Privacy Policy

Triple Threat Ventures, Inc. ("Triple Threat", "we", "us"), a California corporation, runs the Triple Threat platform, including the Breakaway apps, our websites and our APIs (the "Service"). This policy explains what personal information we collect, how we use and share it, how long we keep it, and the choices and rights you have. It applies to athletes, creators, agents, agency staff and anyone who visits our websites.

For most of the information in this policy, we are the business (or "controller") that decides how it is used. Agencies that use the Service to manage athletes make their own decisions about the athlete information they see and the records they create, such as notes about their clients. They are responsible for those decisions under their own legal obligations and privacy practices. Where we handle information only on an agency's behalf under a written agreement with that agency, the agreement sets out our role, and we pass requests about that information to the agency. Questions or requests: team@support.triplethreat.co.

• We collect what you give us, what you connect, and basic information about how you use the Service.
• We use it to run Triple Threat for you, including AI analysis of your contracts, content and brand.
• We don't sell your personal information or share it for targeted advertising. Our AI provider can't train its models on your contracts or other private content.
• Our service providers, including our AI provider, process it for us. Agents and agencies you link to can see your account data.
• You can download a copy of your data or delete your account at any time, in Settings or on your account page, even if your plan has lapsed. When you delete it, we delete your information from our active systems, apart from the records listed in How long we keep your information.

This is our notice at collection. We link to it wherever we collect personal information, such as when you create an account. When you use the Service, we collect these categories of personal information for these purposes:

We don't sell any of this information or share it for cross-context behavioral advertising. How long we keep each category is in How long we keep your information. Who receives it is in How we share your information. Your choices are in Your rights and choices.

Information you give us

• Account details: your name, email address, mobile phone number if you give us one (at sign-up or in onboarding), password (stored only in hashed form by our authentication provider), and any invite code you use.
• Profile and onboarding: your sport, league, team, position, career stage and current focus, bio and photo, and what you tell us about your brand: your values, tone, the causes you support, interests, audience, goals, the kinds of sponsors you want or want to avoid, and content you want to be known for. Onboarding includes a conversation with our AI interviewer, and we keep that transcript.
• Contracts: files you upload (PDF or Word), the text we extract from them, and our analysis of them. Contracts often contain other people's information, such as the names and contact details of brand representatives.
• Deals and payments you track: brands, fees, deliverables, dates, payments received and your notes.
• Your activity in the Service: check-ins and reflections, goals, content plans and ideas, media kit settings, and your conversations with our AI coach.
• Agency details if you are an agent: your agency's name and details, and notes and messages you write about or to athletes.
• When you contact us: support requests, sales inquiries, and waitlist sign-ups (name, email and role). With a support request, we keep context such as your name and onboarding conversation in our database. We don't send that context by email: the email that tells our team about your request includes your message, but not your name or your onboarding conversation.

Information from accounts you connect

If you connect Instagram or TikTok, we receive, through our social-data provider Ayrshare and only with the permissions you grant: your username, display name and profile picture; follower counts; your posts, captions, thumbnails and links; per-post performance metrics; aggregated audience demographics (such as age ranges, gender, and top countries and cities of your followers); and when your followers are online. We read this data only to show you analytics and power our recommendations. We never post on your behalf. You can disconnect at any time.

Information from others

• Google and Apple sign-in: if you sign in with Google or Apple, we receive your name, email address and an account identifier. If you choose Apple's Hide My Email, we receive a private relay address instead of your real one.
• Agents and agencies may give us your name and email to invite you, link your account to theirs, and add deals, goals, content plans and notes to your account.
• Stripe, our payment processor, tells us whether a payment or subscription succeeded. We never receive your full card number.

Information collected automatically

• Product analytics: we use PostHog to understand how the Service is used: pages viewed, buttons clicked, device and browser type, and approximate location derived from your IP address. We link this to your account ID, email address and role. PostHog may also record sessions (how you move through pages) to help us fix problems. Recordings hide what you type and the text on your screen, and click data leaves out the text of contracts, deals, conversations, notes and messages.
  • In the European Economic Area, the UK and Switzerland, PostHog doesn't run until you accept analytics. We tell where you are from your IP address's country; if we can't tell, we ask.
  • Elsewhere, it runs unless you turn analytics off under "Your privacy choices" (in the site footer or in Settings), or your browser sends a Global Privacy Control signal.
  • Your choice applies to the browser you make it in. Error reports, below, are separate and aren't affected by it.
• Error reports: we use Sentry to diagnose crashes. Reports include technical details and, for errors on our servers, your account ID. They never include your email address, IP address or username. We strip contract and deal content from these reports. One exception: when a page tries to load something our security policy doesn't allow, your browser sends a report straight to Sentry. It includes the page's address (with any query string), the page you came from, the address of what was blocked, your browser's user agent and your IP address. These reports don't pass through our own filtering.
• Device and log data: your time zone, and the IP address, browser and request details that our hosting providers log when you use the Service.
• Cookies and local storage: see Cookies and similar technologies.

