Privacy Policy — playerkit

Effective date: 2026-10-15

playerkit helps sports clubs, leagues, and schools manage their equipment, rosters, and seasons. That means families trust us with information about themselves and their children, and this policy explains what we do with it.

Parents and guardians have their own accounts here — this is not a club-only tool. A club links you to your own child, and from that link you can see the gear they have been issued, record their sizes, sign the waivers a season requires, pay a fee or deposit, book a pickup or return, claim a jersey number, and decide whether your child may have a supervised sign-in of their own. Everywhere this policy says "your family," it means that link. All of it works the same whether you use playerkit in a web browser or through our phone app.

We have kept it short on purpose. Every category of information we handle is described here in plain language. Some specifics sit in our fuller privacy policy instead — exact retention timelines, exactly which fields are encrypted, the complete list of the service providers we rely on, how a specific feature works. You are entitled to any of it: email privacy@playerkit.app and we will answer with specifics, or send you the longer document.

The short version

We collect the minimum needed to run your club's equipment, rosters, schedules, and payments — and nothing for advertising.
We never sell your information, we show no ads, and we build no profiles. Not for adults, and never, under any circumstances, for children.
We do use aggregate numbers that name nobody — how much gear a club of a given size carries, and the like — to improve the product and to write honestly about the sport. No child's information is ever part of them, and we never publish anything traceable to a person, a family, or a single club.
Player records never store birth dates, home addresses, or player photos. Where age matters we store a coarse label (like "U13") or a fact a guardian confirmed — never a birth date.
Payment card details never touch our systems. Card entry goes directly to Stripe, our payment processor.
If you save a card with your club, it stays with Stripe on the club's own account. We never hold its number: we keep its brand, last four digits, and expiry so you can tell which card it is; it is charged only as the authorization you signed says; and you can remove it at any time.
A child cannot have an account without a parent or guardian's signed consent, and a child under 13 can never be privately messaged through playerkit.
Information about a player stays inside their own club unless a parent or guardian gives specific, revocable permission to share it somewhere named. Two small exceptions. The first is yours to switch off: on game day, score pages and announcer sheets show a player's first name and last initial (announcer sheets also carry the jersey number) — never the full name without your signed permission, and the club, the team, or your family can turn the name off. The second: if a charge on a card saved with the club is disputed or questioned through the card's bank, the records the club sends Stripe to answer it identify the loan and payer, never the child (section 5).
Our primary systems are hosted in Canada, and the most sensitive information is encrypted at rest — stored as unreadable code that needs a secret key to unlock.
You can download a copy of your information or delete your account at any time, from your own account settings.
If we make a material change to this policy, we tell you by email and in the app at least 14 days before it takes effect.

1. Who we are

playerkit operates playerkit. We are based in Alberta, Canada and are governed by PIPA (Alberta) / PIPEDA (Canada). For anything in this policy, you can reach us at privacy@playerkit.app.

2. What we collect

In short: account basics for adults, a name and roster details for players, the records your club creates as it runs its seasons — and a deliberate list of things we never collect.

Information you give us

Account basics — your name and email address, and a password only if you choose to set one (stored only as a one-way hash, so we never see it). You can instead sign in with a code we email you — see Signing in without a password below — and an account created that way stores no password at all. Optionally: a phone number, a title, display preferences, a recovery email address, and two-factor authentication settings. Optional contact details and your two-factor secrets are encrypted at rest.
Player information — a player's first and last name, team, jersey number, and an optional email address, added by their club or by their family. A player's name and email are encrypted at rest. A family may also add an optional note on how the name is said (like "AY-vree" — also encrypted, never a recording) and choose the game-day name settings described in sections 4 and 5: the short name form, the hide switch, and the signed full-name permission. The pronunciation note is shown only on the announcer sheet or page, beside the name that sheet already shows — and it disappears wherever the name does.
Family links — which parents and guardians are connected to which players, so the right adults see the right child's information and sign what only a guardian can sign. The link itself stores two things: a relationship label ("mother", "stepdad" — your club may pre-fill it, and you can change it), and a set of permission switches — whether you can sign waivers, manage the player's profile, see their equipment, book pickup and return appointments, manage a supervised sign-in, and whether you receive notifications about them. Your club sets these when it invites you or approves your link request, and they can be changed or revoked at any time.
Optional player measurements — sizes (like helmet or jersey size) a parent, coach, or admin can record so gear fits. Clubs can also let the system estimate a size from the gear a player was issued; club admins can switch that estimation off.
Things you write in the app — messages (if your club uses in-app messaging), event RSVPs, availability answers ("can you make Saturday's game?"), appointment notes, and similar. Message content is encrypted at rest and is readable only by the people in that conversation. We never use it for advertising, and we never build a search index over it.
Reactions to messages — a small emoji response, chosen from a fixed set of six. Reactions only exist where your club has turned them on and you have turned them on for yourself; both are off by default, and we store your own preference on your account. Others see a count, never a list of who reacted, and reactions are switched off entirely in any conversation involving a minor or an observing guardian — the same rule that keeps read receipts out of those conversations (see section 4). Reacting notifies nobody.
Signed documents — when you sign a waiver or a consent electronically, we keep a legal record of that signature: your typed name, the date and time, the device and internet address you signed from, and an exact snapshot of the text you agreed to. The personal details in these records are encrypted at rest.
Payment records — when you pay a club fee or deposit online, we keep the record of the payment: the amount, its status, and who paid when that identity is known. We link a payment to the signed-in account that made it, or the signer of the saved-card authorization used for it. We do not guess from an anonymous link or a staff member entering the payment. If you pay a fee from the QR code on a club's price list, without an account, we also keep your short answer to "Who is this payment for?" with the payment, so the club can match it to the right player. The card number itself goes directly to Stripe and never touches our systems. If you save a card with a club for equipment card cover, the card is saved with Stripe on that club's own account. A payment plan never saves a card. We keep Stripe's reference numbers for the card and for your customer record there, plus the card's brand, last four digits, and expiry, so the app can show you which card it is. You sign an authorization for that one use, kept like any signed document above, together with the cardholder name you enter (encrypted) and your confirmation that you are the cardholder or are authorized by them. If you sign on a club's device while you are there in person, the record names the staff member whose device it was, and the device and internet address it keeps are that device's. While a card is being confirmed, we record each card tried: its brand, last four digits, whether it went through, and the decline code if it did not. We also keep the record of each charge made under it: the notices we sent and whether they reached you, anything you wrote to contest one, and — for gear that was not returned — the items and their issue and return dates.
Your club's own cards — when your club saves a card for its subscription or as a backup card, we show the club's owner the card's brand, last four digits and expiry so they can recognise it.
Who a store purchase is for — when you buy from your club's store, you can say which of your own players the purchase is for. We keep that link, and your purchase history and the club's order list show those players' first names.

