Privacy Policy
How the Laguna Beach Breakers app and website handle information. Last updated October 16, 2026.
Read this first
Laguna Beach High School is a real school, and this is not its site. This app is unaffiliated — not operated by or endorsed by the school or the district. Its programs, coaches and leagues are real because the school publishes them, and the fall 2026 schedules and rosters and the 2026-27 winter schedules are transcribed from the athletic office's own published documents. The fall rosters name real student-athletes as the athletic office publishes them — level, name, class year, jersey number and position — and this application attaches nothing else to them. Game results are read from the school's own MaxPreps pages, and carry a team, an opponent, a date and two numbers — never a student. Breaker News links to the athletic office's own Weekly Updates and Breaker Insider newsletters where the office publishes them; this application does not copy them. A student's own clearance record, where the athletic office has entered one, is real and is described below. Every other record — the spring season, bookings, officials, bus trips and the department's clearance worklist — is invented, and the population those records hold carries opaque ids and nothing else.
What this covers
This policy covers the Laguna Beach Breakers iOS app, the Android app, and this website. They are one product sharing one backend, so one policy describes all three.
What we collect
Until this app is formally released, every page asks you to sign in. Five pages stay open: this policy, the help page, the sign-in screen, the page an invitation link lands on, and the Boosters' portal at /boosters. Reading any of the first four gives us no account and no advertising identifier, only the analytics described below.
The Boosters' portal is not covered by this policy. It is served at this address but is a separate system for the Breaker Boosters, with its own sign-in and its own accounts, and what it collects is for the Boosters to describe.
There is no sign-up form anywhere in the app; accounts are created by invitation, so nobody can hand us personal information by registering.
Information is collected in seven places:
If you sign in
Accounts exist only for people invited to the app. Signing in uses Firebase Authentication, which stores your email address and a hashed password, and assigns an account identifier. We never see or store your password in a readable form.
Invited administrators, coaches and students can instead choose Continue with Google. Google then confirms your Google account to Firebase, and Firebase keeps the name, email address and profile picture link Google sends with it on your account; Google knows you signed in here. Nobody else can sign in with Google: an account the office did not invite is refused, and the account the attempt created is deleted.
When the athletic office invites you, it may record on your account what it already knows about you: for a student, the program they play and their team level; for a parent, their own child and the program the child plays. Only the office sets or changes these. The app shows them to you and to athletic department staff, and they give no access to anyone's records.
If you talk to Reef
Reef is the in-app onboarding assistant. Your messages are sent to Anthropic to generate a reply. If you are signed in, the onboarding answers Reef collects — your preferred name, your role with the program, which programs you follow, which team level interests you, and which notifications you want — are saved to your account so the app can be set up for you. Your followed programs decide what the site and the app show you first; they never give access to anything, and they link your account to teams, never to a student. Notification choices are saved, but no reminders are sent yet.
If you are not signed in, nothing from that conversation is logged or stored. The reply is generated and the exchange ends there.
If you use Messages in the app
Messages lets the people the athletic office invites talk to one another: staff with students, parents and other staff; parents with their programs' coaches and the office, and with other parents on their programs who have turned on messages from parents; and students with teammates on their programs. Parents and students cannot message each other. Messages are end-to-end encrypted: each one is locked on the sender's phone and can be opened only on the phones of the people in the conversation. The key that opens them never leaves those phones, so we cannot read them, and neither can anyone we work with.
To deliver them, Firebase stores the locked messages, who is in each conversation and their names and roles, when each message was sent, each phone's public encryption key, and who you have blocked. If you report a message, your phone unlocks that one message and sends it to us with your reason, so the athletic office can review it; nothing else in the conversation is sent. Messages is not on the website.
If you allow notifications, your phone's notification token is stored with your account so we can tell you a message has arrived. The notification says who wrote and in which conversation, never what they wrote, and it reaches your phone through Apple's or Google's notification service. Turn notifications off in your phone's settings at any time; signing out removes the token.