Sensitive information

Some of what you share can be sensitive: the causes you support can reveal political or religious views, you may mention injuries or health matters, and contracts and deals contain financial terms. Sharing this is optional, apart from what a feature needs to work. We use sensitive information only to provide the Service you asked for. We don't use it to infer characteristics about you or for advertising. If you are in the European Economic Area, the UK or Switzerland, see Users outside the United States for how consent applies.

• To provide the Service: create and secure your account, show your analytics, generate brand reports, content ideas, contract analysis, deal valuations and coaching, build media kits you choose to publish, and connect you with agents you link.
• To personalize it: tailor recommendations to your sport, brand, audience and goals.
• For billing: run subscriptions, free trials and sponsored or enterprise plans.
• To communicate with you: service emails such as a welcome email when your account is ready, account confirmations, password resets, subscription confirmations (your plan, price, renewal terms and how to cancel), trial reminders, invoices and replies to your requests. We don't currently send marketing emails. If we start, every one will have an unsubscribe link.
• For safety and security: prevent fraud and abuse, enforce usage limits, and investigate problems.
• To improve the Service: analyze usage, fix bugs and develop features. When many athletes adopt a similar general idea, such as the name of a content theme, we may add it, without your name or other personal details, to the suggestions we offer everyone.
• To comply with the law and protect our rights and the rights of others.

We don't sell your personal information, share it for cross-context behavioral advertising, show you third-party ads, or use your contracts, conversations or other private content to train AI models.

Our AI features send the relevant information to one AI provider, Anthropic (Claude), which processes it for us and returns results. Anthropic generates our analysis, recommendations and conversations. Depending on the feature, we send it your profile and onboarding answers, your onboarding conversation, social posts and metrics, contract text, deal details, check-ins and goals, and your messages to our AI coach. For agents, it receives the same kinds of information about the athletes they ask about. For goal research, it may run web searches on your behalf using details such as a brand's name.

Contract search runs on our own systems: we match your search words against the contract text stored in your account. No outside AI or search service receives your contracts or searches for it. When you ask our AI coach about your contracts, the passages it finds are sent to Anthropic as part of that conversation.

Training and retention

Under the terms that apply to our use of Anthropic's services, Anthropic may not use the information we send to train its AI models. Not training on information is different from not keeping it. Anthropic deletes what we send and what it returns within 30 days, unless it has to keep it longer to enforce its usage policies or to comply with the law. We store the results, such as reports, scores and contract flags, in your account. How long we keep them is in How long we keep your information.

AI scores and analysis

Our AI produces inferences about you, such as your brand archetype and score, contract flags and deal valuations. They are information to help you, and the agents you link to, make your own decisions. We don't use them to make decisions about you that have legal or similarly significant effects, such as whether you can use the Service or what you pay. Agencies you link to can see them and may weigh them in their own decisions. If something we generated about you is wrong, you can ask us to correct it.

AI output can be wrong. The Service does not provide legal, financial or NIL-compliance advice; see our Terms of Service.

• Service providers host our systems and process information for us under contracts that limit their use of it: hosting, database and storage, AI processing, payments, social connections, analytics, error monitoring, email and internal alerts. The current providers are on our subprocessor list. The categories each one receives are in California and other US state privacy rights.
• Agents and agencies you link to can see and add to your account data. See Agents and agencies.
• Your public media kit. If you publish a media kit, anyone with its link can see what it shows. That can include your name, photo, bio, sport and team, brand positioning, values and the causes you support, the goals and sponsor categories you're pursuing, your social handles and statistics, top posts and audience demographics. If you turn it on, it also shows the brands you've partnered with. It never shows your email or phone number. Unlisted kits are hidden from search engines; public kits may be indexed. You can make your kit private again at any time.
• Our team can access account information when needed to provide support, keep the Service secure, and operate it.
• Legal and safety: when the law requires it, or to protect the rights, property or safety of our users, the public or us.
• Business transfers: to a buyer or successor in a merger, acquisition or sale of assets, who must keep honoring this policy.
• With your consent or at your direction.

We don't sell personal information or share it for targeted advertising, and we haven't done so in the past 12 months.

If you accept an agency's invitation, redeem its sponsored invite code, or we link your account at your or your agency's request, that agency's agents can see your account data in the Service:

• your profile, brand score and reports, check-ins and growth analytics;
• your deals and earnings;
• your contracts and their analysis, including clause text;
• your content plans and goals.

