Privacy Policy — playerkit

Effective date: 2026-11-11

playerkit helps sports clubs, leagues, and schools manage their equipment, rosters, and seasons. That means families trust us with information about themselves and their children, and this policy explains what we do with it.

Parents and guardians have their own accounts here — this is not a club-only tool. A club links you to your own child, and from that link you can see the gear they have been issued, record their sizes, sign the waivers a season requires, pay a fee or deposit, book a pickup or return, claim a jersey number, and decide whether your child may have a supervised sign-in of their own. Everywhere this policy says "your family," it means that link. All of it works the same whether you use playerkit in a web browser or through our phone app.

We have kept it short on purpose. Every category of information we handle is described here in plain language. Some specifics sit in our fuller privacy policy instead — exact retention timelines, exactly which fields are encrypted, the complete list of the service providers we rely on, how a specific feature works. You are entitled to any of it: email privacy@playerkit.app and we will answer with specifics, or send you the longer document.

The short version

We collect the minimum needed to run your club's equipment, rosters, schedules, and payments — and nothing for advertising.
We never sell your information, we show no ads, and we build no profiles. Not for adults, and never, under any circumstances, for children.
We do use aggregate numbers that name nobody — how much gear a club of a given size carries, and the like — to improve the product and to write honestly about the sport. No child's information is ever part of them, and we never publish anything traceable to a person, a family, or a single club.
Player records never store birth dates, home addresses, or player photos. Where age matters we store a coarse label (like "U13") or a fact a guardian confirmed — never a birth date.
Payment card details never touch our systems. Card entry goes directly to Stripe, our payment processor.
If you save a card with your club, it stays with Stripe on the club's own account. We never hold its number: we keep its brand, last four digits, and expiry so you can tell which card it is; it is charged only as the authorization you signed says; and you can remove it at any time.
A child cannot have an account without a parent or guardian's signed consent, and a child under 13 can never be privately messaged through playerkit.
Information about a player stays inside their own club unless a parent or guardian gives specific, revocable permission to share it somewhere named. Two small exceptions. The first is yours to control: on game day, score pages and announcer sheets name a player the way the club chose — first name and last initial unless the club chose the full name, first name only or numbers only (announcer sheets also carry the jersey number) — and your family's own choice always wins, from the full name down to number only. The second: if a charge on a card saved with the club is disputed or questioned through the card's bank, the records the club sends Stripe to answer it identify the loan and payer, never the child (section 5).
Our primary systems are hosted in Canada, and the most sensitive information is encrypted at rest — stored as unreadable code that needs a secret key to unlock.
You can download a copy of your information or delete your account at any time, from your own account settings.
If we make a material change to this policy, we tell you by email and in the app at least 14 days before it takes effect.

1. Who we are

PLAYERKIT INC. operates playerkit. We are based in Alberta, Canada and are governed by PIPA (Alberta) / PIPEDA (Canada). For anything in this policy, you can reach us at privacy@playerkit.app.

2. What we collect

In short: account basics for adults, a name and roster details for players, the records your club creates as it runs its seasons — and a deliberate list of things we never collect.

Information you give us

Account basics — your name and email address, and a password only if you choose to set one (stored only as a one-way hash, so we never see it). You can instead sign in with a code we email you — see Signing in without a password below — and an account created that way stores no password at all. Optionally: a phone number, a title, display preferences, a recovery email address, and two-factor authentication settings. Optional contact details and your two-factor secrets are encrypted at rest.
Player information — a player's first and last name, team, jersey number, and an optional email address, added by their club or by their family. A player's name and email are encrypted at rest. One exception: a child's supervised sign-in keeps its own copy of the child's name, stored without that encryption, until a guardian withdraws consent or the club deletes the player. A family may also add an optional note on how the name is said (like "AY-vree" — also encrypted, never a recording) and choose the game-day name described in sections 4 and 5 (let the club decide, full name, first name and last initial, first name only, or number only). The pronunciation note is shown only on the announcer sheet or page, beside the name that sheet already shows — and it disappears wherever the name does.
Family links — which parents and guardians are connected to which players, so the right adults see the right child's information and sign what only a guardian can sign. The link itself stores two things: a relationship label ("mother", "stepdad" — your club may pre-fill it, and you can change it), and a set of permission switches — whether you can sign waivers, manage the player's profile, see their equipment, book pickup and return appointments, manage a supervised sign-in, and whether you receive notifications about them. Your club sets these when it invites you or approves your link request, or you get the usual set when you register a new child yourself on a team your club marked adults only, with no approval step. They can be changed or revoked at any time.
Optional player measurements — sizes (like helmet or jersey size) a parent, coach, or admin can record so gear fits. Clubs can also let the system estimate a size from the gear a player was issued; club admins can switch that estimation off.
Things you write in the app — messages (if your club uses in-app messaging), event RSVPs, availability answers ("can you make Saturday's game?"), appointment notes, and similar. Message content is encrypted at rest and is readable only by the people in that conversation. We never use it for advertising, and we never build a search index over it. Where your club has turned Photos on, adults can also send photos in a message — never in a conversation that includes a player under 18 (see Team photos below).
Reactions to messages — a small emoji response, chosen from a fixed set of six. Reactions only exist where your club has turned them on and you have turned them on for yourself; both are off by default, and we store your own preference on your account. Others see a count, never a list of who reacted, and reactions are switched off entirely in any conversation involving a minor or an observing guardian — the same rule that keeps read receipts out of those conversations (see section 4). Reacting notifies nobody.
Signed documents — when you sign a waiver or a consent electronically, we keep a legal record of that signature: your typed name, the date and time, the device and internet address you signed from, and an exact snapshot of the text you agreed to. The personal details in these records are encrypted at rest. You get a copy by email: the club, the document, who signed, who it was for and when — never the text itself. If someone signs at a club's door by scanning a tag and types an email address that already has an account, we email that address to confirm it was them before the signature is attached to the account. When a staff member records a signature made on paper, that record keeps no electronic-signature disclosure and no device details — only the name as written on the paper and which staff member recorded it.
Payment records — when you pay a club fee or deposit online, we keep the record of the payment: the amount, its status, and who paid when that identity is known. We link a payment to the signed-in account that made it, or the signer of the saved-card authorization used for it. We do not guess from an anonymous link or a staff member entering the payment. If you pay a fee from the QR code on a club's price list, without an account, we also keep your short answer to "Who is this payment for?" with the payment, so the club can match it to the right player. A deposit paid by hand: if you tell the club "I've sent it", we keep the way you name, the day if you give one, your note if you add one, and who said it. The staff your club chose for club emails, who can include store staff, get an email with your child's first name, the team, the amount and the way, and a link to mark it received with no sign-in. Your note and your child's last name are not in that email. The card number itself goes directly to Stripe and never touches our systems. If you save a card with a club for equipment card cover, the card is saved with Stripe on that club's own account. A payment plan never saves a card. We keep Stripe's reference numbers for the card and for your customer record there, plus the card's brand, last four digits, and expiry, so the app can show you which card it is. You sign an authorization for that one use, kept like any signed document above, together with the cardholder name you enter (encrypted) and your confirmation that you are the cardholder or are authorized by them. If you sign on a club's device while you are there in person, the record names the staff member whose device it was, and the device and internet address it keeps are that device's. While a card is being confirmed, we record each card tried: its brand, last four digits, whether it went through, and the decline code if it did not. We also keep the record of each charge made under it: the notices we sent and whether they reached you, anything you wrote to contest one, and — for gear that was not returned — the items and their issue and return dates.
Your club's own cards — when your club saves a card for its subscription or as a backup card, we show the club's owner the card's brand, last four digits and expiry so they can recognise it.
Who a store purchase is for — when you buy from your club's store, you can say which of your own players the purchase is for. We keep that link, and your purchase history and the club's order list show those players' first names.
A question to a club's store — if you use the contact form on a club's store page, your name, email address and message are emailed to the people your club chose for store questions, each as their own email. We do not keep the message, and the club's own addresses are never shown to you.

