Privacy Policy

This Privacy Policy explains how ClubRostr ("ClubRostr", "we", "us") collects, uses, shares, and protects personal data when you use the ClubRostr mobile app and related services (the "Service"). ClubRostr is a multi-tenant club-management platform: each club, group, or organisation that uses ClubRostr (a "Club") decides what member information to collect and how to run its club. For that member information, the Club is the data controller and ClubRostr acts as a processor on the Club's behalf. ClubRostr is the controller for the data we need to operate the platform itself (such as account credentials and diagnostics).

Information we collect

• Account information — your name, email address, and password (passwords are managed by our authentication provider; we never see them in plain text).
• Profile information — optional details you or your Club add, such as phone number, date of birth, gender, school, emergency contact, and team/roster details.
• Health information — optional medical information a Club may ask you to provide (e.g. allergies or conditions relevant to participation).
• Children's data — where a Club supports youth participation, a parent or guardian may create and manage child profiles. See "Children's data" below.
• Membership & payments — if your Club uses paid memberships, payments are processed by Stripe. We receive confirmation and membership status; we do not store your full card details.
• Activity — content and actions within the Service, such as RSVPs, posts, comments, and challenge entries.
• Device & diagnostics — push-notification tokens (if you enable notifications) and crash/diagnostic data used to keep the app stable.

How we use information

• To provide and operate the Service for you and your Club.
• To manage memberships, scheduling, teams, announcements, and payments.
• To send notifications you have opted into and important service messages.
• To keep the Service secure, diagnose problems, and improve reliability.
• To comply with legal obligations.

Children's data

ClubRostr is designed to be used by clubs that include young people. Child profiles are created and managed by a parent or guardian, or by Club administrators acting under the Club's responsibility. A child does not create their own account. Parents/guardians and Clubs are responsible for ensuring they have the appropriate consent and lawful basis to provide a child's information. If you believe a child's data has been provided without appropriate authority, contact us and we will work with the relevant Club to address it.

How we share information

We share personal data only as needed to run the Service:

• Your Club — administrators and managers of your Club can see the member information relevant to running the club.
• Service providers (sub-processors) — Supabase (database & authentication hosting), Stripe (payments), Sentry (crash/diagnostics), Expo (push notification delivery), and our email provider (transactional email).
• Legal & safety — where required by law or to protect rights and safety.

We do not sell your personal data.

Data retention & deletion

We keep personal data for as long as your account and Club membership are active, and as needed for legitimate club records, legal, and accounting purposes. You can delete your account at any time from within the app (Profile → Settings → Delete account). Deleting your account closes your login and removes your personal profile data; some records may be retained where a Club or the law requires it (for example, payment records).

Your rights

Depending on where you live, you may have rights to access, correct, delete, or restrict the use of your personal data, and to object to certain processing or request portability. You can exercise many of these directly in the app, or by contacting us or your Club. We will respond in line with applicable law (including the UK GDPR and EU GDPR where relevant).

Security

We use industry-standard measures to protect personal data, including encryption in transit, access controls, and tenant isolation so one Club cannot access another Club's data. No system is perfectly secure, but we work to protect your information and to respond promptly to any incident.

International transfers

Our providers may process data in countries other than your own. Where that happens, we rely on appropriate safeguards as required by applicable data-protection law.

Changes to this policy

We may update this policy from time to time. We will revise the "Last updated" date above and, where appropriate, notify you in the app.

Contact us

Questions about this policy or your data? Contact us and we'll help.