Privacy Policy

Last updated September 13, 2026.

This policy describes the RoboBattles app at hub.robobattles.com, operated by the Grant Imahara STEAM Foundation ("we," "us"). It does not describe every separate Foundation website or external service.

Information we collect

• Account information: email collected at welcome; first name, last name, self-selected participant role and full date of birth collected after email verification; account display name, email confirmation status, account dates, sign-in activity, and any existing player/educator preference. A preference is not proof of a person's role or authority.
• Registration information: your age-screening result and its date, team names and numbers, player counts, site names and types, optional parent organization names, city and ZIP code, listing status, and optional public contact email and website.
• Management information: organization memberships, staff roles, invitation email addresses and acceptance status, event details, team entries, player-count snapshots, and registration dates.
• Technical information: session cookies, authentication tokens, browser session storage, and request information needed for delivery, security, and troubleshooting, such as IP address and browser information. Rate-limit identifiers are hashed; hosting logs may contain request information.

Team managers may optionally provide aggregate estimates of expected annual participation, first-time robotics participation, gender, and race or ethnicity, along with the estimate source and update date. Estimates cover the sibling teams sharing that program location. Unknown information may be left blank. The app does not collect named student rosters or individual student demographic records. Do not put individual student details in names or other free-text fields.

These estimates are available to the program's managers and authorized Foundation personnel, not public listings or event organizers solely because a team registers for an event. GISF may combine estimates for impact planning and funding reports, identifying them as estimates and distinguishing school/community context from participant-based information. Team managers can update or clear their estimates. The latest report is retained with the managed location until cleared or the location is deleted; prior copies in backups follow provider retention periods.

How we use information

We use information to send sign-in emails, maintain accounts, display listings, provide approximate ZIP-based discovery, manage staff access and event entries, prevent abuse, provide support, and understand program participation and tailor program outreach using your self-selected role, after you complete your account profile. Registrations and player counts are not proof of attendance or unique individuals. This app does not automatically subscribe you to marketing emails.

Public and restricted information

When a team is listed, its name, number, site association, parent organization name, city, ZIP, player count, and the site's optional contact information are public. Published event details include the host site name and public contacts, venue, schedule, capacity, and registration count. Public listings are accessible through the directory API without an account and may be copied by others. Entering an email in the interface does not make the directory private.

Unlisted teams and draft events are not part of public discovery. Access is limited by management and registration permissions. Organization staff can see their organization's staff information. Event hosts can see registered team names, numbers, player counts, and registration times; this is not a named student roster. Authorized Foundation personnel and service providers may access information as needed to operate, secure, and support the service.

Your sign-in email is not automatically published as a contact. Site public contact fields are optional and must be entered separately; they are shared across that site's teams and published events. Use a program or adult-managed address that you have permission to publish. Do not publish student personal emails or residential addresses.

Your full date of birth is private account information used for age screening. It is not included in public discovery, organization staff views, event registration lists, or Foundation directory listings. It remains stored with your account until corrected or removed under our retention and deletion process.

External contact and providers

RoboBattles does not collect or forward requests to join teams. Contact links open an email application or external website. Sending an email or submitting another site's form shares information with that recipient under their practices, not through a RoboBattles inbox. We do not vet external contacts or control what they retain.

Cloudflare provides hosting, database, session storage, and security infrastructure. We also use Cloudflare Turnstile on welcome, email requests, and registration submissions to reduce automated abuse. Turnstile processes browser and network signals to perform security checks. Amazon Web Services SES delivers authentication emails. ZIP lookups send the ZIP code to Zippopotam.us, not your account email; results are cached. Google Fonts delivers fonts to your browser and receives the associated network request. Providers may process data in the United States and other locations.

The current app does not include advertising trackers or sell personal information. We may disclose information when required by law, to protect people or the service, or to service providers assisting us with those purposes.

Cookies and storage

Authentication uses cookies shared across configured RoboBattles subdomains. Sessions can last up to 30 days and may renew with use. An opaque, host-only welcome cookie remembers that you completed the welcome form for up to 12 months, renewing with use. The associated server record stores your email and 13+ declaration; browser session storage also remembers the email and when a code was requested. Welcome also creates an unverified account record if the email is new, without changing existing account details. Neither that record nor the welcome cookie signs you in or grants account permissions. Signing out, choosing Forget this browser in Your account, or using a different email removes that browser's welcome record. Clearing cookies or browser storage limits may require you to enter your details again. Blocking required cookies can prevent sign-in. These mechanisms are not an age or identity verification service.

Retention and deletion

Account and registration records currently remain stored until removed; the app does not yet automatically delete inactive accounts or old event records. Expiring authentication data has separate cleanup. Welcome records expire after 12 months without renewal and are normally removed within about a day after expiry. You may request removal of these records even if you never verified your email. Archiving a team or cancelling an event preserves its records and is not deletion.

Contact us to request access, correction, or deletion. We may need to verify your control of the account and resolve organization ownership or shared registrations. We will review what can be deleted and explain any information retained for legal, security, or legitimate recordkeeping needs. Copies in backups or hosting logs may persist for the relevant provider retention period. We cannot remove copies of public information or emails already retained by others.

Children and teenagers

Accounts are intended for people 13 or older. A younger player should ask a parent or guardian to use their own account and contact information. A self-reported birthdate is not verified age, guardian consent, or proof of adulthood. Do not submit a child's personal information on their behalf through these registration fields. If you believe a child under 13 has supplied personal information, contact us so we can review and address it.

Teenagers should involve a parent or guardian before contacting unfamiliar people or attending an event. The app does not establish that a listed host is an adult, school representative, or vetted supervisor.

Your choices and contact

You can edit managed team and event details, remove public contact fields, unlist or archive a team, and withdraw an event entry. For privacy, deletion, support, or safety reports, email support@robobattles.com. Do not send identity documents or sensitive student information unless a necessary, secure process has been agreed.

Policy changes

We will update this page and its revision date when practices change, and provide additional notice or obtain consent where required. New demographic collection or materially different sharing requires review and updated disclosures before it is enabled.