Legal

Squadora Privacy Policy

Effective: October 21, 2026

1. Who we are

Squadora is software for youth soccer clubs, offered on iOS, Android and the web by Squadora L.L.C., a Minnesota limited liability company ("Squadora", "we", "us"). Squadora L.L.C. is responsible for the personal information described here, except where a club decides what to collect (see below).

Contact for privacy questions and requests, and for anything else: support@squadora.com.

Clubs and Squadora. Each club runs its own program on Squadora. A club decides which families and players it adds, what it asks them to share and how it uses what it holds. We process that information for the club to provide the service. A club's own privacy practices are the club's responsibility.

This policy covers the Squadora apps for iPhone, Android and the web. Our Terms of Service are in the app.

2. Children's privacy

Squadora serves youth soccer clubs, so many of the people whose information it holds are children. Squadora is offered in the United States only.

Guardians come first. A child's record is created by a parent or guardian, or by the club working with a parent or guardian. A parent or guardian can see their child's information, ask us or the club to correct it, ask us or the club to delete it, and ask us to stop collecting more.
Children under 13. A child under 13 does not create an account or give us information directly. Information about a child under 13 comes from the parent or guardian or from the club. We do not knowingly collect personal information directly from a child under 13 without the verifiable consent of a parent or guardian, where the law requires it.
Players 13 and older. A club can invite a player who is 13 or older to join with their own account. A player with an account can see their own team, schedule and messages and can upload their own photo. If we learn that a child under 13 has an account, we delete it.
What we hold about a child. A name, an age group or date of birth, a jersey number, a position, a team, a photo, and the details a guardian or club adds, such as medical notes, allergies, medications, a doctor and an emergency contact. These details are visible only to the child's household, and to the club staff who need them for that team.
Sharing. We do not sell a child's information, use it for advertising or share it for behavioral advertising. A public club page and a public tournament page show only team and match information. They do not show a player's date of birth or contact details.
Second guardian. A guardian, or a club administrator, can invite a second parent or guardian for the same child. The person invited must accept. The guardian who invited them, or a club administrator, can withdraw a pending invitation or remove that access.
AI. When a minor is involved, the AI tools apply a stricter safety block (section 5).
To use any of these rights, a guardian can write to support@squadora.com or use the controls in the app. We may confirm that you are the child's guardian first. If you believe a child has given us information without a guardian's permission, write to us and we will delete it.

3. What we collect

3.1 Your account

Your email address, name, profile photo and phone number, as you provide them or as your sign-in provider gives them to us (Apple may give us a private relay address instead)
Which way you sign in: email and password, Apple or Google. Passwords are handled by Google's Firebase sign-in; we do not see them.
Your role in each club (for example parent, coach, manager, club administrator or player) and which teams you are assigned to
Your notification choices and communication preferences, and and, if you allow notifications, a device push token tied to your account. We use the token only to deliver your club's notifications to that phone. Push messages are sent through Firebase Cloud Messaging, which delivers them through Apple's and Google's push services (section 3.7)
Your address and date of birth, if the club asks for them

3.2 Players and families

Player name, jersey number, position, team and club, date of birth, gender and photo
Which parents or guardians are linked to which child, and invitations to a second guardian
Private player details a guardian or club adds: allergies, medications, medical notes, a doctor, school and grade, an emergency contact and family contacts. These sit in a separate private record, visible to the household (including a second guardian the household invites), to the club owner and administrators, to the managers and coaches of that player's team, and to Squadora's platform administrators. Treasurers, other team staff, data stewards and scouts cannot see it. We treat this as sensitive: it is used only to provide Squadora to you and your club, it is never sold, and it is never used for advertising.
Forms a family completes for a club, including a signature image
Registrations for programs, events and tournaments, and the answers a family gives

3.3 What happens in the club

Team rosters, schedules, attendance and replies to event invitations, game results and lineups
Messages, club and team chats, and announcements. A direct message is visible to its participants and a team chat to its members. - Photos and media a member uploads, such as match photos. Club media is deleted automatically 3 years after upload unless the club turns on the setting to keep media longer. - Reports you send about a message or a person, and any safeguarding flags a club raises. These go to the club and to Squadora's support staff.
Support requests and the replies

3.4 Payments

Club fees are paid by card through Stripe. Each club has its own connected Stripe account, and your payment goes to that account. Stripe receives your card details directly; we never receive or store your full card number. We keep a record of each payment: who paid, for what, the amount, the fee, the status and Stripe's reference, plus the last digits and brand of a saved card and your autopay choices. If you ask a club for financial aid or a refund, we keep the request.