Records created as you use playerkit

Equipment records — what gear exists, who it is assigned to, who is holding it, and its return and repair history. This is the core of the service.
Schedule records — appointments, games, practices, attendance, and game scores.
A player's account with the club — what is owed and paid for a player: fees, store purchases, items and other charges club staff add to the account at the club, and fundraising. For each charge we keep the items, the amounts, the due date, and who added it; if the club covers a charge itself, the reason staff give; and for a payment the club records itself (e-transfer, cash, or cheque), the amount, the method, the date, and the staff member's note. When staff add a charge, the adult the club bills for that player is emailed a bill with a pay link. The link opens without signing in, so treat it as private: its page shows the club, the items, the amount, the due date, the club's e-transfer instructions if it takes e-transfers, and the player's first name and last initial — nothing else about the player or family. We store only a one-way hash of the link, never the link itself, plus the address it was sent to (encrypted). It pays that one bill only and stops working after 90 days. While a bill is unpaid, reminders are sent by email by default; the club can turn them off, except the notices for a payment plan's payments, which are always sent. Beyond these we do not chase payment, add fees or report anyone.
Payment plans — if your club offers one, you can pay a registration in several payments on dates the club sets. No card is saved and nothing is charged automatically: each payment is a bill on the player's account that you pay yourself. When you agree, we keep a record of who agreed, when, in which language, and the exact text you were shown, with a fingerprint of it — no internet address, device or typed name. You and the club's owners and administrators can see it; we send it to no one, including Stripe. You get a copy of the agreement by email. For each payment after the first, you get a notice in the 3 days before its date and on that date, whatever the club's reminder setting, and weekly reminders while a payment is overdue only if the club has reminders on. If you registered the player and the club has not approved your link to them yet, you can still see the plan and pay its payments, and nothing else on the player's account.
Fundraising — if your club runs a fundraising campaign, we keep each player's goal, the deadline, and each credit toward it: the amount, the date, where it came from, and a short description staff type — which can name a sponsor or a business. A family's own card contribution is kept like any other payment. If the club offers a buy-out, the part of a goal still unmet at the deadline becomes a charge on the player's account. A charge's due date and a campaign's deadline appear in your family's calendar; in your personal calendar feed they show only the item or campaign name and the date — we never add an amount or a player's name to calendar feed entries (the item name is the one club staff typed).
Security records — a log of sign-ins and security events on your own account (visible only to you), a rough "last active" timestamp, and a record of who viewed a player's scannable tag. These exist to protect accounts, not to track behaviour: we do not log the pages you visit.
Crash reports — if our phone app crashes or runs into an error, it sends us a report so we can fix it. A report carries the phone model and operating-system version, the version of our app, the error and the sequence of code that led to it, the names of the screens you moved between (never anything typed on them), a count of app sessions and whether each ended normally, and an anonymous account number so we can tell whether one person or many are affected. A small sample of sessions also reports how long screens took to load. A report never carries your name, your email, your messages, your photos, a gear or roster record, or a link containing one of the private codes that opens a tag or a sign-in — the app removes those before anything is sent. Our web app and our own servers report errors to the same service under the same rule: no personal details. These reports go to Sentry, a crash-reporting service (see section 5), and are deleted after 90 days (see section 7).
Visits to our public website — on the public marketing pages only (home, features, pricing, help…), our own server counts page views: the page, the site you came from, browser and device type, language, and the country and city your address points to. No cookie, nothing stored on your device, no IP address kept, no third party, nothing tied to an account. Off when your browser sends Do Not Track or Global Privacy Control. Never in the app, on scan pages, in the mobile app, or on a join, payment or deletion link.
Push notifications — if you allow notifications on your phone, the app gives us the push token the phone's operating system issued for it: an opaque delivery address, never a hardware serial or advertising identifier. We store it hashed and encrypted, tied to your sign-in, and delete it the moment you sign out of the app or forget the device from your account's security settings. A notification we send says nothing about anyone: a fixed generic line for its kind ("New message", "Safety notice", "Schedule update"), the identifiers the app needs to open the right screen, and your unread count for the badge — never a person's name, a message's words, an amount, a requirement's title or a player's status. The app fetches the real thing over your signed-in connection when you open it. Which kinds reach your phone is your choice in Account → Notifications: only safety notices and messages addressed to you are on to begin with; everything else is off until you turn it on, and your quiet hours and snooze apply to push exactly as they do to email. The phone's own notification permission is the last word. Push notifications travel through Apple's and Google's push services (see section 5). Accounts on the under-13 path (section 4) never register a push token — their guardians receive instead.

