Privacy Policy

Effective: May 19, 2026 · Last updated: November 2, 2026

This Privacy Policy explains how SidelineStats ("we," "us," "our") collects, uses, and protects personal information when you use our sports league management platform for youth and adult leagues (the "Service"), including the sidelinestats.app website, the iOS and Android mobile applications, and any league site operated on our platform (e.g. yourleague.sidelinestats.app).

This policy applies to information about parents, guardians, players (including minors, and adult players who register themselves), team captains, coaches, referees, scorekeepers, and league administrators who use the Service.

1. The Short Version

We do not sell, rent, or trade your personal information. Ever. To anyone.
We have no parent company or affiliate that could resell your data. SidelineStats is independently operated.
We share data only with the minimum set of operational vendors required to run the platform. Each vendor listed in §4 below is contractually bound to use the data only to provide their service to us.
We do not run third-party advertising, retargeting pixels, or marketing analytics. No Google Analytics, no Meta Pixel, no ad networks.
Age-verification documents are deleted from our servers within seconds of successful processing. We retain only the verification outcome, never the document itself.
Children's data (under 13) is handled with parental-consent gating in compliance with COPPA. See §7.
Adult players (18 and over) register and manage their own information. No parent or guardian account is involved. See §8.

2. What Information We Collect

2.1 Information you provide directly

Account information: name, email address, phone number, password (stored hashed — we never see your password).
Player information: player first name, last name, date of birth, gender, age group, jersey size and other uniform sizes, preferred jersey number, position preferences, prior playing experience, skill self-assessment.
Parent / guardian information (youth programs): name, contact details, relationship to player, emergency contact information.
Adult player information (adult programs): the player’s own name, contact details, and emergency contact information. In adult programs the player is the account holder.
Team and free-agent information (adult programs, where the league offers it): the team name and colors a captain enters, and — if you list yourself as a free agent — the positions, skill level, available nights, and note you choose to share.
Medical information (only when you choose to provide it): allergies, asthma / inhaler status, EpiPen status, prior heat illness, cardiac history, pediatrician or physician contact, other conditions relevant to safe participation. This information is shared only with the player's coaches and league administrators.
Communications: messages sent through the in-app messaging system; emails sent to league administrators or coaches.
Photos: photos that leagues upload to their public website or photo galleries. The platform-wide Photo / Video Release waiver governs how images of players may be used by the league.

2.2 Information collected automatically

Device and usage information: IP address, browser type, operating system, device identifiers, pages visited, features used, timestamps. Used solely to operate and secure the Service.
Cookies and similar technologies: we use first-party cookies and localStorage to keep you logged in, remember your preferences, and run the platform. We do not use third-party advertising or tracking cookies.

2.3 Information from payments

When you register a player (or yourself), pay a team fee as a captain, or pay any other league fee, payment is processed by Stripe. Card details and bank information are entered directly into Stripe's secure checkout and never touch our servers. We receive only confirmation that payment succeeded, the amount, and a reference identifier we use to credit your registration.

2.4 Age-verification documents

Some youth leagues require a parent or guardian to upload a document (e.g. a birth certificate, school ID, passport) to verify a player's date of birth. Adult programs confirm that a player is 18 or older from the date of birth the player enters; a league may also ask an adult player to upload a document, which is handled the same way.
These documents are processed in memory and deleted from our servers within seconds of successful verification. We retain only a boolean record (verified / not verified) and the date of verification, never the document itself.
We do not transmit these documents to any third party.

3. How We Use Your Information

We use personal information solely to:

Operate the Service (registration, scheduling, scoring, statistics, communications, payments).
Allow league administrators and coaches to manage their team rosters and contact players and families.
Send operational notifications (game reminders, schedule changes, score updates, message notifications, registration confirmations). You may opt out of non-operational categories in your account preferences.
Provide the ScoutAI chat feature (see §4).
Improve the Service through aggregate, non-identifying usage measurement (e.g. server response times, error rates).
Protect against fraud and abuse.
Comply with legal obligations.

We do not use personal information for advertising, marketing to third parties, profiling for commercial purposes, or training general-purpose AI models.

