You In Hockey Privacy Policy

Who we are

You In Hockey is made by SPORTPLAY LABS LLC, a company registered in Florida, United States, at 3111 E 8th St, Panama City, FL 32401, United States. We decide what data the app collects and how it is used, which makes us the data controller. Our privacy contact is support@sportplay-labs.com.

A note about children

You In Hockey is built for hockey teams, and many of those teams are youth teams. The app is not directed to children under 13 as a general-audience product: an account for a player under 13 is created and managed by a parent, legal guardian, or a coach acting with the parent's permission, and that adult decides what goes in the child's profile.

Whatever the age of the player, the app never:

shows advertising of any kind;
sells or shares personal data with data brokers or advertising networks;
builds advertising profiles or tracks users across other apps and websites;
asks a child for more data than the team needs to organise practices and games;
makes a child's profile public or searchable outside the teams they belong to.

A parent or guardian can ask us at any time to show them what data we hold about their child, to correct it, or to delete it and close the account. Write to support@sportplay-labs.com from an address we can verify against the account, or see how to delete an account. We will not require a child to disclose more than is reasonably necessary in order to take part in team activities in the app.

What we collect

Account data

An email address or phone number, a password, and a display name. Passwords are stored only as salted hashes, never in a form we can read. We keep account credentials separate from profile data in our database, so that a person's identity and their team activity are not held in one place.

Profile data

The role in the team (player, coach, staff, or parent), and for players the position, jersey number, and the age group or date of birth where the club records it. A profile photo if one is uploaded. All of this is entered by the user or by the adult managing the account.

Team data

Which teams a person belongs to and with what rights, the schedule of practices, games and events, and attendance responses for those events.

Messages

The content of messages sent in team and staff chats, with the sender and timestamp. Messages are stored on our servers so that they can be delivered to team members who were offline and so that the team can read the history. They are not end-to-end encrypted, and a team administrator can see messages in the team chats they administer.

Sports statistics

Game results, player statistics for the season, and attendance history. Some of this is entered by the team and some is imported from league sources where the club uses them.

Technical data

Device model, operating system version, app version, language, IP address, crash diagnostics, and a push notification token so we can deliver notifications about team events.

Usage analytics

Which screens are opened and which features are used, through Google Analytics for Firebase. We use it to find what breaks and what nobody can find, not to identify people. We do not enable advertising identifiers or ad personalisation features in it.

Why we use this data

To run the app. Rosters, schedules, attendance and chat are the product; without this data there is nothing to show. Legal basis: performance of our agreement with you.
To send notifications about practices, games, schedule changes and new messages. Legal basis: performance of our agreement with you; you can turn notifications off in your device settings.
To keep accounts secure and to investigate abuse, spam and attacks. Legal basis: our legitimate interest in a service that is not abused.
To fix and improve the app using crash reports and usage analytics. Legal basis: our legitimate interest in a working product; where consent is required for analytics, we ask for it in the app.
To answer support requests. Legal basis: performance of our agreement with you.

We do not use personal data to make decisions about anyone by automated means, and we do not profile users.

Who else receives data

We share data only with service providers acting on our instructions:

Hosting. The companies whose data centres run our servers and store our databases and backups.
Push notifications. Apple Push Notification service and Firebase Cloud Messaging deliver notifications to devices. They receive the device token and the notification content.
Analytics and crash reporting. Google Analytics for Firebase and Firebase Crashlytics receive usage events and crash diagnostics.

We do not sell personal data and we do not share it for cross-context behavioural advertising, as those terms are used in United States state privacy laws. We disclose data to authorities only when a valid legal request requires it, and we tell affected users unless the law forbids it.

Where data is processed

Our servers are located in data centres in the Russian Federation, and our push and analytics providers process data in the United States and other countries where they operate. This means personal data is transferred across borders, including out of the country where the user lives. We keep such transfers limited to what the app needs to work, and we require our providers to protect the data under contract.

How long we keep it

Account and profile data: while the account exists, then deleted within 30 days of a deletion request.
Team data and messages: while the team exists. When a person leaves a team, their attendance history stays with the team record, and their messages remain in the team chat unless deletion is requested.
Crash diagnostics: up to 90 days.
Analytics events: up to 14 months.
Backups: deleted data may remain in encrypted backups until those backups expire, within 90 days.

Your rights

You can ask us to show you the data we hold about you, correct it, delete it, export it in a portable format, or restrict how we use it. If you are in the European Economic Area or the United Kingdom, these rights come from the GDPR. If you are in California, the CCPA gives you the rights to know, delete, correct, and opt out of sale or sharing — we do neither, so there is nothing to opt out of. Parents and guardians hold these rights on behalf of their children under COPPA.

Write to support@sportplay-labs.com. We answer within 30 days. We will never refuse you service, charge you more, or give you a worse experience for exercising a privacy right.

Security

Connections between the app and our servers are encrypted with TLS. Sessions use short-lived signed tokens rather than stored passwords. Passwords are hashed. Access to production systems is restricted to the engineers who need it and protected by multi-factor authentication. We keep credentials and personal details in separate database records so that one does not expose the other.

Changes to this policy

We update the date at the top when this policy changes. If a change materially affects how we use personal data, we will notify users in the app before it takes effect.

Contact

support@sportplay-labs.com

Postal correspondence can be sent to:
SPORTPLAY LABS LLC
3111 E 8th St, Panama City, FL 32401, United States