Information that arrives from somewhere else

Roster imports — your club can import the roster it already manages elsewhere (a spreadsheet, or an export from another sports platform). We keep only the narrow fields we would collect anyway — names, optional emails, team, jersey number, a coarse age label. Anything else in the file (birth dates, phone numbers, addresses, photos) is discarded during processing and never stored. If the file lists a parent's or guardian's email, nothing is sent and no one is linked until the club chooses to authorize them. Once it does, that parent is linked to their child when they sign in with that email address — proved by the code we send to it — or right away if they already have a verified account with it. The club may also email them an invitation. An authorization has no expiry date: it works until that parent signs in or the club removes it, and stops 180 days after the child is archived or has left every club's roster (at once if the child's record is deleted). A file may give up to three parent or guardian emails for one player; we keep a name with the first one only. If the file lists volunteers or staff (coaches, managers, a treasurer), we read their name, email and role so your club can review them. Only your club sees them, they never become player records, and only the people the club ticks get a team invitation, kept with that invitation. One invitation email can name several teams, each with its own link. When the club confirms the import, their names and emails are cleared from its review, and everything is deleted within three days. Words in a file's name (like a team or a season) that the club confirms can be remembered as labels for its next import. Those saved labels are club settings, not personal data, and last until the club removes them.
Calendar feeds — a club can connect a schedule it publishes elsewhere so it shows alongside its playerkit schedule. We store the readable events only, visible only to that club's own audience.
Signing in without a password — instead of a password, you can enter your email address and the 6-digit code we send to it. While that code is waiting we store only a one-way hash of it, a one-way hash of a token held by the browser or app that asked for it, a count of wrong tries, and when it expires — never the code itself. It is deleted the moment it is used, when it expires, or after a few wrong tries. The code only works in the browser or app that asked for it, so it is useless to anyone who talks you into reading it out — and we will never ask you for it. The same code confirms your email address, so there is no separate confirmation step.
Sign in with Google or Apple — if you choose it, the provider sends us your name, email, and avatar so we can recognize you. We never receive your password, we keep no access tokens, and we can never read or change anything in your Google or Apple account — signing in is all the connection does. You can disconnect it at any time.
Bot protection on public forms — our public forms use Cloudflare Turnstile to keep automated scripts out. Cloudflare sees standard browser signals for that check — never your name, email, or anything you typed into our form.

The public club directory

A club can choose to be listed in our public club directory, so people can find it by name and ask to join. This is off unless the club turns it on, and a listing shows club information only — the club's name, motto, colors, and sports. Never players, rosters, members, counts, or contact details.
Asking to join requires an account. Your request — your name, email, who you are to the club, and anything you write in the message box — goes to that club's staff and nobody else. It is information you chose to send to a club you chose. The club approves or declines; nothing is shared with you, and nothing about the club's people is shared, unless they approve and set you up.

What we never collect

Birth dates — for anyone, anywhere in playerkit. There is no such field.
Home addresses.
Payment card details — the card number and security code are collected and held by Stripe, never by us. For a card you save with a club, we keep its brand, last four digits, and expiry, and for each card tried while saving one, its brand and last four digits (see Payment records above).
Player profile photos. We do not ask for or require a photo of any player.
Biometric data of any kind.

Registration confirmations forwarded by your club

A club can forward registration confirmations to its private import address, or to a separate address it creates for one team. Our dedicated Fastmail receiving mailbox temporarily holds the original email, which may include information the registration provider included, such as birth dates, postal addresses, payment details, and waiver text. We do not add those fields to player records or use birth dates to identify players. Once the minimal registration draft is safely saved, we delete the original mail, even if the registration still needs review. Failed deletions are retried. A three-day mailbox deletion rule covers unprocessed or unsupported mail; receiving is disabled until that fallback rule is configured. Fastmail retains deleted mail in backups for another seven days under its recovery policy, and may process mail outside our primary application-hosting region.

We extract only player names, separately identified contact names and email addresses, season and division labels, and the destination team selected by the club — or the team or season the club previously told us a division or season label means. Those saved label matches are club settings, not personal data, and last until the club removes them. Email-import drafts and sender addresses are encrypted at rest and expire after three days. Keyed duplicate markers and minimal processing metadata remain for up to 30 days to prevent repeated imports. Imported player records follow the normal roster retention rules. Review details may also be held in the existing private import session for its three-day window.

Verified club administrators can forward from their verified account address. Other addresses require a club administrator's approval and proof of email ownership. We retain approved sender addresses, their verification/revocation status, and the approving administrator while the connection exists. Expired verification secrets are removed. We check the actual authenticated sender, not a sender name quoted inside a forwarded message. Unauthorized messages create no players; their contents are not stored in the application.

