Privacy Policy

1. Information we collect

We collect the following categories of information:

• Account information. Name, email address, password, account type (player/parent, trainer, or organization), and phone number when provided.
• Profile and athletic information. Profile photos, location, sport(s), position, height/weight, graduation year, academic information, recruiting headlines, highlight videos, and team memberships that you choose to add.
• Booking and transaction information. Sessions you book or offer, schedules, and payment records. Card and bank details are collected and processed directly by our payments provider (Stripe); RosterUp does not store full card numbers.
• Messages. The content of messages you send to other users through the in-app messaging feature.
• Interest and attention information. When staff of a RosterUp-verified sports organization view an athlete's profile or add an athlete to their organization's watchlist, we record that activity (the organization, the date, and a daily view count) so we can show the athlete's family that organizations are interested. This activity is described in Section 4a below.
• Usage and device information. Log data, pages and features used, approximate location derived from IP address, browser and device identifiers, and analytics events we use to understand and improve the Services.
• Cookies and similar technologies. See our Cookie Policy.

2. How we use information

• Provide, operate, and maintain the Services and your account.
• Facilitate bookings, payments, payouts to trainers, and messaging between users.
• Send transactional notifications (e.g., booking, payment, and message alerts) by email and in-app.
• Personalize discovery (e.g., surfacing relevant trainers, tryouts, and teams).
• Protect the Services, prevent fraud and abuse, and enforce our Terms of Service.
• Comply with legal obligations.

3. How we share information

We do not sell your personal information. We share it only as described here:

• With other users. Your profile and the information you choose to make visible are shared with the trainers, organizations, and athletes you interact with (for example, when you request a booking or apply to a tryout).
• Public Player Card and organization pages. If an eligible athlete claims a card username and their profile is set to public, a limited “Player Card” page (name, photo, sports and positions, selected athletic measurements, and verified college commitments — never academics, date of birth, or contact information) is publicly accessible at its card link. Verified college commitments an athlete chooses to record may also appear on their club's public commitments page. Setting the profile to private, revoking guardian consent, or deleting the account immediately removes these public pages.
• Academic information and verified organizations. Academic details set to “recruiters only” are visible solely to active staff of organizations that RosterUp has verified — never to the general public or to unverified accounts.
• Service providers. We use trusted vendors to run the Services, including Supabase (authentication, database, and hosting), Stripe (payments and trainer payouts), and Resend (transactional email). These providers process information on our behalf under contractual confidentiality and security obligations.
• Legal and safety. We may disclose information to comply with law, respond to lawful requests, or protect the rights, safety, and property of users and the public.
• Business transfers. Information may be transferred as part of a merger, acquisition, or sale of assets, subject to this Policy.

4. Youth athletes and parental consent

RosterUp does not currently support self-registration for athletes under 13. Athletes ages 13 through 17 have restricted access until a parent or legal guardian verifies consent by email. A parent or guardian may review, update, or request deletion of their child's information by contacting us at privacy@rosterup.io. We collect only the information reasonably necessary for an athlete to participate, and we do not condition participation on disclosing more information than is reasonably necessary.

4a. Profile-view tracking and watchlists

To help athletes and their families see genuine interest from sports organizations, we record when staff of a RosterUp-verified organization view an athlete's public profile and when an organization adds an athlete to its watchlist. This works one way only: organizations never see an athlete's activity, and view information is shown only to the athlete's own account (for younger athletes, the account their parent or guardian manages). Free accounts see counts and the names of organizations that have watchlisted the athlete; identifying which organizations viewed a profile, and how often, is available with an optional paid subscription. Detailed view records are kept for 12 months and then reduced to monthly counts. Athletes can prevent all view tracking by setting their profile to private.

5. Data retention

We retain personal information for as long as your account is active or as needed to provide the Services, comply with our legal obligations, resolve disputes, and enforce our agreements. Detailed profile-view records are retained for 12 months and then reduced to monthly counts (Section 4a). When you delete your account, we delete or de-identify your personal information — including athletic measurements, commitments, view and watchlist records, and notifications — and permanently retire your card username so it can never be reassigned to another person, except where retention is required (for example, transaction records needed for tax, accounting, or fraud-prevention purposes).

6. Your choices and rights

• Access, update, or correct your information in your account settings.
• Delete your account and associated personal information, subject to Section 5.
• Opt out of non-essential email by following the unsubscribe instructions; you may still receive essential transactional messages.
• Depending on where you live, you may have additional rights (e.g., under the GDPR or the CCPA/CPRA), such as the right to access, port, restrict, or object to certain processing. Contact us to exercise these rights.

7. Security

We use administrative, technical, and organizational safeguards designed to protect personal information, including encryption in transit and access controls. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

8. International users

The Services are operated from the United States. If you access them from outside the U.S., you understand your information may be processed in the U.S., where data-protection laws may differ from those in your country.

9. Changes to this Policy

We may update this Policy from time to time. We will post the updated version with a new “Last updated” date and, where appropriate, provide additional notice.

10. Contact us

Questions about this Policy or your information? Email privacy@rosterup.io or write to us at [RosterUp mailing address].