Privacy Policy

What we collect

Everyone: email address, date of birth (to enforce age minimums — fans must be 13+, athletes 18+), a display name, and the requests, purchases, and collection entries you create. Fans’ full names are never shown publicly — display names only.

Athletes: identity verification is performed by Stripe as part of payment onboarding. Your government ID and verification documents go to Stripe, not to us — we receive and store only the verified legal name and confirmation that verification passed, along with the public roster information and social-account handle used to verify who you are.

Payments: handled entirely by Stripe. We never see or store card numbers. When you make a request, your card is authorized; you are charged only when your item is delivered.

Media: athlete videos are processed and streamed by Mux; voice memos are stored with our database provider (Supabase). Signatures are stored as stroke data with a cryptographic authenticity record.

Notifications: if you enable push notifications we store a device push token to deliver them. We also send transactional email (request updates, receipts).

Text messages (SMS)

We text athletes only, and only transactional messages: a one-time message with the private link to claim a profile that the athlete’s sports agency or the Warmups team set up for them, using the mobile number the athlete gave that agency or us, and only after the person entering it confirms the athlete agreed to receive the text (we record who confirmed it and when). There are no marketing or recurring texts. Message and data rates may apply. Reply STOP to opt out at any time (we record the opt-out and never text that number again unless you reply START); reply HELP for help, or write to hello@getwarmups.com. Texts are delivered by Twilio.

We do not sell or share your SMS opt-in data or personal information with third parties for marketing purposes. No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Text-messaging opt-in data and consent are never shared with any third party, except the carrier and messaging provider needed to deliver the message.

What we don’t do

No advertising, no ad tracking, no sale of personal data, no data brokers. We don’t host or copy third-party game footage; if you attach a YouTube link to an item in your collection, it plays from YouTube through their embedded player (YouTube’s privacy terms apply to that playback), it is visible only to you, and we store only the link.

Sharing you control

Items in your collection are private by default. Public pages exist only when you create them: a certificate page for an item’s authenticity record, and a share page if you choose to share an item. Share pages never expose your identity — only the athlete’s.

Service providers

Stripe (payments & identity verification), Supabase (database, authentication, storage), Mux (video), Expo (push notification delivery), Resend (transactional email), Twilio (text messages). Each receives only what it needs to do its job.

Your choices

You can disable push notifications in system settings at any time. You can delete your account yourself from the app or from your account page on the web (30-day grace period, cancel any time inside it) — see how account deletion works — or contact hello@getwarmups.com. Some records (completed transactions, NIL compliance disclosures, authenticity records for items other people own) are retained where the law or the integrity of delivered items requires it.