Clubs can choose review before import or automatic import for complete, unambiguous registrations. Possible existing-player matches and unavailable seasons or teams still require review. Imports never automatically authorize or email guardians. After a registration is imported, a club administrator may authorize its listed contacts exactly as for a roster import: an authorized contact is linked to the player when they sign in with that email address, with no expiry date — until the club removes the authorization, or 180 days after the player is archived or has left every club's roster — and is emailed only if the administrator chooses. Administrative changes and import outcomes are recorded in the organization's audit log without raw email bodies.

Original forwarded registration emails are a separate, temporary mailbox copy: see “Registration confirmations forwarded by your club” above.

3. How we use your information

In short: to run the service you signed up for, to keep accounts safe, and to send you the messages the service genuinely needs — nothing else.

Running the service — tracking gear, managing rosters, scheduling, collecting the consents the law requires, and processing the payments your club has set up.
Charging a saved card only as agreed — if you save a card with your club, it is charged only for the one use you signed for. With equipment card cover, nothing is charged unless gear is not returned — and then only for the missing items, never above the maximum you agreed to, and only after the return date and a grace period. Even then, a charge starts only when a club owner or administrator asks for it, which sends you a notice you can contest; the card is charged only after that notice has reached you and its waiting period has passed. Emails about these never show card details.
Billing a player's account — sending the bill for a charge the club added, with its pay link, and the reminders, unless the club has turned them off, to the adult the club bills for that player; and telling the club's owners and administrators when someone says they have sent an e-transfer.
Payment plans — recording your agreement to a plan, sending its payments as bills with their due notices, and showing your club what is paid and what is overdue.
Telling your club about a store order — when you place a store order and say you will pay by e-transfer, and, only if your club turns it on, when you pay for one by card, we email the people and addresses your club chose for store orders: your name, the amount, the order reference and the items, so someone can watch for your transfer or get your order ready.
Keeping accounts safe — sign-in security, two-factor authentication, and checking new passwords against known data-breach lists (using a method that never transmits your actual password).
Necessary email — security alerts, receipts, invitations, schedule changes, and reminders. Optional categories (like schedule notices and message digests) are controlled from your account settings. Receipts and refund notices also reach the recorded payer, alongside the people already entitled to them for the registration, order, player or plan. The payer can download that payment’s receipt; this gives no access to the player’s account, plan agreement or other payments. We do not send marketing email unless you expressly ask us to, and we would never send it to a player or use a child's information for it. We keep a record of each email we send — who it went to, which club it concerned, what kind of email it was and when, never its content — so that once a club stops using playerkit, we send you at most three more reminders or digests about that club, and then stop.
Improving the service, using numbers that name nobody — we count and compare things like how much equipment a club of a given size carries, or how often gear is returned late, so we can make the product better and describe the sport honestly when we write about it. These are aggregate statistics. No child's personal information is ever part of them: nothing that identifies a player, or could be traced back to one, goes into these numbers, and neither does anything that identifies a family, a household, or an individual club. We publish and share only figures at that level — never a record, never a list, never one of you.

We do not use your information for advertising. We do not sell it. We do not build behavioural profiles.

4. Children come first

In short: players are usually minors, so the strictest rules in this policy are theirs.

A club can put a player's name on its roster to run its season — a name on a list. On its own, that gives the child nothing to do and no way to be reached: no account, no sign-in, no way for anyone to message them.
A child gets account access only after a linked parent or guardian signs an explicit consent. This is enforced in our code, not just in policy. The sign-in a guardian can then give their child is supervised: the child never holds a password, and the account can never sign waivers, make payments, save a card, or agree to anything the law reserves to a guardian.
A guardian can withdraw that consent at any time, which immediately closes the child's access on every device.
A child under 13 is never in a two-way conversation — no direct messages, no chats, no way for anyone to message them. The only thing a young player's sign-in can see in messaging is the club's read-only announcements.
A teen (13–17) can join their own team's chat only if their club has turned teen chat on and their guardian has confirmed they are 13 or older — and every such conversation stays readable by the teen's guardians. That oversight cannot be switched off. In return, that conversation never reports when anyone read a message: no read receipts, and no reactions either. A teen knows their guardians can read; they are never told the moment they did.
A player's full name — and anything else that could identify a player, like a stat line — is never published or sent outside their club without a specific, revocable consent from a parent or guardian (see section 5). A minor can never give that consent themselves. There are two small carve-outs. The first is yours to switch off: game-day pages and announcer sheets show a first name and last initial by default — never the full name, and nothing else about the player beyond the jersey number where a surface already shows numbers and, on the announcer sheet only, how to say the name if you added that — and the club, the team, or your family can turn it off, removing the player's name from every game-day surface. The second: if a charge on a card saved with the club is disputed or questioned through the card's bank, the records the club sends to answer it identify the loan and payer, with the child’s name and initials removed.
A player's account — what is owed, paid, and credited for them — is visible only to the adults linked to them (parents, guardians, and other family contacts the club has linked), to an adult player who manages their own account, and to the club staff described in section 5. A child's supervised sign-in never sees it. A pay link shows a player only as their first name and last initial.
We never sell or monetize children's information, under any circumstances, with no exception.
Self-managed accounts are for adults. An adult player can run their own playerkit account — their schedule, gear, profile, and their own waivers. Every path into self-management asks for an explicit confirmation that the player is 18 or older, and what we keep is that confirmation as a fact — consistent with the rule above, never a birth date. A child's account is never self-managed. The full explanation lives at our self-management page.