3.5 Keeping the service safe and affordable

To prevent abuse and control cost, we keep rate-limit counters and a record of each AI request's size and cost. We also log every email we send (who, which kind and when) so we can show it was delivered or find a failure.

When we email a club about Squadora, and when anyone visits squadora.com or app.squadora.com, we count it on our own servers: that an email was opened, that a link in it was clicked, and which page was visited. We keep the page, the day, the link and the kind of browser. We do not keep your IP address, set a cookie or follow you from page to page, and none of it goes to another company. A browser that sends Do Not Track or Global Privacy Control is not counted as a visit. To stop abuse, our server briefly uses a scrambled form of your network address as a counter; it is never saved with what we count. We delete the individual records after 90 days and keep only the daily totals.

3.6 What we do not collect

No advertising identifiers and no ad trackers. The app's dependency list (package.json, checked 2026-10-14) holds no analytics or advertising SDK. The shipped app has no third-party analytics or crash reporting. Our server keeps its own error logs.
Location: the app never asks for your location in the background. On a phone, a parent can turn on "Leave now alerts" for a child. The phone then reads its own location, while the app is open, to work out the drive to the next event and to schedule a reminder on that phone. Squadora never sees or stores your location: it is not sent to Squadora and not shared with the club. On iPhone the drive time comes from the phone's own Maps, which means your phone asks Apple for a route under Apple's privacy terms, the same as using the Maps app; on Android the phone estimates the drive itself and the reminder says the time is approximate. The choice itself is kept only on that phone. The alerts are off until you turn them on and you can turn them off at any time in Notification preferences. (Code: lib/leaveNow, modules/device-eta.)

3.7 Push notifications and the home-screen widget

Push notifications. If you allow notifications on your phone, the app registers a device push token with Squadora and keeps it with your account. The token is used for one thing: delivering your club's notifications (schedule changes, cancellations, messages, announcements, RSVP and event reminders, payments, forms and access updates). It is not used for advertising or tracking and is not shared with your club.
What a notification shows. The text on your lock screen names the team and says what happened. It never includes a child's name, an amount of money or medical details. Opening it takes you to the event, message, invoice or form.
Your control. You choose which categories you get, can mute a team or a child, and can set quiet hours. Routine reminders are held until quiet hours end. Live match updates are off until you turn them on. We send no promotional notifications.
When the token is removed. We delete your token when you sign out of that phone, when you use "sign out of all devices", and when you delete your account. We also delete tokens that Apple or Google report as no longer valid.
The home-screen widget. The widget shows your household's next events, such as the event, the team, the time and whether an RSVP is needed. It reads a copy of that schedule that the app already saved on your phone. The widget makes no network connection of its own, sends nothing to Squadora or anyone else, and that saved copy is cleared when you sign out.

4. How we use it

To run your account and sign you in
To let your club run teams, schedules, registrations, messages and fees
To send notifications and emails you or your club trigger, such as invitations, reminders, receipts and fee notices
To process payments through Stripe
To draft club messages and answer coaching questions when staff use the AI tools (section 5)
To prevent abuse, enforce limits, keep costs under control, fix problems and keep the service secure
To meet legal obligations

We do not sell your personal information, share it for cross-context behavioral advertising or use it for advertising of any kind.

4A. Marketing email

What we send. If you write to us about your club, we reply to you. If you ask to hear from us, we may send you occasional email about Squadora: what we are building, when it is ready, and how clubs use it. We do not send marketing email to anyone who has not asked for it.

