Privacy Policy

Effective: 2026-09-11

1. Who we are and what this policy covers

MatViz is a platform for wrestling clubs and athletes offering livestreaming, recorded and annotated match video, athlete profiles, and club management (rosters, scheduling, dues, and team communication). This policy describes how MatViz collects, uses, discloses, and retains personal information through the matviz.com website, its subdomains, and the MatViz desktop application (collectively, the "Service").

The data controller of personal information processed through the Service is FinnTech LLC, a South Dakota limited liability company doing business as MatViz. References to "we," "our," and "MatViz" mean FinnTech LLC.

Until 2026-09-10 the controller was Casey Finnicum, a sole proprietor doing business as MatViz. Effective 2026-09-10 the MatViz business was transferred to FinnTech LLC, which assumed the predecessor operator's obligations under this policy. That transfer changed the identity of the controller only: the categories of information we collect, the purposes for which we use it, the subprocessors listed in Section 4.1, and the retention periods in Section 5 are unchanged, and your rights under Section 7 are unaffected.

This policy does not cover third-party tournament software, hardware scoring devices, or sites operated by tournament organizers, clubs, or schools that link to or from the Service.

2. Information we collect

2.1 Information you provide directly

• Account. Email address, password (stored only as a salted bcrypt hash — never in plaintext), optional display name, and the time at which you confirmed you are at least 13 years old.
• Profile. Profile-visibility setting (public or private). You may link your account to wrestler records you represent or manage.
• Wrestler records you create or manage. First and last name, date of birth, gender, weight class, grade, club or team, school, a parent or guardian contact email, and — if one is uploaded — a profile photograph of the wrestler. For wrestlers under 13, see Section 8; those records are collected only by an adult on behalf of the minor under the representations in Section 9.
• Tournament and registration data. Entries, weigh-in records, seedings, brackets, match results, and any custom fields a tournament organizer requires (e.g., USAW membership number, medical waiver acknowledgments).
• Waivers and electronic signatures. When a club requires a waiver, release, medical authorization, or code of conduct, we record your electronic signature: the name you type as the signature, the relationship you select (parent, guardian, self, or other), which version of the document you signed, the date and time, and the IP address and browser user-agent captured at the moment of signing. Those last two are part of the signature's audit trail under the federal E-SIGN Act; they are not used for tracking or profiling.
• Attendance and RSVPs. Practice and event attendance for wrestlers on a club roster — whether the wrestler was present, late, excused, or unexcused, whether the record came from a self-service kiosk check-in or a coach's roll call, the check-in time, an optional short note a coach adds, and RSVP responses (going, out, maybe) together with who answered. A kiosk device holds a PIN-gated device session — a hashed device token, an optional device label, and a last-seen time — not a wrestler login.
• Team communication. Messages you send in club channels and in direct messages: the text of the message, who sent it, when it was sent, whether and when it was deleted, and your per-channel read and mute state. A deleted message is hidden from the conversation but retained in the club owner's audit view. Section 8 explains how these features work where minors are involved.
• Payment information. Cardholder data is collected and processed directly by Stripe, Inc. on Stripe-hosted forms; MatViz never sees or stores the card number, expiration date, or CVC. We receive only payment metadata such as Stripe customer ID, last four digits, card brand, payment status, and refund or dispute events. When you pay a club or tournament registration for one or more wrestlers, each wrestler's name is sent to Stripe as the description of that line item, so the checkout page and your receipt itemize what you are paying for. Stripe receives your email address and those names; it does not receive dates of birth, contact details for the wrestler, or any other roster information.
• Communications. Support emails, abuse reports, and access or deletion requests sent to hello@matviz.com.
• Audio and video. Match livestreams and recorded clips, collected only when a user actively starts a livestream, uploads a clip, or records via the personal-recording feature.