5. Who can see your information

In short: your own club, your own family, our small staff when you ask for help, and the service providers that run the platform. Nobody else — unless you specifically say so, with one game-day exception you can switch off: score pages and announcer sheets show a player's first name and last initial by default (the last bullets below).

Your club — staff see the players and equipment their role covers. By default a coach sees only their own team's players; club admins control any wider visibility, and those choices are recorded in an audit log.
Your family — a linked parent or guardian sees their own player's information: profile, equipment, schedule, and activity.
Being added by a club you already belong to — if you already belong to a club (as a member, on one of its teams, as the guardian of a player on one of its teams, or as someone who has bought from its store) and its staff add your email as a guardian or as team staff, we add you straight away and tell you, with a one-tap way to leave. The club already knows you, so this reveals nothing new; a club you are not part of still only sends an invitation.
Other clubs — no. Player information never crosses to another organization, unless the player actually moves there through the normal roster process, or a guardian authorizes a specific disclosure (below).
Our staff — when you ask for support, an authorized member of our staff may temporarily view your account the way you see it. These sessions are read-only, expire automatically, and every one is logged.
Service providers — the companies that help us run the platform: Stripe (payments), our email delivery provider, our hosting provider in Canada, Cloudflare (bot protection on public forms), Sentry (crash and error reports from our apps and servers — see section 2), and Apple and Google (delivering push notifications to phones — an opaque device token, a fixed generic line and routing identifiers, never a name or a message's words; see section 2). Each receives only what its job requires. Some of this limited processing happens outside Canada; where it does, it may be subject to the laws of that jurisdiction.
Saved cards — when you save a card with your club, the club is the merchant, so it can see the card's brand, its last four digits, and your customer record in its own Stripe dashboard. Coaches and equipment staff see whether a player's gear is covered, the maximum, and the covered items — never card details. If a charge on that card is disputed or questioned through the card's bank — by you or by the cardholder — the club's answer can send Stripe the records that show what was agreed: the authorization you signed (its text, when and how it was signed, the cardholder name and your cardholder confirmation), when its copy was emailed to you, proof that the notice reached you and anything you wrote to contest it, and the item descriptions and return records behind the charge for unreturned gear. The submission copy, including the authorization text, identifies the loan and payer and removes the child’s name and initials. The processor, acquiring bank, card network and issuer may receive the records needed to answer the dispute.
A player's account — the family (section 4), and at the club its owners, administrators, and club-wide viewers, plus the staff of the player's current team. Fundraising credits, including any sponsor named in them, are part of the account. Anyone you forward a pay link to can see what that one bill shows (section 2).
With your specific consent — and only then. Some sharing needs your signed permission first: today that is exactly three things — a player's full name on the game-day announcer sheet, a player's full name on a game's public live-score page, and a stats file a coach can upload to MaxPreps. Each happens only for a player whose parent or guardian (or the player themselves, if an adult managing their own account) has given a specific consent for that exact place — revocable at any time, effective immediately. Without it, at most the short game-day name described below appears.
Public pages show almost nobody. Anything anyone can see without signing in — a public store, a shared team calendar — is built to show no player names and no family information. The one exception is game day: a game's public live-score page names the scorers of scoring events, and the announcer's phone page lists the roster by jersey number and name — in both cases the name is the first name and last initial (or the shorter form the family chose), never a full name without your signed permission (the pronunciation note, where you added one, appears on the announcer page only, beside whichever name form is shown there), and nobody at all from a club or team that has switched game-day names off. The live-score page itself carries no jersey numbers and no roster. Its link works until the club revokes it, so treat it as public. Your family can hide your own player from these pages at any time, from your own account (see section 6).

6. Your choices and rights

In short: you can see, correct, download, and delete your information — most of it yourself, from your own account settings.

Access — download a copy of your information (and your linked children's) from your account settings, or ask us for it.
Correction — fix inaccurate information yourself where the app allows, or ask us to.
Deletion — delete your account from your account settings. There is a 14-day grace period in case you change your mind; after that, your account and the personal information tied to it are permanently deleted, including the messages you wrote. If you would rather email us, our staff can retire the account for you: your email address, phone, password and sign-ins are removed right away (the address is free to reuse immediately), your club memberships end, and the record is hard-deleted 14 days later.
Deactivation — pause your account instead of deleting it. Nothing is erased, and signing back in reactivates it.
Withdrawing consent — any consent you gave (a child's account access, a disclosure to an outside destination, a game-day full-name permission) can be withdrawn from your account at any time, and takes effect immediately.
Hiding a player's game-day name — the default short name at games (section 5) is not a consent, so there is nothing to withdraw: switch it off any time from My Players → your player → Game-day name, and the player shows without a name on every game-day surface from that moment. The same screen sets the name form and the pronunciation note.
Removing a saved card — see and remove any card you saved with a club, at any time, from your own account. The screen tells you what will happen before you confirm: the card is removed from the club's Stripe account (if that account can no longer be reached — for example, because the club has left playerkit — we mark the card removed on our side, and it stays on the club's own Stripe account, under the club's control); a card cover ends, and the club may ask for a deposit instead; and an amount you were already sent a notice for is not cancelled and stays owed to the club. You can still view the authorization you signed (section 7).
Notification controls — optional email categories, digests, and quiet hours are yours to set under Account → Notifications.

