Privacy

What we store, and what happens to it

Running a tournament means holding personal information about adults and about children. This page describes what WNY Athletics actually does with it — not what a template says a product like this usually does.

Last updated August 7, 2026

Factual sections final · policy language in review

The descriptions of what the system stores, sends, publishes, and keeps are accurate and were checked against the product. The legal parts of a privacy policy — legal basis, retention periods, your rights, which law applies, and how to make a request — have not been reviewed by a lawyer and are gathered under open for review rather than stated as commitments. If you need a reviewed policy before you can adopt this product, tell us and we will prioritise it.

Whose information this is about

Four groups, and it is worth being blunt about the third:

People with an account: Tournament directors, club and region administrators, and anyone else an organization adds to its staff list.
Coaches, team contacts, and officials: Mostly adults, usually without accounts. An organizer enters their details so the product can reach them about a schedule.
Athletes, including minors: Youth volleyball rosters are rosters of children. An athlete record can hold a date of birth, an email address, a mobile number, and a governing-body membership number. This is the reason this page exists.
Visitors: Families and fans who open a public tournament page without signing in.

The organization running the tournament decides what goes into a roster. WNY Athletics does not require a date of birth, an athlete email, or an athlete mobile number for a tournament to run. If you do not need a field, leave it empty — it is the single most effective thing an organizer can do here.

Account information

An account holds a username, a password (stored as a one-way hash, never as the password itself), a display name and first/last name, a role, a status, and the time of the last sign-in. Email addresses and phone numbers are held separately as verified contact identities, so an account can have more than one and each can be confirmed independently.

Signing in also records the sign-in itself: the device's IP address, the browser's user-agent string, and when it was last seen. Sign-in attempts are recorded the same way. This is what makes it possible to show you your active sessions and to sign a device out remotely.

Access requests submitted from the request-access form store the name, email, organization, role, timing, and notes you provide, together with the submitting IP address.

Teams, rosters, and athlete records

A team belongs to a tournament and carries a label, a club, an optional governing-body team code, a division, a seed, and organizer-only notes. Team contacts — coach, club director, captain, or other — carry a name, an email address, and a mobile number.

An athlete record can carry: first and last name, a phonetic spelling, date of birth, jersey numbers, positions, height, weight, gender, age level, captain marker, email address, mobile number, a recruiting profile link, a commitment status, and governing-body membership numbers. Which of those are filled in is entirely the organizer's choice.

An athlete can be marked hidden, which removes them from the public team page and from public reads of the roster.

Organization contacts that outlive a tournament

Separately from any one event, an organization keeps a durable contact directory: name, phonetic spelling, club, email, mobile, free-text notes, and tags. Some tags are applied by hand; others are derived from what that person has done across the organization's tournaments.

The point of the directory is that a coach you dealt with last season is still there next season without being re-entered. The consequence is that these records persist after the tournament they came from ends. They belong to the organization, not to a single event.

What becomes publicly visible

A tournament's schedule, brackets, pools, standings, results, live scoreboard, team pages, and team directory are public: anyone with the link can open them without signing in, and that is the point — families need to find the next match without an account.

On a public team page, the roster shows an athlete's first and last name, jersey number, positions, and captain marker. Athletes marked hidden do not appear. The team directory shows coach names. Officials' names appear on published schedules where they are assigned.

Seed numbers can be hidden from the public view. That control applies to bracket groups only — pool and crossover schedules always show seeds, because they are read from the sheet at the scorer's table.

Tournaments are not listed in any global directory and there is no public search across organizations. Finding an event requires the link, or both the organization code and the tournament code.

Two things an organizer should know before deciding what to type into a roster. First, a public page is public: it can be linked, screenshotted, and indexed unless the tournament is left in draft. Second, an athlete record carries fields the public team page does not display — a date of birth and contact details among them — and the public tournament data endpoints do not yet filter every stored field the way the rendered page does.

So the safe working assumption today is: treat anything entered on an athlete record as potentially public. Field-level filtering of those endpoints is an open product task, and this section will be tightened when it ships. Until then, leave fields empty that your event does not need, and use the hidden marker for anyone who should not appear at all.

Email and text messages

Email is never sent from the page you are on: it is written to a queue and delivered by a background process, which is why a large send does not stall the browser and why a failed send can be retried. The queue keeps the full message — recipient, subject, and body — and nothing in the product removes those rows.

An organizer can email their organization's durable contacts, their teams' coach contacts, and their officials and staff. The product also sends automatically when a schedule changes, when a staff assignment changes, and when a registration is submitted. Athletes are never an email or text recipient list — messages go to coaches, team contacts, staff, and administrators.

Text messages are different in three ways worth stating. They are off unless the organizer turns the channel on for that tournament. They are sent immediately rather than queued, through a third-party messaging provider. And if the deployment has no messaging credentials configured, a send is skipped silently rather than failing — so an organizer should confirm SMS actually works for them before relying on it. Text messages go to staff mobile numbers and team coach contacts. One-time sign-in codes may also be sent by text.

