Privacy Policy

1. Who We Are & How to Contact Us

Squad operates the Squad sports team management platform. For any questions about this Privacy Policy or to exercise your data rights, contact our privacy team:

If you are in the EU/EEA and have an unresolved complaint, you have the right to lodge a complaint with your local supervisory authority.

2. Information We Collect

2.1 Information You Provide

2.2 Information Collected Automatically

2.3 Information We Do Not Collect

We do not collect:

• Medical or health information about children
• Government-issued identification numbers
• Financial account details (handled entirely by Stripe)
• Precise geolocation data
• Biometric data

3. How We Use Your Information

We do not use your personal data for advertising, profiling, or selling to third parties.

4. How We Share Your Information

We do not sell, rent, or trade your personal data. We share data only in the following limited circumstances:

4.1 Within the Platform

By design, certain data is visible to other users who are part of the same team:

• A coach can see the names, contact details, and RSVP status of players on their roster and the parents associated with those players.
• Parents on the same team can see messages and images shared in the team communication thread.
• Club Managers can see team names, coach assignments, and aggregate team information for teams in their club.

This sharing is fundamental to the operation of the Service and is disclosed to users during sign-up.

4.2 Service Providers (Sub-processors)

All sub-processors are contractually required to protect data and use it only for the specified purpose.

4.3 Legal Requirements

We may disclose personal data if required to do so by law, court order, or government authority, or when we believe in good faith that disclosure is necessary to protect our rights, protect your safety or the safety of others, investigate fraud or abuse, or respond to a government request.

4.4 Business Transfers

If Squad is involved in a merger, acquisition, or sale of assets, personal data may be transferred as part of that transaction. We will notify affected users by email before any such transfer and before data becomes subject to a different privacy policy.

4.5 Club Sponsors

Squad does not show advertising, and we never sell your data or use it for ads. Clubs may list the local businesses that sponsor them; these are shown, labelled "Club sponsor," on the club's public page, in the app to the club's members, and in the club's emails to families.

• What we count. For each sponsor we keep only daily totals: how many people saw it, how many clicked through to its website, and how many emails included it. We do not record who saw or clicked a sponsor.
• How we count a person once a day. So that refreshing a page doesn't count twice, we combine your account ID (or, if you're not signed in, your IP address) with the date and turn it into a one-way code that is kept only in our server's memory for that day. It is never written to our database or logs and is discarded at the end of the day. Search engines and link previews are not counted.
• Emails. We count emails sent with a sponsor's name. We do not use tracking pixels and do not record whether you opened an email.
• Who sees the numbers. The club's managers. A club may share a report link with its sponsor; it shows the same totals and the club's public information, never anyone's name, contact details, or other personal information.
• Sponsor websites. Clicking a sponsor takes you to the sponsor's own website, which has its own privacy practices. We pass the sponsor nothing about you; like any website, it can see your IP address and browser when you visit.

5. Children's Privacy (COPPA & Minors' Data)

Given the nature of our platform, we take children's privacy with the utmost seriousness.

5.1 No Direct Registration by Children Under 13

Children under 13 years of age may not create Squad accounts. All data about children under 13 is provided by their parent or legal guardian through the parent's account. We do not knowingly collect personal information directly from children under 13.

5.2 What Children's Data We Hold

For children added to the platform by their parent or guardian, we hold:

• First and last name
• Year of birth (used to display age group context — entered by the parent, not the child)
• Team membership (which team(s) the child is on)
• RSVP / availability responses for events
• Notes the parent chooses to add (visible only to the child's parents and guardians; please don't add medical details)
• Team photos that club staff upload to their club's gallery, which may show children. These are visible only to signed-in members of the club unless a club manager chooses to show a photo on the club's public page.

We do not hold addresses, school information, medical information, or any other categories of data about children beyond what is listed above.

5.3 Parental Rights Over Children's Data

Parents and guardians may at any time:

• Review all information about their child by viewing their child's profile in their account.
• Correct inaccurate information by editing their child's profile.
• Delete their child's data by removing the child from their account or by contacting us at contact@squadroot.com.
• Restrict processing by removing the child from all teams and deleting the child profile.

5.4 Image Sharing

The team messaging feature allows coaches and parents to share photos. It is the responsibility of the user posting the image to ensure they have obtained appropriate media consent from parents before sharing images of minors. Squad does not pre-screen images but will act promptly upon receiving a report of inappropriate content.

5.5 Reporting Concerns

To report any concern about a child's data or inappropriate content involving minors, contact us immediately at contact@squadroot.com. We take such reports seriously and respond within 24 hours.

6. Data Retention

You can download a copy of your data, and ask us to delete your account, from the Account & privacy page (the shield icon at the top of the app once you're signed in). We delete your account and your children's profiles within 30 days of your request and email you when it is done. Signed consent forms are kept as legal records and club payment records for the club's accounting; both are separated from your account. Some data may remain in encrypted backups for up to the backup window before it is overwritten.