2.2 Information collected automatically

• Application logs. Our servers write operational logs to the host system journal — timestamps, the operation performed, error conditions, and in some cases the IP address associated with a request — for debugging, abuse mitigation, and capacity planning. We do not run HTTP access logging, so we do not keep a systematic per-request record of the pages you visit or the responses you received. These logs are retained on a rolling, size-capped basis — the oldest entries are discarded as newer ones arrive — rather than for a fixed number of days.
• Session records. A session token (stored hashed), IP address, user-agent, expiry, and last-seen timestamp, retained as long as the session is valid.
• Playback and viewing telemetry. When you watch match video we record playback events — play, pause, seek, buffering, quality change, and completion — along with the position in the video, the video's dimensions, a per-visit playback identifier, which match was watched and, when you are signed in, your account ID. We use this to diagnose playback problems and to size video infrastructure. It is not used for advertising and is not shared with anyone.
• Streaming session metadata. Starting or joining a livestream generates session metadata such as room IDs, participant identities, and recording start/stop events. This is produced by our own LiveKit media server, which we operate on the same infrastructure as the rest of the Service; it is not sent to a third-party streaming provider.
• Error data. Sentry collects exception traces and associated request context from our servers to help us diagnose production errors. Personal information — emails, IP addresses, cookies, sensitive headers, request bodies, and email- or token-shaped values inside error context — is stripped on our server before the report is sent. Error reports are generated by our servers, not by your browser, so the network address Sentry sees is our server's, not yours.
• Bot-check signals. Our sign-in and sign-up pages run Cloudflare Turnstile, an automated check that tells a person apart from a scripted sign-up. When one of those two pages loads, your browser contacts Cloudflare directly, and Cloudflare receives your IP address, your browser user-agent, and signals about your browser and how it interacts with the page, which it uses to score whether the request is automated. Cloudflare returns a single-use token; when you submit the form, our server sends that token and your IP address back to Cloudflare to confirm it. This exists because automated sign-ups make MatViz send login emails to people who never asked for them. We receive only a pass-or-fail result — not Cloudflare's underlying signals — and neither we nor Cloudflare uses them for advertising. Cloudflare may store data on your device under its own domain as part of running the check; that storage is Cloudflare's, under Cloudflare's policies, and is not readable by MatViz. The check runs on those two pages only, and not for signed-in users.
• Embedded YouTube videos. A coach can attach a YouTube video to a practice plan or to a technique-library entry. Whenever a plan or entry with an attached video is displayed, the video's preview image loads from YouTube's image servers, and when you open the video, YouTube's embedded player loads in your browser from YouTube's servers; in each case Google LLC receives your IP address, your browser user-agent, and — for the player — your interactions with it. MatViz uses YouTube's privacy-enhanced embed, and MatViz receives nothing back from YouTube about you. Anything YouTube stores in your browser is set on YouTube's domain under Google's policies and is not readable by MatViz. These requests happen only where a coach has attached a YouTube video.
• Cookies and similar technologies. See Section 6.

We do not collect precise or device-level location data, and we do not infer your city, region, or country from your IP address.

2.3 Information from third parties

• Stripe. Payment status, subscription updates, refund and dispute events, and account-link status for tournament organizers using Stripe Connect.
• Resend. Delivery outcomes for the transactional email we send — delivered, bounced, or marked as spam — are recorded by Resend in its own dashboard, which we consult when diagnosing delivery problems. We do not import that data into MatViz.

2.4 Information about other people you provide

When you register a wrestler, invite a coach, add a roster entry, or list a parent contact, you provide information about other people. By doing so you represent that you have the authority to provide that information, including (where the information concerns a minor) the authority described in Section 9.

3. How we use your information

We use personal information to:

• Provide the Service — account management, registration, weigh-ins, brackets, scoring, livestreaming, recording, payments, payouts, and storage of match results.
• Communicate — magic-link login emails, receipts, optional match-start notifications, support replies, and security or policy announcements.
• Improve the Service — analysis of feature usage, error trends, video-playback quality, and platform load. Most of that analysis is aggregate, but the underlying playback records described in Section 2.2 are tied to your account when you are signed in. We do not build individual behavioral profiles for marketing.
• Draft practice plans on a coach's request — an optional AI-assisted drafting feature described immediately below.
• Prevent abuse and fraud — rate limiting, anomaly detection on payments and registrations, and investigation of suspected ToS violations.
• Comply with law and defend legal claims — responding to subpoenas, court orders, valid data-subject requests, tax and accounting obligations, and preserving records relevant to anticipated litigation or regulatory inquiry.

3.1 AI-assisted practice-plan drafting

MatViz offers coaches and club administrators an optional feature that drafts a practice plan. It runs only when a coach or administrator starts it, only for club practice planning, and never automatically or in the background.

