Privacy Policy

Last updated: September 27, 2026

Collegiate Athletic Planning ("CAP Recruiting," "we," "us," or "our") operates caprecruiting.com (the "Service"). This page explains what information we collect, why we collect it, who can see it, and the choices you have.

1. Information We Collect

1.1 Information you provide

• Account information: name, username, email address, password (stored only as a bcrypt hash), role (player or coach), state, and (for coaches) school, title, division and conference.
• Player profile content: position, class year, measurables and stats (height, weight, GPA, 40-yard dash, vertical, bench, squat, clean, broad jump, pro agility, wingspan and similar), intended major, the factors that matter most to you in a college, bio, social and Hudl links, news links, scholarship offers, campus visits, uploaded photos, uploaded highlight videos, and academic transcripts.
• Contact details: the athlete's phone number, contact email and home address (street, city, state, ZIP).
• Parent / guardian details: first and last names, email addresses and phone numbers for a mother, father or guardian, if you enter them.
• NCAA Eligibility Center number, if you enter it.
• Recruiting questionnaire: if you fill out the CAP questionnaire, the answers you give there (much of it copied from your profile, including address and parent details) so coaches do not have to ask for them again.
• Messages and evaluations: the content of messages sent through the in-app messenger and written evaluations coaches leave on player profiles. Both are encrypted at rest in our database.
• Signed agreements: when you sign the CAP player agreement electronically, we collect the athlete's full and printed name, a drawn or typed signature, the date, the IP address the signature was submitted from, and, for athletes under 18, the parent or guardian's name, relationship to the athlete, and drawn or typed signature. The signed agreement is stored as a PDF on our server and is available only to CAP administrators.
• Payment information: handled entirely by Stripe. We store Stripe customer and subscription identifiers, never card numbers or CVV.

1.2 Information we collect automatically

• Log and security data: IP address, browser type, pages requested and timestamps, kept in server logs and in login-attempt and rate-limit records used to stop abuse.
• Session cookie: a signed cookie that keeps you logged in. It is required for the Service to work.
• Coach profile views: when a signed-in coach opens a player's profile, we record which coach viewed which player, how many times, and when. Administrators can see this log. The player receives an anonymous notice ("A coach viewed your profile") that does not name the coach, and Premium players see a monthly count of coach views.
• Profile stat history: when you change a tracked stat, we keep the earlier value and date so your progress can be charted.
• Analytics: our pages include a Google Analytics (measurement ID G-TWX00ZCMYS) configuration, but Google's analytics script is not currently loaded, so no analytics data is sent to Google. If it is enabled in the future it will run under Google Consent Mode: visitors in the EEA, UK and Switzerland are asked first, and it is not configured at all when your browser sends a Do Not Track or Global Privacy Control signal.

1.3 Information from third parties

• Sign in with Google: we receive your Google account email, name and profile picture (scopes: openid email profile) and nothing else.
• Sign in with Apple: we receive your Apple ID email (which may be an Apple private-relay address) and, the first time only, your name.
• College coaching staff directories: to invite college coaches to the Service, we collect the names, titles, work email addresses and staff photos that colleges publish on their public athletics websites. See section 4.

2. How We Use Your Information

• Provide and maintain the Service (profiles, player directory, messaging, offers, questionnaires, scout board).
• Process subscription payments via Stripe.
• Send account and service emails (welcome, password reset, new-message alerts, payment and renewal notices).
• Enforce tier-based visibility (for example, hiding Premium content on non-Premium profiles).
• Keep a signed record of the player agreement.
• Invite college coaches to join (section 4).
• Monitor and prevent abuse, spam and fraud, and alert our operator when something breaks.

3. Who Can See Your Information

3.1 Other users and the public

• Anyone, including logged-out visitors, can see the player directory (player names and summary cards) and a player's profile page with the basic stats grid (position, class year, measurables, GPA). Photos, offers, visits, videos and contact details on that page are shown only as the player's tier allows.
• Signed-in coaches and administrators can see the full player profile, including photos, offers, visits, videos, transcripts, contact details (phone, contact email and home address), parent/guardian details, the NCAA Eligibility Center number, and the recruiting questionnaire.
• Other signed-in users can see a player's contact details only when that player has a Premium plan.
• Parent/guardian details, the NCAA Eligibility Center number, transcripts and questionnaires are never shown to logged-out visitors or to other players.

