Privacy

Effective date: October 22, 2026.

This page explains, in plain language, what information REFocus uses and why. REFocus is run by [Business legal name], Apache Junction, Arizona. Questions: help@refocus.football.

The short version

• You don't create an account. You sign in with an access code from your association.
• We don't count visits and don't use analytics, advertising or tracking tools. We don't sell or rent personal information.
• The only personal details we receive on purpose are what you type into the "Request a pilot" form.

What stays in your browser

The app saves a few settings in your browser's local storage. It does not save where you were: every visit starts fresh at the main menu. They stay on your device and are not sent to us. You can clear them any time by clearing this site's data in your browser.

• Whether you finished or skipped the welcome screens, and the mechanics level, crew and position you chose there.
• Which weeks of the study path you ticked off.
• Your drill score history (see below).
• Whether the play list and the on-field key are shown or hidden.
• Whether you have already seen the one-time "Help is here anytime" hint.
• An older first-visit marker that some browsers may still hold.

Your drill scores (one entry per question: crew, position, play, stage, how many you got right and wrong, the total asked, and the score, with the time) are saved in this browser so you can see your progress under Menu → Score history. They stay on this device only and are never sent to us or anyone else. You can delete them any time with Clear history in that view, or by clearing this site's data in your browser. Up to the last 500 scores are kept.

Your access code and the sign-in cookie

When you sign in, your access code is sent over HTTPS and checked against our list. We store access codes only as one-way hashes, along with the access level and a label for the association. After a successful sign-in, REFocus sets one cookie, fr_access. It is HttpOnly (page scripts cannot read it), Secure (sent only over HTTPS) and SameSite=Lax. It holds the sign-in time, an expiry time and a short signed tag for the code it was issued for, not the code itself or anything about you. It ends when you close your browser, and is removed sooner when you sign out. Even if your browser keeps it open longer, we stop accepting it 12 hours after you signed in, so you enter your code again on each visit. This cookie is needed for sign-in; we use no other cookies.

Sign-in attempt limits

To stop people guessing access codes, REFocus counts recent sign-in attempts from each connection. Each count is filed under a one-way keyed hash of the connection's IP address, never the IP address itself. A record holds only the number of attempts and the times of the first and latest attempt and of any lockout. These records are kept in our host's storage. [Retention period for attempt records].

Pilot requests

If you send the "Request a pilot" form, the name, association, state, approximate roster size and email you enter are submitted to Netlify Forms, our host's form service, and forwarded to our email so we can reply. We use them only to respond to your request and follow up about REFocus for your association. We keep them until we no longer need them for that, or until you ask us to delete them.

Our host

REFocus is hosted by Netlify, Inc. Like any website host, Netlify processes technical information to deliver the site and keep it secure, such as your IP address, browser type, the pages requested and the time of the request, and may keep it in short-term server logs. Our sign-in code also writes brief error and lockout log lines that contain no access codes, IP addresses or secrets. Netlify's handling of this information is described in Netlify's privacy policy.

Email with us

If you email help@refocus.football, we receive your email address and whatever you write, through our email provider, and use it to reply.

Sharing

We don't sell, rent or trade personal information, and we don't share it for advertising. We share it only with the service providers that run REFocus (our host, our email provider and our visit-count service), when the law requires it, or to protect REFocus and its users. If the business is reorganized or sold, information may transfer with it under this policy.

Keeping and deleting information

We keep information only as long as we need it for the purposes above. To ask what we have about you, or to have it corrected or deleted, email help@refocus.football from the address you used. We will respond within a reasonable time, usually 30 days.

Security

The site is served only over HTTPS, codes are stored as hashes, and IP addresses are never stored in plain form. No system is perfectly secure, but we work to protect what we hold.

Children

REFocus is for people 18 and older, as our Terms require, and is not directed at anyone under 18. We do not knowingly collect personal information from anyone under 18. If you believe someone under 18 has sent us information, email us and we will delete it.

Changes

If we change how REFocus handles information, we will update this page and its effective date.