Records created as you use playerkit

Equipment records — what gear exists, who it is assigned to, who is holding it, and its return and repair history. This is the core of the service. Club staff can email a family about gear still out and add a short note. The note is delivered by email and not kept: we record that one was sent and when, never what it said. A reply goes to the staff member who sent it. When a club owner or admin lets you keep gear that the club's rules would have come back, we keep who decided it, when, which rules were set aside and a note they write saying why. Only the club's owners and admins can read that note. You are told the gear is kept; the note is not shown to you and is not in your data download. Section 6 says how to ask your club for what it holds about you.
Schedule records — appointments, games, practices, attendance, and game scores.
A player's account with the club — what is owed and paid for a player: fees, store purchases, items and other charges club staff add to the account at the club, and fundraising. For each charge we keep the items, the amounts, the due date, and who added it; if the club covers a charge itself, the reason staff give; and for a payment the club records itself (e-transfer, cash, or cheque), the amount, the method, the date, and the staff member's note. When the club gives money back to you, we keep how it went back (to the card, or by cash, e-transfer, cheque or another way), how much, who recorded it and when, whether the club says you still owe it, and any note the staff member adds. You see all of it, the note included, in your data download (section 6). When staff add a charge, the adult the club bills for that player is emailed a bill with a pay link. The link opens without signing in, so treat it as private: its page shows the club, the items, the amount, the due date, the club's e-transfer instructions if it takes e-transfers, and the player's first name and last initial — nothing else about the player or family. We store only a one-way hash of the link, never the link itself, plus the address it was sent to (encrypted). It pays that one bill only and stops working after 90 days. While a bill is unpaid, reminders are sent by email by default; the club can turn them off, except the notices for a payment plan's payments, which are always sent. Beyond these we do not chase payment, add fees or report anyone. Your account at the club also shows the ways the club says it takes payment outside the app, with where to send it. If a club closes its playerkit account while you still owe it something, you still see what is owed there (it cannot be paid in the app) and, if the club took e-transfers, the address it took them at, so you can settle with the club directly. Only the adults linked to the player who can see their account see it, and never the club store's contact addresses.
Payment plans — if your club offers one, you can pay a registration in several payments on dates the club sets. No card is saved and nothing is charged automatically: each payment is a bill on the player's account that you pay yourself. When you agree, we keep a record of who agreed, when, in which language, and the exact text you were shown, with a fingerprint of it — no internet address, device or typed name. You and the club's owners and administrators can see it; we send it to no one, including Stripe. You get a copy of the agreement by email. For each payment after the first, you get a notice in the 3 days before its date and on that date, whatever the club's reminder setting, and weekly reminders while a payment is overdue only if the club has reminders on. If you registered the player and the club has not approved your link to them yet, you can still see the plan and pay its payments, and nothing else on the player's account.
Fundraising — if your club runs a fundraising campaign, we keep each player's goal, the deadline, and each credit toward it: the amount, the date, where it came from, and a short description staff type — which can name a sponsor or a business. A family's own card contribution is kept like any other payment. If the club offers a buy-out, the part of a goal still unmet at the deadline becomes a charge on the player's account. A charge's due date and a campaign's deadline appear in your family's calendar; in your personal calendar feed they show only the item or campaign name and the date — we never add an amount or a player's name to calendar feed entries (the item name is the one club staff typed).
Security records — a log of sign-ins and security events on your own account (visible only to you), a rough "last active" timestamp, and a record of who viewed a player's scannable tag. These exist to protect accounts, not to track behaviour: we do not log the pages you visit.
Crash reports — if our phone app crashes or runs into an error, it sends us a report so we can fix it. A report carries the phone model and operating-system version, the version of our app, the error and the sequence of code that led to it, the names of the screens you moved between (never anything typed on them), a count of app sessions and whether each ended normally, and an anonymous account number so we can tell whether one person or many are affected. A small sample of sessions also reports how long screens took to load. A report never carries your name, your email, your messages, your photos, a gear or roster record, or a link containing one of the private codes that opens a tag or a sign-in — the app removes those before anything is sent. Our web app and our own servers report errors to the same service under the same rule: no personal details. These reports go to Sentry, a crash-reporting service (see section 5), and are deleted after 90 days (see section 7).
Visits to our public website — on the public marketing pages only (home, features, pricing, help…), our own server counts page views: the page, the site you came from, browser and device type, language, and the country and city your address points to. No cookie, nothing stored on your device, no IP address kept, no third party, nothing tied to an account. Off when your browser sends Do Not Track or Global Privacy Control. Never in the app, on scan pages, in the mobile app, or on a join, payment or deletion link.
Push notifications — if you allow notifications on your phone, the app gives us the push token the phone's operating system issued for it: an opaque delivery address, never a hardware serial or advertising identifier. We store it hashed and encrypted, tied to your sign-in, and delete it the moment you sign out of the app or forget the device from your account's security settings. A notification we send says nothing about anyone: a fixed generic line for its kind ("New message", "Safety notice", "Schedule update"), the identifiers the app needs to open the right screen, and your unread count for the badge — never a person's name, a message's words, an amount, a requirement's title or a player's status. The app fetches the real thing over your signed-in connection when you open it. Which kinds reach your phone is your choice in Account → Notifications: only safety notices and messages addressed to you are on to begin with; everything else is off until you turn it on, and your quiet hours and snooze apply to push exactly as they do to email. The phone's own notification permission is the last word. Push notifications travel through Apple's and Google's push services (see section 5). Accounts on the under-13 path (section 4) never register a push token — their guardians receive instead.

