Privacy Policy
NTScore ("NTScore," "we," or "us") builds tools that help college athletes measure and share their on-platform reliability — and that help local businesses find athletes to work with. This policy describes what personal data we collect, how we use it, who we share it with, and what choices you have. We have written it to match what the product actually does today, not what it may do later.
Who we are
NTScore is operated by NTScore, based in Hartford, Connecticut, USA. For any privacy question or to exercise the rights described below, write to legal@ntscore.com.
Data we collect
We collect information from three sources: directly from you when you create an account or fill in your profile; automatically when you use the service, such as session and security data; and from public Instagram profiles for handles that are looked up on the service. We collect only what we need to operate the product. Specifically:
- Your email address, which is both your login identifier and the address we send transactional email to.
- If you sign in with Google, your Google account identifier — see Signing in with Google below.
- The date you accepted these Terms and this Policy, and how you first arrived at the service.
- We do not store passwords. NTScore has no password at all: you sign in either through a single-use link sent to your email or through Google.
- Your city and state, sport, and class year, as you enter them in your profile.
- Your display name and profile picture, which we take from your connected Instagram account. Profile pictures are copied to our own managed file storage so they load reliably; the stored copy is referenced from your athlete profile.
- The Instagram handle and Instagram numeric user ID.
- Public profile data: follower count, engagement rate, post count, public biography, profile picture, posting cadence, and an estimate of local audience.
- A short verification code we ask you to place temporarily in your bio when you claim ownership of a handle.
- We never receive your Instagram password, we cannot post from your account, and we cannot see private accounts or direct messages beyond what is described in Third-party processors.
- Your computed NIL Trust Score (300–850) and its component breakdown — deal history, engagement and reach, consistency, momentum, and diversification.
- A referral code issued for your Instagram handle, and the relationship between accounts that signed up through one another.
- A first-party session cookie, the IP address and browser user-agent recorded when you signed in.
- The IP address and timestamp recorded when a sign-in link is issued and when it is used.
- Events describing how the product is used — for example a sign-in link requested, a score saved, a handle verified, or a scorecard shared — together with a timestamp, an IP address, and, for some events, the email address or Instagram handle involved. We use this to understand where the product works and where it breaks. We do not build advertising profiles and we do not use third-party analytics services.
Deals. NTScore does not currently support making or recording deals — there is no payment processing on the platform, and no deal data is collected from real users. When we launch that functionality, we will update this policy and describe exactly what is collected before you can use it.
We do not knowingly process sensitive categories of data — race, religion, biometric data, precise geolocation, financial account numbers, government identifiers, or health data.
Signing in with Google
If you choose "Continue with Google," we ask Google for three basic permissions — openid, profile, and email — and Google returns your Google account identifier, your email address, confirmation that the address is verified, and your name and profile picture.
Of that, we store only your Google account identifier and your email address, and we use them for one purpose: to create your NTScore account and sign you in. We do not use Google user data for advertising, we do not sell it, and we do not transfer it to anyone other than the service providers listed below who operate the product on our behalf. NTScore's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
You can revoke NTScore's access at any time in your Google account settings. Doing so stops future Google sign-ins; it does not by itself delete your NTScore account — for that, write to legal@ntscore.com.
Public Instagram data
NTScore lets anyone look up a score for any public Instagram handle — your own, a teammate's, or an athlete you are curious about. This means we hold public profile data for people who never signed up for NTScore. We think you should know that plainly rather than find it in a footnote.
- What we collect — only what is visible on a public Instagram profile: the handle, display name, profile picture, biography, follower and post counts, and engagement metrics derived from public posts.
- What we do not collect — private accounts, direct messages, content behind a login, or anything requiring an Instagram password. The collection is performed on our behalf by a third-party vendor reading publicly available pages.
- Why — to compute the score that the person who ran the lookup asked for, and to keep a short-lived cache so that repeating the same lookup does not re-fetch the same data.
A profile collected this way is not published in our athlete directory. Directory listings require the athlete to claim the handle, verify ownership, and switch their profile to public — see Sharing & visibility for the one exception involving shareable scorecard images.
If your handle was scored and you want it removed, write to legal@ntscore.com with the handle. You do not need an NTScore account to make this request. We will delete the cached data for that handle, and we will ask you to confirm ownership first — usually by placing a short code in the bio — so that nobody can erase someone else's profile.
NTScore is not affiliated with, endorsed by, or sponsored by Instagram or Meta Platforms, Inc.
How we use it
- Signing you in and keeping your session secure.
- Computing and updating your NIL Trust Score.
- Showing your athlete profile to businesses, if you have chosen to make it public.
- Sending transactional email — sign-in links, account notices, and security messages.
- Detecting abuse, fraud, false ownership claims, and policy violations.