They can also add or edit deals, goals and content plans for you, message you, and ask our AI about you.

Who controls what

• Your account information (your profile, contracts, deals, reports, goals and everything else in your account) is yours to control. You can change or delete it, and an agency sees it only while you're linked to that agency.
• Records an agency creates in the Service are the agency's working records. They include its private notes about you, which you can't see, its messages with you, and its AI conversations about you.
• Information an agency holds outside the Service, such as anything an agent copied, downloaded or wrote down elsewhere, is controlled by the agency under its own legal obligations and privacy practices, not by us.
• Records kept under a contract or the law. An agency may have to keep records of its work for you, for example under its agreement with you or under athlete-agent or tax rules. Those obligations are between you and the agency.

When you leave an agency

You can leave an agency at any time in Settings. Its access to your account through the Service ends right away; our database enforces this, not just the app. Leaving doesn't delete:

• the notes, messages and AI conversations about you that the agency created in the Service. They stay with the agency until it deletes them or you delete your account;
• information the agency obtained or kept outside the Service. Deleting your account can't erase it either. Ask the agency about those records.

We use cookies and browser storage for these purposes:

• Essential: keeping you signed in (our authentication provider's session cookies), a signed cookie that routes you to the right part of the app for your plan (tt_sub_status, with a short-lived tt_sub_refresh marker), and a short-lived cookie that carries an invite code through a Google or Apple sign-in (tt_pending_invite). The Service doesn't work without these. Two more cookies remember your analytics choice: tt_consent_region records whether we must ask before analytics, based on your IP address's country, and lasts 24 hours; tt_analytics_consent records your choice and lasts 12 months.
• Analytics: PostHog stores an identifier in ph_… cookies and local storage to measure usage. Its traffic goes through our own domain. In the EEA, the UK and Switzerland, they're set only after you accept analytics. Turning analytics off deletes them.
• Preferences and progress: local and session storage remember things like panel sizes, dismissed tips, your place in onboarding or a tour, and your time zone check.

We don't use advertising cookies or third-party ad trackers. When you view posts or media kits, images load directly from Instagram's and TikTok's servers, which can see your IP address. You can block or delete cookies in your browser; blocking essential cookies will sign you out. You can turn analytics on or off at any time under "Your privacy choices", in the site footer or in Settings. We treat a Global Privacy Control signal as a request to turn analytics off on that browser. We don't respond to "Do Not Track" signals.

We keep personal information while your account is open, or as long as we need it to provide the Service. When you delete your account, we delete or de-identify your information in our active systems, with the exceptions below. Some copies stay for a limited time in backups and with our service providers under their retention schedules. Some records are kept longer where the law requires or allows it.

You can delete your account at any time in Settings → Delete account, or on your account page, which works even if your plan has lapsed. Deletion:

• cancels any personal subscription;
• disconnects your social accounts and deletes the social data we collected;
• deletes your uploaded files and onboarding archive;
• deletes your profile, contracts, deals, reports, conversations and other account data, including agents' notes and AI conversations about you;
• deletes your login.

It can't be undone. We delete or de-identify your information in our active systems right away. Copies in backups and with our providers are deleted on the schedules in How long we keep your information, which also lists the records we keep longer. Deleting your account can't erase information an agency obtained or kept outside the Service (see Agents and agencies). Enterprise accounts managed under an agency contract are closed through support: email team@support.triplethreat.co.

Depending on where you live, you can ask us to:

• tell you what personal information we hold about you and give you a copy of it;
• correct information that is wrong;
• delete your information;
• send your information to you in a portable format;
• stop or limit how we use your information (the rights to object and to restrict processing), for example while we look into a correction you asked for;
• not make decisions about you based solely on automated processing that have legal or similarly significant effects. We don't make such decisions (see How our AI features use your information);
• withdraw consent you gave, without affecting earlier processing.

You can do much of this yourself:

• edit your profile;
• download a copy of your data (JSON, with your contract files) from Settings or your account page;
• disconnect social accounts;
• leave an agency;
• make your media kit private;
• turn analytics on or off ("Your privacy choices" in the site footer, or in Settings);
• delete your account.

For anything else, email team@support.triplethreat.co from the address on your account.

Your data download. We build it when you ask for it and don't keep a copy. Files that don't fit in it come as links that expire after 24 hours. It doesn't include records an agency created about you, such as its private notes and its AI conversations about you; email us to ask about those.

How requests work.

