Privacy policy

Short version: we collect as little as the site needs, we never sell it, and every service that touches your data is named below. Last updated 2026-08-17.

Who we are

WrestlingColleges.com is an independent publication run by an individual publisher in Tennessee, United States. It is not affiliated with the NCAA, any conference, or any institution. Contact for anything in this policy: privacy@wrestlingcolleges.com.

What we collect, and why

When you…	We collect	Processed by	Why
Browse the site	Page views, approximate region, device/browser type. IP addresses are truncated (`anonymize_ip`) and not stored by us.	Google Analytics 4 (Google LLC); Firebase Hosting serves the pages and keeps standard request logs.	To see which pages and programs people use so we can prioritise verification and guides.
Subscribe to the newsletter	Email address; the page you subscribed from (a "tag" such as program or guide); open/click statistics from the emails.	Buttondown (Buttondown, LLC).	To send the monthly recruiting-changes email and the free PDF you asked for. Double opt-in; unsubscribe link in every email.
Create an account / sign in	Email address, sign-in timestamps.	Firebase Authentication and Cloud Firestore (Google LLC).	To know who holds a Recruit Pass. No password is stored — sign-in is a one-time email link.
Buy a workbook or Recruit Pass	Name, email, billing details, and card information — entered on Stripe's pages, never on ours. We receive the subscription status, price, and a Stripe customer ID.	Stripe, Inc. (payment processor); Cloud Firestore stores the subscription status next to your account.	To deliver what you bought, unlock premium content, and handle refunds.
Send a correction or claim a page	What you type into the correction form. The report (program, what's wrong, source link, message) becomes an issue in our GitHub repository; your name, email and role — and, if you are claiming a page and choose to answer it, your reply to the optional question about paid camp promotion — are stored separately in our access-controlled database (Cloud Firestore) under a reference id; they never appear in the issue or on the site. We also record which link brought you to the form (a campaign token such as `outreach`), which says nothing about you personally. To limit abuse we also count submissions per client for the current clock hour under a salted hash of the IP address; those counters carry an expiry and are deleted automatically by Firestore's TTL policy after the hour ends (deletion typically completes within 24 hours).	Cloud Functions and Cloud Firestore (Google LLC); GitHub, Inc. for the report text; reCAPTCHA Enterprise / Firebase App Check (Google LLC) checks that the submission comes from a browser on this site — invisible, no puzzle; it sets its own cookie and receives your IP and browser signals under Google's privacy policy.	To fix the data and reply to you.
Email us	Your email and message.	Gmail (Google LLC).	To answer you.

We do not sell personal information, run advertising networks, or share your details with schools or coaches. Aggregate statistics ("1,200 families viewed D3 Iowa pages in May") may appear in our newsletter or posts.

Cookies and local storage

Google Analytics sets its _ga cookies to distinguish sessions. Analytics is configured with IP anonymisation and Google Signals off.
Firebase Authentication uses IndexedDB/local storage to keep you signed in; we also store the email you typed while a sign-in link is pending. Signing out clears it.
Stripe sets its own cookies on Stripe-hosted checkout and portal pages, governed by Stripe's privacy policy.
reCAPTCHA Enterprise sets a cookie on the corrections page only, to tell browsers from bots.
No advertising or cross-site tracking cookies.

Information about coaches and programs

The directory lists names, titles, and official contact details of coaching staff exactly as published on each institution's athletics website, together with roster counts and results from official and federal sources. We never construct or infer contact details. If you are a coach or staff member and something about you is wrong or out of date, use the correction form or email us; we answer within 7 days and update the page. You can also claim your program's page, which records only that a verified member of the program claimed it — the claim date, the role you gave, and how we verified you — and never publishes your contact details. If a school removes a contact from its official page, we remove it at the next verification pass or immediately on request.

Children

Many readers are high-school families. The site can be read by anyone, but accounts, purchases and the newsletter are for adults (18+, or a parent/guardian acting for a student). We do not knowingly collect personal information from children under 13; if you believe a child has created an account, email us and we will delete it.

Retention

Analytics: Google Analytics event data is retained for 14 months, then aggregated.
Newsletter: until you unsubscribe (Buttondown then keeps a suppression record so we don't re-add you).
Account and subscription records: while your account exists; deleted within 30 days of a deletion request. Stripe keeps transaction records as required by financial regulation.
Correction/claim reports: the issue (no contact details) is kept as part of the data audit trail; the separate contact record is deleted on request or once the report is closed and any follow-up is done.
Rate-limit counters: expire at the end of the clock hour; Firestore's TTL deletes them automatically (typically within 24 hours of expiry). The hash is salted with the hour, so counters from different hours can't be linked.

Your choices and rights

Access, correct, delete: email privacy@wrestlingcolleges.com from the address on the account. We'll confirm within 7 days and complete within 30.
Unsubscribe: the link at the bottom of any newsletter.
Cancel a subscription: your account → manage subscription (Stripe customer portal).
Analytics opt-out: Google's browser add-on, or block googletagmanager.com; the site works without it.
Residents of the EU/UK, California and other jurisdictions with privacy laws have the rights those laws provide (access, deletion, portability, objection, non-discrimination). We honour them for everyone regardless of location. We do not "sell" or "share" personal information as those terms are defined in the CCPA/CPRA.

Security

Pages are served over HTTPS. Payments never touch our servers. Access to the account database is limited to the publisher and to server code that checks entitlements. Secrets (Stripe, GitHub) live in Google Secret Manager.

Changes to this policy

We'll update the date at the top and, for material changes, say so in the newsletter.