Plain-English summary at the top, the legal-grade detail is below. Both bind us, but we want you to actually know what's going on.
FlySport is operated by Limestone Labs LLC, a Texas limited liability company based in Austin, Texas. We are the data controller for personal information collected through the Service. You can reach us at info@limestonelabs.cc or by mail at the address listed on the limestonelabs.cc website.
Account information (when you sign in with Google or Apple):
Profile information you add later:
Team and role information:
Communications:
Event and attendance data:
A note on emergency and medical information: FlySport does not ask you to enter, and provides no form for, emergency-contact, health-insurance, or medical information. That information is collected by your league's registration system (PitZone, operated for NICA) and imported into FlySport; see Section 2.2. The one piece of safety information FlySport itself collects is an injury incident report, also described in Section 2.2.
Public prospect intake (when you fill out the "join a team" form at /leagues/{league}/join):
From Google or Apple: the sign-in fields listed above.
From PitZone (the registration platform operated for NICA): your league's administrators import a roster into FlySport from PitZone. We do not collect this information from you; it is collected by NICA/PitZone and imported. It typically includes:
FlySport does not surface any of that emergency or medical data for editing; it is shown read-only to a limited set of authorized staff (league and team directors, and head or assistant-head coaches who meet the coaching-level requirement), and every access to it is recorded in an audit log (Section 5). You may have a FlySport record from a PitZone import before you ever log in; if you don't want one, see Section 9.
Injury incident reports (the one safety record FlySport collects): if an athlete is injured at an event, an authorized staff member, a league or team director, or a head/assistant-head coach who meets the coaching-level requirement, may file an injury report. It can include the athlete's date of birth, sex, grade, the body parts affected and a diagnosis, whether they were evacuated or transported and where, and the type of care received. The injury form (and the emergency-contact details it displays) is restricted to those same authorized roles, and access is audit-logged.
From RaceCreator (a separate platform we also operate): your role assignments (e.g., "league director," "head coach") are read into FlySport on login so we know what team to put you on.
Standard server logs:
Audit logs (covered separately in Section 5): every time we access medical, emergency-contact, or incident records on you or your child, we log who looked, when, and from where.
Cookies: a single session cookie (fs_session) keeps you logged in for up to 12 hours. We do not use advertising cookies or analytics cookies.
Push subscriptions: if you enable browser push notifications, your browser gives us a push endpoint and two keys. We store these to send you notifications you've opted into.
The FlySport mobile app for iOS and Android is a Capacitor wrap of the web app and collects the same data the website does. The app itself declares only the INTERNET permission; it does not bundle a camera, photo-library, contacts, microphone, or location plugin, and it does not track device identifiers or your location in the background.
You can, however, attach images and PDFs inside the app, for example a photo in team chat or a profile picture. When you do, the app opens your device's standard file picker, which on a phone may give you the option to take a new photo or pick an existing one; your operating system handles any camera or photo-library permission at that moment. The file you choose is uploaded to our file storage (Tigris) and handled as described in this policy. We receive only the files you choose to attach.
We use the information above to:
We do not use your information to:
FlySport is used by minors. We take content safety seriously and use automated tools to detect unsafe messages:
Use of these third-party tools is necessary to protect children using the Service. You cannot opt out of safety scanning and remain on the Service. If this is unacceptable to you, please contact us at info@limestonelabs.cc.
When a coach, league director, or admin accesses sensitive data on you (or your child), we automatically log it. Access logs include:
You can review your own (or your child's) audit log at /my-data/audit after logging in.
Logs are retained for two years and then automatically purged.
When an authorized superadmin impersonates a user (a rare diagnostic feature), every action is logged separately and attributed to the real admin, never the impersonated user.
We share data with the third parties below, and only the third parties below, when needed to operate the Service. We do not sell your data and we do not share it for marketing.
