Privacy Policy

Rookie Anthems is operated by Rookie Anthems LLC, a Virginia limited liability company (“Rookie Anthems,” “we,” “us”). This policy explains what information we collect, how we use it, and the choices you have. We built this product for kids 6–14, so we collect as little personal information as possible — and only through their parent or guardian.

Rookie Anthems is currently offered only to residents of the United States. This policy is written under U.S. law (including COPPA and applicable state privacy laws such as the California Consumer Privacy Act and the Virginia Consumer Data Protection Act) and does not address rights granted by laws outside the United States such as the EU General Data Protection Regulation. We do not knowingly accept purchases from outside the United States.

1. The information we collect

From you (the buyer)

• Payment information. Processed by Stripe. We do not see or store your card number, CVC, or expiration date — only the last 4 digits and a confirmation that payment cleared.
• Email address. Provided to Stripe at checkout for your receipt. We retain the email associated with each order so we can send you a download link and respond to support requests.
• Account & sign-in. You can create an account to access your anthem library by entering your email and clicking a one-time sign-in link we send you (a “magic link” — no password). We store your email and use it to show you the purchases and saved anthems associated with that email. You may optionally enable two-factor authentication. There is no separate profile beyond your email and the orders linked to it.
• Server logs. Standard request data from our host (Vercel): IP address, browser, referrer, time of request. Used for security and debugging.
• Messages and feedback you send us. If you use our contact form or reply to a survey, we keep what you send — your email, any name you include, and the contents of your message or survey response — so we can help you and improve the product.

About your child (the rookie)

We deliberately collect the minimum data required to write a song. You provide it; we never solicit it from the child directly.

• First name (we ask you not to provide a last name)
• Optional phonetic pronunciation
• Optional jersey number
• Activity (sport, art, or other)
• Optional team name
• Gender (used only to choose appropriate pronouns in lyrics)
• Optional personality details: nickname, favorite athlete or hero, and up to five short personality tags
• Musical preferences: genre, sub-style, vocal arrangement, tempo, language, and an audience-age band (used to set the song’s tone)

We do not ask for last names, dates of birth, addresses, school names, photographs, voice recordings, or anything else that could identify the child to a stranger.

From Team Earnings organizers (coaches and clubs)

If you set up a Team Earnings page for a team, we additionally collect, from you (an adult organizer):

• Your name and email address
• Team details you choose to display: team/club name, tagline, logo, goal, and optional end date
• A mailing address you provide so we can send the team’s earnings by check
• Payout records (amounts and dates of payments we’ve sent), and — where tax law requires it — tax information such as a Form W-9 before we issue payments above reporting thresholds
• Aggregate page statistics for your team page (visit count and order count — see “Team page view counting” in §6)

2. How we use this information

• To generate the lyrics, music, and (optionally) album cover for your purchase.
• To deliver the finished files to you via a secure download link.
• To process your payment and send a receipt.
• To respond to support requests and investigate failed generations.
• To improve product quality through aggregate, de-identified review (e.g., the most-popular genre this month). We do not use your individual song or your child’s details for marketing examples without your prior written consent.

We do not sell your information, ever. We do not show advertising on this site, and we do not allow third parties to track you here.

3. The third parties that help us deliver the song

To create and deliver your purchase, we share narrowly scoped data with the following service providers. Each is bound by their own privacy commitments and our contracts limit how they may use the data we send.

