Privacy Policy

1. Information We Collect

Information you provide directly:

• Account information: name, email address, and password (passwords are stored in hashed form by our authentication provider — we never see or store your plaintext password);
• Profile and roster information: phone number, pronouns, t-shirt size, height, football experience and position preferences, Instagram handle, team affiliation, jersey number, or other details you choose to provide;
• Demographic information (optional): age range, gender identity, sexual orientation, race or ethnicity, and zip code, collected for league diversity reporting and organizational purposes;
• Registration and waivers: typed electronic signatures, waiver acknowledgments, and timestamps when you register for a season;
• Mailing list: email address and optional name when you sign up for league updates, plus your consent to receive emails;
• Contact form: name, email address, and message content when you reach out through the Site;
• Communications: other content you submit through the Site and correspondence you send us.

Information collected automatically:

• Technical data: IP address, browser type, device information, and basic usage logs generated by our hosting and authentication providers;
• Cookies and similar technologies: we use cookies strictly for essential functions such as keeping you logged in, maintaining site security, and (when enabled before public launch) remembering preview access to a password-protected version of the Site. We do not use advertising or cross-site tracking cookies.

2. How We Use Your Information

We use your information solely to operate the League and the Site, including to:

• Create and manage your account and authenticate logins, including sign-in with Google;
• Organize teams, rosters, schedules, standings, drafts, and league events;
• Communicate with you about League matters (schedule changes, cancellations, registration, rules, and similar operational messages);
• Send mailing-list updates you have opted into;
• Maintain the safety and integrity of the Site and the League;
• Comply with legal obligations.

3. What We Will Never Do With Your Information

We do not sell, rent, trade, or share your personal information with third parties for advertising or marketing purposes. Ever.

Specifically, we will never:

• Sell or rent your contact information to anyone;
• Use your email address or phone number to send you third-party advertisements or promotional material;
• Share your information with data brokers, advertisers, or marketing companies;
• Display third-party targeted advertising on the Site based on your data.

The only communications you will receive from us relate to League operations or mailing-list updates you opted into.

4. Who Can See Your Information

Member information (rosters, contact details, schedules) is visible only to registered, logged-in League members and administrators. It is not published on public-facing pages, indexed by search engines, or made available to the general public.

All members are contractually prohibited under our Terms of Service from sharing other members' information outside the League or using it for non-League purposes.

5. Service Providers

We use third-party service providers to operate the Site. These providers process data on our behalf and only as necessary to provide their services to us:

• Supabase — authentication, database, realtime updates, and session management;
• Google — optional OAuth sign-in (name, email, and profile photo from your Google account);
• Vercel — website hosting, server functions, and scheduled tasks;
• Sanity — content management for public page copy, announcements, and waiver text;
• Resend — delivery of contact-form messages and mailing-list welcome emails;
• Discord — posting and displaying league announcements when configured;
• Meta (Instagram) — displaying public Instagram posts on the homepage when configured;
• Google Drive — hosting linked waiver PDF documents (we do not upload your personal data to Google Drive through the Site).

Each provider's use of data is governed by its own privacy policy. We choose providers with reasonable security practices but do not control their operations.

League fees are paid outside the Site through third-party payment apps (such as Venmo). We do not collect, store, or process payment card or bank information through the Site. Any payment information you provide to a payment app is governed by that app's own privacy policy, not this one.

6. Data Security

We take reasonable measures to protect your personal information, including using an established authentication and database provider, encrypted connections (HTTPS), hashed passwords, and access controls limiting administrative access.

However, no method of transmission over the internet or method of electronic storage is 100% secure. While we strive to protect your personal information, we cannot guarantee its absolute security, and you provide information to the Site at your own risk. In the event of a data breach affecting your personal information, we will notify affected members and any required authorities as required by applicable law.

7. Data Retention

We retain your personal information for as long as your account is active or as needed to operate the League. If you leave the League or delete your account, we will delete or anonymize your personal information within a reasonable period, except where we must retain it to comply with legal obligations or resolve disputes.

8. Your Choices and Rights

You may:

• Access and update your account and profile information at any time by logging in;
• Unsubscribe from the mailing list using the link in any mailing-list email;
• Request deletion of your account and personal information by contacting us at seattlewffl@gmail.com;
• Opt out of non-essential communications (note: we may still need to send essential operational messages, such as game cancellations, while you are an active member);
• Request a copy of the personal information we hold about you.

California residents: we do not sell or share personal information for cross-context behavioral advertising. You may request to know what personal information we collect, request deletion, and not be discriminated against for exercising these rights. Contact seattlewffl@gmail.com to submit a request.

Depending on where you live, you may have additional rights under applicable privacy laws. To exercise any of these rights, contact us at seattlewffl@gmail.com and we will respond within a reasonable timeframe.

9. Children's Privacy

The Site and the League are for adults only. We do not knowingly collect personal information from anyone under 18 years of age. If we learn that we have collected personal information from a person under 18, we will delete it promptly. If you believe a minor has provided us with personal information, please contact us at seattlewffl@gmail.com.

10. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will post the updated Policy on the Site and update the Effective Date above. Your continued use of the Site after changes take effect constitutes acceptance of the revised Policy. We will never change this Policy to permit the sale of your information or its use for third-party marketing without your explicit consent.

11. Contact Us

If you have questions or concerns about this Privacy Policy or our data practices, contact us at:

Seattle Women's Flag Football League

Email: seattlewffl@gmail.com

12. Google Sign-In and Google User Data

Google Sign-In is optional. You may create and use an account with email and password instead.

Seattle Women's Flag Football League's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Data Accessed

• When you choose Sign in with Google, we access your Google account email address, name (given name, family name, and/or full name), profile photo URL, and Google account identifier through OpenID Connect (email and profile scopes only).
• We do not access Gmail messages, Google Calendar, Google Drive files or contents, Google Contacts, or any other Google user data beyond basic profile and email information needed for authentication.

Data Usage

• We use Google user data solely to create and authenticate your League member account, pre-fill your profile name and photo, and display your name on internal league rosters, team tools, and member-only pages.
• We do not use Google user data for advertising, sale or resale, creditworthiness determination, user profiling unrelated to League operations, or training artificial intelligence or machine learning models.

Data Sharing

• We do not sell, rent, or share Google user data with advertisers, data brokers, or marketing companies.
• Google user data is processed by Supabase, our authentication and database provider, only as necessary to operate the Site (sign-in, session management, and account storage). Supabase does not use this data for its own marketing purposes.
• We do not transfer Google user data to other third parties except as required by law.

Data Storage and Protection

• Google-derived account information is transmitted over encrypted HTTPS connections and stored in Supabase with access controls and row-level security.
• We do not receive or store your Google account password. OAuth session handling is managed by Supabase Auth.
• Only authorized League administrators have administrative access to member account data, subject to our internal access controls.

Data Retention and Deletion

• We retain Google-derived account data for as long as your account is active or as needed to operate the League.
• You may request deletion of your account and associated personal information, including data obtained through Google Sign-In, by emailing seattlewffl@gmail.com. We will delete or anonymize your data within a reasonable period, except where retention is required by law or to resolve disputes.
• You may stop using Google Sign-In at any time by signing in with email and password instead, or by requesting account deletion.