Privacy Policy

Version 0.4 (draft) · Last updated 2 November 2026

Core16 helps Canadian high school hockey players and their families keep track of NCAA Division I and II academic eligibility. To do that we handle information about students, most of whom are under 18. This policy explains what we collect, why, who else sees it, how long we keep it, and what you can ask us to do with it.

In this policy, "Core16", "we" and "us" means [legal name of the business]. "You" means the parent or guardian who holds the account, and the student whose record it is.

1. The short version

• We collect what we need to track a student's courses and marks against the NCAA rules, the hockey schedule those marks have to fit around, and what we need to advise the family. Nothing else.
• A parent or guardian gives consent for each student, and we record when and how.
• We store student records in Canada (Toronto).
• We don't sell information, show ads, or use analytics or tracking tools in the app.
• Ask Core16 and video sessions are optional, and stay off without consent. Neither is needed to use the rest of Core16, and refusing either changes nothing else.
• Ask Core16, our AI assistant, is off for a student until a parent consents and the student agrees too. It sends what's typed to Anthropic in the United States, and can send a student's courses and marks, but not their name, school or birth date. See section 7.
• A video session with a professional can't be booked until a parent consents. Calls run through Daily, usually in the United States, and are never recorded. See section 8.
• If we text you a link code, the text contains only the code and a link, and we don't keep your phone number.
• We use email addresses to sign you in and to work with your family, never to send marketing you haven't agreed to.
• Core16 is not the NCAA. Only the NCAA Eligibility Center can certify a student, and we don't share records with it or with schools on your behalf.

2. Information we collect

About the parent or guardian

• Email address, to identify the account, sign you in and stay in touch. Core16 doesn't use passwords. See section 6.
• Billing status: whether the account is paid, invoiced or complimentary, and the reference numbers our payment processor gives us. Card details go to the payment processor and never reach us. [Billing isn't set up yet; confirm before publishing.]
• Name, relationship and phone number of each parent or guardian on the family's list, which our staff keep so an advisor can call you, and so you can have your own sign-in (section 9).
• Consent records: which policy version you agreed to, for which student, when, and how.
• Documents you sign on your family page: the wording you saw, the name you signed with, and when.
• Sign-in details, if you have your own sign-in: your passkey's public half, which can't be used to sign in by itself, and when it was last used (section 9).
• Push address, if you use the Core16 Portal app and allow notifications: the address Apple gives the app on your device, so we can tell you about a session or a reply from your advisor. Those notifications never name a student.

About the student

• Email address: we don't hold one for a student today. A student signs in on the web with a code from their phone (section 9). [Sign in with Apple for students is planned and isn't built. See section 6.]
• Profile: first and last name, province, grade, school, graduation year, and the NCAA division being targeted. Also the student's birth month and year, never the day, which the app asks for when a student is set up. It's used only to work out when the NCAA's five-year eligibility period starts. [New 7 Oct 2026; needs counsel.]
• NCAA ID, if you enter one. It's optional. BC families are asked to use it as the answer to the BC Ministry of Education transcript security question, and we remind them to.
• Courses and marks: course codes and titles, credit values, whether a course is finished or in progress, marks entered from report cards (percentages, or proficiency levels for BC grade 9) and the date of each report card.
• Assignments: title, due date, weight and score, if the family chooses to log them.
• Hockey log, if the family chooses to keep one in the app's Hockey tab: the date and kind of each practice, game, skills or off-ice session, a short description (usually an opponent), how long it took, travel time, and time on ice for games. It's used to warn when school work is due right after a heavy stretch of hockey, and so our advisors can see the same. It never affects eligibility results: the NCAA has no rule about it.
• Report cards and IEPs, only for a student in Grade 10 or higher and only if the family chooses to send them: photos or PDFs of earlier report cards and, if the student has one, their Individual Education Plan. Our advisor reads them to enter the student's earlier final marks. An IEP describes a student's learning needs, so it is health information. We use it only to plan the student's timetable and only our advisors and administrators can open it. [New 29 Sep 2026; needs counsel before real families can send documents. Uploading is switched off until then.]
• Questions sent to an advisor, only if a student or parent chooses to send one from Ask Core16: the question, the answer Ask Core16 gave, anything they add, and any follow-up they write. See section 7.
• Video sessions, only if a parent has consented and a session is booked: the time, the professional, the topic written when booking, who joined and for how long, and the sessions a student has left. See section 8.
• Changes made on the web by a parent or student, such as a hockey session, a due date or a mark, with the name of who made it, until the phone has taken them in.
• Eligibility results that our server calculates from the above, such as core course count, core GPA, courses that don't count, and marks close to the next grade band. Each result records which version of the NCAA rules produced it.