• MiniMax (Nanonoble Pte. Ltd., Singapore) — generates the lyrics and audio. Receives the kid’s first name, activity, jersey number, team name, personality tags, and musical preferences as part of the generation prompt. Does not receive your email or payment data. We access MiniMax through its commercial API. Under their Open Platform terms, MiniMax may use submitted prompts and generated content to maintain, develop, and improve their service; no opt-out tier is available. MiniMax states in their API Privacy Policy that input personal data is not used to train models for profiling or targeting consumers. See MiniMax’s own Terms of Service and Privacy Policy at minimax.io for their full handling.
• OpenAI — generates album cover art (when this feature is enabled). Receives a text prompt that may reference the kid’s first name and activity. Does not receive your email or payment data. We access OpenAI through its commercial API tier; OpenAI’s commercial API terms do not use API inputs or outputs to train their models by default.
• Stripe — processes payments. Receives your name, email, and payment method. Stripe is PCI-DSS Level 1 certified.
• Resend — delivers transactional email (your receipt, the “your anthem is ready” email, and replies to support inquiries). Receives your email address, your name (when you provide one), and the contents of the message we send. Does not receive payment data or your child’s metadata.
• Vercel — hosts the website. Receives standard request logs (IP, browser, etc.). We also use Vercel Web Analytics and Speed Insights to measure aggregate page traffic and page-load performance. These are cookieless: they record page views, referrers, device/browser type, and performance timings, and Vercel discards visitor IPs after deriving an anonymous daily identifier. We do not use them to identify you or to advertise.
• Cloudflare — R2 stores the generated audio (until it expires), your chosen album cover (retained — see §4), and any team logo an organizer uploads. Cloudflare’s Email Routing also forwards email sent to our support address to our support inbox (hosted by Google/Gmail) — so if you email us, the message contents pass through Cloudflare and are stored in that inbox.
• Supabase — stores order records, redemption codes, and the song metadata we need for support and regeneration.
• Upstash — provides the rate-limiting and abuse- prevention layer. Receives your IP address to enforce request limits. Does not receive your child’s details or payment data.
• Sentry — error monitoring. Receives diagnostic data when something goes wrong (e.g., error messages, the URL, and a signed-in user’s ID). We disable Sentry’s default collection of personal data, so it does not receive your child’s details or payment data.

4. How long we keep things

• Audio files: stored in Cloudflare R2 for 7 days after generation. After day 7 the share page closes; we keep a 3-day admin grace window during which we can restore the audio on request. After that (typically day 10), the audio is permanently deleted. Please save your files to your own device while the window is open.
• Your chosen album cover: we retain the final album cover you select indefinitely, so we can reach back out to you later about your anthem (for example, to offer a new song for the next season). The cover candidates you did not pick are deleted on the same day-10 schedule as the audio. We never use your cover in public advertising without your explicit consent (see the “feature” consent below), and we delete the retained cover whenever you request deletion of your data.
• Featured anthems: if you have given us consent to feature your anthem, we retain that take and its album cover for as long as it is displayed on our site, our social media, or our marketing, and we stop using it when it is no longer featured or when you withdraw consent.
• Lyrics and song metadata: retained indefinitely so we can manually regenerate audio for you if a file is lost.
• Order records: retained for at least 7 years to comply with US tax and accounting requirements.
• Server logs: retained per Vercel’s default (typically 30 days).
• Contact messages and survey responses: retained so we can follow up and improve the product. We delete them when you delete your account, or sooner on request.

5. Children’s privacy & COPPA

The U.S. Children’s Online Privacy Protection Act (COPPA) applies to operators of online services that knowingly collect personal information directly from children under 13. Our service is not directed at children, is purchased only by adults, and information about a child is provided by the parent or guardian. Although we do not believe COPPA applies to our service in the traditional sense, we voluntarily follow its data-minimization principles and the protective spirit of state laws addressing children’s data, including the California Age-Appropriate Design Code, the Maryland Kids Code, and Connecticut’s children’s privacy law.

• You must be 18 or older to purchase from Rookie Anthems. The site is not directed at children, and children do not interact with it directly.
• You provide consent on the child’s behalf. By completing a purchase as the child’s parent or legal guardian, you consent to our limited collection of the kid metadata described in section 1. Before we build the anthem, we also ask you to confirm directly in the app that you are the parent or guardian (or have their permission) and that you consent to sharing those details with the providers in section 3 — and we record when you do.
• We minimize what we collect. We do not request a last name, address, school, photograph, or any contact information for the child.
• We never market to children. All marketing emails and promotions, if any, are directed at the buyer.
• You can request deletion at any time. Send us a message with your order code and we will delete the kid’s metadata and lyrics from our records (subject to legitimate retention requirements such as tax records).

6. Cookies

We use a small number of strictly functional cookies. We do not use third-party advertising cookies, cross-site tracking, or analytics that profile individuals — our traffic analytics are aggregate and cookieless (see Vercel in §3).

