Privacy Policy

Directly from you, when you use the service:

• Account info: name, email address, and a bcrypt-hashed password (we never store your password in plain text).
• Athlete profile data: sport, school, division, conference, position, class year, the performance stats you enter, and the follower/engagement numbers you self-report for Instagram, TikTok, and X.
• Brand account info: company name, industry, and description, if you sign up as a brand.
• Content you post: feed posts, comments, likes, saves, messages, and campaign applications.

Product analytics: we use PostHog to understand which pages and features people actually use, so we know what to fix or build next. PostHog records page views and general interactions (like clicks), basic device/browser info, and an approximate location (city/region, derived from IP address, never exact) — it does not read what you type into forms, and we've explicitly turned off session recording. Events are tied to an anonymous device ID, not your name or email, unless you're logged in. We don't use any ad networks or ad-tracking pixels.

The only cookie the site itself sets is a single first-party, signed session cookie (nil_session) used to keep you logged in — no third party can read it. PostHog's analytics cookie is third-party and only loads if you accept it in the cookie banner on your first visit — see our Cookie Policy for the full list.

• To calculate your NIL Rating and estimated NIL value.
• To operate the public leaderboard, school pages, and feed — only for profiles and posts you've opted to make public.
• To power the marketplace and Discover matching between athletes and brands.
• To authenticate you and keep your account secure.

Every profile defaults to private. Your data only appears on the public leaderboard, school pages, or feed if you explicitly check the "list me on the public leaderboard" box (or, for brands, set your profile to public). You can change this at any time by resubmitting your profile.

We don't sell your personal information. We share it only:

• With other users, to the extent your profile or content is public (that's the point of the leaderboard and feed).
• With our infrastructure and service providers (hosting, database, and PostHog for analytics) who process data on our behalf, under obligations to keep it secure.
• If required by law, subpoena, or legal process.

We retain your data as long as your account is active. There's no self-serve account deletion yet — email support@breakoutnil.com to request deletion of your account and associated data, and we'll process it.

Passwords are hashed with bcrypt, never stored or logged in plain text. Traffic to the site is encrypted (HTTPS). No method of storage or transmission is 100% secure, but we take reasonable steps to protect your information.

Breakout NIL is not directed at, and we don't knowingly collect information from, anyone under 18. If you believe a minor has created an account, contact us and we'll remove it.

We may update this policy from time to time. If we make material changes, we'll update the "Last updated" date above.

Questions about this policy or your data? Email support@breakoutnil.com.