Privacy policy

Who we are

Scrimmages provides scheduling, registration, messaging, and game-video tools to youth sports teams, clubs, and leagues. The club or league you belong to (the “organization”) decides what programs to run and what information to request; Scrimmages processes that information on the organization’s behalf.

What we collect

• Account data — name, email, password (stored hashed), and team/organization role for coaches, managers, league staff, and parents or guardians.
• Registration data about minors — when a parent or guardian registers a child, the organization may collect the child’s name, date of birth, emergency contacts, medical or allergy notes, and answers or documents for organization-configured program questions. This information is provided by the guardian or authorized organization staff acting for them. Registration and medical details are restricted to authorized organization administrators, registrars, and treasurers, and to the player’s own coaches and team managers (for example in a printed roster pack for game day). Access to medical and emergency-contact details is logged. They are never sold or used for advertising.
• Additional adult contacts — a guardian may request a player's secondary-contact invitation using that adult's name, email and optional relationship. The request is encrypted and waits for roster publication and primary-account confirmation. The invited adult must accept before receiving player access; their household, other players and payment access stay separate. Verified adults can request a copy or removal of their captured details through the privacy-request process.
• Game video, audio, and photos — game film uploaded or streamed by teams, including footage of minor athletes. Audio is off by default and may be enabled only under the organization’s recording policy and capture-time notice controls. Processed game film is private by default; a team coach may choose to list recent game cards on the public channel, while full film still requires an authorized sign-in.
• Payment data — organizations may record manual or offline payments in the ledger. When an organization enables online payments, Stripe processes the payment details; Scrimmages never sees or stores full card numbers. We keep payment amounts, payment status, how each payment was made (for example card, check, or cash), the payment processor’s reference number, and receipts.
• Vendor check mailing — when enabled by an organization, finance staff submit approved vendor payee names, postal addresses, amounts, check messages, and organization sender details to Lob for printing and mailing. We retain check requests, independent approvals, mailing outcomes, and bank clearance evidence as financial records. Mailing addresses and provider credentials are encrypted. Bank verification and signature setup take place with the provider; a connected bank feed alone does not authorize check funding.
• ACH payments and reimbursements — when enabled by an organization, finance staff send approved business vendor payments and individual coach or volunteer reimbursements through Modern Treasury using verified bank-account references. Reimbursements link the approved receipt and team claim to the accounting bill; receipts stay in Scrimmages. We retain masked destination details, payment terms, independent approvals, provider status, and confirmed bank debit and return evidence as financial records. Provider credentials and approved destination snapshots are encrypted. Full bank details and verification are handled with the payment provider; a reconciliation bank connection alone does not authorize sending payments.
• Organization bank activity — when authorized finance staff connect an organization bank account through Plaid, we keep bank account names, masked identifiers, account type and currency, transaction dates, descriptions, amounts and status, and connection permission records for reconciliation. Bank authorization takes place with Plaid or the bank. Bank access credentials are encrypted, and bank activity is restricted to the organization’s administrators and treasurers. Finance staff can disconnect to stop future syncing; retained accounting evidence and closed reconciliations remain subject to the organization’s financial record obligations.
• Usage data — logs (IP address, browser, pages viewed) used for security and to keep the service working. When product analytics are turned on, we also send coded organization or team IDs and general information about which features are used. This never includes names, email addresses, children’s content, tracking cookies, or session recordings. If a family follows a registration link on an organization’s website, a short-lived label records which page the link was on so that a registration submitted from it counts toward that page. Organization administrators see only totals per page; this report doesn’t identify visitors or collect browsing history.

Game safety records

An organization may use recorded game film to review a reported safety, safeguarding, misconduct, serious-injury, or referee-abuse incident. A report protects a limited time window from routine deletion. Authorized administrators at both organizations involved (the one that accepted the report and the home organization whose game was recorded) may view, play, and download the restricted clip. Only administrators at the organization that accepted the report may change the clip’s time window, retry creating the clip, resolve the report, release its hold, or otherwise decide what happens to it. Every view, playback, and download of a protected record, and each of those actions, is logged. Safety records are not a video-review system and may not be used to challenge ordinary referee judgment calls.

Children

Scrimmages does not offer accounts to children under 13, and we do not knowingly collect personal information directly from them. A parent or guardian can create a player login only for an athlete whose age on record is 13 or older. If we learn that an athlete with a login is under 13, we remove that login. Athletes 13 through 17 are normally records managed by a guardian, but a guardian may provision an optional read-restricted athlete login when the organization enables that feature. Information about minor athletes is provided by their parent or guardian (or by organization staff with the guardian’s consent) to run the program: rosters, schedules, emergency contact, and safety. Scrimmages has no private one-to-one messaging between a minor and an unrelated adult; direct messages are between adults only. If you believe we hold information collected directly from a child under 13, contact us so we can verify the request and remove or retain it as legally required. For full detail on how we handle information about athletes under 13 — including parental rights and our contextual-ads-only commitment — see our Children's privacy notice.