Information that arrives from somewhere else

Roster imports — your club can import the roster it already manages elsewhere (a spreadsheet, or an export from another sports platform). We keep only the narrow fields we would collect anyway — names, optional emails, team, jersey number, a coarse age label. Anything else in the file (birth dates, phone numbers, addresses, photos) is discarded during processing and never stored. If the file lists a parent's or guardian's email, nothing is sent and no one is linked until the club chooses to invite them. Even then, that parent is linked to their child only if they accept. If they already have an account with that address, we email them and tell them in the app; otherwise they see it when they sign in with that address — proved by the code we send to it. The club may also email everyone on the list an invitation. Whether the address has an account is not shown to the club, and neither is a refusal. The invitation has no expiry date: it works until that parent accepts or the club removes it, and stops 180 days after the child is archived or has left every club's roster (at once if the child's record is deleted). A file may give up to three parent or guardian emails for one player; we keep a name with the first one only. If the file lists volunteers or staff (coaches, managers, a treasurer), we read their name, email and role so your club can review them. Only your club sees them, they never become player records, and only the people the club ticks get a team invitation, kept with that invitation. One invitation email can name several teams, each with its own link. When the club confirms the import, their names and emails are cleared from its review, and everything is deleted within three days. Words in a file's name (like a team or a season) that the club confirms can be remembered as labels for its next import. Those saved labels are club settings, not personal data, and last until the club removes them.
Calendar feeds — a club can connect a schedule it publishes elsewhere so it shows alongside its playerkit schedule. We store the readable events only, visible only to that club's own audience.
Signing in without a password — instead of a password, you can enter your email address and the 6-digit code we send to it. While that code is waiting we store only a one-way hash of it, a one-way hash of a token held by the browser or app that asked for it, a count of wrong tries, and when it expires — never the code itself. It is deleted the moment it is used, when it expires, or after a few wrong tries. The code only works in the browser or app that asked for it, so it is useless to anyone who talks you into reading it out — and we will never ask you for it. The same code confirms your email address, so there is no separate confirmation step.
Sign in with Google or Apple — if you choose it, the provider sends us your name, email, and avatar so we can recognize you. We never receive your password, we keep no access tokens, and we can never read or change anything in your Google or Apple account — signing in is all the connection does. You can disconnect it at any time.
Bot protection on public forms — our public forms use Cloudflare Turnstile to keep automated scripts out. Cloudflare sees standard browser signals for that check — never your name, email, or anything you typed into our form.

The public club directory

A club can choose to be listed in our public club directory, so people can find it by name and ask to join. This is off unless the club turns it on, and a listing shows club information only — the club's name, motto, colors, and sports. Never players, rosters, members, counts, or contact details.
Asking to join requires an account. Your request — your name, email, who you are to the club, and anything you write in the message box — goes to that club's staff and nobody else. It is information you chose to send to a club you chose. The club approves or declines; nothing is shared with you, and nothing about the club's people is shared, unless they approve and set you up.

Team photos

Team photo albums are off unless your club turns them on. To turn them on, the club confirms that it holds the photo permissions its own rules require (such as a media release), and that confirmation is kept permanently, with who gave it and when. Staff confirm they have the right to share the photos each time they upload.
Never public. An album is seen only by the club's staff (every coach in the club can open every album) and by the players on the album's team now and their families. When a player leaves a team, their family no longer sees that team's albums. Photos are stored privately and open only for someone signed in who is allowed to see them.
No location. We re-make every photo when it is uploaded, so no location or camera details are kept. We keep only the date it was taken, to sort the album.
Name tags need your permission. Staff can tag a player in a photo by hand, and only where a parent or guardian (or an adult player for themselves) has given the photo-tag permission in the player's privacy settings, on the web or in the phone app. A tag shows the first name only, is seen only inside the team, and gives your family a "Photos of" view of your player. Withdrawing the permission removes every tag. We never use face recognition.
Video links. An album can link a YouTube, Vimeo or Hudl video. The video service is reached only when you press play; from then its own privacy policy applies.
Hearing about new photos. New photos never send a push notification or an email of their own. If you turn on New photos (Account → Notifications → Advanced) — it is off until you do — your daily or weekly recap email carries one line for each album you are allowed to open that gained photos: its title, the team, the club and how many photos, with a link. Never a photo, a thumbnail, a caption or a tagged name.
Photos in messages — between adults only. Where the club has turned Photos on, adults in a conversation inside the club (staff, parents and adult players) can attach up to ten photos to a message, confirming each time that they may share them. A photo can never be sent or shown in a conversation that includes a player under 18 — checked each time — and club bulletins and team announcements carry no photos. A photo posted in a game chat goes into the poster's own club's album for that game; the other club's people see only a line saying photos were added. Message photos are treated like album photos: no location, stored privately, seen only by the people who can read the conversation. An email or your inbox says "Sent a photo" instead of showing it, and a phone notification keeps its usual generic line.
Storage. Each club has a storage allowance, with optional paid extra storage. When it is full, new uploads are refused — nothing is ever deleted to make room.
Deleting. Deleting a photo or an album removes it, and deleting your message removes its photos at once (see section 7). A deleted game's album stays as an album of the team; a deleted team's albums stay with the club's owners and administrators unless they are deleted with it; a club that leaves playerkit has its albums deleted when it closes. Turning albums off hides them and deletes nothing.

What we never collect

Birth dates — for anyone, anywhere in playerkit. There is no such field.
Home addresses.
Payment card details — the card number and security code are collected and held by Stripe, never by us. For a card you save with a club, we keep its brand, last four digits, and expiry, and for each card tried while saving one, its brand and last four digits (see Payment records above).
Player profile photos. We do not ask for or require a photo of any player.
Biometric data of any kind.

Registration confirmations forwarded by your club

A club can forward registration confirmations to its private import address, or to a separate address it creates for one team. Our dedicated Fastmail receiving mailbox temporarily holds the original email, which may include information the registration provider included, such as birth dates, postal addresses, payment details, and waiver text. We do not add those fields to player records or use birth dates to identify players. Once the minimal registration draft is safely saved, we delete the original mail, even if the registration still needs review. Failed deletions are retried. A three-day mailbox deletion rule covers unprocessed or unsupported mail; receiving is disabled until that fallback rule is configured. Fastmail retains deleted mail in backups for another seven days under its recovery policy, and may process mail outside our primary application-hosting region.

We extract only player names, separately identified contact names and email addresses, season and division labels, and the destination team selected by the club — or the team or season the club previously told us a division or season label means. Those saved label matches are club settings, not personal data, and last until the club removes them. Email-import drafts and sender addresses are encrypted at rest and expire after three days. Keyed duplicate markers and minimal processing metadata remain for up to 30 days to prevent repeated imports. Imported player records follow the normal roster retention rules. Review details may also be held in the existing private import session for its three-day window.

Verified club administrators can forward from their verified account address. Other addresses require a club administrator's approval and proof of email ownership. We retain approved sender addresses, their verification/revocation status, and the approving administrator while the connection exists. Expired verification secrets are removed. We check the actual authenticated sender, not a sender name quoted inside a forwarded message. Unauthorized messages create no players; their contents are not stored in the application.

Clubs can choose review before import or automatic import for complete, unambiguous registrations. Possible existing-player matches and unavailable seasons or teams still require review. Imports never automatically invite or email guardians. After a registration is imported, a club administrator may invite its listed contacts exactly as for a roster import: a contact is linked to the player only if they accept, with no expiry date on the invitation — until the club removes it, or 180 days after the player is archived or has left every club's roster. The club's email goes out only if the administrator chooses; someone who already has an account with that address is told either way. Administrative changes and import outcomes are recorded in the organization's audit log without raw email bodies.

Original forwarded registration emails are a separate, temporary mailbox copy: see “Registration confirmations forwarded by your club” above.

3. How we use your information

In short: to run the service you signed up for, to keep accounts safe, and to send you the messages the service genuinely needs — nothing else.

Running the service — tracking gear, managing rosters, scheduling, collecting the consents the law requires, and processing the payments your club has set up.
A registration filed with your address — a club's public form now asks for the code we email you first, so nobody can use your address on it. If one was filled in with your address before that, and you have not yet answered "Is this your child?" on your Home screen, the club sees only what the form said, and you can't open that child's page. The club's announcements reach you by email, whole, with the club's name and the child's first name. Each has a one-click way to stop that club's emails, which needs no account and tells the club nothing. Nothing about the child's gear or money is sent to you before you answer.
Charging a saved card only as agreed — if you save a card with your club, it is charged only for the one use you signed for. With equipment card cover, nothing is charged unless gear is not returned — and then only for the missing items, never above the maximum you agreed to, and only after the return date and a grace period. Even then, a charge starts only when a club owner or administrator asks for it, which sends you a notice you can contest; the card is charged only after that notice has reached you and its waiting period has passed. Emails about these never show card details.
Billing a player's account — sending the bill for a charge the club added, with its pay link, and the reminders, unless the club has turned them off, to the adult the club bills for that player; and telling the club's owners and administrators when someone says they have sent an e-transfer.
Payment plans — recording your agreement to a plan, sending its payments as bills with their due notices, and showing your club what is paid and what is overdue.
Telling your club about a store order — when you place a store order and say you will pay by e-transfer, and, only if your club turns it on, when you pay for one by card, we email the people and addresses your club chose for store orders: your name, the amount, the order reference and the items, so someone can watch for your transfer or get your order ready.
Keeping accounts safe — sign-in security, two-factor authentication, and checking new passwords against known data-breach lists (using a method that never transmits your actual password).
Necessary email — security alerts, receipts, invitations, schedule changes, and reminders. Optional categories (like schedule notices and message digests) are controlled from your account settings — among them New photos, a line in your recap email when an album you may open gains photos (off until you turn it on; see section 2), and Requests waiting on your club, for people who answer a club's requests: a daily list in the recap email of what is waiting for an answer (registrations, requests to keep equipment longer, people asking to join and payments to confirm: how many and for how long, never a child's name), or one email per request if they choose. If every owner and administrator of a club has turned this off, or turned email off, the club's owners still get a line in a daily recap when a family says it has paid or asks to keep equipment longer, so the request is not missed by everyone. Receipts and refund notices also reach the recorded payer, alongside the people already entitled to them for the registration, order, player or plan. The payer can download that payment’s receipt; this gives no access to the player’s account, plan agreement or other payments. We do not send marketing email unless you expressly ask us to, and we would never send it to a player or use a child's information for it. We keep a record of each email we send — who it went to, which club it concerned, what kind of email it was and when, never its content — so that once a club stops using playerkit, we send you at most three more reminders or digests about that club, and then stop.
Improving the service, using numbers that name nobody — we count and compare things like how much equipment a club of a given size carries, or how often gear is returned late, so we can make the product better and describe the sport honestly when we write about it. These are aggregate statistics. No child's personal information is ever part of them: nothing that identifies a player, or could be traced back to one, goes into these numbers, and neither does anything that identifies a family, a household, or an individual club. We publish and share only figures at that level — never a record, never a list, never one of you.

We do not use your information for advertising. We do not sell it. We do not build behavioural profiles.

4. Children come first

In short: players are usually minors, so the strictest rules in this policy are theirs.

A club can put a player's name on its roster to run its season — a name on a list. On its own, that gives the child nothing to do and no way to be reached: no account, no sign-in, no way for anyone to message them.
A child gets account access only after a linked parent or guardian signs an explicit consent. This is enforced in our code, not just in policy. The sign-in a guardian can then give their child is supervised: the child never holds a password, and the account can never sign waivers, make payments, save a card, or agree to anything the law reserves to a guardian.
A guardian can withdraw that consent at any time, which immediately closes the child's access on every device.
A child under 13 is never in a two-way conversation — no direct messages, no chats, no way for anyone to message them. The only thing a young player's sign-in can see in messaging is the club's read-only announcements.
A teen (13–17) can join their own team's chat only if their club has turned teen chat on and their guardian has confirmed they are 13 or older — and every such conversation stays readable by the teen's guardians. That oversight cannot be switched off. In return, that conversation never reports when anyone read a message: no read receipts, and no reactions either. A teen knows their guardians can read; they are never told the moment they did.
No photo is ever shared in a conversation that includes a player under 18. This is checked every time a photo is sent and every time one is viewed, so a photo already sent is hidden as soon as a player under 18 joins. Players under 18 can never send photos.
A player's full name — and anything else that could identify a player, like a stat line — is never published or sent outside their club without a specific, revocable consent from a parent or guardian (see section 5). A minor can never give that consent themselves. There are two small carve-outs. The first is yours to control: game-day pages and announcer sheets name a player in the form the club chose — first name and last initial unless the club chose the full name, first name only or numbers only — and nothing else about the player beyond the jersey number where a surface already shows numbers and, on the announcer sheet only, how to say the name if you added that. Your family's own choice always wins over the club's and the team's: choose "number only" and the player's name is removed from every game-day surface, or choose a name form and it is used even where the club shows numbers only. The second: if a charge on a card saved with the club is disputed or questioned through the card's bank, the records the club sends to answer it identify the loan and payer, with the child’s name and initials removed.
A player's account — what is owed, paid, and credited for them — is visible only to the adults linked to them (parents, guardians, and other family contacts the club has linked), to an adult player who manages their own account, and to the club staff described in section 5. A child's supervised sign-in never sees it. A pay link shows a player only as their first name and last initial.
We never sell or monetize children's information, under any circumstances, with no exception.
Self-managed accounts are for adults. An adult player can run their own playerkit account — their schedule, gear, profile, and their own waivers. Every path into self-management asks for an explicit confirmation that the player is 18 or older, and what we keep is that confirmation as a fact — consistent with the rule above, never a birth date. A child's account is never self-managed. The full explanation lives at our self-management page.

