Privacy Policy

We collect information you provide directly to us and information generated as you use our platform.

Information You Provide

• Account information: Name, email address, and organization name when you create an account.
• Organization details: Sport type, team name, and season information you configure.
• Payment information: When you connect a bank account to receive payments, we collect information required by Stripe (our payment processor). We do not store full bank account or card numbers on our servers.
• Player/family information: Names and email addresses of players and guardians you add to your roster.
• Communications: Any messages or support requests you send us.

Information Collected Automatically

• Usage data: Pages visited, features used, time and date of access, and referring URLs.
• Device information: Browser type, operating system, IP address, and device identifiers.
• Log data: Server logs including IP address, browser type, and pages requested.

We use the information we collect to:

• Create and manage your account and organization
• Process payments and send payment reminders
• Track enrollment and cleared-to-play status
• Send transactional emails (receipts, reminders, notifications)
• Respond to your support requests
• Improve our platform and develop new features
• Comply with legal obligations
• Detect and prevent fraud and abuse

We do not sell your personal information to third parties.

All payment processing on RosterPay is handled by Stripe, Inc., a PCI DSS Level 1 certified payment processor. When parents make payments or organizations connect their bank accounts, financial data (card numbers, bank account details) is transmitted directly to and stored by Stripe.

RosterPay does not store full payment card numbers or bank account numbers on its servers. We receive payment tokens and transaction status information from Stripe.

By using RosterPay's payment features, you also agree to Stripe's Privacy Policy.

RosterPay uses Supabase (powered by PostgreSQL) for secure data storage. Our databases are hosted on infrastructure with encryption at rest and in transit.

Data is stored in the United States. By using RosterPay, you consent to the transfer and processing of your information in the United States.

Supabase maintains its own security certifications and practices. You can review Supabase's security practices at supabase.com/security.

We use cookies and similar tracking technologies to:

• Authentication cookies: Keep you signed in to your account (managed by Supabase Auth).
• Session cookies: Temporary cookies that expire when you close your browser.
• Analytics: We may use privacy-respecting analytics tools to understand platform usage and improve features.

You can control cookies through your browser settings. Disabling authentication cookies will prevent you from signing in to RosterPay.

RosterPay is a platform for sports organizations and adult coaches/administrators. Our platform is not directed to children under the age of 13, and we do not knowingly collect personal information directly from children under 13.

While RosterPay may store the names of minor players (under 18) on rosters as entered by their adult coaches or team managers, we do not directly solicit or collect personal information from minors. Player roster entries are provided by the adult organization administrator, not by the player themselves.

Payment interactions (enrollment, fee payments) are handled by the adult parent or guardian of the minor player, not by the minor directly.

If you believe we have inadvertently collected personal information from a child under 13 without appropriate parental consent, please contact us at support@rosterpay.io and we will promptly delete such information.

We comply with the Children's Online Privacy Protection Act (COPPA). Parents and legal guardians of minor players have the right to review and request deletion of any information we may hold about their child by contacting us.

We share your information only in the following circumstances:

• Service providers: We share data with trusted third-party service providers who help us operate the platform (Stripe for payments, Supabase for data storage, email service providers for transactional messages). These providers are contractually obligated to protect your data.
• Within your organization: Organization administrators can see information about their enrolled players and payment statuses.
• Legal requirements: We may disclose information when required by law, court order, or governmental authority.
• Business transfers: If RosterPay or PJ Publishing, LLC is acquired, merged, or sells assets, your information may be transferred to the acquiring entity, subject to the same privacy protections.
• With your consent: We may share information for other purposes with your explicit consent.

We retain your information for as long as your account is active or as needed to provide you services. You may request deletion of your account and associated data by contacting us at support@rosterpay.io.

We may retain certain information for longer periods as required by law (for example, financial transaction records for tax and accounting purposes). Payment and transaction records are typically retained for at least 7 years as required by applicable law.

Depending on your location, you may have the following rights regarding your personal information:

• Access: Request a copy of the personal information we hold about you.
• Correction: Request correction of inaccurate or incomplete information.
• Deletion: Request deletion of your personal information, subject to certain legal obligations.
• Portability: Request your data in a portable format.
• Opt-out of marketing: Unsubscribe from marketing communications at any time using the unsubscribe link in our emails. Note: you cannot opt out of transactional emails related to your account.

To exercise any of these rights, contact us at support@rosterpay.io.

We take reasonable technical and organizational measures to protect your information from unauthorized access, loss, or alteration. These measures include:

• HTTPS/TLS encryption for all data in transit
• Encryption at rest for database storage
• Secure authentication via Supabase Auth (magic links and OAuth)
• PCI DSS Level 1 payment processing via Stripe
• Limited employee access to personal data on a need-to-know basis

No method of transmission over the internet or electronic storage is 100% secure. While we strive to protect your information, we cannot guarantee absolute security.

We may update this Privacy Policy from time to time. When we make material changes, we will notify you by updating the "Last updated" date at the top of this page and, where appropriate, by sending you an email notification.

Your continued use of RosterPay after any changes constitutes your acceptance of the updated Privacy Policy.

If you have questions, concerns, or requests regarding this Privacy Policy or our privacy practices, please contact us: