Privacy Policy

1. Information We Collect

A. Information You Provide to Us Directly

• Account Information: First name, last name, email address, and password. You may also save an optional phone number for user-initiated Connect emails. Phone numbers are not shown on public profiles. They are only shared when you choose to include them in a one-time Connect email to another user.
• Profile Details: Optional information such as a photo, bio, positions, jersey number, clothing sizes (for example, shirt or pant size), highlight media, privacy setting, and home location.
• Location Information: When you set a home location or create an event venue, we store the address details and coordinates you select through Google Places autocomplete (including latitude and longitude). We do not continuously track your device GPS.
• Event, Team, and Organization Information: Details related to events you create or join, team membership, organization profiles and branding, posts or news you publish, registrations, roster information, waiver acknowledgments, and refund-request messages.
• Media Uploads: Images, video, and PDF files you upload (for example, profile photos, event or organization media, gallery photos and videos, news-post attachments, and host-provided waiver documents). Gallery and news media on event or organization pages may be publicly visible.
• Communications: Messages you send through our contact form, and emails or other communications you send to us. The Platform does not provide private user-to-user direct messaging or chat. Players may send a one-time Connect email through the Platform that introduces them and optionally shares the sender's email and/or phone so the parties can continue offline.
• Notification Preferences: Your choices about emails for events you're registered for and organizations you follow, location-based event emails, host registration emails, sitewide operational emails, and Connect emails from other players.
• Payment Information: When you pay for a league or tournament registration, referee game pay, or league team-player dues, payment card and billing details are collected and processed by Stripe. We do not store full card numbers on our servers. For hosts and league team managers who collect payments online, Stripe Connect onboarding collects business, tax, and banking information in Stripe's interface. We store Stripe account identifiers, onboarding or capability status, and transaction records needed for fulfillment and record-keeping (for example, amounts, dates, event or team details, payment identifiers, and platform-fee metadata).

B. Information We Collect Automatically

• Device and Log Information: Information such as browser type, operating system, IP address, approximate network location, and request metadata used for security, rate limiting, and diagnostics.
• Usage and Performance Data: Aggregated or anonymized analytics about page views, referrers, device category, and performance metrics through Vercel Web Analytics and Vercel Speed Insights. These tools are designed not to use advertising cookies.
• Signed-In Activity (platform operations): When you are signed in, we may record return visits when you come back after closing the tab or being away for an extended period (about 30 minutes). In-app navigation does not count as a separate visit. We use this only for internal platform operations. We do not use it for advertising or cross-site targeting.
• Error Monitoring and Session Replay: We use Sentry for error monitoring, performance tracing, and session replay. When you are signed in, we may associate your user id and email with error reports. Session replay may capture on-screen text and media from the pages you visit, including content shown in forms or profiles.
• Cookies and Local Storage: We use essential cookies for authentication and session management (via Supabase Auth). We may also store limited preferences in your browser, such as an age-confirmation flag in localStorage, navigation history, and signed-in return-visit timing in sessionStorage.

C. Information from Third Parties

• Payment and Connect status information from Stripe.
• Place and address details from Google Places when you select a location.
• We do not currently offer Google or Apple sign-in.

2. How We Use Your Information

• Create, secure, and manage your account
• Operate event discovery, registration, rostering, scheduling, organizations, teams, posts, and related Platform features
• Process payments, refunds, payouts readiness, and registration fulfillment through Stripe Connect
• Send transactional and service emails you request or that are needed to operate the Platform (for example, account verification, password reset, registration notices, event updates for subscriptions you enable, and contact-form responses)
• Monitor reliability and security, debug errors, and improve performance
• Enforce our Terms and Conditions and protect users and the Platform
• Comply with legal obligations and protect our legal rights

We do not currently use your information for advertising networks, cross-site behavioral advertising, or sale of personal information. We do not send promotional marketing emails beyond the operational and subscription email categories described above.

3. How We Share Your Information

• With Other Users: Public profile details, team information, organization pages, event listings, rosters, posts, gallery media, and other content you make available may be visible to other users or the public. Hosts and team managers may see registration and roster details needed to run an event. When you use Connect, we email the recipient a one-time introduction that may include the email address and/or phone number you choose to share so you can continue the conversation offline.
• Service Providers: We share information with vendors that help us operate the Platform, including:
  • Supabase (authentication, database, and file storage)
  • Vercel (hosting, Web Analytics, and Speed Insights)
  • Stripe (payment processing and Connect)
  • Resend (email delivery)
  • Google (Places autocomplete and Maps-related features; some organization branding may load Google Fonts)
  • Sentry (error monitoring, performance, and session replay)
  • GitHub (contact-form submissions may be stored as GitHub issues containing your email and message)
• Payment Processors: With Stripe, to process registration payments and host Connect accounts. Payment card data is handled by Stripe under Stripe's privacy policy. Checkout metadata may include account and registration identifiers needed to fulfill a registration.
• Legal Compliance: If required by law, subpoena, or legal process, or to protect our rights and users' safety.
• Business Transfers: If the Platform is involved in a sale, merger, financing, or similar transaction, information may be transferred as part of that process.