When it runs, MatViz sends the following to Anthropic, PBC through Anthropic's commercial API, which generates the draft and returns it:

• the titles of the club's existing practice plans and the titles and minute lengths of the sections inside them;
• the club's practice-tag names and the total minutes logged against each tag over the preceding 28 days;
• the title and date of the linked calendar event, if the coach selects one; and
• a free-text focus note of up to 500 characters that the coach types for that draft.

We do not send video, recordings, match records, brackets, wrestler profiles, rosters, dates of birth, contact information, payment data, or team messages. We do not send your account ID, email address, or IP address with the request.

Everything transmitted is text a coach wrote. Because it is free text, a coach can type a person's name into a plan title, a section title, or a focus note — for example, naming the athlete a drill is aimed at — and that name would be transmitted along with the rest of the request. The focus-note field carries a reminder not to include athlete names; the plan and section title fields do not, and we cannot guarantee that no name is ever typed into any of them.

Anthropic acts as a service provider to MatViz for this feature, under Anthropic's commercial terms of service and the data-processing addendum those terms incorporate. Those terms do not permit Anthropic to train its models on what we send, and they govern how long Anthropic keeps a request. Anthropic publishes the current versions of those terms, and they are Anthropic's to change.

3.2 What we do not do

We do not sell personal information (as that term is defined under the California Consumer Privacy Act — see Section 11.2) or share it for cross-context behavioral advertising.

We do not use your data — including video, match records, wrestler profiles, team messages, or practice plans — to train artificial- intelligence or machine-learning models. That commitment covers models we might build ourselves and models operated by anyone else: nothing you put into MatViz becomes training data. Sending text to an AI provider so it can generate an answer for you, as described in Section 3.1, is not the same thing as training a model on it, and we do not permit the latter.

4. How we share your information

4.1 Subprocessors

MatViz uses the following subprocessors. Each processes personal information under that provider's published terms of service, which limit its use of the information to providing its service to MatViz. Where a provider offers a data-processing agreement or incorporates one into its terms, that agreement applies; Section 7.2 describes the status of formal international-transfer mechanisms.

We do not use third-party web-analytics, advertising pixels, or tracking libraries, and nothing we run builds a profile of you across other websites. The only third-party code that runs in your browser is the Cloudflare bot check described in Section 2.2, which loads only on the sign-in and sign-up pages, and YouTube's embedded player described in Section 2.2, when you open a video a coach has attached. Web fonts are served from MatViz's own servers, so rendering our pages sends no request to any third-party font host. If we add analytics or advertising technologies in the future, we will update this section and present a cookie-consent interface before any non-essential cookie is set.

4.2 Other categories of disclosure

• Tournament organizers see registration, weigh-in, bracket placement, match results, and payment status for the participants in their tournament.
• Club and school administrators see roster information for wrestlers affiliated with their club — name, date of birth, weight class, and match history — along with attendance, RSVP, waiver- signature, and team-communication records for their club.
• Public-by-design data. Some information you provide is intended to be public: a wrestler's name in a public bracket, registration list, or match result. Once published, these items may be cached, indexed, or copied; we cannot fully recall them (see Section 5). Match video is different — see Section 8 for how it is shared.
• Legal compliance. We may disclose personal information in response to a valid subpoena, court order, or other legal process, or when reasonably necessary to protect the rights, property, or safety of MatViz, our users, or the public.
• Business transfer. If MatViz is sold, merged, or reorganized, personal information may be transferred to the acquirer. We will notify users by email and post a notice on the Service before personal information becomes subject to a different privacy policy. The 2026-09-10 transfer of the MatViz business from the predecessor sole proprietorship to FinnTech LLC (Section 1) was a reorganization of this kind; it did not subject personal information to a different privacy policy.

5. How long we keep your data

Account-deletion behavior. Deletion is staged, and most of it happens the moment you ask:

1. Immediately. The account is marked deleted and becomes inaccessible. The email address on the account record is replaced with a non-identifying value, the password hash is dropped, every active session is invalidated, club memberships, tournament roles and links to wrestler records are removed, and active subscriptions are cancelled.
2. During the 30-day grace window. Your original email address is held in a single restore-only field so that a restore link can be sent to it if you change your mind. It is used for nothing else, and it is cleared the moment you either restore the account or the window closes.
3. After 30 days. A scheduled job purges the account record — taking the restore-only copy of your email address with it — and anonymizes linked wrestler records that no other account is still linked to.