To exercise any right, or ask how your information is used, email privacy@playerkit.app. We respond within the timeframe PIPA (Alberta) / PIPEDA (Canada) requires. If you are not satisfied with our answer, you may also contact the privacy regulator under PIPA (Alberta) / PIPEDA (Canada).

7. How long we keep it

In short: while your club or account is active, plus a few deliberate windows — and some signed records the law requires us to keep.

Your club's data is kept while its subscription is active, and for a 30-day grace period after cancellation.
Deleting your account permanently removes the personal information tied to it after the 14-day grace period. Where a club record you made has to stay attributable (an equipment receive session you ran, an age bracket you verified, a payment plan you agreed to or registered a player under), the account becomes an anonymized placeholder instead: everything that identifies or reaches you is removed and nobody can sign in as you, and only your name on that history stays.
Charges, payments, and fundraising credits on a player's account are the club's financial records and are kept with the club's data, as above.
Payment-plan agreements are kept with the bills they back, as financial records: seven years after the final relevant financial event.
Audit logs are kept for 7 years. They record actions, not personal details where feasible; once a person is deleted, their name in old records degrades to a generic label like "Former staff." We keep them this long so we can investigate a security incident or reconstruct what happened to an account or a piece of equipment.
Website visit counts are kept for 13 months, then deleted by a daily job. They were never tied to an account.
Signed consent and waiver records are legal evidence and are kept for the applicable statutory period, even after an account closes — that is what makes a signature worth signing.
Saved-card records — evidence (the authorization and signed text, notices and delivery proof, contests, resolutions and charge outcomes) is kept during the authorization and for at least two years after the later of its release/end and the last charge. This is a review point, not an automatic destruction date. Financial records — charges, refunds and their supporting evidence — are kept for seven years after the final relevant financial event, and longer when tax requirements, later relevance or payment-processor obligations require it. A record in both categories follows the longer period; contested or disputed records join the financial category. A hold prevents deletion for a contest, dispute, complaint or anticipated litigation. Each matter has its own reason: closing one matter does not release another hold, and a closed payment dispute triggers review, not automatic release. Before destruction, we check for related proceedings, appeals, complaints and manual holds. Retained information is minimized and access-restricted, and is deleted or anonymized when it is no longer needed. The card’s brand and last four digits are removed when retention ends; expiry is removed when the card is removed. The payer can view and print their own authorization copy for as long as it is retained, even after the club leaves playerkit.
An email address that permanently bounces, or that reports us as spam, goes on a suppression list and stays there. We keep the address, the reason and the dates, and nothing else — no message content, no name, no link to an account. It is kept indefinitely on purpose: a list that expired would let us mail a dead address all over again, which is the harm the list prevents. A temporary failure like a full mailbox does not suppress on its own. A suppression can be lifted if an address was mistyped or a mailbox is fixed.
Our record of the emails we send is kept for 13 months, then deleted automatically. It holds who an email went to (your account, or, if you have no account, a keyed fingerprint of the address), which club it concerned, what kind of email it was and when — never the content, the subject line or the address itself. Deleting your account deletes your entries.
Player measurements are deleted 3 years after a player goes inactive, by default. While a player is on any roster in your club, their whole size history is kept, however far back it goes — that history is the point of recording it. Once they are off every roster, the clock starts from when they left, and their measurements for that club are then permanently deleted. Each club keeps its own records under its own window, so leaving one club never removes anything from another. Club admins can set a different window for their club, shorter or longer.
A club's guardian authorization (from a roster import or a registration email) has no expiry date: it works until that parent is linked or the club removes it, and stops 180 days after the child is archived or has left every club's roster (at once if the child's record is deleted). A plain emailed invitation to connect with a player can be accepted by signing in with that address for 180 days after it was sent (or last re-sent); its emailed link stops working after 7 days. For an invitation we email, we also keep our email provider's message reference and whether it was reported delivered or bounced, so the club can see whether it arrived and send it again or to a corrected address.
Short-lived data is deleted on a schedule: roster import files, and the volunteers' names and emails a file lists, after 3 days, a lost-item finder's contact details after at most 90 days, crash and error reports after 90 days, and daily encrypted backups after 30 days.
A phone's push-notification token lives only as long as the sign-in it belongs to: signing out of the app, forgetting the device, or signing that device out from your account's security settings deletes it at once — as does a report from Apple or Google that the token is dead.
Because backups are snapshots, information you delete can persist inside a backup copy for up to 30 more days before those copies age out.

