Arena · Legal
Privacy Policy
Arena Sports Network LLC
Arena · Legal
Arena Sports Network LLC
Last updated:
Arena Sports Network LLC (Arena, we, us, or our) operates the Arena platform. This Policy explains how information is collected, used, disclosed, and retained when you browse Arena, create an account, manage a participant or organization, purchase or provide an offering, communicate, or use connected services. The contact details at the end apply to privacy questions and requests.
This Policy is a notice about information practices, not a blanket consent to every use of information. Where a particular use requires consent, we must obtain that consent separately. The Consumer Health Privacy Notice addresses health information in additional detail.
This Policy covers Arena's website, its hosted mobile experience, and related platform operations. It also covers information supplied about people who do not have an account, such as managed participants, invited family members, emergency contacts, applicants, and contacts imported by organizations.
An activity host or organization can make its own decisions about registrations, rosters, communications, waivers, records, and other information it receives. Its separate notice and obligations may also apply. In some arrangements Arena processes information on an organization's instructions; in others Arena determines the purposes of processing for its own account, payment, security, and platform operations. The role depends on the particular activity and applicable agreement.
Contact both Arena and the responsible organization when a request concerns records each controls. We will assess our own responsibilities and, where appropriate, help route the request. A third-party website, external payment service, or other independently operated service can have its own privacy policy.
The information processed depends on the features used and the fields completed. Optional fields need not be completed unless a particular offering lawfully requires them. Avoid entering information that is unnecessary for the requested feature.
Requests to Arena and its infrastructure can include IP address, browser or device information, operating system, request time, page or resource requested, and diagnostic or security information. Authentication services process device and session information to support sign-in, security, session review, and revocation.
Arena measures activity-page views, registration-button clicks, checkout starts, and registration outcomes. A browser identifier scoped to an activity can be kept in local storage for up to 30 days. Signals can be associated with an authenticated identity for the authorized measurement workflow. Organizer reports provide activity-level totals and conversion measures. These measurements are not a recording of everything typed or viewed across your device.
Referral and campaign links can record visits, referral source, recipient interactions, and attributed outcomes. Email delivery services can report delivery, bounce, complaint, open, or click events where supported. Counts may be affected by email privacy features, automated scanners, or blocked storage.
If you choose a current-location feature and grant permission, your browser or device supplies location coordinates for the requested nearby-search or location function. You can enter a location manually instead. Location preferences may be stored for future searches. The current-location feature is not continuous background tracking.
Push subscriptions include a browser endpoint or mobile push token and associated platform information. Notification payloads can contain a title, message preview, or destination. Your operating system may display previews on a lock screen depending on your settings.
If you open an available camera feature, Arena requests the device or browser permission needed to take a photo or record a video. Video recording can also request microphone access to record sound. You choose the captured or selected media to attach. Attached photos, videos, and files are processed through Arena's upload and storage services and can be disclosed to the people or audience with whom you share them.
You can deny or revoke camera and microphone permissions through your browser or operating-system settings. Doing so limits the corresponding capture feature; it does not, by itself, prevent ordinary account access. Selecting a file or photo gives Arena access to the selected item, not permission to use your entire photo library for unrelated purposes. Removing local permissions does not delete an attachment already uploaded or shared; the retention and request sections explain those records.
We receive information from people who interact with you through Arena, such as family managers, hosts, coaches, organizers, other conversation members, and people inviting you. An organization can import contacts and information it represents it is entitled to use. If you did not supply the information yourself, you can still contact us about applicable rights.
WorkOS and your selected sign-in provider supply identity and session information. Google or Apple sign-in can provide the name, email or relay email, and other profile information included in the permission and provider response. Stripe supplies transaction, payment-method, verification, balance-availability, dispute, and payout information relevant to the feature.
External location, media, messaging, email, and device services provide the responses and delivery information needed for their features. Connected Gmail is described separately below. We may also receive information from lawful security reports, support inquiries, or legal requests.
We use the categories above as needed to provide the feature requested: maintain accounts and permissions; publish offerings and profiles; register participants; administer bookings, attendance, documents, competitions, helper work, and sponsorships; send communications; and collect, reconcile, refund, allocate, and pay out funds.
We also use relevant information to secure accounts, investigate reports and payment issues, prevent abuse, maintain records of transactions and permissions, provide support, diagnose failures, measure use of features, and improve reliability. We use contact and preference information to deliver permitted service and promotional communications and to honor applicable choices.