5. Who can see your information

In short: your own club, your own family, the families on your child's team (who is on the team, by name), our small staff when you ask for help, and the service providers that run the platform. Nobody else — unless you specifically say so, with one game-day exception your family controls: score pages and announcer sheets name a player the way the club chose, or the way your family chose, which wins (the last bullets below).

Your club — staff see the players and equipment their role covers. By default a coach sees only their own team's players; club admins control any wider visibility, and those choices are recorded in an audit log.
Your family — a linked parent or guardian sees their own player's information: profile, equipment, schedule, and activity.
Your child's team — the families of the players on a team now, and the team's adult players, can see who is on that team: each player's first and last name, jersey number and position. Nothing else — never an email, a phone number or an address, never who a player's parents are, and never anyone outside that team or club. The club can switch this off. If your family hides your player's name at games (section 6), it is hidden here too: other families see only the jersey number.
Being added by a club you already belong to — if you already belong to a club (as a member, on one of its teams, as the guardian of a player on one of its teams, or as someone who has bought from its store) and its staff add your email as a guardian or as team staff, we add you straight away and tell you, with a one-tap way to leave. The club already knows you, so this reveals nothing new; a club you are not part of still only sends an invitation.
Other clubs — no. Player information never crosses to another organization, unless the player actually moves there through the normal roster process, or a guardian authorizes a specific disclosure (below).
Our staff — when you ask for support, an authorized member of our staff may temporarily view your account the way you see it. These sessions are read-only, expire automatically, and every one is logged.
Service providers — the companies that help us run the platform: Stripe (payments), our email delivery provider, our hosting provider in Canada, Cloudflare (bot protection on public forms), Sentry (crash and error reports from our apps and servers — see section 2), and Apple and Google (delivering push notifications to phones — an opaque device token, a fixed generic line and routing identifiers, never a name or a message's words; see section 2). Each receives only what its job requires. Some of this limited processing happens outside Canada; where it does, it may be subject to the laws of that jurisdiction.
Saved cards — when you save a card with your club, the club is the merchant, so it can see the card's brand, its last four digits, and your customer record in its own Stripe dashboard. Coaches and equipment staff see whether a player's gear is covered, the maximum, and the covered items — never card details. If a charge on that card is disputed or questioned through the card's bank — by you or by the cardholder — the club's answer can send Stripe the records that show what was agreed: the authorization you signed (its text, when and how it was signed, the cardholder name and your cardholder confirmation), when its copy was emailed to you, proof that the notice reached you and anything you wrote to contest it, and the item descriptions and return records behind the charge for unreturned gear. The submission copy, including the authorization text, identifies the loan and payer and removes the child’s name and initials. The processor, acquiring bank, card network and issuer may receive the records needed to answer the dispute.
A player's account — the family (section 4), and at the club its owners, administrators, and club-wide viewers, plus the staff of the player's current team. Fundraising credits, including any sponsor named in them, are part of the account. Anyone you forward a pay link to can see what that one bill shows (section 2).
With your specific consent — and only then. Some sharing needs your signed permission first: today that is exactly three things — a player's stat line on a game's public live-score page, a stats file a coach can upload to MaxPreps, and a player's name tag on a team photo, seen only inside the team. Each happens only for a player whose parent or guardian (or the player themselves, if an adult managing their own account) has given a specific consent for that exact place — revocable at any time, effective immediately. No permission decides a player's name any more: the game-day name described below follows the club's choice and yours. You can give the live-score permission from your account today, and the photo-tag permission in the player's privacy settings (on the web or in the phone app) where your club has albums on; club staff then place tags on the album screens. No screen yet asks for the MaxPreps permission, so that happens only where such a permission is already on record. Announcer-sheet permissions are no longer asked for; one already signed stays on file and changes nothing.
Public pages show almost nobody. Anything anyone can see without signing in — a public store, a shared team calendar — is built to show no player names and no family information. The one exception is game day: a game's public live-score page names the scorers of scoring events, and the announcer's phone page lists the roster by jersey number and name. In both cases the name is the form the club chose — first name and last initial unless the club chose the full name, first name only or numbers only — or the form your family chose, which always wins. No signed permission is needed for the name. The pronunciation note, where you added one, appears on the announcer page only, beside whichever name form is shown there. The live-score page carries no roster; its list of scoring plays carries no jersey numbers, and it shows a player's stat line, with their jersey number, only with the permission described above. Its link stops working 30 minutes after the game is finalized or ended, or 12 hours after kickoff if nobody ends it; until then, treat it as public. A past game names the child who wore a number at that game, never whoever wears it now. Your family can hide your own player from these pages at any time, from your own account (see section 6).

6. Your choices and rights

In short: you can see, correct, download, and delete your information — most of it yourself, from your own account settings.

Access — download a copy of your information (and your linked children's) from your account settings, or ask us for it. The download holds your account, your family links, your children's profiles, teams and measurements, game-day name settings, the permissions you signed and the messages you wrote (with how many photos each one carried, not the photos), your sign-in history and devices, availability and attendance, gear, payments and orders, signed waivers, registrations, appointments, found reports and photo tags. Other adults in those records are named by their role only. Club staff's own notes and the evidence kept with a signed agreement are not in the file; email privacy@playerkit.app for those.
Correction — fix inaccurate information yourself where the app allows, or ask us to.
Deletion — delete your account from your account settings. There is a 14-day grace period in case you change your mind; after that, your account and the personal information tied to it are permanently deleted, including the messages you wrote. If you would rather email us, our staff can retire the account for you: your email address, phone, password and sign-ins are removed right away (the address is free to reuse immediately), your club memberships end, and the record is hard-deleted 14 days later.
Deactivation — pause your account instead of deleting it. Nothing is erased, and signing back in reactivates it.
Withdrawing consent — any consent you gave (a child's account access, a disclosure to an outside destination, a live-score stat-line permission) can be withdrawn from your account at any time, and takes effect immediately.
Choosing a player's game-day name — the name at games (section 5) is not a consent, so there is nothing to sign or withdraw. In the player's Privacy settings, on the web or in the phone app, choose let the club decide (the default), full name, first name and last initial, first name only, or number only; your choice wins over the club's and the team's from that moment. With "number only", the player shows without a name on every game-day surface — and to the other families on the team roster and the team's stats table, by jersey number only. The same place sets the pronunciation note. A parent or guardian who manages the player's profile chooses for a child; an adult player who manages their own account chooses for themselves.
Removing a saved card — see and remove any card you saved with a club, at any time, from your own account. The screen tells you what will happen before you confirm: the card is removed from the club's Stripe account (if that account can no longer be reached — for example, because the club has left playerkit — we mark the card removed on our side, and it stays on the club's own Stripe account, under the club's control); a card cover ends, and the club may ask for a deposit instead; and an amount you were already sent a notice for is not cancelled and stays owed to the club. You can still view the authorization you signed (section 7).
Notification controls — optional email categories, digests, and quiet hours are yours to set under Account → Notifications.