How we use and share information

We use the information above to run the service the organization signed up for: rosters, schedules, RSVPs, registration and payment records, team messaging, and game film. When a feature that relies on an outside provider is turned on (for example online payments or text messages), Scrimmages sends that provider the kinds of data described on our Subprocessors page. Your organization’s signed agreement with Scrimmages, including its data-processing addendum, says which providers are actually in use. Some services, such as accounting, payroll, or social publishing accounts, are connected by your organization with its own account; the Subprocessors page lists those too. We never sell personal information, never use minors’ data for advertising, and disclose data otherwise only when the law requires it.

If you choose optional street-address search during registration, Google Maps receives the address text you search, a random search-session identifier, and an optional country filter. We send no account identifier, child name, birthdate, phone number or email with that search. Suggestions are temporary; your selected address stays with the registration you submit or explicitly save in a private registration draft. Lookup addresses are not copied into reusable family profiles. You can enter your address manually instead. Google’s Privacy Policy applies to its processing of address searches.

Email and SMS

Schedule changes, reminders, and announcements go out by email, push, and, only if you opt in, SMS. Your organization may also send promotional emails about programs, membership renewals, and organization promotions, but only to families where a parent or guardian has opted in on the Family page. Promotional emails, and announcement emails sent to families without a Scrimmages account, include an unsubscribe link. If you have an account, turn email, push, or SMS on or off on Notification preferences. Essential messages, such as registration, payment, safety, and urgent schedule changes, may still be sent after you unsubscribe. Stop SMS by replying STOP. Message and data rates may apply; consent to SMS is never a condition of registration.

Scrimmages Capture mobile app

This policy also covers Scrimmages Capture on iOS and Android. The app uses your account and team roles to show schedules, announcements, team conversations and the family information you are authorized to see. Messages, replies, attachments and reactions you submit are shared with the authorized participants in that conversation. Announcement formatting and links are part of the message content; opening an external link sends you to the destination website, whose own privacy policy applies.

Camera, microphone, photo-library and Bluetooth access are used for the capture, attachment or camera-pairing feature you choose. You may decline or revoke these permissions in your device settings; features that need that permission will be unavailable. We do not upload your entire photo library. Selected media, recordings and upload-retry records may remain in the app's local storage until uploaded or removed. Sign-in credentials are kept in the device's secure credential storage. Removing the app does not delete media or account records already stored by Scrimmages.

When you enable push notifications, Expo and Apple or Google process device delivery tokens and notification content. Turn push off in the app's notification preferences or device settings. If error reporting is configured, Sentry receives diagnostic information such as errors, stack traces and device/app context; default collection of personal request information is disabled. The app does not use advertising identifiers or cross-app advertising tracking. Optional personal-library purchases are processed by Apple or Google; we retain purchase identifiers and entitlement status to verify access and restore purchases, not full payment-card details. Store subscriptions are managed and canceled through the relevant store.

Delete your account and associated data

In Scrimmages Capture, open Settings → Help and privacy → Export or delete your personal information. Sign in on the web page to confirm your identity and submit a deletion request. You can also open privacy requests or email support@scrimmages.app with the subject “Account deletion,” your account email and organization. You do not need to reinstall the app to ask. Never send your password, medical documents or payment-card details by email.

We verify that you control the account before acting. A verified request removes or anonymizes account and associated personal information, except records that must be retained for legal, financial, safeguarding or security obligations. Shared team records may be retained with personal identifiers removed where appropriate. We explain any applicable retention exception when handling the request. Deleting an account does not automatically cancel an Apple or Google subscription; cancel it in the store as well.

Retention and deletion

Account data is kept while your account is active. Registration records (including medical notes) are kept for the duration of the program and as long as the organization needs them for its own legal and safety obligations, then deleted on the organization’s instruction. Organizations set separate retention periods for raw uploads from game cameras, processed game video, and evidence from resolved safety incidents. An active legal or safeguarding hold overrides those deletion periods; resolving an incident does not release its hold automatically. Guardians can ask their organization — or us directly — to correct or delete their family’s information; we honor verified requests except where the organization or law requires a record to be retained.

Security

All traffic is encrypted in transit (TLS). Passwords are stored hashed. Access to registration and medical data is restricted by role — organization administrators, registrars, and treasurers can view only their own organization’s records, and coaches and team managers only their own team’s. No system is perfectly secure; if a breach affects your data, we will notify you and the organization as the law requires.

Your choices and rights

Change your phone number, language, password, and which channels we use (email, push, or SMS) on Notification preferences. Stop SMS by replying STOP. You may ask us to access, correct, or delete your personal information and, where applicable law (such as the CCPA/CPRA or other state privacy laws) grants them, to exercise additional rights. If you have a Scrimmages account, you can ask for a copy of your data or ask us to delete it from Privacy requests. For corrections or other rights, or if you don’t have an account, email privacy@scrimmages.app. We don’t discriminate against you for exercising any right. For a child’s information, see the Children's privacy notice.

Cookies

We use a single first-party session cookie to keep you signed in and to protect against cross-site request forgery. We don’t use third-party advertising or cross-site tracking cookies, and ads on public pages are contextual only.

Contact

Questions or requests: email privacy@scrimmages.app, or contact support@scrimmages.app for app support.