7. Data Security

We implement appropriate technical and organisational measures to protect your personal data against accidental or unlawful destruction, loss, alteration, or unauthorised disclosure or access:

• Encryption in transit: All data transmitted between your browser and our servers is encrypted using TLS (HTTPS).
• Encryption at rest: Data stored in our database (hosted on Supabase) is encrypted at rest.
• Password security: Passwords are never stored in plain text. They are hashed using industry-standard algorithms by our authentication provider.
• Access controls: Row-level security policies on our database ensure that users can only access data they are authorised to view.
• Authentication tokens: Session tokens are short-lived JWTs that expire automatically.
• Least privilege: API endpoints enforce role-based access controls so coaches cannot access data from other teams, and parents can only see their own children's data.

No method of transmission or storage is 100% secure. If you become aware of a potential security issue, please contact us at contact@squadroot.com immediately.

8. Cookies & Tracking Technologies

Squad uses a minimal set of cookies and browser storage:

• Sign-in storage: Your sign-in session is kept in your browser's local storage so you stay signed in. It is strictly necessary and cannot be disabled without breaking the Service.
• Session storage: Temporary storage cleared when your browser tab closes, used for in-progress UI state.

We do not use advertising cookies, third-party tracking cookies, or analytics cookies that identify individual users. We do not fingerprint devices.

9. International Data Transfers

Our infrastructure is hosted on Supabase, which may store data in data centres in the United States and/or other regions. If you are located in the European Economic Area, the United Kingdom, or other jurisdictions with data transfer restrictions, your data may be transferred to and processed in countries that may not have equivalent data protection laws.

Where such transfers occur, we rely on appropriate safeguards, including Standard Contractual Clauses (SCCs) approved by the European Commission. You may obtain a copy of relevant safeguards by contacting us at contact@squadroot.com.

10. Your Rights

Depending on your location, you may have the following rights regarding your personal data:

To exercise any of these rights, email us at contact@squadroot.com. We will respond within 30 days (or sooner where required by law). We may need to verify your identity before processing your request.

11. U.S. State Privacy Laws

In addition to the rights described in Section 10, residents of certain U.S. states have specific rights under their state's privacy law. We honor these rights regardless of where you are located — contact us at contact@squadroot.com to exercise any of them.

11.1 California (CCPA / CPRA)

The California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), grants California residents the right to: know what personal information is collected and how it is used; correct inaccurate information; delete personal information; opt out of the sale or sharing of personal information (we do not sell or share data for advertising); and limit the use of sensitive personal information. California residents may also designate an authorized agent to exercise rights on their behalf. We will not discriminate against you for exercising any CCPA/CPRA right.

11.2 Virginia (VCDPA)

The Virginia Consumer Data Protection Act grants Virginia residents rights to: access, correct, delete, and obtain a portable copy of personal data; opt out of the processing of personal data for purposes of targeted advertising, sale, or profiling. We do not conduct targeted advertising or sell personal data.

11.3 Colorado (CPA)

The Colorado Privacy Act grants Colorado residents substantially the same rights as Virginia (access, correction, deletion, portability, opt-out of sale/profiling). Colorado residents may also appeal a decision we make in response to a rights request within 45 days of our response.

11.4 Connecticut (CTDPA)

The Connecticut Data Privacy Act grants Connecticut residents rights to access, correct, delete, and port their personal data, and to opt out of sale and targeted advertising. Connecticut residents may appeal a denied rights request within 45 days.

11.5 Texas (TDPSA)

The Texas Data Privacy and Security Act grants Texas residents rights to access, correct, delete, and obtain a portable copy of personal data, and to opt out of the sale of personal data and targeted advertising. We do not sell personal data.

11.6 Delaware (DPDPA)

The Delaware Personal Data Privacy Act (effective January 1, 2025) grants Delaware residents rights to access, correct, delete, and port personal data, and to opt out of sale and targeted advertising. We honor these rights for Delaware residents. Delaware residents may appeal a denied request within 60 days of our response.

11.7 Additional State Laws

The following states have enacted comprehensive consumer privacy laws that may also apply to you:

Under all of these laws, residents generally have the right to access, correct, delete, and receive a portable copy of their personal data, and to opt out of the sale of personal data. We do not sell personal data. To exercise any right under any of these laws, contact us at contact@squadroot.com.

12. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or applicable law. When we make material changes, we will notify you by email and/or by a notice on the Service at least 14 days before the changes take effect.

Your continued use of the Service after the effective date of the revised Policy constitutes your acceptance. If you do not agree, you may delete your account before the changes take effect.

13. Contact & Complaints

For any privacy questions, data requests, or to report a concern:

If you are in the EEA or UK and are not satisfied with our response, you have the right to lodge a complaint with your local data protection supervisory authority.