Privacy Policy
Effective date: July 18, 2026
This Privacy Policy explains how WhereTheyPlay (wheretheyplay.com), operated by WhereTheyPlay LLC, a Washington limited liability company, collects, uses, and protects your information.
1. Information We Collect
From parents/visitors: name, email, and message when you contact an organization; general search inputs (sport, zip code, radius, child's age range). We don't require an account to search or contact an organization.
From organizations: account email (used for magic-link sign-in), organization name, contact email, location/address, bio, staff names/roles/photos, team and recruiting information, and facility photos.
Automatically: IP address (used for rate-limiting and abuse prevention on contact forms), basic usage data (e.g., page views), and CAPTCHA verification results.
Payment data: handled entirely by Stripe. We do not receive or store full card numbers. We store limited billing metadata (subscription status, Stripe customer ID) to manage your listing.
2. How We Use Information
- To operate the directory (search, display listings, geocode zip codes to show distance)
- To deliver contact-form messages from parents to organizations (via Resend)
- To process and manage organization subscriptions (via Stripe)
- To prevent spam and abuse (hCaptcha, IP-based rate limiting)
- To communicate with you about your account or a support request
We do not sell your personal information.
3. Third-Party Services We Use
| Service | Purpose |
|---|---|
| Supabase | Database, authentication, photo storage |
| Stripe | Subscription billing and payment processing |
| Resend | Transactional email delivery |
| Mapbox | Zip code geocoding and map display |
| hCaptcha | Bot/spam prevention on forms |
| Vercel | Website hosting |
Each of these providers processes data under its own privacy policy and security practices.
4. Cookies and Tracking
We use only the minimum cookies/local storage needed for authentication sessions (Supabase Auth) and bot protection (hCaptcha). We do not use third-party advertising trackers.
5. Children's Privacy
WhereTheyPlay is intended for use by parents, guardians, and organization staff who are 18 or older. We do not knowingly collect personal information directly from children. Any child-related information (e.g., a team's age group) is provided by organizations or parents in the context of describing programs, not as a profile of an identifiable child.
6. Data Retention
We retain account and listing data for as long as an account is active, and contact-form submissions for as long as needed to prevent abuse and handle support inquiries. You can request deletion at any time (see Section 8).
7. Data Security
We use industry-standard practices, including database access controls (row-level security), encrypted connections (HTTPS), and third-party providers with their own security certifications. No system is perfectly secure, and we can't guarantee absolute security.
8. Your Rights
You can request access to, correction of, or deletion of your personal information by emailing leads@wheretheyplay.com. Organization owners can edit or delete most of their own listing data directly from their dashboard.
9. Changes to This Policy
We may update this Privacy Policy from time to time. Material changes will be reflected by updating the effective date above.
10. Contact
Questions about this policy: leads@wheretheyplay.com