Trust & Tenant Isolation

    How LevelUp Soccer keeps your data separate, private, and provably yours — and what we may publish, only in anonymized aggregate.

    Who owns what

    LevelUp runs on a clean three-tier ownership model. Each layer owns different things, and none of them can read across the lines.

    Players own their data

    Training history, uploaded videos, AI feedback the player personally received, badges, XP, and personal bests live on the player's LevelUp account. None of it disappears when they leave a club, switch clubs, or join two clubs at once. Players (and parents on family-shared child accounts) can export everything as a ZIP from Settings at any time.

    Clubs own their brand and content

    Each club owns its branding and domain, its drill library and coaching philosophy, its private coach notes, the match clips it uploaded, its team rosters and training plans, its licensing terms, and the fine-tuning of any club-specific AI models trained for them. A club's private artifacts stay with the club and are exported and removed per the club's data agreement if the club ever leaves.

    LevelUp owns the platform

    LevelUp owns the codebase, the core AI models, and the platform-level anonymized aggregate insights — for example, "U13 wingers across LevelUp average X for first-touch progression." LevelUp may publish these aggregates as benchmarks, research, or an annual State of Youth Soccer Development report. No individual player or club is identifiable in those aggregates, and they are only built from players who have explicitly opted in (see below).

    Controls in place
    • Club-owned APIs resolve your clubId from the request and filter at the data layer.
    • A boot-time route audit (validateTenantRoutesAtStartup) walks every registered endpoint and refuses to start the server when a club-owned route lacks an explicit scoping param or an annotated exemption.
    • A standalone audit script (tsx scripts/audit-tenant.ts) re-runs the route audit and seeds two test clubs for a cross-tenant probe.
    • Session-based auth and role checks gate club-director and super-admin operations.
    White-label

    Your club can run on its own subdomain (e.g. yourclub.levelup.soccer) or a custom domain. Your logo, colors, and app name show up on the loading screen, top bar, and PWA install prompt for players who join via your URL. The canonical LevelUp experience is unchanged for everyone else.

    Exclusivity Mode (optional)

    Clubs that need a closed environment can ask LevelUp staff to turn on Exclusivity Mode. When it's on, your members are locked into your branded subdomain: they can't create or join other clubs, use the public referral program, or see another club's data. Exclusivity Mode only restricts which surfaces members can reach — it never deletes or hides a player's own training history, videos, AI feedback, or progress data. The setting is super-admin gated, every change is recorded with actor and timestamp, and turning it off restores universal access on the next request.

    Audit & transparency
    • Every module-toggle and branding change is recorded with actor, timestamp, and before/after values.
    • The daily CEO brief surfaces uncovered routes flagged by the boot validator.
    • Need a SOC 2 / vendor questionnaire? Email support@levelup.soccer.
    What we explicitly do NOT do
    • We do not let one club read another club's raw data — ever.
    • We do not sell player or club data to third parties.
    • We do not use a club's private drills, coaching philosophy, or coach notes to improve services for other clubs.
    • We do not use a player's videos to train AI for other players unless that player has opted in.
    • We do not run per-club databases or per-club deploys. Isolation lives in the data layer of a single codebase.
    What we may do, in aggregate only

    With the player's explicit opt-in, LevelUp may include their training data in anonymized, group-level benchmarks — for example, "your U13s are in the top 15% for first-touch progression," or an annual State of Youth Soccer Developmentreport. These outputs are about populations, never individuals.

    • Opt-in, default off. Every player (existing and new) starts opted out. No one is ever in an aggregate without first turning the setting on.
    • Small-sample suppression. Any cell that would reveal a small group (e.g. one U10 goalkeeper at a club) is dropped, so a result can never be traced back to a person.
    • No raw cross-tenant reads. Aggregates are computed by LevelUp from consenting players — they never give one club a window into another club's raw data.
    • Reversible. Turning the setting off removes that player from future aggregates.

    Manage this setting in your profile under Privacy & data.