Created by our advisors

• Contact log: a dated note of each conversation with the family (who we spoke to, how, and what we advised). It's our record of the advice we gave.
• Access log: every time a staff member opens a student's record, we log who opened it and when. We also log when a question asked on a web page reads a student's figures, but not the words. A question asked on the phone isn't logged this way, because a phone isn't tied to one person.

Calls from our advisors

• Call records: if an advisor phones a parent through Core16, who was called, both phone numbers, how the call went and how long it lasted. Calls aren't recorded. See section 5.

For linking a phone

• Link codes: a short one-time code our staff give you so the app can connect to the student's record. A code works once and expires after 7 days.
• Device tokens: once linked, the phone holds a token that lets it sync. We store only a scrambled (hashed) version of it, not the token itself.
• Web sign-in codes: a short code the phone shows so the student can sign in on the web. We store only a scrambled version, and it works once, for five minutes (section 9).
• Phone number, if you ask us to text you a code. See section 5.
• Push address: if you allow notifications on a student's phone, the address Apple gives the app there, so we can update the number on the app's icon when an advisor replies to a question the student sent. That number is all we send this way: no words, and no names.

What we don't collect

We don't collect location, contacts, advertising identifiers, or usage analytics, and we don't record video sessions or phone calls. The only photos and health information we hold are the report cards and IEPs a family chooses to send us, described above, and anything someone types into Ask Core16 or a question they send to an advisor. The app doesn't include third-party analytics, advertising or crash-reporting tools.

3. How we use it

• To calculate and show the student's NCAA academic eligibility status, and to flag problems early, such as a course that doesn't count or a mark just below a grade band.
• To let our advisors review the student's progress and give advice.
• To keep a record of what we calculated and advised, so we can explain it later if a question comes up.
• To restore a student's record if it's accidentally overwritten, for example by an old phone syncing.
• To manage your account and billing.
• To answer questions asked through Ask Core16, if you've chosen to use it (section 7).
• To arrange and run video sessions, if a parent has consented to them (section 8).
• To sign parents and students in to their web pages (section 9).
• To send link codes you've asked for, and documents for you to sign.
• To email you sign-in links, account and billing notices, and messages from your advisor.

We don't use student information for marketing, and we don't sell it, rent it or share it for anyone else's marketing.

4. Consent, and students under 18

Our staff set up the account with a parent or guardian, who gives consent for each student on it. We record the student, the version of this policy you agreed to, the date and time, and how consent was given.

[Needs counsel: the age at which a student may consent for themselves, and whether an older student needs to give their own consent as well. Quebec's Law 25 sets a specific age; Core16 doesn't currently serve Quebec, and if it does, Quebec families will get a separate consent process.]

You can withdraw consent at any time (see section 13). The app can't track or sync a student's record without it.

Ask Core16 and video sessions are optional, and each has a consent of its own, separate from this one. Each stays off until it's given, and refusing or withdrawing it changes nothing else in Core16. For Ask Core16 a parent signs and the student agrees too (section 7). For video sessions a parent consents (section 8).

