Privacy Policy

This policy explains what personal information Defend Utah collects, why we collect it, where it is stored, and what choices you have. It applies to defendut.com and any account-protected areas of the site.

The short version

We do not sell your personal information, and we do not share it with third parties for their own marketing purposes. The only outside companies that touch your data are the service providers listed below, who process it solely to operate this website on our behalf and are not permitted to use it for anything else.

What we collect

If you create an account: your email address, an encrypted (hashed) form of your password, the date you created the account and last signed in, and a record that you accepted the applicable terms. We never store your password in a readable form, and no one at Defend Utah can see it.

If you are a parent using the team roster:your child’s name, their jersey number and X-Player mark, and a photograph only if you choose to provide one — plus the display name you pick for yourself and anything you post, reply, or add to the team calendar. See “Information about children” below — that section describes the complete set, and it is deliberately small.

If you subscribe to a newsletter or sign a petition: the name, email address, and any location information you provide on that form.

Automatically, when you visit: standard web server information such as IP address, browser type, pages visited, and referring page. This is ordinary web traffic data and is used to keep the site running and understand general usage patterns.

Where your data is stored and who processes it

We want to be straightforward rather than vague about this. Defend Utah does not run its own servers for this website. Your data is stored and processed by the following providers, each acting on our instructions:

• Vercel — hosts the website and processes web requests and server logs.
• Supabase — stores account records (email address, hashed password, sign-in timestamps). Hosted on Amazon Web Services infrastructure in the United States.
• Resend and Amazon SES — deliver account emails such as confirmation and password-reset messages.
• Cloudflare — provides bot protection on sign-up and sign-in forms, to prevent automated abuse.
• Google Analytics — measures general site usage and traffic patterns.
• Google Sheets (via Google Apps Script) — records newsletter subscriptions and petition signatures.

All of these providers are located in, or store data in, the United States. If you are accessing this site from outside the United States, your information will be transferred to and processed there.

How we use your information

• To create and secure your account and sign you in.
• To send transactional email you have asked for — confirming your address, resetting your password, or important notices about your account.
• To send newsletters or campaign updates, if you asked to receive them.
• To keep the site working, secure, and free of automated abuse.

We do not use your information to build advertising profiles, and we do not run third-party advertising on this site.

How long we keep it

We keep account information for as long as your account exists. If you ask us to delete your account, we remove your account record and its associated data. Newsletter and petition records are kept as long as they are relevant to the campaign or advocacy effort they support. Ordinary server logs are retained for a short period by our hosting providers as part of their normal operations.

Your choices

• Access or correction — you may ask what information we hold about you, or ask us to correct it.
• Deletion — you may ask us to delete your account and associated personal information.
• Unsubscribe — every newsletter email includes an unsubscribe link. Transactional emails about your own account are not promotional and cannot be unsubscribed from while the account exists.

To make any of these requests, contact us using the address at the bottom of this page.

Security

Passwords are stored using industry-standard one-way hashing, never in plain text. Traffic to and from this site is encrypted with HTTPS. Access to account data is limited to those who need it to operate the site. Optional two-factor authentication is available on accounts that support it, and we encourage you to enable it.

No online service can promise perfect security. We take reasonable measures to protect your information, but we cannot guarantee it against every possible threat.

Information about children

Part of this site hosts a roster for a youth football team. It holds only a player’s name, a jersey number, an X-Player mark where the league’s weight rule applies, and — optionally — a photograph. Nothing else about a child is stored.

Specifically, we do not collect or store emergency contact details, medical or allergy information, home addresses, phone numbers, dates of birth, school names, or social security numbers for any child. Photographs are entirely optional — a player can appear on the roster without one.

We do not store any child’s weight.The X-Player mark records only whether a player is above the league’s carry-weight limit — a yes or no. We are given each player’s weight once, when the roster is set up, use it to work out that mark, and discard the number. It is never saved.

This is deliberate. Information that is never collected cannot be exposed, and a youth roster does not need more than this to be useful.

Signed-in families can also post about players, reply to each other’s posts, and add events to a shared team calendar. Anything posted is visible to every signed-in account on that page. Post authors can delete their own contributions, and team admins can remove any of them. If a player is removed from the roster, every post about that player and every reply to it is deleted automatically.

Children do not create accounts here and do not give us information directly. Accounts may only be created and operated by a parent, legal guardian, adult relative, or an authorized team official, all of whom must be 18 or older. Information about a child reaches us only because an adult responsible for that child chose to provide it.

Roster information is visible only to signed-in account holders associated with the team. It is not public, it is not indexed by search engines, and it is not linked from anywhere else on this site.

We do not sell information about children, we do not share it with third parties for their own purposes, and we do not use it for advertising or to build profiles. The service providers listed above process it only to operate the site.

Parents and guardians can, at any time: ask what information we hold about their child, ask us to correct it, ask us to remove a photograph, or ask us to delete it entirely. Email defendut.com@gmail.comand we will act on the request. You may also withdraw consent and have your child’s information removed while remaining part of the team.

Account holders agree to specific obligations about handling other families’ information — including not sharing, screenshotting, or reposting it — as a condition of access. The full terms are on the roster page.

If there is a data breach

Utah law (Utah Code § 13-44-202) requires anyone holding personal information about a Utah resident to investigate a suspected breach and, where misuse for identity theft or fraud is reasonably likely, to notify affected people in the most expedient time possible and without unreasonable delay. We will meet that obligation.

In practice, if we become aware that personal information may have been accessed without authorization, we will investigate promptly, notify the people affected by email at the address on their account, and explain what was involved and what we are doing about it. If we cannot reach someone by email we will use another reasonable method, including substitute notice where the law allows it. Where the law also requires notifying the Utah Attorney General or another authority, we will do that too.

This duty cannot be waived. Nothing in our Terms of Service, our roster terms, or any limitation of liability reduces or removes it.

Changes to this policy

If we make material changes to this policy, we will update the effective date above and, where appropriate, notify account holders by email.

Contact

Questions about this policy, or requests regarding your information, can be sent to defendut.com@gmail.com.