This marketing website
Pages are delivered over HTTPS. Form submissions are validated server-side and stored in a private storage binding. There is no public endpoint to list or read submissions. Forms enforce same-origin requests, a honeypot, field limits and an adult-only acknowledgement.
Planned application controls
Passkeys and email-link sign-in, role-based access, guardian-linked youth access and credential checks are part of the launch plan. We will document encryption, access review and operational controls before club onboarding.
No borrowed badges
We do not claim SOC 2 certification, ISO certification, a completed external security audit or a published uptime SLA. Enterprise requirements can be discussed through the contact form.
Report a concern
Choose “Security concern” on the contact form. Describe the affected page, expected behaviour and steps to reproduce. Please avoid submitting passwords, private member records or exploit payloads. We will use the request to coordinate a response.