4. Who We Share Information With

We share data only with operational vendors that are contractually limited to using the data on our behalf. Each vendor receives the minimum data set required for their function.

Vendor	Data shared	Purpose
Stripe, Inc.	Payment information you enter directly into Stripe's checkout; basic identifiers (name, email) for receipt purposes	Payment processing. Subject to Stripe's Privacy Policy.
Anthropic PBC	Player names, team names, game statistics, and the text of your ScoutAI question	Powering the ScoutAI conversational feature. No contact information, no addresses, no payment information, no medical information is sent. Subject to Anthropic's privacy policy.
Resend, Inc.	Recipient name and email address; the email body	Transactional and league-broadcast email delivery. Subject to Resend's privacy policy.
Google LLC (Firebase Cloud Messaging)	An anonymous device push token; the notification payload	Delivering Android push notifications and web push notifications. We do not send personally identifying information in the notification payload beyond what is required for the notification (e.g. a coach's name in a "New message from Coach Smith" banner). Subject to Google's privacy policy.
Apple Inc. (Apple Push Notification Service)	An anonymous device push token; the notification payload	Delivering iOS push notifications. Subject to Apple's privacy policy.
Cloudflare, Inc.	Network-level data including IP address and request metadata; all platform data is stored on Cloudflare's infrastructure (Workers, Pages, R2, D1 database)	Hosting and infrastructure. Data resides on Cloudflare's United States network. Subject to Cloudflare's privacy policy.

We may also disclose information when required by law, subpoena, court order, or to protect the rights, safety, or property of SidelineStats, our users, or the public.

Calendar subscriptions: when you subscribe to your personal schedule in Google Calendar or Apple Calendar using the .ics URL we provide, Google or Apple will periodically fetch that URL. The URL contains only your schedule; no contact information is transmitted in the calendar feed itself. We do not push data to Google or Apple — they pull on the schedule you set up.

5. Third-Party Analytics and Advertising

We do not use third-party analytics services. We do not run Google Analytics, Meta Pixel, Adobe Analytics, Mixpanel, or any other analytics provider. We do not display advertising on the Service. We monitor our own database and server performance using internal tooling that does not transmit personal information to third parties.

6. Data Retention and Deletion

Active registrations: we retain registration and roster data for the duration of the season plus seven (7) years after a player's last activity, to support tax, audit, and liability documentation requirements.
Payment records: retained as required by Stripe and applicable tax law (typically seven years).
Age-verification documents: deleted within seconds of processing (see §2.4).
Messages: retained for the duration of your account; deleted on account closure.
Account closure: you may request deletion of your account at any time. We will delete or anonymize your personal information within thirty (30) days of a verified request, except for records we are legally required to retain (e.g. payment history for tax purposes).
Tenant data: when a league closes its account, we return the league's data on request and delete it from our active systems within thirty (30) days.

To request deletion, email gcliff@gmail.com with the subject "Data Deletion Request" from the email address on the account.

7. Children's Privacy (COPPA)

The Service is used by minors under the age of 13, but only through parent- or guardian-managed accounts. A parent or legal guardian must create the account, enter the child's information, and consent to participation. We do not knowingly collect information directly from children under 13 without verifiable parental consent.

In compliance with the Children's Online Privacy Protection Act (COPPA):

A parent or guardian provides the player's name, date of birth, and any medical information during registration.
A parent or guardian signs the league's waivers on behalf of the minor.
We do not knowingly enable children under 13 to publicly post their own personal information.
We do not knowingly use children's data for advertising, marketing, or profiling.
A parent or guardian may review, edit, or request deletion of their child's information at any time by contacting their league administrator or emailing us at the address in §16.

