler under 18 are given by a parent or guardian.
•
Parents' rights. A parent may review the information about their child, ask us or the club to correct or delete it, and withdraw permission for further collection, by contacting the club or us at [email protected]. We will not require a child to give more information than needed to take part.

6. How long we keep it

•
Practice footage is deleted automatically after 90 days. Clips a coach saves remain until deleted.
•
Account and club information is kept while the account or club is active; when an account is deleted, it is deleted or de-identified seven days after the request, except as below.
•
Payment and signature records may be kept for as long as needed for tax, accounting, legal, and dispute purposes (seven years), because they are evidence of what was agreed and paid.
•
Security and audit records (which account changed what, and when) are kept while the Service runs.
•
Reports you make about a clip, a photo or a person are kept as the club's and our record of how it was handled; the words you wrote are removed if you delete your account, and your blocks are deleted with it.

7. Your choices and rights

•
Deleting your account takes effect seven days after you ask, and signing in again before then cancels it. Your name, contact details, photo, saved cards and alerts are then deleted; a child you alone manage is deleted too if you choose, otherwise they stay with the club. Records of payments stay with the club with your name removed.
•
Access, correct, and delete. You can see and edit much of your information in the app, and delete your account in the app (Profile → Delete account) or by writing to [email protected].
•
Notifications. You choose push and email alerts in Notification settings; some service messages (such as payment receipts) are always sent.
•
California and other state residents may have rights to know, delete, correct, and opt out of the "sale" or "sharing" of personal information. We do not sell or share personal information for targeted advertising.
•
If you are outside the United States, the Service is run in the United States, and your information is stored and processed there..
We will respond to requests within the time the law requires, and may need to verify who you are first. For information a club controls, we may refer you to the club, or act on the club's instructions.

8. Security

Club information is separated in the database itself, so one club cannot see another's. Connections are encrypted, video is streamed only through short-lived signed links, and GritMetrics staff access is limited to the people who run the Service and is recorded (section 4). No system is perfectly secure; if a breach affects your information we will notify you as the law requires.

9. Changes

We may update this policy. If the changes are significant we will tell you in the app or by email before they take effect.

10. Contact

Benjamin Michael Tomaino, doing business as GritMetrics 41 Seneca Place, Oceanport, NJ 07757 [email protected]