Privacy

Effective 10 October 2026

Pinnieboard is operated by Aubrey Freeman III, Verona, Wisconsin. Questions or requests about data: privacy@pinnieboard.com.

What Pinnieboard is

Pinnieboard is a tool a youth hockey association uses to run its own tryouts. The association (“your organization”) decides who is evaluated, who evaluates, and what happens to the results. Pinnieboard stores and processes that information on the organization's behalf. Pinnieboard does not make team decisions and does not show results to parents. If you have a question about your child's evaluation, your organization is the right place to ask.

What is collected, and from whom

Skaters. The organization enters each skater's name and assigns a pinnie color and number for the session. That is all Pinnieboard holds about a skater: a name, a number, and what evaluators recorded. No date of birth, address, photo, USA Hockey number, or contact details. If a future version links skaters across seasons, this page will be updated before that feature is turned on and every organization will be told.

Evaluations. Evaluators record a score or placement grade per skater per category and may type a short comment. Comments are about a skater's play; evaluators are asked to keep them to hockey.

Evaluators. When someone joins a session to evaluate, they give a name and email address. The email identifies the same evaluator across sessions and attributes their scores. It is visible to the organization's admins. Pinnieboard does not email evaluators.

Admins. Organization admins have a name, email, and password. Passwords are stored as salted bcrypt hashes; Pinnieboard cannot read them. Invite and password-reset links are single-use tokens, stored hashed, and expire (invites after 7 days, resets after 1 hour).

Nothing else. No analytics, advertising, or tracking scripts. The only cookie is a session cookie for logged-in admins and evaluators (HttpOnly, Secure, SameSite=strict; admin sessions expire after 8 hours). Server logs record requests but not their contents.

AI comment summaries

When an admin asks for them, Pinnieboard sends the comments about a skater — and only the comments — to a third-party language model to produce a one-to-three-sentence summary of the evaluators' consensus. Before sending, evaluator names are replaced with “Evaluator 1, 2…” and the skater's name is removed; the model is asked about “this skater”. The summary is stored and shown to the organization's admins alongside the raw comments.

The provider is Nous Research (US), running Anthropic's Claude Haiku. The account is set to the provider's privacy mode, under which requests are not retained or used for training. Nothing is sent until an admin asks; an organization that does not want this simply does not use the feature.

Where it lives

• Database: Neon (PostgreSQL), AWS us-east-1 (N. Virginia). Encrypted at rest.
• Application: Railway, United States.
• Email: Resend, United States — invite and password-reset emails only. Content: the recipient's address, the organization's name, the inviter's name, and a link.
• Error reporting: Sentry, United States — receives stack traces and request paths when something breaks. Request bodies, cookies, and authorization headers are stripped before sending. It never receives scores, names, or emails.

Everything is encrypted in transit (TLS).

Who can see what

Each organization's data is isolated. An admin in one organization cannot see another organization's skaters, evaluators, or evaluations; the system answers as if they do not exist. Within an organization, full admins see every evaluation; members see only evaluations shared with them. Evaluators see only the skaters in the session they joined, by pinnie color and number. Skater names are hidden from evaluators by default; an admin must choose to show them.

The operator named above can access any organization's data for support and maintenance, and will say so when that happens.

How long it is kept

Evaluation data is kept for as long as the organization keeps its account, so a skater's results can be looked at season over season. An organization's full admin can delete any evaluation at any time; everything under it — sessions, scores, comments, summaries — goes with it, permanently. Admins can remove evaluators and other admins. An organization that leaves can ask for its data to be exported and then deleted in full; both happen within 30 days of the request. Backups roll off within 30 days after a deletion.

Once a year, each organization's owners receive an email listing what their organization holds in Pinnieboard.

Your rights, and a parent's

A parent or guardian can ask their organization what was recorded about their child and ask for it to be corrected or deleted; the organization can do that in Pinnieboard directly. If the organization is unresponsive, write to the address above and Pinnieboard will help. Evaluators and admins can ask for their account and personal details to be removed: an organization's owners can do that from the Users card, or write to the address above.

Children

Pinnieboard is used by adults — coaches, evaluators, administrators — to record evaluations of minors. Minors do not use Pinnieboard and do not have accounts. The organization is responsible for having the authority, through its own registration process, to evaluate the skaters it enters.

Changes

When this page changes in a way that matters, the date at the top changes and every organization's owners receive an email describing the change before it takes effect.

Plain-language summary: your organization's data is its own; Pinnieboard holds names, numbers, scores, and comments; evaluators and admins are identified by email; AI summaries are generated from comments with all names removed; nothing is sold or used for advertising; you can delete anything, anytime.