To exercise any right, or ask how your information is used, email privacy@playerkit.app. We respond within the timeframe PIPA (Alberta) / PIPEDA (Canada) requires. If you are not satisfied with our answer, you may also contact the privacy regulator under PIPA (Alberta) / PIPEDA (Canada).

7. How long we keep it

In short: while your club or account is active, plus a few deliberate windows — and some signed records the law requires us to keep.

Your club's data is kept while its subscription is active, and for a 30-day grace period after cancellation.
Deleting your account permanently removes the personal information tied to it after the 14-day grace period. Where a club record you made has to stay attributable (an equipment receive session you ran, an age bracket you verified, a payment plan you agreed to or registered a player under), the account becomes an anonymized placeholder instead: everything that identifies or reaches you is removed and nobody can sign in as you, and only your name on that history stays.
Charges, payments, and fundraising credits on a player's account are the club's financial records and are kept with the club's data, as above.
Payment-plan agreements are kept with the bills they back, as financial records: seven years after the final relevant financial event.
Audit logs are kept for 7 years. They record actions, not personal details where feasible; once a person is deleted, their name in old records degrades to a generic label like "Former staff." We keep them this long so we can investigate a security incident or reconstruct what happened to an account or a piece of equipment.
Website visit counts are kept for 13 months, then deleted by a daily job. They were never tied to an account.
Signed consent and waiver records are legal evidence and are kept for the applicable statutory period, even after an account closes — that is what makes a signature worth signing.
Saved-card records — evidence (the authorization and signed text, notices and delivery proof, contests, resolutions and charge outcomes) is kept during the authorization and for at least two years after the later of its release/end and the last charge. This is a review point, not an automatic destruction date. Financial records — charges, refunds and their supporting evidence — are kept for seven years after the final relevant financial event, and longer when tax requirements, later relevance or payment-processor obligations require it. A record in both categories follows the longer period; contested or disputed records join the financial category. A hold prevents deletion for a contest, dispute, complaint or anticipated litigation. Each matter has its own reason: closing one matter does not release another hold, and a closed payment dispute triggers review, not automatic release. Before destruction, we check for related proceedings, appeals, complaints and manual holds. Retained information is minimized and access-restricted, and is deleted or anonymized when it is no longer needed. The card’s brand and last four digits are removed when retention ends; expiry is removed when the card is removed. The payer can view and print their own authorization copy for as long as it is retained, even after the club leaves playerkit.
An email address that permanently bounces, or that reports us as spam, goes on a suppression list and stays there. We keep the address, the reason and the dates, and nothing else — no message content, no name, no link to an account. It is kept indefinitely on purpose: a list that expired would let us mail a dead address all over again, which is the harm the list prevents. A temporary failure like a full mailbox does not suppress on its own. A suppression can be lifted if an address was mistyped or a mailbox is fixed.
Our record of the emails we send is kept for 13 months, then deleted automatically. It holds who an email went to (your account, or, if you have no account, a keyed fingerprint of the address), which club it concerned, what kind of email it was and when — never the content, the subject line or the address itself. For an email club staff send about gear still out, it also says which player it was about, who sent it and whether it had a note. Deleting your account deletes your entries.
Player measurements are deleted 3 years after a player goes inactive, by default. While a player is on any roster in your club, their whole size history is kept, however far back it goes — that history is the point of recording it. Once they are off every roster, the clock starts from when they left, and their measurements for that club are then permanently deleted. Each club keeps its own records under its own window, so leaving one club never removes anything from another. Club admins can set a different window for their club, shorter or longer.
A club's guardian invitation (from a roster import or a registration email) has no expiry date: it works until that parent accepts or the club removes it, and stops 180 days after the child is archived or has left every club's roster (at once if the child's record is deleted). A plain emailed invitation to connect with a player can be accepted by signing in with that address for 180 days after it was sent (or last re-sent); its emailed link stops working after 7 days. For an invitation we email, we also keep our email provider's message reference and whether it was reported delivered or bounced, so the club can see whether it arrived and send it again or to a corrected address.
Team photos — album photos and photos in messages — are removed from our storage 7 days after they are deleted, by a daily job. A deleted conversation's photos are kept only for its 30-day restore. The club's confirmation that it holds its own photo permissions is kept permanently.
Short-lived data is deleted on a schedule: roster import files, and the volunteers' names and emails a file lists, after 3 days, a lost-item finder's contact details after at most 90 days, crash and error reports after 90 days, and daily encrypted backups after 30 days.
A phone's push-notification token lives only as long as the sign-in it belongs to: signing out of the app, forgetting the device, or signing that device out from your account's security settings deletes it at once — as does a report from Apple or Google that the token is dead.
Because backups are snapshots, information you delete can persist inside a backup copy for up to 30 more days before those copies age out.

8. How we protect it

The most sensitive information — player names and emails, everything you sign, message content, contact secrets, the address a bill's pay link was sent to — is encrypted at rest. That means each of those values is scrambled into unreadable code (using AES-256, a standard encryption algorithm) before it is written to storage, and can only be turned back into readable text with a secret key our application holds. If someone obtained a copy of our database, or a backup of it, those fields would be unreadable without that key. This is separate from encryption in transit below: one protects information while it is stored, the other while it travels. Beside each encrypted player name we keep two keyed one-way codes so a club can find a player without us decrypting anything: an exact code of the name, and a coarser code of how it sounds. Neither can be reversed into the name. The coarser one does exactly one thing — it warns a person during a roster import, or when adding a player, that someone already on their roster sounds like this name. It never merges, blocks or decides anything on its own.
All traffic is encrypted in transit — everything that travels between your device and playerkit is encrypted, whether that device is a computer running a web browser (the padlock in the address bar) or a phone using our app on Wi-Fi or cellular data. If someone can watch the network in between — on shared café or airport Wi-Fi, say — they see scrambled data, not what you typed or what came back.
On your phone, the app stores little, and what it stores is encrypted. Your sign-in credential lives in the phone's own secure keychain. Four things live in one encrypted file on the phone (AES-128, with a key generated on the phone and held only in that same keychain — so a copy of the file is unreadable anywhere else): your sign-in session (your name and email, your clubs, teams and roles, and — for a parent or guardian — the names of the children you are linked to), so the app still opens as yours when there is no signal; equipment actions a staff member's scanner captured while offline (which item, which action, and the identifiers needed to replay it — never a person's name), held until they reach us and re-checked by our servers before anything is applied; and, for club staff, a working copy of the roster names and storage locations they were already shown online (player names, including minors', and staff names — never a guardian's), so gear can be handed out or put away where there is no signal; and an unfinished checkout identifier and fingerprint, so reopening after an uncertain payment answer cannot start a second purchase. That checkout record contains no card details, card token, names or cart contents and ends on acknowledged completion, a safe reset, or sign-out. Signing out clears all of it except the queued actions, which stay locked to the account that captured them so offline work is never silently lost — no other sign-in on that phone can open them. Apart from that, the app and the website may keep an unfinished club-setup draft (team and season names, no personal information) on the device until it is saved or for at most 30 days. You can see every device signed into your account, and sign any of them out, from your account's security settings.
Opening the app from the website. If you are signed in on the website on your phone and tap Open in the app, the app is signed in with a single-use code that expires after 60 seconds. We keep only a one-way hash of it, with your account, the times, and the name the app gives the device, for 30 days. The new sign-in shows in your security settings like any other, and we tell you about it in the app — no email.
Access is enforced by role: the app checks who you are and what your role allows on every request.
Two-factor authentication is available on every staff and volunteer account, and we recommend it for club owners and admins.
New passwords are screened against known data breaches, without your password ever leaving our systems.
Our own staff use individually named, two-factor-protected accounts — there are no shared logins.
If a breach poses a real risk of significant harm, we will tell you — as fast as we safely can, and we aim for within 72 hours of discovering it. We will only take longer if law enforcement asks us to hold a notice while they act, or if telling you before the breach is contained would put you at more risk — and a delay is never a decision not to tell you. If minors are affected, every linked guardian is notified directly, and we report qualifying breaches to the privacy regulator as required.