5. Text messages and phone calls

If you ask, our staff can text you a link code instead of reading it out to you. Here's how that works:

• We text about one thing at a time, never marketing. A text is either a link code you asked for, or a note that a document is waiting for you to sign, sent by our staff to a parent on the family's list.
• The message contains only the code and a link to core16.ca, which opens the app with the code filled in, or a link to sign in and read the document. It doesn't include the student's name, school, grade or anything about their marks.
• A number typed in just to text a code isn't stored. It's used to send that one message and isn't saved in our systems. A number on your family's list is kept there (section 2).
• Our texting provider, Twilio, does see the number and the message. Twilio is based in the United States and keeps delivery records under its own privacy policy. [Confirm how long Twilio keeps message logs and bodies on our account settings.]
• Reply STOP to stop receiving texts from our number, and START to resume. Standard message and data rates from your carrier may apply.
• Only Canadian and US mobile numbers can receive texts.

Keep a texted code private until you've used it. Whoever uses a code first can connect a phone to the student's record. If someone else has already used your code, the app tells you it no longer works, and our staff will cancel it and issue a new one. [Staff can't yet disconnect a phone that's already linked; build that before this sentence is relied on.]

Phone calls from an advisor

An advisor can phone a parent on the family's list from the student's file. Twilio rings the advisor, then the parent, and shows a Core16 number. Twilio sees both phone numbers and handles the call. Calls aren't recorded. We keep who was called and how long it lasted, and the advisor writes up what was said in the contact log. [Confirm how long Twilio keeps call records.]

6. Email

Whose email addresses we hold

• The parent or guardian's, which is required for the account. A family can add a second parent or guardian's address too. [Confirm whether accounts will allow more than one.]
• The student's: none today. If we add Sign in with Apple for students, Apple lets the student share their real address or hide it behind a private relay address, which forwards to them without revealing it. Either way, we'd use it only to identify the student when they sign in. We don't email students directly. [Confirm with counsel, given the student's age.]
• Addresses in emails you send us. If you email us from a different address, or copy in someone else, we'll have that address too.

What we send

• A setup link for your own sign-in. It works once and stops working a day after it's made (section 9).
• A document waiting for your signature, including when a student has asked to use Ask Core16.
• A note that an advisor has replied to a question you sent. The reply itself isn't in the email.
• Account and billing notices, such as receipts, invoices, failed payments and changes to this policy. Receipts and invoices come from our payment processor, Stripe. You can't opt out of these while the account is open, because they're about the service you've signed up for.
• Messages from your advisor about the student's progress and eligibility. [Advisors' own mailboxes aren't set up yet.]
• News or offers from Core16, only if you've agreed to receive them. Every one has an unsubscribe link, and unsubscribing doesn't affect the account. [Confirm Canada's anti-spam law (CASL) wording with counsel.]

What's in them

The emails Core16 sends automatically say there's something to read and where to sign in. They don't name a student or contain a question, a reply, a course or a mark. A family's address may be read by more than one person, and our email provider sees what we send. A setup link does name the parent it's for.

A message written to you by an advisor can contain student information when that's the point of it. Email isn't as secure as the app or the portal, so we keep detailed records there, and don't send whole transcripts or reports by email unless you ask.

[Confirm from our Resend settings: open and click tracking are off, so our emails don't report whether you've opened or clicked them.]

Where email goes, and how long it's kept

• Resend sends the emails Core16 sends automatically and the emails an advisor writes to you from the portal, and receives your replies to them, and sees the address and the message of each. [Confirm where Resend stores them and for how long.]
• Our mailbox provider will store emails advisors send and receive from their own mailboxes. [Name it once chosen. Advisors' own mailboxes aren't set up yet.]
• When an advisor emails your family from the portal, the email comes from an address that belongs to the student's record. Its subject and message go in the student's contact log (section 2), word for word, and so does your reply, along with the address it came from. Staff who can see the student's file can read it. Attachments to a reply aren't kept, only their file names. When an advisor writes from their own mailbox, a short note of it goes in the log instead.
• We keep emails in our mailboxes [period: needs counsel; likely the same as the contact log]. An email address on an account is deleted with the account.

To change the address on your account, or to stop optional emails, contact us (section 16) or use the unsubscribe link.

7. Ask Core16, our AI assistant

Ask Core16 answers questions about NCAA rules. It's optional, and it's off for a student unless a parent consents and the student agrees too. It runs on Claude, an AI made by Anthropic, so it isn't a person and it can be wrong. It can't certify anything: only the NCAA Eligibility Center can. [Only demo students can use it until counsel has reviewed this section.]

