Privacy Policy

Effective date: September 28, 2026 for new users, and October 30, 2026 for existing accounts and running payment plans.

Version: 2026-09-28

This policy explains what information WhereTheyPlay LLC ("WhereTheyPlay," "we," "us") collects through wheretheyplay.com (the "Service"), why, who we share it with, how long we keep it, and the choices you have.

1. The short version

• Searching and messaging clubs is free and needs no account.
• We do not sell personal information. We do not use it to show parents targeted ads. If we run ads for clubs, the advertising tags in section 5 load only on pages for clubs.
• We ask for a child's name only for a club that uses our Ultimate Dashboard: in its private roster, and on its private uniform size form, which asks for a first name only. A child's name is never shown on a public page. Our Children's Data Notice explains it.
• We never ask for a child's date of birth, and we never ask anyone for health information.
• We contact people by email only. We never send text messages.
• Anyone can ask to see, correct or delete their information. See section 10.

2. What we collect

When you search

• What you search for: the sport, the child's age you enter, the age group, the zip code, the distance, and whether you asked only for organizations that are recruiting.
• Whether you typed in the keyword box, but not the words you typed.
• How many results came back and which organizations were shown.

We do not link a search to your name, email address or IP address.

When you message an organization

• Your name, your email address and your message.
• That you confirmed you are a parent or guardian aged 18 or older.
• Your IP address, which we store with the message to stop abuse.
• The result of the "I am human" check (hCaptcha).

Please do not put your child's name or any health information in a message.

When you pay a registration

• Your name and email address.
• The payment itself: the amount, the club's share, the service fee, the program name the club gave it, the date, whether it was paid, refunded or disputed, and Stripe's reference numbers for it.
• For a payment plan: the schedule, how many payments have been made, and Stripe's reference to your saved card and to you as a Stripe customer. Stripe stores the card. We never see or store your card number.
• If the club uses the Ultimate Dashboard roster: your child's first name, last name (if you give it) and team age, and the exact words you agreed to. See the Children's Data Notice.

When a club offers your family a team spot

• The email address the club gave us for you.
• The team, what the offer is for, the deposit if there is one, the deadline and any new deadline, and whether you accepted or declined, or the offer ran out of time or was withdrawn.
• If you pay a deposit, the same records as any registration payment.

We never ask for a child's name here.

When you volunteer or send uniform sizes (Ultimate Dashboard)

• Volunteer shifts: your name and email address, the shift you picked, and whether we sent you a reminder. If you stop a club's emails, we keep a scrambled code of your address so we never email you for that club again.
• Uniform sizes: your name and email address, each player's sizes and jersey number request, and, only if the club uses the roster, each player's first name. See the Children's Data Notice.

Family balances

When you pay a registration through us, we also keep a family record for you at that club: your email address, the name you typed when paying (if any), and what was owed for that registration. We keep it even if the club does not use balance pages yet, so its records are complete if it starts. If the club does use WhereTheyPlay balance pages, we also keep the bills the club created, cash and check payments the club recorded (amount, date, method, and a private note for the club), whether you asked to stop reminder emails, and a log of emails we sent you about your balance.

Organizations, their staff and coaches

• Account: the email address you sign in with.
• Page: the organization's name, contact email, location, description, teams (including practice days and places, whether a tryout is needed, tryout dates, travel notes and registration status, with the date the club last changed that status), recruiting needs, age groups, staff names and roles (a staff member whose role names a team is also shown with that team), staff headshots, coach bios (Ultimate Dashboard, agreed to by the coach), facility photos and logo.
• Claims: the claimer's name, role and email address, a scrambled copy of the code we emailed (never the code itself), how many tries it took, each claim check they ticked, and the yearly confirmation.
• Records of agreement: for each statement a person agrees to (such as the claim checks, the photo and staff statements, and the coach statements), the exact words, the time, the person's name and email address where given, and the IP address and browser details where recorded. See section 10 about why we keep these.
• Billing: Stripe's customer reference, the plan and its status. Stripe holds the card.
• Registration payments: the organization's Stripe account reference and whether it is ready to take payments. Business and bank details, and identity checks, go straight to Stripe, not to us.
• Coaches (Ultimate Dashboard): name, email address, the teams they coach, their 18 or older and confidentiality statements, a log of changes they make in the dashboard, and the dates the club records for the coach's background check and trainings, and when each runs out. We keep dates only, never what a check found.
• Club messages (Ultimate Dashboard): the text of each message, who sent it, when, and whether it was delivered. We do not store the list of addresses a message went to. If someone unsubscribes, we keep a scrambled code of their address so we never email them for that club again.
• Club dashboard records (Ultimate Dashboard): volunteer shifts, uniform orders, and a record each time the owner downloads a spreadsheet: the kind of file, when, and how many lines.

Pages we compile

We build some pages from information an organization publishes on its own website: its name, sports, location, age groups, website, and public email address and phone number. We store the web address we read it from and the date we read it, and we show both on the page. We use the published email address to send the code to anyone who claims the page and to send notices about the page, such as when it will come down.

Requests and reports

When you ask us to correct, claim or remove a page, or you report one, we keep what you sent, the time, and your IP address, so we can spot a pattern of bad faith requests. When you email us, we keep the email.

Automatically

• Our own counting. On an organization's page, we count page views and clicks on its website link, email address, phone number, directions and photos. We record where the visit came from (search, a city or sport page, a direct visit, or a preview), and any campaign tags in the link you followed (utm_source, utm_medium and utm_campaign). Each visit gets a random tag, made by your browser and stored only for that browser tab, which we scramble before saving. We also record whether a visit looked automated. We do not save your IP address in these records.
• Vercel Web Analytics. Our host, Vercel, counts visits by page address, referring site, country, device type and browser. It does not receive the addresses of club dashboard, payment, family balance, stop payment, tryout offer, volunteer sign up, uniform size, unsubscribe or delete-my-records pages.
• Server logs. Like any website, our host receives your IP address and browser details when you load a page, to deliver it and keep it secure.
• Security records. When a WhereTheyPlay administrator signs in, and when a request pretends to come from Stripe and fails its signature check, we record the time, IP address and browser details.

What we do not collect

We do not ask for Social Security numbers, birth dates, health or medical information, or your precise location. To search, we ask for a zip code, not an address. Please do not send us health information about anyone.

3. How we use it

• To run the directory: show pages, search, measure distance from a zip code, and compare organizations.
• To send your message to the organization you chose.
• To take registration payments for clubs, including later payments on a plan you agreed to.
• To bill organizations for their subscriptions.
• To run club dashboards for the clubs that pay for them.
• To send emails you need, such as sign-in links, receipts, account notices and renewal reminders, and marketing emails to organizations with an unsubscribe link.
• To keep the Service secure and stop spam, fraud and abuse.
• To keep records we need for legal, tax and dispute reasons.
• To understand how the Service is used, from counts and totals.

We do not sell personal information. We do not use it for targeted advertising to parents. We do not make decisions about people by automated means that have legal or similarly important effects.

4. Who we share it with

The organization you contact or pay. It receives your message, or your name, email address and payment records. Organizations see totals about visits to their own page, never anything about one visitor.

Families. A family's balance page shows only that family's own records.

Coaches. In the Ultimate Dashboard, a coach sees the names and team ages of the players on their own team and their stats, the names (not the email addresses) of adults who signed up for their team's volunteer shifts, and their own training dates. Coaches never see parents' email addresses or payment records.

Our service providers. They process information for us, under their own security and privacy terms:

Stripe's own role. When you provide personal data in connection with a registration payment, a subscription, or setting up a club's Stripe account, Stripe receives that personal data and processes it in accordance with Stripe's Privacy Policy.

Advertising measurement companies. See section 5.

When the law requires it, or to protect people's safety, our rights, or the Service.

If the business changes hands. If WhereTheyPlay is sold or merged, information may pass to the new owner, who must follow this policy or tell you about any change.

5. Advertising measurement tags

We may use measurement tags from advertising companies to learn which of our own ads brought an organization to sign up. They load only on these pages for clubs: /pricing, /coaches, /get-started, /claim, and the dashboard page shown right after a purchase. They never load on search pages, comparison pages or any organization's page.

These companies can collect information about your visit, such as the page address, your IP address and browser details, and may use it across other websites over time under their own policies. Our code never sends them a child's age, a zip code from a search, or anything typed into a form on our site, and we have switched off the settings in each company's account that would collect form entries automatically.

The one switched on today is Meta (Facebook and Instagram). We may switch on tags from Google Ads, Microsoft Advertising, Reddit, TikTok, LinkedIn, Nextdoor, Pinterest or X in the future, on the same pages and under the same rules, and we will update this list when we do.