Consent. You choose to receive marketing email by asking us in writing or by signing up through a form we provide. Writing to us with a question does not sign you up for anything. Replying to a club enquiry is not marketing email.

Children. We do not send marketing email to children, and we do not collect a child's email address for marketing. Parents and club staff are our audience. If a child's address reaches us, we delete it and tell the club.

Unsubscribe. Every marketing email carries an unsubscribe link that works without signing in. You can also write to support@squadora.com and we will stop within ten business days. Messages you need as a club member (a schedule change, a payment receipt, a form to sign) are not marketing and keep coming while you use Squadora.

What we keep. For marketing email we keep your name, your email address, your club if you told us, and the record of your consent and of any unsubscribe. We keep it while you are subscribed and for as long afterwards as the law requires us to prove that we honoured your choice.

What we never do. We do not sell, rent or share our mailing list. We do not buy lists. We do not add tracking pixels to our email beyond the counts our own email service reports.

Who sends it. Marketing email comes from an address on squadora.com. Our mailing address appears in the footer of every marketing email. That address is Squadora L.L.C., PO Box 101, Eyota, MN 55934.

5. AI: Google Gemini through our server

Some Squadora tools can draft text for club staff (messages, newsletters and match recaps) and can answer coaching questions. They are written by Google's Gemini model, reached only through Squadora's own server. Your device never talks to the model directly. Every request goes through our server, which checks that you are signed in, that your email is verified and that your club is allowed to use AI, and which enforces a daily limit. Gemini is the only AI provider that receives what you write.

Draft this asks first: before a staff member's first use of Draft this, the app names Google Gemini and asks them to agree, and our server refuses a draft until they have. - What is sent: the text you or the tool prepared as the request, and sometimes an age group, a competitive level and whether the person is a minor. Our server sends the request as written and does not remove names, so a player's name reaches the model if the request contains it. Please do not type a child's private details (health, address, school, contact details) into an AI request.
Chat safety checks: every new chat message is first checked by fixed word and pattern rules. If those rules do not stop it, the message text is sent through our server to Gemini to look for grooming, bullying, self-harm, requests for personal information and similar harms. A flagged message is hidden and sent to club admins for review. Only the message text is sent for this check, and if the check fails the message stays as written. A chat that includes anyone under 18, or anyone whose age we cannot confirm, is never sent to the model; only the word and pattern rules check it.
How Google handles it: we use Google's paid Gemini API. Under Google's terms for paid use, Google does not use your messages or the AI's replies to improve its products, and processes them as our data processor. Google keeps a log of requests and replies for 55 days, only to detect and prevent misuse and for legally required disclosures, and may store that data briefly or cache it in any country where Google or its agents have facilities, so it can be processed outside the United States.
Fence for minors: requests marked as involving a minor use a stricter safety block. The AI is not a person, a coach, a doctor or a lawyer, and a person at the club should read any draft before it goes out (Terms, section 4).

6. Who we share it with

Google Cloud and Firebase (Google LLC). Hosting, database, file storage, server functions and sign-in. Project matchday-152cd. Stored in the United States. Receives everything in section 3 that we store.
Stripe. Processing card and bank payments for clubs. Receives what you need to pay; you give card details to Stripe directly.
Google Gemini (Google LLC). AI drafting and the chat safety check, only the request text described in section 5. May be cached outside the United States.
Apple and Google. Sign in with Apple and Google sign-in, and push notifications, which go through Firebase Cloud Messaging (Google) to Apple's and Google's push services. The notification text and a device push token are what they receive; see section 3.7.
Email host. Email we send for the service goes through our mail account. The provider is GoDaddy Email Essentials, which runs on Microsoft 365. It receives the message, the recipient and the delivery details.
Weather provider. Open-Meteo. For the weather on a match or event, our server sends it the venue or location text the club entered, and then the coordinates it returns. It does not receive your name, account or device. Our server keeps the answer for a short time (30 to 60 minutes for forecasts) so the same venue is not looked up again.
Your club. The club you belong to sees what you or your family give it, and what we hold for it. Other members see what the club's roles allow, such as names and photos on a roster. Only a player's own team sees the player's photo.
Authorities. Only when the law requires it, the minimum required.