If you are a student, or a student's parent
The athletic office keeps each invited student's own clearance record here, and only the office enters it: for each clearance form (the physical, the consent, insurance, the head-injury and cardiac information sheets, the baseline test and, for beach programs, the open-water acknowledgment) whether it is on file and the date it arrived; whether the office has cleared the student to participate; the student's grade; and yes-or-no answers to whether an emergency contact card and medical notes are on file. The content of a form, any medical information, and any contact name or phone number are never stored here.
The record can be seen by the student, in the app and on this website; by a parent the athletic office has linked to that student's account; and by the athletic office. Coaches, other parents and other students cannot see it. It is never sent to analytics or to any other service, and it is not used for anything else.
Activity on your account
While you are signed in, your account carries its own activity log, written server-side: sign-ins on the website, the gated pages you open there, and each Reef exchange from either app, with timestamps. It is the account's audit trail — readable by you and by staff, used for the admin activity view, and it leaves the backend for nobody. It is not an analytics product and runs regardless of the section below.
If you open the website's home page
The home page can show the athletic department's latest Instagram posts in a panel that Instagram itself supplies. The panel loads with the page, so opening the home page contacts Meta. Your browser contacts Instagram, which is run by Meta, and sends it what any website receives: your IP address, your browser and device details, and the address of the page. Meta can also set and read its own cookies, including ones it uses on other websites, and if you are logged in to Instagram or Facebook in that browser, Meta may connect the visit to your account.
We receive nothing back from Meta about you. What Meta does with that information is set by Instagram's privacy policy, not this one. This applies only to the website's home page: no other page and neither app loads anything from Meta. To avoid it, block instagram.com in your browser before opening the home page.
If you open the Athletic Clearance page
The Athletic Clearance page has a window for the athletic office's walk-through video, which is hosted on YouTube. The video does not load until you press play. Until then, nothing on the page contacts Google or YouTube. When you press play, your browser contacts YouTube (through its privacy-enhanced address, youtube-nocookie.com), which is run by Google, and sends it what any website receives: your IP address, your browser and device details, and the address of the page. YouTube may also set cookies or similar identifiers once the video plays.
We receive nothing back from Google about you, and we do not record whether you pressed play. What Google does with that information is set by Google's privacy policy, not this one. This applies only to the website's Athletic Clearance page, and only after the press: neither app loads anything from Google for it, and a link under the window opens the video on YouTube if you would rather watch it there.
Analytics — on
The website and the apps record how they are used: which pages and screens are opened, and for how long; which links and buttons are pressed, described by where they lead and which part of the page they sit in and never by what they say; how far down a page you scroll; when a form is started or sent, never what is typed in it; which outside websites and files are opened; how quickly pages load; and when something breaks — in the apps, that includes the reason the phone gives when the app closed unexpectedly or stopped responding, never a crash report or its contents. Each event carries the version of the website or app it came from. Reef conversations are counted in turns and never read. Store and sponsorship checkouts record which items, the amounts, and whether PayPal completed the payment — never a payment detail.
The events go to CosmotionAI, the company that builds this software, and nowhere else: no third-party analytics service is involved. Your browser or device is given a random identifier that is not connected to your account, and if you sign in only your role (parent, coach, athletic director, and so on) is attached, so use can be understood by persona without knowing who anyone is. It never receives your email address, your name, your account, anything you type, anything a roster shows, your location or an advertising identifier, and your IP address is never stored. It is not shared with or sold to anyone, and none of it is used to follow you across other websites or apps.
Nothing is sent from the apps until you choose to share usage and diagnostics. They ask once, and the choice can be changed at any time under More, Share usage and diagnostics. Turning it off stops sending at once and deletes the app's random identifier, so turning it back on starts as a new, unconnected one.
On the website, if your browser sends Global Privacy Control, nothing is sent at all. Do Not Track is not treated separately, since Global Privacy Control is the signal the law recognises. You can also switch analytics off for this browser with the control below.
What we do not do
- No advertising, ad networks or advertising identifiers.