Who has to agree

• For a student to use it, two people agree. A parent or guardian signs a separate consent, and the student then agrees for themselves. A student can ask us to email the family's address so a parent can sign. [Needs counsel: whether a parent's consent is required, and at what age a student can agree alone.]
• A parent asking about their child needs only their own signed consent, so a parent can still ask, and their question can still read the student's figures, after the student has turned it off for themselves. [Needs counsel.]
• Either can stop it at any time. A parent can withdraw consent from their family page, which stops it answering for that student. A student can turn it off in the app or on their page. Either takes effect on the next question.
• Saying no costs nothing else. The tracker and the family page work the same without it.

What goes to Anthropic

Each question goes through our server to Anthropic, in the United States:

• Always: what was typed, the conversation so far on that screen, the student's province and today's date.
• If Ask Core16 needs the student's own figures to answer: each course's code, title, grade, subject, credit value, status, mark and whether it counts; core GPA, its minimum, and credits by subject and by the 10/7 rule; how the student's core courses are pacing; marks close to the next grade band; and the graduation year and the year the five-year eligibility period starts. It fetches these only when a question calls for them, so a question about a rule normally sends none of this.
• Never from our records: the student's name, school, birth date, NCAA ID or assignments.

This isn't anonymous. A province, a graduation year and a full list of courses and marks could together point to one student, the year the five-year period starts narrows down when they were born, and we can't control what someone types into a question or a course title. Please don't type a name, a school or anything private. Ask Core16 may ask for a birth month and year if a question needs them and we don't have them, and anything typed in answer goes to Anthropic too.

Anthropic may keep this for a short time under its own terms. [Confirm from our current agreement with Anthropic: how long it keeps this, and that it doesn't use it to train its models.]

What we keep

• The conversation: nothing. It stays on the phone's screen until you leave it, or in that browser tab until you close it or sign out. Nobody can read it back later: not you, not your advisor and not Core16, so we hold no record of what Ask Core16 said. [Needs counsel.]
• How much it's used. We count how many questions a student asks, and how many each parent asks about them, on which days, whether on the phone or the web, and how many read the student's own figures, so the student's advisor can see it's being used. We never keep what was asked. Counting began with the wording that says so.
• A question you choose to send to an advisor. A button under each answer does this, and it asks first. We then keep that question, its answer and anything you add, but not the rest of the conversation. Every Core16 advisor and administrator can read it.
• The advisor's reply shows on the screens of whoever asked, and goes in the contact log. A student's question and its reply aren't shown on a parent's page, and a parent's aren't shown to the student. [Needs counsel, and a qualified person: an adult replying in writing to a minor.]
• A follow-up you write to a reply goes to the advisor and not to Ask Core16, and we keep it the same way.
• Removing a question from your screens doesn't delete it. We keep a copy for your advisor, because it's part of our record of the advice we gave. To have it deleted, ask us (section 13).

How we tell you about a reply

• A student sees a number on the app's icon, if they've allowed notifications, and a note in the app and on their page. The number is all that's sent.
• A parent gets a notification in the Core16 Portal app, if they use it and allow notifications, and an email to the family's address. Neither contains the student's name, the question or the reply.

Our staff

Our advisors and administrators can use Ask Core16 too, for questions about the rules. No student's record goes with their questions, and we tell them not to type a student's name or details. That is our instruction to them, not something the system prevents. [Needs counsel before real families' records are in the advisor portal.]

On a school laptop

A student's web page can be used on a laptop the school manages. The school's network or device tools may be able to see what's typed there. [Needs counsel.]

8. Video sessions with a professional

Core16 can arrange one-to-one video sessions between a student and a professional, such as a hockey mentor or a performance coach. They're optional, and none can be booked unless a parent has given a separate consent, which we record. Our server checks this for every booking. Refusing or withdrawing it changes nothing else in Core16. Our staff also have to set sessions up for a student before they're offered, and a session only happens if someone books it. A parent's consent is what's required: a student isn't asked to agree separately, as they are for Ask Core16. [Not for real students until counsel has reviewed this section.]