We may use information to comply with applicable law, respond to valid legal process, establish or defend legal claims, and handle corporate transactions subject to applicable safeguards. A general platform-improvement purpose does not override a restriction applicable to child information, consumer health data, Google API data, or another specially protected category.
Where we use aggregated or de-identified information, it must be treated consistently with the applicable legal requirements for that status. Removing a name alone does not necessarily make a record anonymous. New materially different uses require appropriate notice and, where required, consent before the new use begins.
Public profiles, organization pages, offerings, competition results, and approved sponsorship displays may be visible to anyone who can access the page, including through shared links or search engines. Public content can be copied by others. A private link may be forwarded; it is not equivalent to account-based access control.
Profile controls offer public, connections, or private audiences and a separate Explore-discovery choice where supported. These control the relevant profile presentation; they do not conceal information you separately publish in a listing, send in a message, or must share to complete a transaction. Changing visibility cannot recall copies already lawfully received by others.
A person with family-management authority can access the managed person's information according to their granted permissions. Registration can create a connection between the registering account and the relevant organizer or organization. A managed participant is a roster identity, not an automatically public social connection.
When you register or book, the responsible organization and authorized staff receive the identity, contact, registration, payment-status, waiver, document, attendance, or other operational information appropriate to their role. Medical access is separate from general roster or check-in access. Authorized medical workflows can include viewing and exporting relevant current health and emergency information. The organization is responsible for handling its exported copies lawfully.
Messages and attachments are disclosed to conversation recipients, and permitted channel or organization managers may administer the relevant communications. Other recipients may retain copies after you leave a conversation. Reports may include relevant content and account information for authorized review.
If a referral is attributed, the referrer can see the joined person's first and last name when available, join date, code, and relevant source, shared-activity title, or channel. The referral view is not a disclosure of that person's health records, bank credentials, or customer-level purchase history.
Sponsors can choose a public name or anonymous display under campaign rules. Organizers still receive the information needed to evaluate and fulfill a request. Helper organizers receive applications, work records, and payment information needed for the role. General marketing access does not entitle a sponsor or helper to participant health records.
We disclose information needed for infrastructure, authentication, payment processing, storage, communications, and other requested services. The recipient and categories depend on the feature used. A provider can have separate legal obligations and, for some services, act for its own purposes under its own policy.
Connecting Gmail authorizes Arena to identify the connected mailbox and send the campaigns you authorize. The integration requests account identity/email and Gmail send access. It is not an inbox-reading or calendar-sync feature. Arena stores the connected address and encrypted refresh credential, creates messages from your Arena campaign content, and records send identifiers, status, and errors.
You can disconnect Gmail in workspace outreach settings, which removes the stored connection and cancels queued work for that connection. You can also revoke access in your Google account. A message already sent cannot be recalled by disconnecting, and Arena's campaign and transaction records are handled under the retention section.
Arena's use and transfer of information received from Google APIs is subject to the Google API Services User Data Policy, including its Limited Use requirements where applicable. Such information is used for the visible connected feature and permitted security or legal purposes, not advertising, data brokerage, credit decisions, or general-purpose AI model training. Human access to Google API data is restricted to the circumstances allowed by that policy, such as your affirmative permission for specific data, necessary security investigation, or legal compliance. Transfers in a merger, acquisition, or sale of assets require explicit prior user consent where the Limited Use requirements apply.
Contact-import tools process the files or selected contacts supplied for the import and maintain organization contact and audience records. Importing a contact does not verify marketing consent. You may receive an invitation or campaign even if you do not have an Arena account; contact us or the sender to exercise applicable choices.
Personal Text stores the requested recipient, message, schedule, device binding, and execution history, and routes the message through the sender's enrolled device or supported composer. The enrolled device, Apple services, and carrier may process it. Arena does not import the sender's full text inbox or ingest replies through this workflow. A sender must handle a recipient's reply or stop request; contact Arena if you need help with an Arena-related message.
Authorized Arena personnel may access information when needed for support, security, moderation, payment administration, or legal obligations, with any additional restrictions applicable to the data. We may disclose relevant information to emergency responders, appropriate authorities, legal advisers, auditors, insurers, or other parties when reasonably necessary and legally permitted to address safety, fraud, legal process, or claims.
