Privacy Policy

1. Who this covers

T-Rating Sports operates tratingsports.com. This policy covers everyone the site touches: trainers with accounts, club staff who review or make contact, and people whose details a trainer gives us so we can invite them to review. Questions and requests: [email protected] — it reaches a human.

2. What we collect

From trainers: name, email, password (stored hashed), and what you put on your profile — specialty, sport, city, bio, rate, availability, travel radius, the programs you train, and the clubs and seasons you've worked.

From club staff: your name, role, work email, and message when you register a club or contact a trainer; your review — verdict, reason, tags, scores, text — when you redeem a review link.

About club staff, from trainers: when a trainer nominates you as a reviewer, they give us your name, role, and work email so we can send you a single invitation. That's the only use it gets. If you'd rather we drop your address entirely, one email does it.

Automatically: ordinary server logs (IP address, pages requested, timestamps) and two cookies — session and CSRF — that make login and forms work. When an account is created or a review is submitted, we also keep the network address the request came from, attached to that record. It has exactly one use — detecting fraudulent signups and self-reviews — and it is never published or shared. No analytics, no ad trackers, no fingerprinting, nothing third-party in the page.

3. What is public — and what never is

Public: trainer profiles, including everything a trainer chooses to put on them. Reviews, published with the reviewer's name, role, club, and season — attribution is the product; the review form says so before you submit. Club names and their verification status.

Never public: email addresses, passwords, review links, contact-form messages (those go only to the trainer you addressed), and anything about anyone under 18 — see section 6.

4. What we do with it

Run the directory, verify clubs, send the emails the product is made of — review invitations, receipts, forwarded contact requests, password resets — prevent fraud (the eligibility checks that keep self-reviews out), and respond when you write to us. That's the list. We send no marketing email, and we don't use your data to build anything other than the service you can see.

5. Who touches the data

Three infrastructure providers process data on our behalf: Oracle Cloud Infrastructure (hosting, United States), Cloudflare (network proxy, DNS, and email forwarding), and SMTP2GO (outbound email delivery). Each sees what its job requires and no more.

We do not sell personal information, share it with advertisers or data brokers, or run ads. Beyond the processors above, we disclose data only if the law compels it, to protect someone's safety, or — should the service ever change hands — to a successor bound by this policy, with notice to you.

6. Children

The site is for adults. No one under 18 may use it, we do not knowingly collect information from or about anyone under 18, and reviews are required to describe the coaching, never the athletes. If a review names a minor, report it and we remove it. If we learn we hold data about a child, we delete it.

7. How long we keep things

Account data: while your account exists, then deleted on request within 30 days. Reviews: retained while the reviewed trainer is listed — they're the integrity of the ratings — with removal handled per the narrow grounds in our terms. Review links: we never store the link itself, only a hash that can confirm it but not reproduce it. Logs and database backups: about 30 days.

8. Security

Everything travels over TLS. Passwords and review tokens are stored only as hashes. Access to production is limited to the people who run it. No one can promise perfect security, so we don't — but the design assumes the database could be read, which is why the sensitive things in it are hashes.

9. Your choices

Email [email protected] to see what we hold about you, correct it, or delete it. Trainers can edit their own profiles and close their accounts. Club staff can decline any invitation by ignoring it — an unredeemed link expires on its own — and can ask us to stop contacting an address permanently.

If we change this policy materially, account holders get email notice before the change takes effect, and the date at the top always tells you the version you're reading.