• A second adult on every call. A parent or a member of our staff is named before anyone can join. If nobody is named, the student and the professional are both refused. Our staff can see every booking and can join any call. [Needs counsel: whether a parent must be there for students under 16.]
• Nothing is recorded. We don't ask for a recording, and there's no chat on the call, so no sound, picture or text from a call is kept by us or by Daily.
• What the professional sees: the student's first name and grade, and the topic written when booking. Nothing else from the record. [Needs counsel: a regulated professional, such as a psychologist, may have health-privacy duties of their own, including for any notes they keep.]
• What Daily handles: Daily is the provider that runs the call. Live video and sound pass through it, usually in the United States, because it can't yet keep a call in Canada. It's told a display name for each person (a student's first name), the time of the call and an internal reference. It isn't told a student's school, grade or marks. [Confirm what Daily logs about each device on a call, and for how long.]
• What we keep: the booking, the topic, who joined and for how long (which we read from Daily after the call), and the sessions a student has left. This is the record that a second adult was there.
• Camera and microphone: the app uses them only during a call, and asks the phone's permission first.
• Withdrawing: a parent can withdraw consent on their family page or through their advisor. No more sessions can be booked, and any still to come are cancelled with the credit returned. A session already under way is cancelled without one.

9. Signing in on the web

Parents and students can use Core16 in a web browser, and parents in the Core16 Portal app as well. [Not for real families until counsel has reviewed this section.]

Parents and guardians

• Each has their own sign-in, never a shared family one. It starts from a one-time link our staff issue, which you open to set up a passkey on your phone or computer. Your device keeps the private half and checks your face, fingerprint or passcode itself. None of that reaches us.
• What you can see: your family's students who are still active: their status and figures, one calendar of school and hockey, and documents to sign. Being taken off the family's list ends your sign-in.
• What you can change: hockey sessions, due dates and marks. Your change waits until the student's phone takes it in. A session or due date you add shows your name on the phone. You can also take the second-adult seat on your child's call.
• How long it lasts: you stay signed in while you use it, and are signed out after 30 days without use.

Students

• A code from the phone. The linked phone shows a short code and the student types it in. There's no email address, password or passkey. A code works once, for five minutes.
• What they can see: their own day, courses, marks, GPA, hockey and video sessions. Anyone who can see the screen can see these too, so a student should sign out on a shared laptop. [Needs counsel: what a school's network or device tools can see.]
• What they can change: the same waiting changes as a parent, and booking or cancelling a video session a parent has consented to.
• How long it lasts: twelve hours, and it's never extended, so a shared laptop doesn't stay signed in.

Cookies and browser storage

These pages use one cookie to keep you signed in, and the Core16 Portal app adds one that holds its push address. The browser also remembers your light or dark choice and whether you've seen the walkthrough, and holds an Ask Core16 conversation in that tab (section 7). None of this is used for tracking or advertising.

10. Where information is stored

On our servers. Student records, eligibility results, the contact log and the access log are stored in a database hosted by DigitalOcean in Toronto, Canada.

On your phone. The app keeps a copy of the student's record on the device so it works offline, and syncs changes to our servers.

Calendar and reminders (optional, off by default). If you turn them on in the app's Profile screen:

• The app adds upcoming assignments to a separate "Core16" calendar on your phone. It only ever changes that calendar, and doesn't send any calendar information to us.
• The app schedules assignment reminders on your phone. These are created by the phone itself, not sent from our servers.

You can turn either off in the app, or in your phone's Settings.

11. Who else handles information

We use a small number of service providers. Each one gets only what it needs to do its job, and is bound by its own privacy and security commitments.

Information outside Canada. Some of these providers store or process information in the United States, where it may be accessible to courts, law enforcement and national security authorities under US law.

Our advisor tools run on our own servers, not a third-party internal-tools service, and the advisor portal doesn't load anything from other websites. [The public core16.ca home page loads fonts from Google Fonts, which shares a visitor's IP address with Google. Host the font ourselves or mention it here.]