Security concerns can be reported any time to security@playerkit.app.

9. Cookies

We use only essential cookies today — the ones that keep you signed in and make the app work. They do not track you across other sites. Your account settings include controls for optional cookie categories (functional, analytics, marketing); we currently set none of those, and if we ever introduce one, it will respect the choice you have already saved and we will update this policy first. The count of visits to our public pages (section 2) is not a cookie and stores nothing on your device.

To avoid duplicate payments after a lost answer, store and scan-and-buy checkouts also keep an opaque payment identifier and a fingerprint in tab-scoped browser storage. A public fee-payment page keeps an opaque identifier and, once acknowledged by the server, the payment amount and currency. No card details, card tokens, names or cart contents are kept in these records. The identifier is sent with the payment request to recognize the same operation, not to authorize it. Browser copies end when the tab closes or the flow explicitly clears them. The phone's checkout copy uses the encrypted store above and ends on acknowledged completion, a safe reset, or sign-out. Unknown outcomes stay available for recovery. These records are essential to payment safety and do not track you across sites.

10. Changes to this policy

Material change — 2026-11-11. When a club owner or admin lets you keep gear that the club's rules would have come back, we now keep who decided it, when, which rules were set aside and a note they write saying why. Only the club's owners and admins can read the note; it is not shown to you and is not in your data download. Section 2 says so. This is a material change because the note is new information about you. It takes effect on 2026-11-11. The 14-day advance notice was waived for this change by our founder's decision of 2026-11-11; the 14-day promise below stands for every future material change.

Material change — 2026-11-05. When your club gives money back to you, we now keep how it went back, how much, who recorded it and when, whether the club says you still owe it, and any note the staff member adds. You see all of it, the note included, in your data download. Section 2 says so. This is a material change because the note is new information about you. It takes effect on 2026-11-05.

Change — 2026-11-03, not yet live. Deposits paid by hand: you can tell your club "I've sent it". The staff your club chose for club emails get an email with your child's first name, the team, the amount and the way, and a link to mark it received. "Payment records" in Section 2 says what we keep.

Material change — 2026-10-30. Photos in messages: where your club has turned Photos on, adults can now share photos in messages — in a conversation inside the club, or in a game chat, where the photo goes into the poster's own club's album for that game. A photo can never be sent or shown in a conversation that includes a player under 18, players under 18 never send photos, and club bulletins and team announcements carry none. Each photo is re-made so no location or camera details are kept, stored privately and seen only by the people who can read the conversation; emails and phone notifications never carry one. Section 2 now describes team photos — albums and photos in messages — in full; section 4 adds the under-18 rule; section 6 says your data download counts the photos each of your messages carried; section 7 says photos are removed 7 days after they are deleted. This is a material change because messages could only hold text before. It took effect on 2026-10-30. The 14-day advance notice was waived for this change by our founder's decision of 2026-10-30; the 14-day promise below stands for every future material change.

Non-material clarification — 2026-10-30. Section 2 now describes the team photo albums a club can turn on — who sees them (the club's staff, and the players on the album's team now and their families), that no location is kept, name tags only with your permission, video links, storage, and what happens when a photo, album, game, team or club is deleted — and New photos, an optional line in your recap email, off until you turn it on (also in section 3). Section 5 now says the photo-tag permission is given in the player's privacy settings, on the web or in the phone app; it had said no screen asked for it. These describe how the albums already work. No new information is collected.

Material change — 2026-10-28. Names at games: your club now chooses how players are named on every game-day page and sheet — the full name, first name and last initial, first name only, or numbers only (first name and last initial if it has not chosen) — and your family's own choice wins over the club's and the team's, in either direction: let the club decide, full name, first name and last initial, first name only, or number only, in the player's Privacy settings. A full name no longer needs your signed permission; the live-score permission now covers only a player's stat line on that page, shown with the jersey number. Announcer-sheet permissions are no longer asked for, and ones already signed change nothing. A saved "first name and last initial", which the old screen chose for you, was reset to "let the club decide". This is a material change because a club that picks full names now shows a child's full name on public game-day pages unless the family chooses otherwise. The same change also narrows what is shown: a game's public live-score link stops working after the game, a past game names the child who wore a number then, linked games send no names between clubs, and a club's reports on past seasons no longer list children who have left it. Section 6 now says what your data download holds — now nearly everything, with other adults named by their role, also on the phone app — and that you can ask us for the rest. It took effect on 2026-10-28. The 14-day advance notice was waived for this change by our founder's decision of 2026-10-28; the 14-day promise below stands for every future material change.

Non-material clarification — 2026-10-28. Section 2 now describes the contact form on a club's store page: what you type is emailed to the people your club chose for store questions, each as their own email, and we do not keep it. The form already worked this way, except that it now sends each person their own email rather than one email to all of them. No new information is collected.

Non-material clarification — 2026-10-26. Section 2 now says that your account at a club shows the ways the club says it takes payment outside the app, with where to send it, and that if a club closes its account while you still owe it something, you still see what is owed and, if the club took e-transfers, the address it took them at, so you can settle with the club directly. Only the adults linked to the player who can see their account see that address — the one the club gave families to send money to — and never the club store's contact addresses. No new information is collected.

Non-material clarification — 2026-10-25. Section 5 now says that the families of the players on a team, and the team's adult players, can see who is on that team: each player's name, jersey number and position. These families could already see the same names in the team's stats table. Your club can switch the roster off, and a player whose family hides their name at games is shown to other families by jersey number only, on the roster and in the stats table. No new information is collected, and nobody outside the team sees it.

