NCAA compliance posture

WI Athlete implements:

• NCAA Division I recruiting calendar for track & field.Direct athlete-contact period opens September 1 of the prospect’s junior year of high school.
• NCAA Bylaw 13 messaging restrictions.Pre-window contact with the prospect themselves is prohibited; pre-window contact with the prospect’s HS coach about the prospect is allowed (per the “recruiter may contact HS coach about prospect” clause).
• Audit-trail retention. 5 years, matching the NCAA standard for recruiting records.
• FERPA on the athlete-data side. See /ferpa.

Division II and III rules are looser, but we apply the D1 window across the board so a single recruiter account can operate at any division without manual rule-switching. If a D2 / D3 coach wants the looser window, contact us and we’ll talk about an account flag.

At message-send time, the platform computes the athlete’s recruiting window and routes the message accordingly:

• Allowed. Athlete is a senior, or a junior on/after September 1. Message is sent to the HS coach and recorded with window='allowed' in the audit log.
• Restricted.Athlete is a junior before September 1, sophomore, or freshman. Message is delivered to the HS coach (per Bylaw 13’s HS-coach contact allowance) but flagged in audit with window='restricted' for compliance review.
• Prohibited.The athlete’s grad year is missing, malformed, or wildly out of range. Message is blocked entirely.
• Unknown. Message is a general team-wide outreach with no specific athlete attached. Routed to the HS coach unchanged; flagged in audit.

The classifier is a pure function with explicit unit tests. Source: lib/ncaa-recruiting-window.ts. The send-time enforcement is in the messaging audit layer so it cannot be bypassed by API call.

By design, WI Athletedoes not expose a recruiter → athlete messaging surface. The only outbound channel from a recruiter account is recruiter → HS coach. The HS coach can forward at their discretion. This keeps the recruiter compliant without requiring them to manually check each athlete’s grad year against the calendar.

Athletes can opt to make their profile invisible to recruiter discovery entirely (parent-managed flag on the profile-edit page). Opted-out athletes are filtered server-side from search, watchlist, and profile-view endpoints.

Three messages per recruiter → HS-coach pair per rolling 7-day window. This keeps HS-coach inboxes survivable. Requests for higher limits go through Kyle.

For every recruiter action we record:

• Recruiter ID and verified .edu identity.
• Action type (search, watchlist add/remove, tag, profile view, message send, export, login).
• Timestamp (UTC + the local America/Chicago equivalent).
• Target athlete ID and / or target HS-coach org.
• For messages: classifier verdict, applied window, message subject, full body, send result, deliverability status from Resend.
• For searches and exports: the full query filter set and the row count returned.
• IP address (for fraud detection — see Privacy Policy section 5).
• User-agent.

Audit entries are append-only. Recruiters cannot delete or edit their own log. The log lives for 5 years from the date of the recorded action.

Your athletic compliance officer can request the full audit log for any recruiter on your staff. We provide:

• CSV export of every logged action.
• Filtered view scoped to a date range or athlete.
• On request, an admin compliance dashboard URL (/admin/compliance) that compiles flagged messages, restricted-window sends, and high-volume signals.

To request access, email hello@wiathlete.com with the compliance officer’s name, title, and institutional email. Turnaround: 2 business days.

We verify recruiter identity in three layers:

1. .edu email required. Enforced at the data model (CHECK constraint) and at the signup API.
2. Disposable-email blocklist. 440+ throwaway domains are rejected at signup.
3. Manual review. Every signup is reviewed by Kyle within one business day, unless your institution is on the pre-approved list (UW system, NAIA, D2 / D3 directories).

Schools using a non-.edu domain (some private, some international) can request manual allowlist. Email hello@wiathlete.com.

• We don’t deliver messages between a recruiter and a prospect-athlete directly — even when the window is open.
• We don’t solicit transcripts, official test scores, or any FERPA-protected educational record.
• We don’t inflate or fabricate “X coaches viewed your profile” counters. The displayed count is the literal number of distinct verified recruiter accounts that viewed the profile.
• We don’t share recruiter activity with the athlete or family in real time. Recruiters retain the standard opacity NCAA bylaws expect during the recruiting process.
• We don’t allow scraping or republishing recruiter identities. Recruiter directory data is private to WI Athlete staff.

• Recruiter FAQ — sub-processor disclosures, verification, throttle rules in detail.
• Privacy Policy — full data-handling detail across all roles.
• FERPA notice — athlete-data scope and directory exemption.
• Terms of Service — recruiter account terms, including acceptable use.