8. How we protect it

The most sensitive information — player names and emails, everything you sign, message content, contact secrets, the address a bill's pay link was sent to — is encrypted at rest. That means each of those values is scrambled into unreadable code (using AES-256, a standard encryption algorithm) before it is written to storage, and can only be turned back into readable text with a secret key our application holds. If someone obtained a copy of our database, or a backup of it, those fields would be unreadable without that key. This is separate from encryption in transit below: one protects information while it is stored, the other while it travels. Beside each encrypted player name we keep two keyed one-way codes so a club can find a player without us decrypting anything: an exact code of the name, and a coarser code of how it sounds. Neither can be reversed into the name. The coarser one does exactly one thing — it warns a person during a roster import, or when adding a player, that someone already on their roster sounds like this name. It never merges, blocks or decides anything on its own.
All traffic is encrypted in transit — everything that travels between your device and playerkit is encrypted, whether that device is a computer running a web browser (the padlock in the address bar) or a phone using our app on Wi-Fi or cellular data. If someone can watch the network in between — on shared café or airport Wi-Fi, say — they see scrambled data, not what you typed or what came back.
On your phone, the app stores little, and what it stores is encrypted. Your sign-in credential lives in the phone's own secure keychain. Four things live in one encrypted file on the phone (AES-128, with a key generated on the phone and held only in that same keychain — so a copy of the file is unreadable anywhere else): your sign-in session (your name and email, your clubs, teams and roles, and — for a parent or guardian — the names of the children you are linked to), so the app still opens as yours when there is no signal; equipment actions a staff member's scanner captured while offline (which item, which action, and the identifiers needed to replay it — never a person's name), held until they reach us and re-checked by our servers before anything is applied; and, for club staff, a working copy of the roster names and storage locations they were already shown online (player names, including minors', and staff names — never a guardian's), so gear can be handed out or put away where there is no signal; and an unfinished checkout identifier and fingerprint, so reopening after an uncertain payment answer cannot start a second purchase. That checkout record contains no card details, card token, names or cart contents and ends on acknowledged completion, a safe reset, or sign-out. Signing out clears all of it except the queued actions, which stay locked to the account that captured them so offline work is never silently lost — no other sign-in on that phone can open them. Apart from that, the app and the website may keep an unfinished club-setup draft (team and season names, no personal information) on the device until it is saved or for at most 30 days. You can see every device signed into your account, and sign any of them out, from your account's security settings.
Opening the app from the website. If you are signed in on the website on your phone and tap Open in the app, the app is signed in with a single-use code that expires after 60 seconds. We keep only a one-way hash of it, with your account, the times, and the name the app gives the device, for 30 days. The new sign-in shows in your security settings like any other, and we tell you about it in the app — no email.
Access is enforced by role: the app checks who you are and what your role allows on every request.
Two-factor authentication is available on every staff and volunteer account, and we recommend it for club owners and admins.
New passwords are screened against known data breaches, without your password ever leaving our systems.
Our own staff use individually named, two-factor-protected accounts — there are no shared logins.
If a breach poses a real risk of significant harm, we will tell you — as fast as we safely can, and we aim for within 72 hours of discovering it. We will only take longer if law enforcement asks us to hold a notice while they act, or if telling you before the breach is contained would put you at more risk — and a delay is never a decision not to tell you. If minors are affected, every linked guardian is notified directly, and we report qualifying breaches to the privacy regulator as required.

Security concerns can be reported any time to security@playerkit.app.

9. Cookies

We use only essential cookies today — the ones that keep you signed in and make the app work. They do not track you across other sites. Your account settings include controls for optional cookie categories (functional, analytics, marketing); we currently set none of those, and if we ever introduce one, it will respect the choice you have already saved and we will update this policy first. The count of visits to our public pages (section 2) is not a cookie and stores nothing on your device.

To avoid duplicate payments after a lost answer, store and scan-and-buy checkouts also keep an opaque payment identifier and a fingerprint in tab-scoped browser storage. A public fee-payment page keeps an opaque identifier and, once acknowledged by the server, the payment amount and currency. No card details, card tokens, names or cart contents are kept in these records. The identifier is sent with the payment request to recognize the same operation, not to authorize it. Browser copies end when the tab closes or the flow explicitly clears them. The phone's checkout copy uses the encrypted store above and ends on acknowledged completion, a safe reset, or sign-out. Unknown outcomes stay available for recovery. These records are essential to payment safety and do not track you across sites.

10. Changes to this policy

Non-material payment-safety clarification — 2026-10-15. We now link a payment to its explicitly known payer for receipts, refund notices and access to that payment’s receipt only. We also describe the essential opaque checkout recovery records newly stored in a browser tab or the phone’s existing encrypted store to prevent duplicate payments. This stays within the financial record and payment purposes already described: no new personal-data category, processor, advertising use or broader player-account access. No card details, card tokens, names or cart contents are stored in the recovery records. The advance-notice promise for future material changes remains unchanged.

Material change — 2026-10-14. Payment plans: a payment plan no longer saves a card or charges anything automatically. Each payment is a bill on the player's account that you pay yourself, and for each payment after the first you get a notice in the 3 days before its date and on the day. When you agree to a plan, we keep who agreed, when, in which language and the exact text shown, with its fingerprint, instead of a signed card authorization, and we send it to no one. Retries, recovery payments and changing a plan to one payment of the balance no longer exist. No payment plan had been used yet. It took effect on 2026-10-14. Only one club was active at the time, and nothing was taken away from anyone, so the 14-day advance notice was waived for this change by our founder's decision of 2026-10-12; the 14-day promise below stands for every future material change.

Material change — 2026-10-06. Equipment appointments: we now send reminders by email and app notification 24 hours and 2 hours before a booked pickup, drop-off or return, and appointment confirmations, a club's cancellations and a club moving an appointment to a new time or place now go to the player's family — the parents and guardians connected to the player who receive notifications, and a player who manages their own account — not only to the person who made the booking. A staff member who booked at the club's desk no longer gets them. Emails name the player, the time and the place; app notifications name no one. The person who made a booking always gets its confirmation; from the next update of playerkit, everyone else's copies follow their own notification settings for Schedule (and Equipment, for gear a family keeps over the off-season). Nothing new is collected or shared with anyone new. It took effect on 2026-10-06. The 14-day advance notice was waived for this change by our founder's decision of 2026-10-06; the 14-day promise below stands for every future material change.