4. Your Rights and Choices

• Access and Correction: You may access or update much of your personal information in your account settings.
• Email Preferences: You can manage notification preferences in Profile → Notifications. Email footers also link to those settings.
• Deletion: You may delete your account in the Platform or request deletion by emailing us. Account deletion removes your profile and related account data from our primary application database, and hosted events or organizations you own may also be deleted because of cascading database relationships. Before deleting your account, you must close any active Stripe Connect account linked to the Platform. We may retain limited records needed for security, accounting, dispute handling, or legal compliance (for example, account-deletion audit logs that include your user id and email). Stripe, Resend, Sentry, GitHub, and other processors may retain related data under their own policies.
• Data Export: We do not currently provide an automated data-export tool. You may request a copy of personal information we hold about you by emailing support@findflagfootball.com.
• Do Not Track: We currently do not respond to "Do Not Track" browser signals.

For privacy-related inquiries or requests, please contact us at support@findflagfootball.com.

5. Data Retention

We retain personal information for as long as needed to provide the Platform, fulfill the purposes described in this Policy, comply with legal obligations, resolve disputes, and enforce our Terms. Retention periods vary by category. For example, account data is generally retained while your account is active; payment and registration records may be retained longer for accounting and compliance; and diagnostic or audit records may be retained for security and operational purposes. When you delete your account, we delete or de-identify personal data we no longer need, subject to the exceptions described above.

6. Security of Your Information

We take commercially reasonable steps to protect personal information from loss, misuse, unauthorized access, and disclosure. However, no method of transmission or storage is completely secure, and we cannot guarantee absolute protection.

7. Children's Privacy

The Platform is intended only for users who are 18 years of age or older. We do not knowingly collect personal information from anyone under 18. If we learn that we have collected personal information from a person under 18, we will delete it promptly. Where shown, our age-confirmation prompt is a browser-stored acknowledgment and is not a verified government ID check.

8. Payment Processing and Stripe Connect

Our Platform uses Stripe to handle registration payments, referee game payments, league team-player dues, and Connect payout setup for hosts and eligible team managers. Payment and financial responsibilities are described in our Terms and Conditions. When you make a payment or set up a Stripe Connect account as a host or team manager collecting online dues:

• Payment Data: Card details and billing information are collected and processed by Stripe. We do not store full credit card numbers on our servers.
• Connect Account Information: Stripe Connect onboarding may require business, tax, and banking information. That information is collected and stored by Stripe. We store your Stripe account id and related onboarding or capability status in our database.
• Transaction Records: We store transaction and fulfillment records (amount, date, event or team details, payment identifiers, and platform-fee metadata) for accounting, compliance, registration operations, and team-dues operations.

For more information about how Stripe handles your data, review Stripe's Privacy Policy at https://stripe.com/privacy and Stripe's legal notices at https://stripe.com/legal.

9. Third-Party Links and Services

The Platform may contain links to third-party websites or services we do not operate. We are not responsible for the privacy practices of those third parties. Please review their policies before submitting personal information.

10. International Users

The Platform is intended for users in the United States. If you access it from outside the U.S., you understand that your information may be processed in the United States and in other countries where our service providers operate, which may have different privacy laws than your country.

11. Cookies and Similar Technologies

A. What Are Cookies?

Cookies are small data files placed on your device when you visit a website. We also use similar browser storage technologies where needed for core functionality.

B. How We Use Them

• Authenticate your session and keep you signed in
• Support security and basic Platform functionality
• Remember limited local preferences such as age confirmation
• Measure aggregated traffic and performance through Vercel Analytics and Speed Insights

C. Types We Use

• Essential Cookies: Required for authentication, security, and core functionality.
• Analytics Technologies: Vercel Web Analytics and Speed Insights provide aggregated usage and performance data. According to Vercel's documentation, these products are designed to avoid advertising cookies. Separately, when you are signed in we may store first-party signed-in return-visit records for platform operations (not advertising).
• Advertising Cookies: We do not currently use advertising cookies or ad networks.

You can manage cookies through your browser settings. Disabling essential cookies may prevent you from signing in or using key features.

12. California Privacy Rights

If California privacy law applies to you, you may have rights to know, access, correct, and delete personal information, and to opt out of the sale or sharing of personal information for cross-context behavioral advertising. We do not sell personal information, and we do not share personal information for cross-context behavioral advertising.

A. Categories of Personal Information

• Identifiers: Name, email, optional phone number, IP address, account identifiers
• Customer Records / Profile Data: Account profile fields, clothing sizes, positions, and similar details you provide
• Commercial Information: Registration and payment transaction records
• Internet or Electronic Activity: Pages viewed, interactions, device or browser information, and diagnostic data
• Geolocation: Precise location coordinates and address details you select for profiles or events; approximate network location derived from IP
• Sensory / Media Content: Photos, videos, and documents you upload
• Inferences: Limited operational inferences needed to provide features you enable (for example, location-based event notices based on your home location)

You may submit a privacy request by emailing support@findflagfootball.com
Subject line: "California Privacy Request"
We will verify your identity and respond within the time required by applicable law.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. If we make material changes, we will update the "Last Updated" date and may provide additional notice through the Platform or by email. Continued use of the Platform after the updated Policy becomes effective constitutes acceptance of the changes, except where applicable law requires a different process.

14. Contact Us

For questions about this Privacy Policy or our data practices, contact Find Flag Football at support@findflagfootball.com. Contact us by email for our mailing address.