3.2 Service providers

• Stripe — payment processing and subscription management.
• DigitalOcean — hosting for our server and database, and DigitalOcean Spaces storage for uploaded videos, images and transcripts.
• Google — Sign in with Google, and Gmail (Google Workspace SMTP) for sending email.
• Apple — Sign in with Apple.
• DiceBear — generates cartoon avatars on admin-only marketing pages. It receives a one-way hash of a contact's email address, not the address itself.
• Let's Encrypt — SSL certificate issuance (receives no personal information).

3.3 Links to other sites

Highlight videos are uploaded to and played from our own storage; we do not embed YouTube or Hudl players. Hudl, social media and news links on a profile are ordinary links: when you click one you leave CAP Recruiting and that site's privacy policy applies.

3.4 For legal reasons

We may disclose information if required by law, court order or valid legal process, or to protect the rights, property or safety of CAP Recruiting, our users or the public.

3.5 We do not sell or share your personal information

We do not sell personal information, and we do not share it for cross-context behavioral advertising, as those terms are defined in the California Consumer Privacy Act (CCPA/CPRA). We do not show ads.

4. Emails to College Coaches

We email football coaching staff at colleges, including coaches who have never signed up, to invite them to use the Service. Their names, titles and work emails come from the college's public athletics staff directory. These emails contain a tracking pixel and a tracked sign-up link, so we can tell whether and when a message was opened or its link clicked, and whether it bounced.

How coaches opt out: reply to any outreach email with "unsubscribe," use your email app's unsubscribe button, or email divinejdavis@gmail.com. We mark you "not interested," and our system skips anyone marked that way when it sends. You can also ask us to delete your record entirely.

5. Athletes Under 18

Most CAP Recruiting athletes are high school students, many of them under 18 (generally ages 14 to 18). The Service is not directed to children under 13, and we do not knowingly collect personal information from anyone under 13; if we learn that we have, we delete it.

• We do not ask for date of birth; we rely on class year. Athletes under 18 should create and manage their account with a parent or guardian.
• The CAP player agreement requires a parent or guardian's signature unless the athlete confirms they are 18 or older.
• A player's name and basic stats are visible to the public (section 3.1). Contact details, home address, parent/guardian details, the NCAA number and transcripts are limited to signed-in coaches and administrators (and, for contact details on Premium profiles, other signed-in users).
• A parent or guardian can ask us to review, correct or delete a minor's information at any time by emailing divinejdavis@gmail.com.

6. Data Retention

We keep account information while your account is active. Profile content, messages and uploaded media stay until you delete them or delete your account. Signed agreements are kept as a record of the agreement. Outreach tracking records for college coaches are kept until the coach asks us to delete them. Stripe keeps transaction records as financial regulations require.

7. Your Rights and Choices

• Access and correct: view and edit your profile from the Edit Profile page, or email us for a copy of the information we hold about you.
• Delete: delete your account yourself from the Edit Profile page (type DELETE to confirm), or email divinejdavis@gmail.com from your registered address and we will delete your account, profile and associated media within 30 days.
• Cancel your subscription: anytime via the Stripe Customer Portal from your account.
• Analytics: send a Do Not Track or Global Privacy Control signal from your browser; when either is on, our pages do not configure Google Analytics.
• California residents (CCPA/CPRA): you have the right to know what personal information we collect and how we use it, to access it, to have it corrected or deleted, and to opt out of its sale or sharing (we do neither). We will not discriminate against you for using these rights. You or an authorized agent can make a request by emailing us; we will verify it by confirming control of the account's email address.
• EEA, UK and Swiss residents (GDPR / UK GDPR): you have the right to access, correct, delete, restrict or object to our processing of your personal information, to data portability, and to withdraw consent at any time. Our legal bases are performance of our contract with you (running your account), consent (analytics cookies and optional profile details), and our legitimate interests (security, fraud prevention and inviting coaches to the Service). You may also complain to your local data protection authority.

We respond to requests within 30 days (45 days for CCPA requests, extendable as the law allows).

8. Security

Passwords are hashed with bcrypt. Traffic is encrypted with TLS. Messages and coach evaluations are encrypted at rest. Sessions are signed with a server-side secret, and admin routes, rate limits and Content-Security-Policy headers are in place to reduce abuse. No system is perfectly secure; please use a unique password and tell us right away if you suspect your account has been compromised.

9. International Users

CAP Recruiting is operated from the United States, and your information is stored and processed in the U.S.

10. Changes to This Policy

We may update this policy from time to time. Changes take effect when posted here, and the date at the top will change. If a change is material, we will notify account holders by email or in-app notice.

11. Contact

Questions, requests or complaints about this policy: divinejdavis@gmail.com.