6. Cookies and browser storage

We use these, and nothing else of our own:

hCaptcha sets its own cookies on pages with the "I am human" box. The advertising companies in section 5 may set their own cookies on the pages listed there, if they are switched on.

7. Do Not Track and Global Privacy Control

Our Service does not change what it does when your browser sends a "Do Not Track" or "Global Privacy Control" signal. Our own counting never follows you to other websites, and it never includes your IP address. To block the advertising tags in section 5, you can use your browser's privacy settings or a tracker blocker.

8. How long we keep it

We keep a full internal retention schedule, table by table. The part about children's information is public, in the Children's Data Notice, section 6.

We may keep information longer if the law requires it, or to deal with a legal claim or investigation.

9. Children

The Service is for adults. We do not direct it to children, and we do not knowingly collect personal information from anyone under 13, or let anyone under 18 use it. If we learn that a child sent us personal information, we will delete it.

Clubs that use the Ultimate Dashboard may keep their players' names, team ages and stats in a private roster. That information comes from the club or from a parent, never from the child, and it is never shown on any public page. We never allow photos of children anywhere on the Service. Our Children's Data Notice explains all of it, including how a parent can have it deleted.

10. Your choices and rights

Anyone, wherever they live, can ask us to:

• tell them what personal information we have about them, and give them a copy;
• correct it;
• delete it; or
• stop sending them marketing email.

Email leads@wheretheyplay.com from the email address you use with us. We may ask you to confirm the request from that address before we act, to protect your information. We will answer within 30 days. If we need more time, we will tell you why, and answer within 45 days in total.

If we say no. We will explain why. You can ask us to look again by replying with "Appeal" in the subject line, and we will answer within 45 days. If you are still not satisfied, you can contact your state attorney general.

What we may keep after a deletion request, and why:

• Records of agreement. When someone agrees to a statement on our Service, such as the claim checks, a photo or staff statement, or a coach statement, we keep a permanent record of the exact words, when, who, and from which IP address and browser. These records are how we, the organization, and the person named on a page can prove what was agreed. We cannot change or delete them. If you ask us to delete your information, we close your account and delete everything else we can, and keep these records only for that purpose.
• Payment records, which tax and card rules require us to keep.
• Unsubscribe records, so we do not email you again.
• Anything we must keep by law or to deal with a legal claim.

Organization accounts. An organization's owner can change or remove most page content from the dashboard. There is no "delete my account" button yet. To close an account, email us.

Information a club controls. If your information is in a club's roster, family balance or messages, the club decides what happens to it, and we pass your request to the club. Every message a club writes to a family in the Ultimate Dashboard has a link to ask the club to delete your family's records. See the Children's Data Notice.

Email. Every marketing email has an unsubscribe link. Every club message has a link to stop that club's emails. You cannot opt out of emails you need while you have an account or a running plan, such as receipts and account notices.

State laws. We give everyone the rights above. Some states give their residents specific rights:

• California. We do not sell personal information, and we do not give personal information to other companies for their own direct marketing. The advertising tags in section 5, if switched on, are described there.
• Washington. We do not ask for or use consumer health data covered by Washington's My Health My Data Act. Our rules forbid clubs from entering it, and if we find it we delete it.
• Nevada. We do not sell covered information.

11. Security

We protect information with:

• encrypted connections (HTTPS) for every page;
• access rules in our database, so each organization can see only its own records, a coach only their own team, and a family only its own balance;
• sign-in by emailed link, with no passwords to steal;
• records of agreement that our database refuses to change or delete;
• limits and "I am human" checks on public forms; and
• service providers with their own security programs.

No system is perfectly secure. If a security breach affects your personal information, we will tell you as the law requires, and no later than 30 days after we discover it where Washington law applies.

12. Where your information is kept

We operate in the United States, for people in the United States. Our service providers store information in the United States. Our database is kept in Northern Virginia, in the United States (Supabase, hosted on Amazon Web Services, region us-east-1).

13. Changes to this policy

Every version of this policy has its own version label and effective date at the top, and we keep a copy of every version. If we make a material change, we will email account holders, and families with a running payment plan, at least 30 days before it takes effect, and post a notice on the Service with a link to the new version. Other changes take effect when we post them.

14. Contact

WhereTheyPlay LLC

123 2nd Ave S, Suite 230 #67, Edmonds, WA 98020

Email: leads@wheretheyplay.com