We may disclose information if the law requires it, for example in response to a court order. Otherwise we don't share a student's record with anyone, including the NCAA, schools or coaches, unless you ask us to. Consenting to Ask Core16 or to video sessions is how a family chooses what goes to Anthropic (section 7), and to a professional and Daily (section 8).

12. How long we keep it

Old records are deleted automatically every day once their period ends. Deleted information can remain in our hosting provider's database backups until those backups expire, [confirm DigitalOcean's backup period for our database] after which it's gone for good.

These periods are the longest we keep information. If you ask us to delete a student's information, we delete it when we act on your request, not at the end of these periods (section 13).

We keep eligibility results, the contact log and the access log for a while because an eligibility question can come up years after we gave advice, and these records show what we calculated and said at the time.

13. Your choices and rights

You can ask us to:

• Show you what we hold about you or your student.
• Correct anything that's wrong. Families can fix most details directly in the app, and our advisors can correct a student's name in our records. Advisor contact-log entries aren't edited. Instead, we add a correction that points to the original entry, and both stay visible, so the record stays accurate.
• Stop using Ask Core16 without closing anything: a parent withdraws consent from their family page, and a student turns it off in the app or on their page (section 7). This doesn't delete a question already sent to an advisor; ask us if you want that deleted.
• Stop video sessions without closing anything: a parent withdraws consent on their family page or through their advisor (section 8).
• Withdraw consent and close the account. We archive the student's record: the app stops syncing, advisors no longer see the student in their day-to-day lists, and a phone can't reconnect without a new link code. The record itself is kept for the periods in section 12, so it can be restored if you come back, unless you also ask us to delete it.
• Delete a student's information. We permanently delete everything we hold about the student: their profile, courses and marks, earlier versions of the record, eligibility results, the advisor contact log, questions sent to an advisor, video session bookings and attendance, call records, documents signed, the staff access log entries about them, consent records, link codes, device tokens and push addresses. If they're the only student on the account, we also delete the account, including the parent or guardian's email address, the family's list of parents and their sign-ins, billing status and consent records. This includes the record of advice we gave, so we can't later show what we told you. [Confirm with counsel.]

Once deleted, information can't be recovered by us. Two things remain: our staff access log keeps an entry recording that a student's information was deleted, when, and by whom, identified only by an internal number with no name or other details; and deleted information can stay in our hosting provider's database backups until they expire (section 12). The app keeps its own copy on your phone until you delete it there or remove the app.

To make a request, contact us (section 16). We'll answer within 30 days, and may need to confirm your identity and your relationship to the student first.

If you're not satisfied with our response, you can complain to the Office of the Privacy Commissioner of Canada (priv.gc.ca) [or the BC Information and Privacy Commissioner, if BC's PIPA applies: confirm with counsel].

14. How we protect information

• Records are hosted in Canada and encrypted in transit between the app, the advisor portal and our servers.
• No passwords: staff and parents sign in with passkeys, and phones and students connect with one-time codes and device tokens that we store only in scrambled (hashed) form.
• Signed-in sessions expire, and every staff view of a student's record is logged.
• Only Core16 advisors and administrators can see whole student records across families, and there are no shared logins. A parent sees their own family's students and a student sees their own. A professional sees only what section 8 lists. Ask Core16 sends only what section 7 lists.
• If a breach creates a real risk of significant harm, we'll notify the people affected and the Privacy Commissioner, as the law requires.

No system is perfectly secure, but we limit what we collect so there's less to protect.

15. What Core16 is and isn't

Core16 isn't affiliated with, endorsed by or acting for the NCAA or its Eligibility Center. Our results are a tracking and advisory tool. Only the NCAA Eligibility Center can certify a student's academic eligibility.

16. Contact us

Privacy officer: [name]
Email: [privacy@core16.ca, once email is set up]
Mail: [business mailing address]

17. Changes to this policy

If we change this policy, we'll update the version number and date at the top. If a change affects how we use a student's information, we'll tell you before it takes effect and ask for your consent again. Each consent we record notes the policy version it was given for.