• Verification: we verify requests by confirming control of the account's email address.
• Authorized agents: you can use one to make a request for you, with your signed permission.
• Parents and guardians of a user under 18 can make these requests for them. We'll ask for reasonable proof of the relationship.
• Timing: we respond within 45 days, or sooner where the law requires.
• Appeals: if we decline your request, we'll explain why, and you can appeal by replying to our decision. If your appeal is denied, you can contact your state attorney general.
• No penalty: we won't treat you differently for exercising your rights.

Residents of California and of other states with comprehensive privacy laws have the rights above. For California residents, here is what we have collected in the past 12 months, using the categories in California law:

• Identifiers: name, email, phone number, account and device identifiers, IP address, social media usernames.
• Customer records: contact details and the financial terms in contracts and deals you add. Card details are held by Stripe, not us.
• Commercial information: subscriptions, and deals and partnerships you track.
• Internet or other electronic network activity: how you use the Service, and your social media activity and performance.
• Geolocation: approximate location only, derived from your IP address and time zone. Never precise location.
• Audio, electronic or visual information: profile photos and post thumbnails.
• Professional information: sport, team, league and career details; agency details for agents.
• Inferences: brand archetype, positioning, scores and recommendations we generate.
• Sensitive personal information: account login credentials, and information you choose to share that may reveal political or religious views or health matters. We use it only to provide the Service and not to infer characteristics about you, so the right to limit its use doesn't apply.

Where it comes from: the sources described in Information we collect.

Why we use it: the purposes in How we use your information.

How long we keep it: see How long we keep your information.

Who receives it. We disclose each category for business purposes to the recipients below. All of them are service providers on our subprocessor list, except agencies you link to and the public, who receive information at your direction.

No sale or sharing: we don't sell or share personal information, including that of consumers under 16.

Global Privacy Control: we honor a Global Privacy Control signal as a request to turn analytics off on that browser. You can also turn analytics off at any time under "Your privacy choices".

Shine the Light: we don't disclose personal information to third parties for their own direct marketing.

Users under 18 in California can remove content they posted on the Service by deleting it or emailing team@support.triplethreat.co. Removal may not delete copies others have made.

The Service is run from the United States, and your information is stored and processed there and in other countries where our providers operate. If you are in the European Economic Area, the UK or Switzerland, these are the legal bases for each purpose:

You have the rights in Your rights and choices, including the right to object to processing based on legitimate interests and the right to restrict processing. Where we rely on your consent, you can withdraw it at any time, for example by turning analytics off under "Your privacy choices", removing the information from your profile, or asking us to delete it.

International transfers. When you use the Service from outside the United States, you send your information to us there. Where personal information is transferred from the EEA, the UK or Switzerland to a country without an adequacy decision, the transfer relies on the European Commission's Standard Contractual Clauses (with the UK and Swiss addenda), or on the recipient's certification under the EU-US Data Privacy Framework and its UK and Swiss extensions. For more about these safeguards, email team@support.triplethreat.co. You can also lodge a complaint with your local data protection authority.

The Service isn't meant for anyone under 16, and we don't knowingly collect personal information from children under 13. If you believe someone under 16 has an account, email team@support.triplethreat.co and we'll delete it.

Users aged 16 and 17:

• Parental agreement. When you sign up, you confirm that you're 16 or older and, if you're under 18, that a parent or guardian has agreed to our Terms of Service. We don't currently verify ages or collect a parent's details.
• Media kits. A public media kit can show your name, photo, sport and team, the causes you support and the sponsors you want. If you're under 18, we recommend keeping your kit unlisted unless your parent or guardian agrees to make it public.
• Agencies. An agency that represents an athlete under 18 is responsible for having a parent or guardian's permission under the laws that apply to it.
• AI features work the same way for users under 18. We never sell their information or use it for advertising.
• Parents and guardians can ask to review, correct or delete their child's information by emailing team@support.triplethreat.co. We'll ask for reasonable proof of the relationship.

We use safeguards appropriate to the sensitivity of the information:

• encrypted connections (HTTPS);
• encryption at rest from our hosting providers;
• database access rules that limit each account to its own data;
• signed cookies, and private file storage with short-lived download links;
• rate limits. For features you can use without signing in, such as joining the waitlist, they count requests by IP address, which we hold briefly in memory and don't save;
• restricted internal access.

No method of transmission or storage is completely secure. If a breach affects your personal information, we'll notify you and the authorities as the law requires.

Instagram, TikTok, Google, Apple, Stripe and other services you use with Triple Threat have their own privacy policies, which govern what they do with your information. Our use of information received from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements.

We'll update this policy as the Service changes. Each version shows its effective date at the top, and earlier versions stay available. If we make a material change, we'll tell you by email or in the Service before it takes effect.

Triple Threat Ventures, Inc.. For privacy questions and requests, email team@support.triplethreat.co.