Privacy Policy

When you create an account, we collect your username, first and last name, email address, date of birth, instrument, and the name of your institution. Your password is stored in encrypted (hashed) form by our authentication provider; we never see or store it in readable form.

For teachers (“Maestros”), we also process subscription and payment information through our payment processor. We do not store your full payment card number on our servers; card data is collected and stored directly by Stripe. If you choose to save a card for future billing, that card is stored by Stripe, not by us.

As you use UML, we store the content you create: league and team information, performance match records, the scores and written feedback that judges submit, and any profile details you add such as hometown, walkout music, a favorite quote, or a profile photo you upload.

A teacher invites a student to a league by entering the student’s email address. At that point, we store only the email address and the invitation itself — no student account, name, or age yet exists.

The student then receives an invitation email and creates their own account. Every student individually accepts these Terms and this Privacy Policy and provides their own date of birth during their own signup. A teacher’s acceptance of our terms does not bind any student; each account holder agrees on their own behalf.

UML is not intended for children under 13. We require every account holder to confirm they are at least 13 years old and to provide a date of birth, and we block account creation for anyone under 13. If we learn that we have collected information from someone under 13, we will delete it.

We use limited, privacy-conscious analytics to understand basic product usage, such as when an account is created. We have deliberately disabled automatic capture of clicks, form inputs, and page activity. We do not collect, transmit, or analyze the contents of judging forms — the scores or written feedback students submit are never sent to any analytics service. Anonymous visitors are not profiled. Our error-monitoring tool does not record session replays.

We rely on a small set of trusted third-party services to operate UML. Each receives only the data needed for its function:

• Supabase — database, authentication, and file storage; stores account, league, performance, and uploaded image data
• Stripe — payment and subscription processing for teachers
• Resend — sending transactional email (verification, password reset, league invitations)
• Vercel — application hosting and infrastructure
• PostHog — limited product analytics, as described above
• Sentry — error and performance monitoring

The guided demo tour loads one background image from Unsplash, and demonstration accounts use placeholder avatars from a third-party avatar service; when these images load, those providers may receive your IP address. These affect the public demo only.

To request access to, correction of, or deletion of your personal data, email us at privacy@ultimatemusiciansleague.com. We currently process these requests manually and will respond within a reasonable time. (We expect to add self-service data management tools in the future.)

We do not sell your personal information, and we do not share it with third parties for their own marketing.

Questions about this policy: privacy@ultimatemusiciansleague.com.