Material change — 2026-10-06. Donations are removed from playerkit. Donors are no longer a kind of person this policy covers, and we no longer collect a donor's name, address or email: clubs can no longer record donations or issue donation receipts through playerkit, and there is no longer a Donate page. Our promise that we never collect home addresses no longer has an exception. Nothing was ever stored — no club had recorded a donation or issued a receipt. A club can still ask for a gift as an ordinary payment, such as a store item or a charge on a player's account; you get the usual payment receipt, and any receipt for tax purposes is the club's to issue itself, outside playerkit. Fundraising is unchanged. It took effect on 2026-10-06. Only one club was active at the time, and nothing was taken away from anyone, so the 14-day advance notice was waived for this change by our founder's decision of 2026-10-06; the 14-day promise below stands for every future material change.

Correction — 2026-10-06. Payment plans: a declined payment that may succeed later is tried again 7 days after we tell you it was declined, then 7 days after that; this policy had said the first try came 3 days later. We also now say that the plan you sign gives your club's contact details and its refund and cancellation policy, that a copy is emailed to you, that you can pay a payment that did not go through from the app, and what happens when your club changes a plan to one payment of the remaining balance, including the 7 days you have to pay it. Nothing new is collected or shared, so this is not a material change, and the date this version took effect is unchanged.

Material change — 2026-10-03. Roster imports: a file may give up to three parent or guardian emails for one player (we keep a name with the first one only); a file may list volunteers or staff, whose name, email and role only your club sees, to review — they never become player records, and only the people the club ticks get a team invitation; their names and emails are cleared from the import's review when the club confirms it, and deleted within three days; words in a file's name that the club confirms can be remembered as team or season labels; and one invitation email can name several teams, each with its own link. It took effect on 2026-10-03. Only one club was active at the time, and the 14-day advance notice was waived for this change by our founder's decision of 2026-09-30; the 14-day promise below stands for every future material change.

Material change — 2026-10-02. Found reports: you now give a way to reach you or a note (at least one); a report about a club's sticker that is not yet on an item goes to the club that owns it; a club's staff may note where an item was found and where it is kept, never your contact details or message; and if you are signed in, the found-report form skips the bot check and limits each account instead — we do not record which account sent a report. It took effect on 2026-10-02. Only one club was active at the time, and the 14-day advance notice was waived for this change by our founder's decision of 2026-10-02; the 14-day promise below stands for every future material change.

Material change — 2026-09-29. A record of the emails we send: who each one went to (your account, or a keyed fingerprint of the address if you have no account — never the address itself), which club it concerned, what kind of email it was and when, never its content. We use it to stop writing to you about a club that has stopped using playerkit: at most three more reminders or digests about that club, then none. It is kept for 13 months. The details are in sections 3 and 7. It took effect on 2026-09-29. Only one club was active at the time, and the 14-day advance notice was waived for this change by our founder's decision of 2026-09-29; the 14-day promise below stands for every future material change.

Material change — 2026-09-28. A player's account with the club: charges staff add at the club, the emailed bill and its pay link (what the page shows, that it needs no sign-in, and that it stops working after 90 days), and reminders. Store purchases can say which of your players they are for. Fundraising campaigns and their credits, which can name a sponsor. And a new kind of person: donors to a club, which can now issue donation receipts — what we keep, why, who can see it, and how long it is kept. Our promise that we never collect home addresses gained its one exception: a donor's mailing address, collected only when the club issues official donation receipts and only to print on that receipt. Your calendar feed can now show a charge's due date or a fundraising deadline; we never add an amount to it. The same day, a club's guardian authorization from a roster import or a registration email: once the club authorizes a parent's email address, that parent is linked to their child when they sign in with it — there is no expiry date; it stops when the club removes it, or 180 days after the child is archived or has left every club's roster. The details are in the short version and sections 2 to 8. It took effect on 2026-09-28. Only one club was active at the time, and the 14-day advance notice was waived for this change by our founder's decision of 2026-09-27; the 14-day promise below stands for every future material change.

2026-09-20: Saved-card evidence now follows the two retention buckets and matter-specific holds in section 7. Dispute copies identify the loan and payer without the child’s name or initials. The signed agreement includes the club’s Stripe business contact, refund policy and separate guardian confirmation.

If we make a material change, we tell you by email and by an in-app notice at least 14 days before it takes effect, so you have time to read it and act on it. When a change is something you can choose, the notice says so and tells you how. The current version took effect on 2026-10-15.

Material change — 2026-09-17. Saved cards: a family can save a card with their club for equipment card cover, or to pay a registration fee in instalments. What we keep, how a saved card may be charged, who at the club can see it, how to remove one, and how long the records are kept are in the short version and sections 2 to 7. It took effect on 2026-09-17. At the time it took effect the only active club was our own, so there was no one owed the advance notice; the 14-day promise above stands for every future material change. Nothing is saved or charged this way until a club turns the feature on, and both are switched off today.

11. Contact

Privacy questions and requests: privacy@playerkit.app
Security concerns: security@playerkit.app
General support: support@playerkit.app