Privacy Policy
What we hold
Enough to run a club: your name and email, your role in each club, the teams and players you are connected to, fixtures, and your availability answers. If you give us a date of birth, it is used for age-based eligibility rules — we do not need it and you can leave it blank.
We do not hold phone numbers, payment details, or location data.
Who else handles it
These are every service that touches club data, what reaches them, and where they process it.
| Service | What it does | What it receives | Where |
|---|---|---|---|
| Supabase | Stores the database and runs sign-in | Everything clubrooms holds: accounts, players, fixtures, availability | Australia (ap-southeast-2) |
| Vercel | Runs the website and the scheduled jobs | Data in transit as pages are served; server logs | Australia (syd1) for requests; United States for builds |
| Resend | Sends email — reminders, invitations | Email addresses, player and club names, fixture details | United States |
| Sentry | Records errors so we can fix them | Error details, the page it happened on, an account identifier; session replays with all text masked | United States |
| PostHog | Counts how features are used | Pseudonymous usage events | United States |
| Browser push services (Google, Apple, Mozilla) | Delivers notifications to a device that has opted in | The encrypted message and the device’s push address. The contents cannot be read by them; that a message was sent, and when, can. | Determined by the browser vendor, typically the United States |
Some of those process data in the United States, which means club data — including children's names — leaves Australia. What we do not do:
- SMS — there is no SMS channel and no phone number is stored anywhere
- Web push without asking — a browser will not send one until the person grants permission on that device, and turning it off removes the registration
- Advertising or marketing networks — none, and club data is never sold
Children
Built for junior sport, clubrooms holds a lot of data about children. A parent is linked to a child only when a club administrator sets that up — never by someone claiming it for themselves.
Anyone under 16 who signs up is asked for a parent or guardian's email address, and no account is created until that parent agrees. We email them a link that works once and expires in 48 hours; if they decline, or it lapses, nothing is created and the details we were holding are deleted. This applies however someone signs up, including with Google.
A child added to a team by a club administrator is a different route, and one we have not yet put a consent record behind — clubs registering players should hold their own signed parental consent, as they would on paper.
How long we keep it
For as long as the club uses clubrooms. When an account is deleted it stops working immediately and is erased permanently after 30 days — that window exists so a deletion somebody regrets can be undone, and once it closes the data is gone.
Two things outlive it, both because we are required to keep them: the record that parental consent was given, for three years, and our audit log, for one. Both stop naming the person when the account is erased. A club's count of how many played a fixture is also kept, without anyone attached to it.
Your rights
You can download a copy of everything we hold about you, correct it, or delete your account — including on behalf of a child you are linked to. All three are on your account page, and none of them requires asking us. If you would rather we did it by hand, email us and we will, at no cost.
Contact privacy@clubrooms.team for anything on this page.
Changes to this policy
- 2026-08-03 — The contact address for privacy and data-rights requests moved from a personal Gmail account to privacy@clubrooms.team, on the domain the product now runs on.
- 2026-08-01 — Recorded what is now built rather than being built: parental consent at sign-up, self-service export and deletion, and the thirty-day recovery window.
- 2026-08-01 — Published the list of services that handle club data, and where each one processes it.
- 2026-07-29 — First published, as a pilot placeholder.
Last updated 2026-08-03. See also our terms of service.