Privacy Policy
How the unaffiliated Newport Harbor athletics app and website handle information. Last updated October 6, 2026.
Read this first
Newport Harbor High School is a real school, and this is not its site. This software is unaffiliated: it is not operated by or endorsed by the school or the district. Its programs, coaches and leagues are real because the school publishes them; its contests are read from the CIF Southern Section schedule of record and its performing-arts bookings from the district's own calendar. The athletic department has sent no transportation workbook, and a facility-use export covering four weeks. The rosters the school sent name real students, and those names are shown to signed-in users only. No public page carries one, and the mobile app bundle carries none at all. Every other record — officials, assignments, payouts, approval chains, facility requests, the clearance population and the squad sizes of programs without a roster — is invented, and the population those records hold carries opaque ids and nothing else.
What this covers
This policy covers the unaffiliated Newport Harbor athletics iOS app and this website. They are one product sharing one backend, so one policy describes both.
What we collect
You can browse the entire app — schedule, programs, coaches and the record — without an account and without giving us anything. No sign-up wall, no advertising identifiers.
Information is collected in four places:
If you sign in
Accounts exist only for people who were invited. Signing in uses Firebase Authentication, which stores your email address and a hashed password, and assigns an account identifier. We never see or store your password in a readable form.
If you talk to Duke
Duke is the in-app onboarding assistant. Your messages are sent to Anthropic to generate a reply. If you are signed in, the onboarding answers Duke collects — your preferred name, your role with the program, which team level interests you, and which notifications you want — are saved to your account so the app can be set up for you.
If you are not signed in, nothing from that conversation is logged or stored. The reply is generated and the exchange ends there.
Activity on your account
While you are signed in, your account carries its own activity log, written server-side: sign-ins on the website, the gated pages you open there, and each Duke exchange from either app, with timestamps. It is the account's audit trail — readable by you and by staff, used for the admin activity view, and it leaves the backend for nobody. It is not an analytics product and runs regardless of the section below.
Analytics — on
The website and the apps record how they are used: which pages and screens are opened; which links and buttons are pressed, described by where they lead and which part of the page they sit in and never by what they say; how far down a page you scroll; when a form is started or sent, never what is typed in it; which outside websites and files are opened; how quickly pages load; and when something breaks. Duke conversations are counted in turns and never read.
The events go to CosmotionAI, the company that builds this software, and nowhere else: no third-party analytics service is involved. Your browser or device is given a random identifier that is not connected to your account, and if you sign in only your role (parent, coach, athletic director, and so on) is attached, so use can be understood by persona without knowing who anyone is. It never receives your email address, your name, your account, anything you type, anything a roster shows, your location or an advertising identifier, and your IP address is never stored. It is not shared with or sold to anyone, and none of it is used to follow you across other websites or apps.
On the website, if your browser sends Global Privacy Control, nothing is sent at all. Do Not Track is not treated separately, since Global Privacy Control is the signal the law recognizes. You can also switch analytics off for this browser with the control below.
What we do not do
- No advertising, ad networks or advertising identifiers.
- No cross-site tracking, and no analytics service beyond our own, named above.
- No selling or renting of information to anyone, for any purpose.
- No location collection.
- No access to your contacts, photos, camera or microphone.
- No payments. The sponsorship screens are illustrative and process nothing — no payment method is ever collected.
Who information reaches
Four service providers, each for one job:
- Google Firebase — authentication and the content database. Firebase holds the email address, account identifier, saved onboarding answers and activity log of anyone who signs in.
- Anthropic — generates Duke’s replies from the messages you send it.
- Resend — delivers the email with a link to set your password, when you ask for one. Resend receives that email address and the message, and nothing else.
- CosmotionAI (usage analytics) — the company that builds this software receives how the website and the apps are used, under a random identifier and your role only. See Analytics above.
Nobody else receives anything. Information is disclosed beyond these four only if the law requires it.
How long it is kept
Account records, saved onboarding answers and the account's activity log are kept while the account exists. Accounts are issued by invitation and are removed when the purpose they were issued for ends. Ask us to delete yours at any time and we will remove the account and everything attached to it.
Usage events are kept for 400 days (about thirteen months), then deleted automatically. That is separate from — and shorter than — how long an account itself is kept.
Children
The app is meant for adults: school and athletic department staff and the people they invite. It is not directed at children, and we do not knowingly collect information from anyone under 13. The only students named are the ones on the rosters the school sent, and those are shown to signed-in users only — never on a public page, and never in the mobile app bundle. The clearance population the app holds is a separate synthetic set with opaque ids and no name field. Every person in the app's records other than the coaches and staff the school publishes is invented.
Rights and requests
Ask us for a copy of what is held about you, ask for a correction, or ask for deletion — email the address below and we will action it. There is no fee and no account needed to ask.
Updates to this policy
If what the app collects changes, this page changes with it and the date at the top moves. Material changes will be noted in the app.
Reach a human
Privacy questions, deletion requests and anything else about this policy: mark@cosmotion.ai