Trust, Security & Privacy

Bullseye Sports Recruiting is built on managed cloud infrastructure. The hosting platform operates physical security, network protection, and database isolation. Bullseye is responsible for application logic, access policies, and how data is collected, stored, and displayed. You — as an athlete, coach, parent, or admin — are responsible for keeping your account credentials private and only sharing recruiting information you are comfortable making visible to verified coaches.

Accounts use email and password or Google sign-in. Passwords are never stored in plain text by Bullseye. Sessions are issued and validated by our managed auth provider and are scoped to a single user. Athlete, coach, and admin features are gated by server-side role checks so that a signed-in user cannot access another role's tools by guessing URLs.

Athlete profiles, questionnaires, stats files, and IQ test answers are stored in our database with row-level security. By default, an athlete can only read and modify their own records. College coaches can browse athlete profiles for recruiting purposes; private contact details (parent contact, phone numbers) and verification metadata are restricted to the athlete and platform administrators.

Premium-only insights — such as the full matched-schools list and Target Score breakdown — are enforced server-side, not just hidden in the UI.

Stats uploads, highlight videos, and IQ test film clips are stored in private storage buckets. Direct public links are not issued; the app generates short-lived signed URLs scoped to the viewer. Uploaded files are scanned for malware before being made available.

Paid subscriptions are processed by Paddle, our merchant of record. Bullseye does not see or store full payment card numbers. Subscription status is reconciled from Paddle webhooks whose signatures we verify server-side.

Bullseye relies on a small set of trusted providers to operate the service: our managed cloud database and auth provider, Paddle for payments, and our transactional email provider for account and coach-to-athlete messages. We use these providers only for the features described on this page.

We keep your data while your account is active. If you'd like your account and associated recruiting data deleted, email us at the address below and we will process the request. Some records may be retained for a limited time afterward to satisfy legal, accounting, or anti-abuse requirements.

Bullseye sends only transactional emails tied to your activity — account events, coach messages, and notifications you've opted into. Every email includes a one-click unsubscribe link for non-essential notifications. We do not sell email addresses or run marketing campaigns from this platform.

If you believe you've found a security vulnerability or have a privacy question, please contact our team directly so we can investigate. Include steps to reproduce and avoid testing against other users' data.

Contact: security@bullseyesportsrecruiting.com