Draft — pending legal review

The product keeps no consent record, adds no unsubscribe link, and holds no opt-out list. A recipient who wants to stop receiving messages has to ask the organizer, who removes or blanks their contact details. There is an administrator-managed suppression list, but a recipient cannot reach it themselves. Sender identity, opt-in and opt-out handling, and messaging compliance in each region are unresolved and under review. Until they are resolved, an organizer using this product to message people is responsible for having the right to message them — and that responsibility is heaviest where a contact belongs to a minor.

What is stored in your own browser

Some things are kept on your device instead of on our servers. They are not tied to an account, they are not sent to us except where noted, and clearing your browser storage removes them.

Teams you follow: Starring a team pins it to your device so you can get back to it. It stores the organization, tournament, and team it points at, up to twelve teams, and it is not a subscription, a profile, or an account preference — nobody is notified that you followed anything, and it does not follow you to another browser. There is a Clear control on the page that lists them.
Recently viewed tournaments: The last five active tournaments you opened, kept for ninety days, so a lost link can be recovered. Draft tournaments are deliberately excluded. It also has its own Clear control, and no browsing history is sent to build it.
Offline score drafts: While a match is being scored, the set scores, any forfeit marker, and the scorekeeper's typed name are held on the scorer's device so a dropped signal does not lose the match. The draft for a match is removed from the device once its result is confirmed.
Display and layout preferences: Light or dark theme, zoom and column widths in the scheduler, which view you last used, and one-time tips you have dismissed.
A scheduler device identifier: The scheduling tool mints a random identifier for the browser and does send it with schedule edits, so that when two people are editing at once each can see which changes are not their own. It is generated on the device, is not derived from you or your account, and is regenerated if you clear storage.

Change history

Changes to schedules, results, teams, divisions, groups, rounds, athletes, team staff, and tournaments are recorded with the account that made the change, the time, and a before-and-after snapshot of the fields that changed. An organization's administrators can search that history and see the exact difference.

This is deliberate — it is how a disputed score or a moved match gets settled. Two consequences follow from it. These records are not deleted or aged out by anything in the product. And because a snapshot captures the row as it was, deleting an athlete removes the athlete record but the earlier snapshot still names them.

What the history does not cover: payment records and changes to who has access. See entry fees and payment status.

Exports

An organization's administrators can export their own lists as CSV — teams, tournaments, venues, schedules and results, officials and staff (including staff email, mobile, and pay figures), and rosters (including athlete email, mobile, date of birth, and membership numbers). These exports require administrator access to that organization.

Two calendar feeds are public rather than administrator-only: a team's match schedule, and an official's assignment calendar reached through their private personal link.

There is no export of the contact directory, no export of the change history, and no single "download everything" file. Ask us if you need one.

Deleting things

Deletion behaves differently depending on what is being deleted, and the difference is worth knowing before you rely on it.

Athletes and team staff: Removed for real. The record is deleted, not archived — though as noted above, a change-history snapshot taken before the deletion still names them.
Teams, tournaments, divisions, officials, venues: Archived rather than erased. They stop appearing but the rows remain, which is what makes an archived tournament restorable.
Organization contacts: Archived when removed. Because the directory is designed to recognise a returning person, an archived contact can come back into use the next time that person interacts with the organization.
Accounts: There is no self-service account deletion today. Deleting an account is an operator action; ask us and we will do it. You can remove your own email addresses and phone numbers from your account, as long as one verified contact remains, and you can sign out of your own devices.

Draft — pending legal review

Two gaps are stated rather than smoothed over. The durable contact directory has no removal path exposed today — a contact can be edited or blanked, but not deleted or archived through the product. And there is no self-service account deletion. Both are open product tasks, and both are among the reasons the rights and retention language below is still in review rather than published as a commitment.

Open for review

Everything above describes the product. Everything in this section is the part a lawyer has to write, and nothing here has been reviewed. It is listed so you can see exactly what is missing rather than infer it from silence.

Draft — pending legal review

Awaiting legal review, and therefore not stated as a commitment anywhere on this site: the lawful basis for each kind of processing; how long each category of data is retained and when it is deleted; the rights an individual has and how to exercise them; which jurisdiction's law governs a given deployment; whether WNY Athletics acts as controller or processor for each category, and the agreement that goes with it; the specific treatment of children's data and how verifiable parental consent is obtained where it is required; the third parties involved in delivering email and text messages; and the formal route and timescale for a data request.

If your review process needs any of these answered before you can adopt the product, ask. A specific question gets a specific answer, in writing, faster than this page will be finished.

Asking us about any of this

Questions about this page, requests about your own information, and anything you think is inaccurate here all go to the same place: our contact page. A person reads it.

If you are a coach, a parent, or an athlete asking about a specific tournament, the organization running that tournament controls its rosters and its contact records — start with them, and copy us if you do not get anywhere.