Privacy Policy

1. Information we collect

We collect the following categories of information:

• Account information. Name, email address, password, account type (player/parent, trainer, or organization), and phone number when provided.
• Profile and athletic information. Profile photos, location, sport(s), position, height/weight, graduation year, academic information, recruiting headlines, highlight videos, and team memberships that you choose to add.
• Booking and transaction information. Sessions you book or offer, schedules, and payment records. Card and bank details are collected and processed directly by our payments provider (Stripe); RosterUp does not store full card numbers.
• Messages. The content of messages you send to other users through the in-app messaging feature.
• Family athlete and guardian records. When family setup is available, a guardian may enter a child athlete's name, date of birth and sport. We record active guardian relationships, invitations, selected-athlete applications, bookings, dues, and access or moderation events. A managed child has no login and receives no email. An invited teen may have a linked login while active guardians remain included in protected conversations.
• Interest and attention information. When staff of a RosterUp-verified sports organization view an athlete's profile or add an athlete to their organization's watchlist, we record that activity (the organization, the date, and a daily view count) so we can show the athlete's family that organizations are interested. This activity is described in Section 4a below.
• Product usage information. Pages and features used, tied to your account when signed in or to a first-party session cookie for anonymous visits. We use IP addresses transiently for request-rate controls; hosting providers also maintain operational request logs. We do not derive a stored location from an IP address or use advertising identifiers or third-party analytics pixels.
• Cookies and similar technologies. See our Cookie Policy.

2. How we use information

• Provide, operate, and maintain the Services and your account.
• Facilitate bookings, payments, payouts to trainers, and messaging between users.
• Send transactional notifications (e.g., booking, payment, and message alerts) by email and in-app.
• Personalize discovery (e.g., surfacing relevant trainers, tryouts, and teams).
• Protect the Services, prevent fraud and abuse, and enforce our Terms of Service.
• Comply with legal obligations.

3. How we share information

We do not sell your personal information. We share it only as described here:

• With other users. Your profile and the information you choose to make visible are shared with the trainers, organizations, and athletes you interact with (for example, when you request a booking or apply to a tryout).
• Public Player Card and organization pages. If an eligible athlete claims a card username and their profile is set to public, a limited “Player Card” page (name, photo, sports and positions, selected athletic measurements, and verified college commitments — never academics, date of birth, or contact information) is publicly accessible at its card link. Verified college commitments an athlete chooses to record may also appear on their club's public commitments page. Setting the profile to private, revoking guardian consent, or deleting the account immediately removes these public pages.
• Academic information and verified organizations. Academic details set to “recruiters only” are visible solely to active staff of organizations that RosterUp has verified — never to the general public or to unverified accounts.
• Service providers. We use trusted vendors to run the Services, including Supabase (authentication, database, and file storage), Stripe (payments and trainer payouts), Resend (transactional email), Vercel (hosting and scheduled jobs), and Sentry (error reporting). These providers process information on our behalf.
• Legal and safety. We may disclose information to comply with law, respond to lawful requests, or protect the rights, safety, and property of users and the public.
• Business transfers. Information may be transferred as part of a merger, acquisition, or sale of assets, subject to this Policy.

4. Youth athletes and parental consent

Player self-registration is for adults. An email response alone does not establish guardianship or admit a minor to a player account. An active guardian may manage a child's athlete record through the family features when those features are available; an eligible teen can receive an account only through a guardian-initiated invitation linked to that existing record. Family setup is currently unavailable. A parent or guardian may ask to review, update, or delete their child's information at privacy@rosterup.io.

4a. Profile-view tracking and watchlists

To help athletes and their families see genuine interest from sports organizations, we record when staff of a RosterUp-verified organization view an athlete's public profile and when an organization adds an athlete to its watchlist. This works one way only: organizations never see an athlete's activity, and view information is shown only to the athlete's own account (for younger athletes, the account their parent or guardian manages). Free accounts see counts and the names of organizations that have watchlisted the athlete; identifying which organizations viewed a profile, and how often, is available with an optional paid subscription. Detailed view records are kept for 12 months and then reduced to monthly counts. Athletes can prevent all view tracking by setting their profile to private.

5. Data retention

We retain personal information for as long as your account is active or as needed to provide the Services, comply with our legal obligations, resolve disputes, and enforce our agreements. Detailed profile-view records are retained for 12 months and then reduced to monthly counts (Section 4a). When you delete your account, we delete or de-identify your personal information — including athletic measurements, commitments, view and watchlist records, and notifications — and permanently retire your card username so it can never be reassigned to another person, except where retention is required (for example, transaction records needed for tax, accounting, or fraud-prevention purposes).

For a closed child athlete record, child-identifying conversation messages, report reasons, review notes, and moderation-event details are anonymized after 90 days. Non-identifying moderation audit events remain, including their event type and order. Financial records follow their separate retention requirements and are not erased by this conversation rule.

6. Your choices and rights

• Access, update, or correct your information in your account settings.
• Delete your account and associated personal information, subject to Section 5.
• We currently send transactional service email, not marketing email. You may still receive essential account, booking, payment, or safety notices.
• Depending on where you live, you may have additional rights (e.g., under the GDPR or the CCPA/CPRA), such as the right to access, port, restrict, or object to certain processing. Contact us to exercise these rights.

7. Security

We use administrative, technical, and organizational safeguards designed to protect personal information, including encryption in transit and access controls. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

8. International users

The Services are operated from the United States. If you access them from outside the U.S., you understand your information may be processed in the U.S., where data-protection laws may differ from those in your country.

9. Changes to this Policy

We may update this Policy from time to time. We will post the updated version with a new “Last updated” date and, where appropriate, provide additional notice.

10. Contact us

Questions about this Policy or your information? Email privacy@rosterup.io and we’ll respond — including a mailing address on request.