What survives, stated plainly. One record deliberately outlives the purge: our account-deletion audit log. It keeps a snapshot of the email address and display name on the account at the time of the request, plus the IP address and browser user-agent that made the request, as evidence that a deletion was asked for and honored. We keep it for legal-compliance and audit purposes and use it for nothing else. So "purge" means the account and its credentials are destroyed and no longer usable or attributable — not that every trace of the address has been erased from every record we are required to keep.

Backups. MatViz takes an encrypted backup of the database and of stored recordings once a day and keeps it off the server. A backup is a frozen copy of the Service as it stood when it was taken, so it cannot be edited to remove one person's records without destroying its integrity as a backup. This means that after we delete or anonymize your data in the live Service, copies of it remain inside older backup snapshots until those snapshots age out — up to about 12 months. Backups are encrypted before they leave our server, are restored only to recover from data loss or corruption, and are never used to look up or re-populate a deleted account. If we ever restore from a backup, we re-apply, from our deletion log, every deletion that had been completed after that snapshot was taken.

Wrestler records and match history. At purge we anonymize the wrestler records that no other MatViz account is still linked to: name, date of birth, team, and contact fields are cleared and the wrestler is displayed under a generic placeholder (for example, "Withdrawn Wrestler"). Wrestler records that another parent, guardian, or account still manages are left untouched. Historical bracket and match rows are not deleted — they survive under the placeholder so the event's results stay internally consistent — but they no longer identify the person. We cannot recall results, brackets, or video already displayed publicly or copied elsewhere; we can and do stop attributing them to you.

COPPA-specific deletion. A parent or legal guardian may at any time request deletion of the personal information MatViz has collected about their child under 13, using the process in Section 8. On a verified request we delete, within 30 days of receiving it: the child's name, date of birth, gender, grade, weight, school and club affiliation, guardian and emergency contact details, the profile photograph (including the stored image file), practice and event attendance records, and any video clip or recording whose only identified subject is the child. Entries in shared competition records — a tournament bracket position or a club team result, which are also other participants' records — are anonymized rather than deleted: they remain under a non-identifying placeholder so the shared record stays internally consistent, and can no longer be connected to the child through the Service.

Four things are kept, and we would rather say so than promise a deletion we cannot perform: (a) video in which the child is not the only subject — a wrestling match has two wrestlers, and footage recorded by a tournament organizer or by the other wrestler's family is their content, so we remove the child's name from it, unlink it from the child's records, and revoke the sharing links we can reach, but we do not delete another family's recording on a third party's request (to have the footage itself taken down, use the process in Terms §10); (b) signed waivers, releases, and consent forms — the signature record (signer name, stated relationship, date, and which version of the document was signed) is the evidence that the document was signed and by whom, kept for as long as a claim arising from the child's participation could be brought, and then deleted, unless the club deletes its account first (Terms of Service, Section 7); (c) records we are required to keep — payment and tax records, and anything we must preserve by law or under a law-enforcement or child-safety preservation request; and (d) the record of the consent, and of the request itself — kept as evidence that we obtained consent and honored the request, and used for nothing else. We cannot recall anything already displayed publicly or copied off our systems (see "Public-by-design data" in Section 4.2).

6. Cookies and similar technologies

Every cookie MatViz itself sets is first-party and strictly necessary. This section also covers equivalent browser storage (localStorage, IndexedDB, and Service Worker caches) — see the Cookies page for the full inventory:

• user_token — session cookie set after login; HTTP-only, Secure, SameSite=Strict.
• session_token — short-lived role cookie for in-tournament scoring; HTTP-only, Secure, SameSite=Strict.
• csrf_token — paired with state-changing requests as a CSRF defense; required for any write action.

MatViz does not set functional, preference, analytics, or advertising cookies. Interface preferences — the tournament you had selected last, dismissed onboarding tips, and similar conveniences — are stored in your own browser's localStorage on your device and are not sent to us as cookies. A fourth cookie named cookie_consent exists in the software to record a consent choice, but it is not set today because there is no non-essential cookie to consent to; the Cookies page describes it.