Non-material payment-safety clarification — 2026-10-15. We now link a payment to its explicitly known payer for receipts, refund notices and access to that payment’s receipt only. We also describe the essential opaque checkout recovery records newly stored in a browser tab or the phone’s existing encrypted store to prevent duplicate payments. This stays within the financial record and payment purposes already described: no new personal-data category, processor, advertising use or broader player-account access. No card details, card tokens, names or cart contents are stored in the recovery records. The advance-notice promise for future material changes remains unchanged.

Material change — 2026-10-14. Payment plans: a payment plan no longer saves a card or charges anything automatically. Each payment is a bill on the player's account that you pay yourself, and for each payment after the first you get a notice in the 3 days before its date and on the day. When you agree to a plan, we keep who agreed, when, in which language and the exact text shown, with its fingerprint, instead of a signed card authorization, and we send it to no one. Retries, recovery payments and changing a plan to one payment of the balance no longer exist. No payment plan had been used yet. It took effect on 2026-10-14. Only one club was active at the time, and nothing was taken away from anyone, so the 14-day advance notice was waived for this change by our founder's decision of 2026-10-12; the 14-day promise below stands for every future material change.

Material change — 2026-10-06. Equipment appointments: we now send reminders by email and app notification 24 hours and 2 hours before a booked pickup, drop-off or return, and appointment confirmations, a club's cancellations and a club moving an appointment to a new time or place now go to the player's family — the parents and guardians connected to the player who receive notifications, and a player who manages their own account — not only to the person who made the booking. A staff member who booked at the club's desk no longer gets them. Emails name the player, the time and the place; app notifications name no one. The person who made a booking always gets its confirmation; from the next update of playerkit, everyone else's copies follow their own notification settings for Schedule (and Equipment, for gear a family keeps over the off-season). Nothing new is collected or shared with anyone new. It took effect on 2026-10-06. The 14-day advance notice was waived for this change by our founder's decision of 2026-10-06; the 14-day promise below stands for every future material change.

Material change — 2026-10-06. Donations are removed from playerkit. Donors are no longer a kind of person this policy covers, and we no longer collect a donor's name, address or email: clubs can no longer record donations or issue donation receipts through playerkit, and there is no longer a Donate page. Our promise that we never collect home addresses no longer has an exception. Nothing was ever stored — no club had recorded a donation or issued a receipt. A club can still ask for a gift as an ordinary payment, such as a store item or a charge on a player's account; you get the usual payment receipt, and any receipt for tax purposes is the club's to issue itself, outside playerkit. Fundraising is unchanged. It took effect on 2026-10-06. Only one club was active at the time, and nothing was taken away from anyone, so the 14-day advance notice was waived for this change by our founder's decision of 2026-10-06; the 14-day promise below stands for every future material change.

Correction — 2026-10-06. Payment plans: a declined payment that may succeed later is tried again 7 days after we tell you it was declined, then 7 days after that; this policy had said the first try came 3 days later. We also now say that the plan you sign gives your club's contact details and its refund and cancellation policy, that a copy is emailed to you, that you can pay a payment that did not go through from the app, and what happens when your club changes a plan to one payment of the remaining balance, including the 7 days you have to pay it. Nothing new is collected or shared, so this is not a material change, and the date this version took effect is unchanged.

Material change — 2026-10-03. Roster imports: a file may give up to three parent or guardian emails for one player (we keep a name with the first one only); a file may list volunteers or staff, whose name, email and role only your club sees, to review — they never become player records, and only the people the club ticks get a team invitation; their names and emails are cleared from the import's review when the club confirms it, and deleted within three days; words in a file's name that the club confirms can be remembered as team or season labels; and one invitation email can name several teams, each with its own link. It took effect on 2026-10-03. Only one club was active at the time, and the 14-day advance notice was waived for this change by our founder's decision of 2026-09-30; the 14-day promise below stands for every future material change.

Material change — 2026-10-02. Found reports: you now give a way to reach you or a note (at least one); a report about a club's sticker that is not yet on an item goes to the club that owns it; a club's staff may note where an item was found and where it is kept, never your contact details or message; and if you are signed in, the found-report form skips the bot check and limits each account instead — we do not record which account sent a report. It took effect on 2026-10-02. Only one club was active at the time, and the 14-day advance notice was waived for this change by our founder's decision of 2026-10-02; the 14-day promise below stands for every future material change.

Material change — 2026-09-29. A record of the emails we send: who each one went to (your account, or a keyed fingerprint of the address if you have no account — never the address itself), which club it concerned, what kind of email it was and when, never its content. We use it to stop writing to you about a club that has stopped using playerkit: at most three more reminders or digests about that club, then none. It is kept for 13 months. The details are in sections 3 and 7. It took effect on 2026-09-29. Only one club was active at the time, and the 14-day advance notice was waived for this change by our founder's decision of 2026-09-29; the 14-day promise below stands for every future material change.

Material change — 2026-09-28. A player's account with the club: charges staff add at the club, the emailed bill and its pay link (what the page shows, that it needs no sign-in, and that it stops working after 90 days), and reminders. Store purchases can say which of your players they are for. Fundraising campaigns and their credits, which can name a sponsor. And a new kind of person: donors to a club, which can now issue donation receipts — what we keep, why, who can see it, and how long it is kept. Our promise that we never collect home addresses gained its one exception: a donor's mailing address, collected only when the club issues official donation receipts and only to print on that receipt. Your calendar feed can now show a charge's due date or a fundraising deadline; we never add an amount to it. The same day, a club's guardian authorization from a roster import or a registration email: once the club authorizes a parent's email address, that parent is linked to their child when they sign in with it — there is no expiry date; it stops when the club removes it, or 180 days after the child is archived or has left every club's roster. The details are in the short version and sections 2 to 8. It took effect on 2026-09-28. Only one club was active at the time, and the 14-day advance notice was waived for this change by our founder's decision of 2026-09-27; the 14-day promise below stands for every future material change.

2026-09-20: Saved-card evidence now follows the two retention buckets and matter-specific holds in section 7. Dispute copies identify the loan and payer without the child’s name or initials. The signed agreement includes the club’s Stripe business contact, refund policy and separate guardian confirmation.

If we make a material change, we tell you by email and by an in-app notice at least 14 days before it takes effect, so you have time to read it and act on it. When a change is something you can choose, the notice says so and tells you how. The current version took effect on 2026-11-11.

Material change — 2026-09-17. Saved cards: a family can save a card with their club for equipment card cover, or to pay a registration fee in instalments. What we keep, how a saved card may be charged, who at the club can see it, how to remove one, and how long the records are kept are in the short version and sections 2 to 7. It took effect on 2026-09-17. At the time it took effect the only active club was our own, so there was no one owed the advance notice; the 14-day promise above stands for every future material change. Nothing is saved or charged this way until a club turns the feature on, and both are switched off today.

11. Contact

Privacy questions and requests: privacy@playerkit.app
Security concerns: security@playerkit.app
General support: support@playerkit.app