| Service | Purpose | Data sent |
|---|---|---|
| Fly.io (Delaware, USA) | Hosts the FlySport application servers and PostgreSQL database | All data above resides on Fly.io |
| Tigris (S3-compatible storage) | Stores encrypted database backups and chat file attachments | Encrypted DB dumps (we hold the encryption key, not Tigris); uploaded attachments |
| Google LLC | Sign-in (Google) + (separately) Gemini AI for in-app help search | Sign-in: email, name, account ID. Help: your question + the help-doc text we send back |
| Apple Inc. | Sign in with Apple (on iOS) | Sign-in: an Apple user identifier and your email or a private relay address |
| Resend | Transactional email delivery | Recipient email, subject, message body |
| Sentry | Application error reporting | Stack traces and limited context. POST bodies, query strings, cookies, and auth headers are stripped before sending. We also mask emails in log strings. |
| OpenAI | Chat message moderation | Message body only (no author identifier or context) |
| Anthropic | Moderator-initiated conversation analysis (chat audit deep-dive) | Conversation transcript with author IDs, when a moderator runs a deep-dive |
| Groq | Fallback for the in-app help chatbot | Your question + the help-doc text |
| Cloudflare | DNS, CDN, Turnstile (bot detection on public forms) | IP + bot-check token on form submissions |
| OpenStreetMap / Nominatim | Geocoding addresses (prospect intake; team locations) | Street address you typed |
| NWS / NOAA / GOES | Weather forecast + lightning detection at event venues | Event latitude/longitude only, no PII |
| Slack | Internal alerts for ops + your feedback submissions | Feedback you submit + your name and email; ops alerts (no user content) |
| PitZone | Read-only roster import | Nothing leaves FlySport; we receive data only |
We may also disclose information when legally required (subpoena, court order), when needed to investigate fraud or safety threats, or in connection with a business transaction (merger, acquisition, though if this changes ownership we will notify you).
FlySport's primary database and application servers are operated by Fly.io and are physically located in the United States. Encrypted backups are stored on Tigris in the United States.
If you are accessing FlySport from outside the United States, you understand that your data will be transferred to and processed in the United States.
We retain different categories of data for different periods:
Depending on where you live (Texas, California, EU/UK, etc.), you may have specific rights. We aim to honor these rights for all users regardless of jurisdiction.
You have the right to:
/account/delete in the app, or email info@limestonelabs.cc./my-data/export in the app, which downloads a zip with your profile, schedule, messages, medical info, and audit log.To exercise any of these rights, email info@limestonelabs.cc. We will respond within 30 days. We will not retaliate against you for exercising your rights.
When you delete your FlySport account, we permanently remove the data we control: your account record, team memberships, chat history, attendance, RSVPs, emergency contacts, medical fields, uploaded photos, and the audit log of who viewed your records. Cascade deletions and Tigris (object storage) purges complete synchronously; the only retained item is an immutable deletion-log row (Section 5) that records the deletion fact, without your email or name in cleartext, for our own compliance audit.
We are not, however, able to delete your data from other systems your league uses. In particular:
When you delete your account, you can optionally check a box to be added to our reimport blocklist. Without this opt-in, the next time PitZone roster data is uploaded by your team's coach, your FlySport account will be re-created automatically (and for athletes under 13, a fresh parental-consent email will be sent). With this opt-in, future imports skip your record. To get back in after opting out, ask your head coach or team director to email info@limestonelabs.cc, a superadmin releases the block on confirmation that the request came from you, and the release attestation is logged with the original deletion record.
The Service is designed for youth mountain bike teams, and we knowingly collect personal information from teen athletes (ages 13–17) and, in some cases, athletes under 13.
For athletes 13–17 (in scope of the Texas SCOPE Act and similar state laws):
For athletes under 13 (in scope of the federal Children's Online Privacy Protection Act, "COPPA"):
FlySport supports youth mountain bike teams where many athletes are middle-schoolers under 13. We collect personal information from children under 13 only after obtaining verifiable parental consent ("VPC") from a parent or legal guardian.
How verifiable parental consent works:
vpc_status='pending' and send a consent email to the parent address on file.fs_vpc_records table.Once consent is granted, we use the child's date of birth only to compute the dates on which they will turn 13 and 18, and then we discard the date of birth itself. The two derived "transition" dates are themselves nulled out on the day each one is reached. The result is that we hold no actual date-of-birth data on any child in the system at rest.
Parents may at any time and for any reason:
/my-children in the app./my-data/audit.We do not share children's data with any third party except those listed in Section 6 (all bound to use the data only to provide their service to us), and we do not use children's data to train AI models or for advertising of any kind.
Questions specifically about under-13 data should go to info@limestonelabs.cc with "Privacy Request — under-13" in the subject. We aim to respond within 5 business days.
We use industry-standard measures to protect your data:
age (asymmetric encryption); the decryption key is held in a password manager and offline backup.No system is perfectly secure. If we discover a breach affecting your information we will notify you and any applicable regulators as required by law.
We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last updated" date at the top and, where required by law, notify you directly via email or in-app banner.
If you continue using the Service after a material change takes effect, your continued use constitutes acceptance of the updated policy.
Limestone Labs LLC
Austin, Texas
info@limestonelabs.cc
For COPPA-specific inquiries or to exercise your privacy rights, please include "Privacy Request" in the subject line so we can route it quickly.
For child-safety concerns or to report content that may exploit a minor, see our Child Safety Standards page for the dedicated reporting flow.