MatViz does not use third-party advertising cookies, tracking pixels, or session-replay tools, and nothing MatViz runs profiles you across other websites. Two third parties run code in your browser and may store data under their own domains, which MatViz cannot read: the Cloudflare bot check on the sign-in and sign-up pages, which inspects your browser environment only to tell a person from an automated sign-up, and YouTube's embedded player when you open a video a coach has attached (Section 2.2). Because MatViz sets no non-essential cookies, it does not display a cookie-consent banner today. If we add analytics or advertising technologies, we will update this section and present a consent interface where required.

7. Your rights

The rights available to you depend on where you live. We honor verified requests through the contact channels in Section 13 within 45 days, or the shorter period required by your jurisdiction.

MatViz is a small business and does not currently meet the revenue or volume thresholds that make the California Consumer Privacy Act, or most other state consumer-privacy statutes, legally binding on it. We extend the rights described in this Section 7 to everyone anyway, as a matter of policy. Where we say we will do something, we mean it and you can hold us to it.

7.1 California residents (CCPA / CPRA)

You have the right to:

• Know what personal information we collect and how we use it (this policy is the disclosure under Cal. Civ. Code §1798.100).
• Access specific pieces of personal information and a portable copy. The self-serve export on your Account page produces a JSON archive containing your account record, your tournament and wrestler links, subscriptions, club memberships, matches you own, video clips, highlight reels, telestrations, follows, your policy-acceptance history, and your account-deletion log entries. If you need a category the self-serve export does not yet cover, email us and we will assemble it for you.
• Delete your personal information, subject to the limits in Section 5.
• Correct inaccurate personal information.
• Opt out of sale or sharing. We do not sell or share personal information; this opt-out is honored automatically.
• Limit use of sensitive personal information to providing the Service. We do not use it for secondary purposes.
• Non-discrimination in service or pricing for exercising any right above.

Email hello@matviz.com from the address associated with your account, or use the Privacy section of your Account page, which offers self-serve export and deletion. We may ask follow-up questions to verify your identity.

7.2 EU/EEA, U.K., and Swiss residents (GDPR / U.K. GDPR)

MatViz is U.S.-based and does not target the European market. If you use the Service from the EU/EEA, U.K., or Switzerland:

• Lawful bases. Performance of a contract (Art. 6(1)(b) GDPR) for account, registration, payment, and core features; legitimate interests (Art. 6(1)(f)) for security, fraud prevention, and product improvement; consent (Art. 6(1)(a)) where presented; and, for children, the consent of the holder of parental responsibility, obtained through the framework in Section 8.
• Rights. Access, rectification, erasure, restriction, portability, objection, and withdrawal of consent.
• International transfer. All personal information MatViz processes is stored in the United States. The primary server, its Postgres database, the LiveKit media server, and recorded video are hosted in Hetzner's Hillsboro, Oregon region; off-host backups are held by Backblaze B2 in the United States. Hetzner Online GmbH is a German company, but the hardware holding your data is in the U.S. Every subprocessor in Section 4.1 is U.S.-based or serves MatViz from U.S. infrastructure. If you use the Service from the EU/EEA, the U.K., or Switzerland, your personal information is therefore transferred to and stored in the United States. MatViz does not currently have Standard Contractual Clauses or another Article 46 transfer mechanism in place with every subprocessor. MatViz does not direct its offering to the EU/EEA (see the next bullet); if you are in the EU/EEA, the U.K., or Switzerland, please take that into account before using the Service, and you can ask us to delete your account at any time using Section 13.
• No EU representative appointed. Article 27 GDPR requires a representative only where a non-EU controller offers goods or services to data subjects in the EU/EEA or monitors their behaviour in the EU/EEA. MatViz is a U.S.-based service marketed to U.S. wrestling clubs, families, and events, does not direct its offering to EU/EEA users, accepts payment only in U.S. dollars, and does not engage in behavioural monitoring. On that basis MatViz has not appointed an Article 27 representative. If our targeting or user base changes we will reassess.
• Supervisory authority. You may lodge a complaint with the data- protection authority in your country.