In a merger, acquisition, financing, reorganization, or sale of assets, information may be reviewed or transferred with appropriate confidentiality and purpose restrictions and subject to applicable notice and consent requirements. A transaction does not remove restrictions that already apply to the information.
We may disclose information at your direction or with an appropriate separate authorization. This Policy does not grant unrelated advertisers, sponsors, or referral users access to private health, family, or payment credentials.
Arena uses cookies and similar storage for sign-in, account security, authentication continuations, preferences, attribution, and feature measurements. Browser or device caches can retain downloaded resources. Clearing storage or blocking cookies can sign you out or disrupt a requested feature.
Examples include the Arena theme preference (up to one year), a referral-touch cookie (up to 60 days), a remembered Explore location, and activity-specific browser identifiers in local storage (up to 30 days). These periods describe those browser records, not deletion deadlines for related server-side transactions or attribution history.
Arena's first-party event measurement checks supported Do Not Track and Global Privacy Control signals and skips those event signals when the opt-out is detected. This is not a promise that every external map, GIF, email link, or provider request has the same controls. You can avoid optional external features, clear storage, and use browser or provider settings to manage their requests.
We do not operate a customer-list marketplace. Disclosures through third-party features can nevertheless require analysis as a sale, sharing, or targeted advertising under some privacy laws, depending on the recipient's use and the applicable contracts. Where a disclosure falls within those definitions, you have the applicable opt-out rights described below. Contact us to exercise them. A legally required consent or opt-out mechanism must be honored for the relevant processing, not merely for first-party measurements.
Use email unsubscribe links to stop the applicable organization's promotional emails. Transactional and security communications may continue where necessary to provide the service or satisfy legal duties. Manage push permissions and previews in your browser or device settings and available Arena notification controls. For texts, tell the sender to stop; Arena's Personal Text feature does not automatically read reply messages.
Independent Arena accounts are for people who are at least 18 and have reached the age of legal majority where they live. Adults can manage participant profiles for children under their lawful authority. Information supplied by an adult about a child is still personal information and may include especially sensitive health, school, insurance, or emergency details.
We use managed participant information for the requested family and program functions, such as eligibility, registration, rosters, authorized health access, consent records, and documents. It is not permission to make a child independently searchable, use their likeness in unrelated marketing, or expose their health information to general conversation members.
A parent or legal guardian may request access, correction, or deletion of information about a child they are authorized to represent by using available management controls or contacting us. Archiving a profile removes it from ordinary active-family views; it is not the same as deleting all associated records. We may need to verify the requester's identity and authority without collecting unnecessary information.
Where COPPA or another child-privacy law applies, the required notice, verifiable parental consent, collection limits, security, and retention measures must be satisfied before the covered processing. Creating an adult account, checking a box, or paying for an activity does not automatically establish that those requirements have been met. If you believe a child has created an independent account or supplied information without required authorization, contact us so we can investigate and take appropriate action.
Do not put a child's sensitive details in public content or optional third-party search tools. A host must obtain the separate permissions required for published rosters, photographs, results, and its own uses of participant information. Privacy requests and legal protections continue to apply even if information was supplied by another user.
Workspace branding can analyze an uploaded logo to suggest colors, including through Vercel AI Gateway and Google Gemini when the AI refinement is used. The image and the color-selection request are processed for that feature. Do not upload a logo containing unnecessary personal or sensitive information. Provider retention and permitted use are governed by the applicable service arrangements; this Policy does not promise universal zero retention by AI providers.
The platform also uses automated rules for eligibility, capacity, pricing, permissions, fraud or security signals, billing schedules, referral attribution, and delivery. Those rules can affect the actions available to an account. Contact Arena about a decision or error and any applicable right to human review. A branding feature does not authorize unrestricted use of messages, medical profiles, or children's information to train AI systems.
We retain information for the purposes for which it was collected and for applicable legal obligations, rather than applying one deadline to every category. Relevant considerations include whether an account or transaction remains active, whether information is needed to provide a requested service, applicable tax and accounting rules, claims and limitation periods, participant and waiver records, security investigations, and required suppression records.
Account and ordinary profile information supports the active account. Transaction, invoice, wallet, refund, dispute, and payout records may need to remain after account closure for reconciliation and legal obligations. Waiver snapshots, signature evidence, and related operational history can be retained as needed to establish what was agreed and resolve claims. Security records may be retained to investigate and prevent abuse. Suppression records help prevent contacting someone who opted out.