- No cross-site tracking by us, and no analytics service beyond our own, named above. Meta's cookies from the home page's Instagram panel, and Google's from the clearance video, are theirs, as described above.
- No selling or renting of information to anyone, for any purpose.
- No location collection.
- No access to your contacts, photos, camera or microphone.
- No card or account numbers. The website's team trip page takes payment through PayPal, which collects and holds those details itself; this site never receives or stores them. The iOS app has no checkout and never sees a payment method.
Who information reaches
Eight service providers, each for one job:
- Google Firebase — authentication and the content database. Firebase holds the email address, account identifier, saved onboarding answers and activity log of anyone who signs in, the students' clearance records the athletic office enters, and the encrypted messages described above, which it cannot read. If you use Continue with Google, Google's sign-in service also confirms your account to Firebase, as described above.
- Anthropic — generates Reef's replies from the messages you send it.
- Apple and Google push services — deliver a Messages notification to your phone, if you allowed notifications. They receive your phone's notification token, the sender's name and the conversation's name; never a message.
- Meta (Instagram) — shows the department's latest posts on the website's home page, and receives your IP address, browser details and the page address when that page is opened. See “If you open the website's home page” above.
- Google (YouTube) — plays the athletic office's clearance video on the website's Athletic Clearance page, and receives your IP address, browser details and the page address when you press play on it. See “If you open the Athletic Clearance page” above.
- CosmotionAI (usage analytics) — the company that builds this software receives how the website and the apps are used, under a random identifier and your role only. See Analytics above.
- PayPal — takes payment for team trips. PayPal's script loads on the team trip page and receives your IP address, browser details and the page address, and PayPal handles and retains anything you enter in its checkout window, including your card or account number, which this site never receives. This site sends PayPal what you chose and the amount due, and receives back whether the payment completed. For a team trip, PayPal also receives the name of the athlete being paid for, as the athletic office linked them to your account, and the Boosters, who receive the payment, see that name with the payer’s name and email. The iOS app has no checkout.
- Resend — delivers the email with your link to set a password, when you ask for one on the sign-in page or the athletic office sets up your account. Resend receives your email address and that email, and nothing else.
Nobody else receives anything. Information is disclosed beyond these eight only if the law requires it.
How long it is kept
Account records, saved onboarding answers, the account's activity log, a student's clearance record and the account's encrypted messages are kept while the account exists. A reported message is kept until the report has been dealt with. Accounts are removed when the person they were created for no longer needs access. Ask us to delete yours at any time and we will remove the account and everything attached to it.
Usage events are kept for 400 days (about thirteen months), then deleted automatically. That is separate from — and shorter than — how long an account itself is kept.
Children
The app is for a high school athletics community: athletic department staff, coaches, parents, and the student-athletes the athletic office invites. It is not directed at children under 13, and we do not knowingly collect information from anyone under 13.
An invited student can use Messages with teammates on their programs, and can be messaged by coaches and athletic department staff. Every conversation that includes a student must include at least two coaches or staff members, and conversations between students and adults are closed from 9 p.m. to 5 a.m. Pacific. Students and parents cannot message each other. A student's messages are end-to-end encrypted as described above, and what we hold about them is what we hold about anyone who uses Messages: their account, who they talk to and when, and any message someone reports.
The fall rosters name real student-athletes exactly as the school's athletic office publishes them — level, name, class year, jersey number and position — and the app neither collects anything from them nor attaches anything to them beyond that published listing. A student the athletic office invites has a real account, and the office may keep that student's clearance record as described above; it is tied to the account, never to a roster listing. Every other person in the app's records is invented.
Rights and requests
Ask us for a copy of what is held about you, ask for a correction, or ask for deletion — email the address below and we will action it. There is no fee and no account needed to ask.
Updates to this policy
If what the app collects changes, this page changes with it and the date at the top moves. Material changes will be noted in the app.
Reach a human
Privacy questions, deletion requests and anything else about this policy: mark@cosmotion.ai