7.3 Other U.S. state privacy laws

Residents of states with comprehensive consumer-privacy statutes — including but not limited to Colorado, Connecticut, Virginia, Utah, Texas, Oregon, Montana, Iowa, Indiana, Tennessee, Delaware, New Jersey, New Hampshire, Kentucky, Maryland, Minnesota, Rhode Island, and Nebraska — have substantially the same rights described in Section 7.1 (access, correction, deletion, portability, and opt-out of targeted advertising and sale, subject to each state's statutory definitions and effective dates), exercised through the same channels. Specific rights and the operative effective date vary by state; we honor verified requests under whichever framework applies to the requester.

Appeals. If we decline a request you make under this Section 7, we will tell you why. You may appeal within 60 days by replying to our response, or by emailing hello@matviz.com with the word "appeal" in the subject line. We respond to an appeal in writing within 45 days, and if we uphold our decision we will tell you how to contact your state attorney general.

8. Children's Privacy

MatViz is a platform for wrestling clubs and athletes. Wrestler profiles on MatViz (including those of athletes under the age of 13) are created and managed by parents, legal guardians, coaches, club administrators, and tournament directors — collectively, "Adult Account Holders." MatViz does not knowingly permit children under 13 to create their own user accounts. Account creation requires confirmation of being age 13 or older.

When an Adult Account Holder enters information about a wrestler under the age of 13 — including name, date of birth, weight class, club affiliation, and match results — and authorizes MatViz to process video footage of that wrestler's matches, the Adult Account Holder represents that they are the parent or legal guardian of the wrestler, OR that they are a coach or administrator with documented parental consent on file. MatViz obtains parental consent under the Children's Online Privacy Protection Act (COPPA, 15 U.S.C. § 6501 et seq.) and its implementing regulations at 16 C.F.R. Part 312 through the paths set out in Section 28.2 of the Terms of Service: a parent who registers a wrestler accepts the Terms and this policy, confirms their relationship to the wrestler, and — where the registration carries a fee — completes an online payment transaction that notifies the cardholder; where a coach, club administrator, or tournament director enters a wrestler on a parent's behalf, we rely on that person's representation that documented parental consent is held by the club or event, and we treat the guardian contact on the wrestler's record as the parent we notify and take instructions from.

We collect the following categories of information about wrestlers under 13, all of which is provided by the Adult Account Holder or generated during ordinary platform use:

• Identifiers: first and last name, date of birth, club or team affiliation, weight class, tournament registration records.
• Competition data: match results, brackets, weigh-in records, historical performance.
• Participation data: practice and event attendance (present, late, excused, or unexcused), the time of a kiosk check-in, RSVP responses, and any short note a coach adds to an attendance record.
• Waiver and signature records: the waivers, releases, and codes of conduct an Adult Account Holder signs on the wrestler's behalf, including the typed signature, the signer's stated relationship to the wrestler, and the IP address and browser user-agent captured at signing.
• Audiovisual data: a profile photograph uploaded to the wrestler's record, and video footage of matches recorded by tournament cameras or by Adult Account Holders using the personal-recording feature.
• Team communication: MatViz includes club channels and direct messages. Where a participant is under 18, a direct message cannot exist unless at least two adults are in it: the Service refuses to create a one-adult-and-a-minor conversation and refuses to post into one, and this is enforced on our servers, not in the app. We determine who is a minor from the date of birth on the wrestler's record and from how the parent-child link was established; where we cannot tell, we treat the person as a minor. This rule applies to direct messages; club-wide and group channels are visible to club staff and are not covered by it. We do not read message content except in response to an abuse report, a club owner's audit request, or legal process. A child's name or other details may appear in the text of messages adults write to each other about practices, lineups, or events; those messages are retained as described in Section 5.

We use this information solely to operate the platform — running tournaments, displaying brackets, computing standings, tracking practice attendance for the wrestler's club, and storing video for later playback by Adult Account Holders and the wrestler's family. We do NOT use under-13 wrestler information for behavioral advertising, profile building, or sale to third parties. We do not send it to any AI provider: the AI practice-plan drafting feature described in Section 3.1 receives only coach-authored plan text, never wrestler records. We do not condition a wrestler's participation in any activity on the disclosure of more information than is reasonably necessary to participate.

What is visible to others. Where a tournament organizer or club publishes brackets, results, or rosters through the Service, your child's name, club, weight class, and match results can appear on pages that other users — and, where the organizer or club has made them public, anyone on the internet — can see, and public pages can be indexed by search engines. Match video is not published to the open internet, but it can be shared through a link that works without a MatViz account for anyone who has it; links expire (after at most 30 days) and we can revoke them, but we cannot list every link already handed out, and we cannot recall a video someone has downloaded. Because a match has two wrestlers, video of your child's matches is also the opponent's family's record: we can stop showing it on your child's records and revoke the links we control, but we cannot remove another family's copy.