The account-deletion workflow includes a 30-day recovery period after a request is successfully scheduled. Finalization can pause for unresolved ownership, family-management, financial, or provider matters. The workflow removes or anonymizes eligible account and profile fields while retaining stable references required for historical and financial records. It is not a promise that every record is deleted 30 days after any request.
Account deletion does not automatically erase every message, uploaded file, waiver, organization record, or copy previously received by someone else. Sensitive insurance documents and provider-held media may require additional handling. A privacy deletion request is reviewed for all applicable categories and legal requirements separately from the account-recovery process. Contact us if the automated account process does not address your request.
Information can persist in backups until handled through their retention and recovery procedures. Copies retained by a host, message recipient, or independent provider are subject to that party's responsibilities. We must apply any legally required deletion instructions and deadlines to processors and backups where applicable; technical inconvenience is not a general exemption from those duties.
Arena uses measures such as authenticated sessions, role and permission checks, validation of requests, restricted access to sensitive workflows, and encryption for certain stored integration credentials. Payment-entry and verification functions use the relevant payment provider's components. Security controls reduce risk but do not guarantee that information can never be accessed, lost, or disclosed without authorization.
Protect your account and devices, use only permissions you are authorized to grant, and report suspected compromise. Messages are not represented as end-to-end encrypted. Public uploads and shared links should not be used as a substitute for the platform's designated sensitive-document workflows. If an incident triggers a legal notification duty, Arena must provide the notices required by the applicable law.
Depending on your location, the applicable law, and whether Arena is subject to it, you may have rights to confirm processing; access information; correct inaccuracies; delete information; receive a portable copy; opt out of sale, sharing, targeted advertising, or certain consequential profiling; limit certain uses of sensitive information; or withdraw consent. These rights have different scopes and exceptions across jurisdictions.
To make a request, email hello@arenasports.space with the subject Privacy Request or write to the listed address. Describe the request and the account or records involved. You do not need an Arena account to contact us. Do not send a full identity document, payment-card number, or medical file in an ordinary email; we will explain a secure verification method if additional information is necessary.
We may ask for information reasonably necessary to verify identity and authority before disclosing or deleting records. An authorized agent, parent, or guardian can submit a request with the authority required by law. Verification requirements for an access or deletion request do not automatically apply to an opt-out request. We will respond within the applicable statutory period and provide any required notice of an extension or reason for denial.
Where applicable, California residents may request the categories and specific pieces of personal information collected, sources, purposes, and categories of recipients; correction and deletion; portability; opt-out of sale or sharing, including qualifying browser signals; and limits on certain uses of sensitive personal information. The information categories, sources, purposes, and recipients are described in the sections above. The applicability of a particular right depends on the law and processing involved. We do not condition an opt-out on creating an account.
Other state laws, including Utah's, may provide access, deletion, portability, opt-out, correction, or appeal rights as specified in the law that applies. We do not assume that every state has identical eligibility thresholds, rights, or exceptions. For health information, see the separate Consumer Health Privacy Notice, including the rights and appeal procedure for applicable Washington requests.
If a request is denied, you may ask for review by contacting us with the subject Privacy Appeal. We will process appeals and provide the decision and any required regulator-complaint information under applicable law. You may also complain to your state attorney general or other competent privacy authority. Arena will not unlawfully discriminate or retaliate against you for exercising privacy rights.
Arena is operated by a United States company. Information may be processed in the United States and other locations used by the providers involved in a requested feature, where legal protections may differ. A server location or United States address does not eliminate laws that apply to a person's information.
Accessing Arena is not, by itself, consent to waive foreign privacy rights or a legally sufficient mechanism for a restricted international transfer. Where another jurisdiction's privacy law applies, Arena must identify the appropriate processing basis, provide the required information and safeguards, and honor applicable rights. Contact us about international processing or access requests.
The Last updated date identifies the most recent revision of this Policy. We will provide appropriate notice of material changes and obtain any consent required before applying a changed practice to your information. Posting a new policy does not retrospectively authorize a use of information that was not permitted when it was collected.
Contact us if you have questions, need an accessible copy, want to report an issue, or want to exercise privacy rights. The same contact can assist people whose information was supplied by a host, family member, or other user.