• A returning-buyer cookie that recognizes when you come back to the site so we can show a banner with a link to your downloads. The cookie expires within 7 days, matching the download/share window.
• Sign-in / session cookies. When you sign in with a magic link to access your library, we set secure session cookies (via our authentication provider, Supabase) so you stay logged in. A short-lived cookie is also set during checkout to link your browser to your in-progress purchase.
• Vercel may set basic functional cookies for security and load balancing.
• Stripe sets cookies on its own checkout pages for fraud prevention. Stripe is responsible for the cookies it sets; see Stripe’s privacy policy.
• Team page view counting. When you visit a team’s Team Earnings page, we count the visit once per browser session using a flag stored in your browser’s sessionStorage (cleared when you close the tab). This increments an aggregate visit counter shown to that team’s organizer — no identifier about you is stored with it, and it is not used for tracking across pages or sites.

7. Your rights and choices

Depending on the state you live in, you may have the right to access, correct, delete, or receive a portable copy of the personal information we hold about you, and to opt out of certain processing. To exercise any of these rights, send us a message with your order code. We will respond within the timeframe required by your state’s law (45 days for California and Virginia residents, with one extension of up to 45 additional days where reasonably necessary), and at most 30 days for any other request.

If you have an account, you can also delete it yourself from your account settings. Deleting your account erases your sign-in identity, your stored email, your order and contact history, and any generated files we still hold. This is immediate and permanent — order records we are legally required to retain for tax/accounting are the only exception.

We do not discriminate against customers who exercise their privacy rights — your service, pricing, and quality remain the same.

Categories of personal information we collect (CCPA / VCDPA)

For California and Virginia residents in particular, the following categorical disclosure is provided. The categories listed track the California Consumer Privacy Act and the Virginia Consumer Data Protection Act.

• Identifiers (e.g., email address, IP address, order code). Source: directly from you and from your browser. Used for: order processing, support, security, and transactional email. Shared with: Stripe, Resend, Vercel, Supabase, Upstash (IP, for rate-limiting), Sentry (diagnostics).
• Customer records information (e.g., name, payment method last 4; for Team Earnings organizers, the mailing address you provide for payout checks). Source: from you, and via Stripe for payment details. Used for: order processing, fraud prevention, and mailing team payouts. Shared with: Stripe, Supabase.
• Commercial information (e.g., purchase history, redemption code). Source: from you. Used for: order fulfillment and support. Shared with: Stripe, Supabase.
• Internet or other electronic activity (e.g., server logs, pages visited). Source: from your browser. Used for: security and debugging. Shared with: Vercel, Upstash (rate-limiting), Sentry (error diagnostics).
• Geolocation data (general region inferred from IP). Source: from your browser. Used for: security and U.S. eligibility verification. Shared with: Vercel, Upstash.
• Information about your child (first name, activity, etc., as listed in section 1). Source: from you. Used for: generating the song you purchased. Shared with: MiniMax, OpenAI (when album art is enabled), Supabase.

We do not sell or share personal information for cross-context behavioral advertising, and we do not engage in profiling that produces legal or similarly significant effects on you. We do not use sensitive personal information for purposes that would trigger a right to limit under the CCPA.

California residents may also designate an authorized agent to make a request on their behalf; we may require reasonable verification before fulfilling such a request. If we deny your request, you may appeal by replying to our response, and we will reconsider within the timeframe required by your state’s law.

8. Security

We use industry-standard practices to protect your information, including TLS encryption in transit, encrypted storage at rest with our infrastructure providers, and access controls on the systems where order data lives. No method of transmission over the internet is 100% secure, but we work to keep your data safe.

9. Changes to this policy

We may update this policy as the product evolves. The “Last updated” date at the top of this page reflects the most recent revision. Material changes that affect your rights will be communicated via the email associated with your most recent order at least 14 days before they take effect.

10. Contact us

Questions, concerns, or deletion requests:

• Send us a message via the contact form.
• Mailing address: Rookie Anthems LLC, 8401 Mayland Dr Ste A, Richmond, VA 23294