A parent or legal guardian may at any time:

• Request access to the personal information MatViz has collected about their child.
• Request correction of inaccurate information.
• Request deletion of their child's personal information. Section 5 ("COPPA-specific deletion") states exactly what is deleted, what is anonymized, and the four things we keep and why.
• Refuse to permit further collection or use of their child's information.
• Revoke the authority of a coach or club administrator to act for their child on MatViz.

To exercise any of these rights, email hello@matviz.com. For deletion or to stop further collection, write from the guardian email on your child's club record, or from the email on your MatViz account if it is linked to your child. For access to a copy of your child's information, we apply a higher standard, because the request discloses information about a child: we confirm your relationship through the club or event your child is registered with before we send anything, and we may ask you to complete the request from an address the club holds on file for you. Where no guardian email is on file, we confirm your relationship through the club or event before acting on any request. We acknowledge every request within five business days and complete verification and the request itself within 30 days of receiving it. We will not act on a request from a coach or club administrator on a parent's behalf without confirming with the parent.

If you believe MatViz has collected information from a child under 13 without sufficient authorization, please contact hello@matviz.com and we will investigate and, where appropriate, delete the information.

9. User Representations Regarding Minors

By creating a MatViz account or otherwise using the Service, you represent and warrant that you are at least 13 years of age. If you create, manage, register, or otherwise enter information about any wrestler who is under the age of 13 — including but not limited to entering the wrestler in a tournament, adding the wrestler to a club roster, or authorizing the recording of video footage of the wrestler's matches — you further represent and warrant that:

1. You are the parent or legal guardian of that wrestler, OR you are a coach, club administrator, or tournament director who has obtained documented parental consent from the wrestler's parent or legal guardian to enter the wrestler's information into the Service and to authorize the activities described above; AND

2. You have read and understood the MatViz Privacy Policy, including its "Children's Privacy" section, and you authorize MatViz to collect, store, and process the wrestler's personal information (including match-related video footage) as described in that policy; AND

3. You will promptly notify MatViz at hello@matviz.com if your authority to act on behalf of the wrestler ends — for example, if a parent revokes consent, or if you cease to coach or administer a club at which the wrestler is registered — so that MatViz can update or remove the wrestler's records as appropriate.

You agree to indemnify and hold harmless MatViz and the other MatViz Parties (as defined in Section 19 of the Terms of Service) from any claim, demand, or liability — including reasonable attorneys' fees — arising out of or related to your breach of the representations and warranties in this section, including any claim that you lacked authority to enter or authorize the processing of an under-13 wrestler's personal information.

MatViz reserves the right to suspend or terminate any account, and to remove any wrestler record, that we determine in our reasonable judgment was created or used in violation of this section.

10. Security

We protect personal information through:

• Encryption in transit — HTTPS enforced site-wide via Caddy with Let's Encrypt certificates.
• Password storage — bcrypt with a per-password salt; never stored in plaintext.
• Cookie hardening — authentication cookies are HTTP-only, Secure, and SameSite=Strict.
• CSRF protection — all state-changing requests require a matching CSRF token.
• Rate limiting — authentication endpoints throttled against brute- force and credential-stuffing attacks.
• Encrypted backups — daily off-host backups encrypted with restic before transmission to Backblaze B2. No continuous on-disk plaintext database dumps are produced inside the application container; the only plaintext dumps that ever land on disk are short-lived pre-migration safety snapshots taken during a deploy and on-demand dumps that a super-administrator explicitly triggers — both of which are also swept into the daily encrypted restic snapshot.
• Error monitoring — Sentry alerts us on production errors; PII is stripped from error events before transmission.
• Audit logs written append-only — acceptance, COPPA, role-grant, and account-deletion events are only ever added to, never edited or removed, by the application.

Limits of our security posture, stated honestly:

• We do not apply application-level encryption at rest beyond what Postgres and Backblaze B2 provide by default.
• MatViz is not SOC 2 or ISO 27001 certified.
• MatViz is operated by FinnTech LLC, a small company with no dedicated security team or 24x7 incident response. We rely on conservative defaults, automated monitoring, and rapid manual response.