8. Adult Leagues and Adult Players

Leagues can run adult programs (players 18 and over) alongside or instead of youth programs. Everything else in this policy — what we collect, who we share it with, how long we keep it, how we protect it, and your rights — applies to adult players in the same way. In an adult program:

You register yourself and you are the account holder. No parent or guardian account is involved, and you provide your own information, including any medical information you choose to share.
You must be 18 or older on the league’s age-cutoff date, based on the date of birth you enter. Players under 18 must register in a youth program through a parent or guardian.
You sign the league’s waivers for yourself.
Team captains (where the league offers captain team registration) can see the names of teammates who joined their team and whether each teammate’s registration is complete. Captains do not see teammates’ contact, medical, or payment details.
Free agents: if you choose to let captains see you on the league’s free-agent list, captains in that season can see your first name and last initial, the positions, skill level, and nights you listed, and your note — never your contact information. You can remove yourself from the list at any time.
You may review, edit, or request deletion of your own information at any time by contacting your league administrator or emailing us at the address in §16.

9. Your Rights and Choices

Depending on where you live, you may have rights under privacy laws including the California Consumer Privacy Act (CCPA), Virginia CDPA, Colorado CPA, and similar laws. These rights generally include:

Access: request a copy of personal information we hold about you.
Correction: request that inaccurate personal information be corrected.
Deletion: request that we delete personal information (subject to legal retention requirements).
Portability: request a copy of your personal information in a machine-readable format.
Opt-out of sale or sharing: not applicable — we do not sell or share personal information for cross-context behavioral advertising.
Non-discrimination: we will not retaliate against you for exercising any of these rights.

To exercise any right, email gcliff@gmail.com from the email address on the account.

European Economic Area users: SidelineStats is not currently directed at the EEA market. If you are in the EEA and use the Service, you have rights under the GDPR including access, rectification, erasure, restriction, portability, and objection. Contact us to exercise these rights.

10. Data Security

We use industry-standard technical and organizational measures to protect personal information, including:

TLS encryption for all data in transit.
Encrypted storage at rest on Cloudflare's infrastructure.
Hashed passwords (we never store or see your plain-text password).
Role-based access controls limiting which league administrators can see which data.
Tenant isolation: each league's data is logically separated; we have multiple defensive layers preventing cross-tenant data exposure.
Regular security review of platform code.

No system is perfectly secure. If we become aware of a confirmed personal-data breach affecting your information, we will notify affected users within seventy-two (72) hours of confirmation, by email and via in-app notice, including the nature of the breach and the steps you can take to protect yourself.

11. International Data Transfers

The Service is hosted on Cloudflare's United States network. If you access the Service from outside the United States, your personal information will be transferred to and processed in the United States.

12. Third-Party Links

The Service may contain links to third-party websites or services (e.g. league sponsors, Stripe checkout, the App Store, Google Play). This Privacy Policy does not apply to those third-party services. We encourage you to review their privacy policies before sharing information with them.

13. League Administrator Use

When you register on a league's site, your data is shared with that league's administrators, coaches, and (where applicable) referees and scorekeepers, who use the platform on behalf of the league. In adult programs, team captains also see limited roster information as described in §8. The league is the party responsible for collecting your data; SidelineStats acts as the league's service provider.

Each league is responsible for:

Drafting and managing its own waivers, including any waivers presented during your registration with that league.
Determining what photos may be taken and published.
Managing access to your data by their own staff and volunteers.

If you have questions or complaints about a specific league's handling of your data, please contact that league directly. We will assist where appropriate.

14. Changes to This Policy

We may update this Privacy Policy from time to time. The "Last Updated" date at the top reflects the most recent revision. Material changes will be communicated via email and in-app notice at least thirty (30) days before they take effect. Continued use of the Service after the effective date constitutes acceptance of the revised policy.

15. Boilerplate Disclaimers Notice (League-Provided Waivers)

The waivers, acknowledgments, and consent forms presented to you during a league's registration flow are template documents provided by SidelineStats as a starting point. Each league is solely responsible for reviewing, customizing, and ensuring that its waivers comply with applicable state and federal law. SidelineStats does not warrant the legal sufficiency of any waiver text and is not a substitute for advice from a licensed attorney. By using the Service, you acknowledge that the league — not SidelineStats — is responsible for the legal content presented to you during registration.

16. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or your personal information, please contact:

SidelineStats
Email: gcliff@gmail.com
Website: https://sidelinestats.app

We respond to all privacy-related inquiries within ten (10) business days.