If Squadora L.L.C. is involved in a merger or sale, your information may move to the new owner under this policy, and we will tell you before it does.

7. How long we keep it

Your account and club data: while your account exists.
When you delete your account: the account is deactivated at once and you can no longer sign in. Support can restore it within the first 30 days. After 30 days a daily scheduled job permanently purges it. Your push tokens are deleted at once, when you delete the account, so no notification reaches your phone again. The purge removes your club memberships, notifications, any remaining push tokens and autopay rules, unlinks your children's player records from your account (unless you chose, when deleting, to also erase a child's record: the purge then deletes that player record and its private details, and the child's name and photo are replaced with "Former player" where they appear in lineups, results and attendance), removes you from any co-owner list, replaces your name on your chat messages with "Former member" and clears your photo there, deletes your personal files, and deletes your sign-in. Deleting an account also turns off saved cards and autopay. Club owners must first transfer or delete their club. Copies in our backups are removed as those backups expire, within 98 days.
Club-held records. A club may keep records it is entitled to keep, such as payment history or a roster, after a member leaves. After a purge we keep payments, signed forms and waivers, registrations and audit logs, because they are club business and legal records. We also keep the Stripe customer record for our financial trail; saved cards are detached from it.
Payment records: 7 years, for tax and accounting duties.
Media: club media is deleted automatically 3 years after upload, or when the club's account ends, whichever comes first, unless the club turns on the setting to keep media longer. The club owner and staff get an in-app notice and an email at 180, 90, 15, 3, 2 and 1 days before deletion.
Rate-limit records, email logs, server logs and support tickets: Server logs are kept for 30 days. Rate-limit and abuse records and email logs are deleted 90 days after their last update. Closed support tickets and their messages are deleted 12 months after the last activity; open tickets are kept until they are resolved.
Inactive accounts: If an account has not been used for 24 months, we email a warning (for a minor's own account, the guardians are copied). If it is still unused 30 days later, we close it as if its owner had deleted it, as described above.

8. Your choices and rights

You can:

See and correct your profile in the app.
Delete your account in the app, as section 7 describes.
Download a copy of your data, and of the children you guard, in Settings under Your account, Download your data.
Turn off notifications in the app or in your phone's settings, choose which push categories you get, mute a team or a child, and set quiet hours. Signing out removes the widget's saved schedule from your phone.
Remove a child's photo (a parent can remove their child's photo).
Ask a club to correct or delete what it holds, and ask us at support@squadora.com about anything else.

Depending on where you live (for example California, Colorado, Connecticut, Minnesota, Oregon, Texas, Virginia or Washington), you may have further rights: to know what personal information we hold and get a copy, to correct it, to delete it, and to opt out of its sale, of targeted advertising and of profiling. We do not sell or share personal information, use it for targeted advertising, or profile you in ways that have legal or similarly significant effects.

To use a right, write to support@squadora.com or use the controls above. You can also download a copy in the app, as above. We may confirm the request comes from you by replying to the email address on your account, and you may use an authorized agent where your state allows it. We will answer within 45 days; if we need longer, as the law allows, we will tell you why within those 45 days. If we decline a request, you can appeal by replying to our answer. We will decide the appeal within the time your state's law sets and, if we still decline, tell you how to contact your state's attorney general. We will not treat you differently for using your rights.

9. Security

Data moves over encrypted connections and is stored on Google Cloud with access rules that let each person read only what their role allows. API keys and payment secrets stay on our servers and never ship in the apps. No system is perfectly secure. If a breach affects your information, we will notify you and the authorities as the law requires.

10. Changes

We will tell you in the app before a material change takes effect, and ask for your consent again where the change needs it. The date at the top shows the latest version.

11. Contact

Squadora is operated by Squadora L.L.C., a Minnesota limited liability company. Privacy and general questions: support@squadora.com. Postal address: Squadora L.L.C., PO Box 101, Eyota, MN 55934. Legal notices may be sent to support@squadora.com.