Privacy Policy

PitchRoots is a community football ⚽ platform serving Greater Edmonton, Alberta, operated by Cully Wakelin. We take your privacy seriously — especially because some of our users are children. This policy explains what data we collect, why, and how you can delete it.

What we collect from coaches

• Display name — shown as "Coach [name]" on your team page.
• Phone number — used for sign-in (one-time passcode) and SMS commands. We store a one-way hash of your number, not the number itself. The hash cannot be reversed back into your phone number.
• Email — optional, for magic-link sign-in only.
• Team details — team name, season, age group, schedule, and game results.

What we collect from parents and players

• Phone number — used for joining a team via SMS and receiving schedule updates. Stored as a one-way hash, same as coaches.
• Player first name — for roster identification by the coach. We never collect last names.
• Birth year — for age-group verification only. We do not collect full dates of birth.
• Jersey number — for roster display.
• Email — if provided by the coach for team communication. Visible only to the coach.
• RSVP responses — when you reply to a game or practice notification.

What we do not collect

We do not collect:

• Last names of players
• Full dates of birth (only birth year)
• Home addresses
• Photos of any kind
• Government ID or passport information
• Location or GPS data

How phone numbers are stored

Across PitchRoots — rosters, team membership, messages — your phone number is immediately converted into a one-way hash (SHA-256). The hash cannot be reversed back into your phone number. This means even if our database were compromised, your phone number could not be extracted from these records.

Your phone number is stored in its original form only by our authentication provider (Supabase) for delivering sign-in codes, and by our messaging provider (Twilio) as part of standard message delivery logs. Twilio retains message records including phone numbers for up to 13 months as part of their service. See Twilio's privacy policy for details.

Payment data

When you purchase a Coach Season Pass, payment is processed by Stripe. PitchRoots does not receive, store, or have access to your credit card number, expiry date, or CVC. Stripe handles all payment details in accordance with PCI DSS standards.

We store a Stripe customer ID and checkout session ID in our database to link your payment to your account. We also store the payment amount, currency, promo code used (if any), and payment status for your records. See Stripe's privacy policy for how they handle your payment information.

How AI is used

PitchRoots uses AI agents to curate community football news from SMS reports and public sources. Here is what the AI does:

• Rewrites community reports into clear, publishable summaries
• Strips any personal names from published content (individuals are referred to by role — "a coach," "a parent")
• Assigns reliability scores to content based on source type
• Researches public websites for registration dates, facility status, and event schedules

SMS reports and community content are processed using Anthropic's Claude AI service. Anthropic does not use this data for model training. PitchRoots uses Anthropic's zero-retention API configuration, meaning your data is not stored by Anthropic after the request is processed. Personal names are stripped before AI processing where possible.

The AI does not profile users, make decisions about individuals, or use personal data for training. It processes content, not people.

Children's data

We understand that many players are minors. Our approach is to collect the absolute minimum:

• First names only — never last names
• Birth year only — never full date of birth
• No photos, no addresses, no contact information for minors
• Player data is only visible to the team's coach and verified team members

A first name combined with a birth year and team is not sufficient to identify an individual child outside the context of their team. That is intentional.

Cookies

We use cookies only for authentication sessions (powered by Supabase). These cookies keep you signed in when you return to the site. We do not use tracking cookies, advertising cookies, or analytics cookies. There are no third-party trackers on PitchRoots.

Analytics

PitchRoots does not use Google Analytics, Meta Pixel, or any third-party tracking service. We do not build user profiles or share data with advertisers. We do not sell, rent, or share your data with any third party.

We collect basic, anonymous page-view data using a first-party system: the page you visited and how long you spent on it. Visitor identifiers are hashed daily and cannot identify you. No cookies are used for analytics.

How to delete your data

Coaches: You can delete your team from the coach dashboard. This permanently removes the team, all roster data, events, RSVPs, and messages. You can also delete your account entirely from your account settings.

Parents: Text STOP to our number at any time. This removes your phone hash from all teams, unsubscribes you from all notifications, and stops all further messages. To rejoin a team later, text the team code again.

Full data deletion: To request deletion of any data we hold about you, email privacy@pitchroots.ca with the subject Data Deletion Request. We will confirm receipt and complete the deletion within 30 days.

How long we keep your data

Team data (rosters, schedules, results) is retained while the team is active. Teams are automatically deleted six months after their season ends. Community content (Pitch Digest) is retained as part of the public community record. You can request deletion of your data at any time.

Where data is stored and who processes it

Your data is stored on Supabase (database and authentication) and Vercel (web hosting), both of which use infrastructure in North America. SMS messages are sent and logged by Twilio (see above for their retention). Payments are processed by Stripe (see above). AI processing is performed by Anthropic (Claude API), which may retain data for up to 30 days. Maps are provided by Mapbox, which may collect anonymous usage data when you interact with maps. All connections use HTTPS encryption.

Canadian privacy law (PIPEDA)

PitchRoots operates in Alberta, Canada, and is subject to the Personal Information Protection and Electronic Documents Act (PIPEDA). You have the right to:

• Know what personal information we hold about you
• Request correction of inaccurate information
• Request deletion of your data
• Withdraw consent for SMS communications at any time

If you are not satisfied with our response, you have the right to file a complaint with the Office of the Privacy Commissioner of Canada at priv.gc.ca.

Contact

Cully Wakelin is responsible for PitchRoots' privacy practices. For privacy questions, data access requests, or corrections under PIPEDA, email privacy@pitchroots.ca. We respond within 30 days.