In the event of a personal-information breach, we will notify affected users and, where required, regulators in accordance with applicable breach-notification statutes.

11. California-specific disclosures

11.1 Categories collected in the past 12 months

For purposes of Cal. Civ. Code §1798.140, MatViz has collected the following CCPA-defined categories: identifiers (name, email, IP, account ID); customer records (contact info, parent/guardian contact, waiver and electronic-signature records); commercial information (registration history, subscription status, payment metadata); internet or network activity (application logs, session records, video-playback telemetry); audio and visual (match livestreams, recorded clips, and wrestler profile photographs); professional or club-related information (coaching role, club affiliation, tournament-organizer role, practice and event attendance); contents of electronic communications (club channel messages and direct messages — also addressed as sensitive personal information in Section 11.3); and inferences (bracket seeding, match-result trends, aggregate platform usage).

11.2 "Sale" and "share" of personal information

MatViz does not sell personal information for monetary or other valuable consideration and does not share personal information for cross-context behavioral advertising, as those terms are defined in the CCPA/CPRA. We have not done so in the past 12 months and have no present intention to do so.

11.3 Sensitive personal information

Under the CPRA, "sensitive personal information" is defined in Cal. Civ. Code §1798.140(ae) and includes categories such as government identifiers, account log-in credentials in combination with access credentials, precise geolocation, racial or ethnic origin, contents of non-business communications, genetic data, biometric identifiers processed to identify a consumer, health information, and information about sex life or sexual orientation. Separately, the CPRA's opt-out of sale or sharing extends to personal information of a consumer the business has actual knowledge is under 16, and additional protections apply to such information.

Of the listed sensitive-PI categories, MatViz collects three: account log-in credentials (stored only as a salted hash, never used for any purpose other than authentication); the contents of communications where MatViz is not the intended recipient — the club channel messages and direct messages described in Section 2.1; and, in the COPPA-governed flow described in Section 8, information about wrestlers under 13 entered by Adult Account Holders. Message contents are processed for one purpose only: operating the messaging feature itself, including the supervision rules that govern direct messages involving minors, and responding to an abuse report or a club owner's audit request. We do not use any of these categories for any purpose other than providing the Service, we do not disclose them for cross-context behavioral advertising, and we do not use sensitive personal information to infer characteristics about a consumer. California residents may exercise the right to limit use of sensitive personal information through the channels in Section 13; because we do not use sensitive PI for secondary purposes, this limit is effectively honored by default.

11.4 Authorized agents

You may designate an authorized agent to make a request on your behalf by providing written, signed authorization. We may require you to verify your identity directly.

11.5 "Shine the Light" disclosure

California Civil Code §1798.83 gives California residents the right to request, once per calendar year, a list of categories of personal information that a business has disclosed to third parties for those third parties' direct-marketing purposes during the preceding calendar year, together with the names and addresses of those third parties. MatViz does not disclose personal information to any third party for that third party's own direct-marketing purposes. A California resident who submits a §1798.83 request to hello@matviz.com will receive a confirmation that no such disclosures have occurred.

12. Changes to this policy

The canonical text of this policy is hashed, and that hash is recorded with every acceptance. Any change to the text changes the hash — a typo fix and a rewritten data-sharing section alike — and signed-in users see a re-acceptance prompt on their next visit asking them to re-acknowledge; the prompt can be postponed and reappears on later visits until you accept, and the acceptance is recorded in our acceptance audit log with the new hash. We would rather ask you again than change the terms quietly, so we do not distinguish between "material" and "cosmetic" edits for this purpose. The "Effective" date at the top of this policy is updated for any change. We will not silently apply a change that materially expands the purposes for which we use your information.

13. Contact

Questions about this policy, requests to exercise your rights, complaints, and reports of suspected COPPA violations:

Controller: FinnTech LLC, a South Dakota limited liability company, doing business as MatViz
Email: hello@matviz.com

EU/EEA, U.K., and Swiss residents may also lodge a complaint with their national data-protection supervisory authority. California residents may also contact the California Attorney General's office. We respond to verified requests within 45 days, or the shorter period required by your jurisdiction; children's-privacy requests within 30 days (see Section 8).