- Understanding which parts of the product work and which don't.
- Complying with legal obligations and responding to lawful requests.
Third-party processors
We rely on a small number of service providers to run the product. Each receives only the data needed to perform its function and is bound by its own privacy commitments.
- Hosting, delivery, and file storage — runs the application, terminates HTTPS, and stores profile pictures.
- Database — managed PostgreSQL that stores accounts, profiles, and scores.
- Transactional email delivery — sends sign-in links, account notices, and security messages to your email address.
- Public social-media data — fetches public Instagram profile data for handles submitted to the service; we send only the public handle and never a password.
- Identity provider (Google) — authenticates you if you use "Continue with Google."
- Instagram messaging (Meta) — we are building the ability to verify handle ownership through a direct message instead of a bio code. Where that channel is active, we receive and log the sender's Instagram ID and a short excerpt of the message they sent us. We only ever receive messages that a person deliberately sends to our account.
- Internal operations messaging — a daily summary of aggregate counts (such as how many accounts exist) is posted to our own team chat. It contains no names, emails, or handles.
Typefaces are served from our own domain, so displaying this site does not disclose your IP address to a font provider. The vendor stack may evolve as the product grows; the current list of named sub-processors in each category is available on request from legal@ntscore.com.
Data retention
We keep each category of personal information only as long as we need it for the purpose for which it was collected, or as required by law:
- Account, profile, and score data — for the life of your account.
- Cached Instagram data — refreshed regularly; older versions are overwritten rather than archived.
- Sign-in links — deleted automatically within 24 hours of being used or expiring.
- Sessions — a session stops working 30 days after your last visit, or immediately when you sign out.
- Product analytics events — kept while they remain useful for understanding how the product is used. When an account is deleted, its events are detached from it and we remove any that still contain that account's email address or handle.
Deleting your account. There is currently no delete button inside the product — deletion is handled by us on request. Write to legal@ntscore.com from the email address on the account and we will remove your personal data within 30 days, except where applicable law requires us to retain specific records.
Your rights
NTScore is a small company and does not currently meet the size thresholds that make the California Consumer Privacy Act, the Connecticut Data Privacy Act, or similar state privacy laws legally binding on us. Rather than claim a compliance status we have not earned, we make a simpler commitment: we honor the following requests from anyone who asks, regardless of where they live and regardless of whether they ever created an account.
- Access the personal data we hold about you.
- Correct inaccurate or incomplete data.
- Delete your account and the data tied to it.
- Delete cached public data for an Instagram handle you own, even if you never signed up.
- Receive a copy of your data in a portable format.
- Object to or restrict certain types of processing.
To exercise any of these, write to legal@ntscore.com. We aim to respond within 45 days. Before acting on a request we may need to verify your identity — typically by confirming you can access the email address on the account, or by asking you to place a short code in the Instagram bio of the handle in question. If we decline a request, we will tell you why, and you can reply to that same address to appeal; a different person will review the appeal.
Minors
NTScore is intended for athletes age 16 and older. The NIL rules themselves — the NCAA policy, the College Sports Commission process, and state high-school association rules including Connecticut's — do not set a minimum age, so we do not exclude younger high-school athletes who are permitted to earn from their name, image, and likeness.
We do not knowingly collect personal information from anyone under 13, and accounts for anyone under 13 are not permitted. If you believe a child under 13 has given us personal data, write to legal@ntscore.com and we will delete it.
If you are under 18, a parent or legal guardian should review this Policy and the Terms with you before you sign up. Today the service only calculates and displays a score — it does not process payments or facilitate contracts. When we introduce paid deals, a parent or guardian will need to be a party to any deal involving an athlete under 18.
Security
We serve all traffic over HTTPS and limit access to production data to the people who need it. Sign-in links are single-use, expire after 15 minutes, and are stored only as a one-way hash, so a copy of our database does not yield a working link.
Because NTScore has no passwords, your email account is the key to your NTScore account. Anyone who can read your email — or who is signed into your Google account — can sign in as you. Protect that mailbox accordingly, and tell us at once if you think someone else has access to it. No online service can promise absolute security.
Where we operate
NTScore is built for users in the United States, and the data described here is stored and processed in the United States. We do not offer the service to users in the European Economic Area or the United Kingdom, and we do not claim compliance with the GDPR. If you access the service from outside the United States, you do so on your own initiative.
Changes to this policy
We may update this policy as the product and the law evolve. The effective date at the top of this page reflects the latest revision. For material changes — in particular, when we introduce payments or any new category of data — we will email registered users and post a notice in the product before the change takes effect.
Contact
For any question about this policy or your data, write to legal@ntscore.com. Mail can be addressed to NTScore, Hartford, Connecticut, USA.