Privacy Policy

RecStak is a team-management tool for youth-sports coaches. Coaches manage rosters, schedules, and communication with players' parents or guardians.

Coaches provide player names, jersey numbers, and notes. Parents who register provide their name, email, and phone number so a coach can send game-day updates. Parents may optionallyupload a photo of their child (see below). Roster data (player names, jersey numbers, and notes) is retained for the life of the team or account and is deleted when a coach removes it or deletes their account; a parent may ask their coach or RecStak to remove their child's information at any time, and RecStak — not the volunteer coach — is the party responsible for honoring that request within 30 days (see below).

Usage & technical data:we also automatically collect log files, IP addresses, browser type, and general usage metrics (such as which features are used and how often) to monitor performance, diagnose problems, and improve the Service. This technical data is not linked to a child's identity.

For teams registered in the United States, RecStak sends transactional, team-logistics text messages— game-day schedule changes, field and time changes, rain-outs, practice cancellations, and reminders — on behalf of a parent's coach. This is not a marketing program; we do not send promotional or advertising texts.

• How you opt in: a parent provides their mobile number and gives express consent by checking an opt-in box (unchecked by default) on their team's registration page, or by tapping a confirmation link a coach sends them. Consent is recorded with a timestamp. The exact disclosure a parent agrees to is: “Send me occasional text alerts for game day changes (rain-outs, time/location changes, reminders) from my child's coach via RecStak. Msg & data rates may apply. Msg frequency varies. Reply STOP to opt out, HELP for help.”
• Frequency & rates: message frequency varies; message and data rates may apply.
• Opting out: reply STOP to any message to unsubscribe at any time, or HELP for help.
• We never share your number: RecStak does not sell, rent, share, or otherwise disclose your mobile phone number, your SMS opt-in, or your consent to any third party or affiliate for their own marketing or promotional purposes. Mobile opt-in information and consent are used solely to deliver the RecStak text messages you requested. Our messaging provider (Twilio) processes them only to deliver those messages on our behalf, and for no other purpose.

A parent or guardian may voluntarily add a head-and-shoulders photo of their child so coaches can identify players. This is never required.

• Purpose: the photo is used only so that team's coaches can identify players. It is never shared publicly, sold, or used for advertising.
• Verifiable parental consent: only a verified, coach-approved parent account can upload, and the parent must give explicit consent and confirm it by email before the photo is used (“Email Plus” method).
• Retention: player photographs are permanently deleted at the end of each season — this stricter, season-based rule applies to photos specifically and is not affected by the general retention timelines below. Parents may remove a photo at any time, and coaches may remove a photo they find inaccurate.
• Parental rights: a parent may review, request deletion of, or refuse the collection of their child's photo at any time by contacting their coach or RecStak.
• No biometrics / no AI: photos are stored as ordinary image files. RecStak does not run facial recognition, facial-geometry scanning, automated cropping, or any biometric or AI analysis on them.

A parent or guardian may voluntarily pick a “walk-up song” for their child from Apple's iTunes catalog. This is never required.

• What's collected: from Apple, we save the song's title, artist, cover artwork, and a 30-second preview link. RecStak never hosts, stores, or serves the actual audio — it streams directly from Apple's servers at play time.
• Clean version only: a parent can search Apple's full catalog, but only a “clean”/non-explicit version of a song can actually be saved. If a song has no clean version available, it can't be selected.
• How it's chosen: only a parent, via their own private token link for their child, can select or change a song — not the coach, not another parent.
• How it's used: a coach decides whether to use walk-up songs on Game Day at all. If they do, the selected song is played from the coach's own device when the child comes up to bat. Picking a song here saves the choice; it does not guarantee it will be played.
• Retention: a walk-up song pick is automatically cleared within approximately 45 days of season close, as part of the faster of the two “Season-close de-identification” schedules described below (the same schedule as contact details, not the longer one that applies to player names), and is deleted immediately if a parent requests removal of their child's data.
• Removal: a parent may remove their child's song at any time from their own token link, using the same Remove control as their other player information.

Aside from the season-based rule for player photos above, general roster and account data follows these timelines:

• Parent-initiated removal request:a parent or guardian can request full removal of their child's data (player record, guardian contacts, and photo) from their own RecStak link at any time. RecStak — the data controller, not the volunteer coach — logs the request immediately and honors it (permanently deleting the child's player record, all associated guardian contacts, and any photo) within 30 days. The requesting parent receives an email confirmation once it's done.
• Coach-initiated deletion: when a coach deletes a player, a parent contact, or their account directly, that data is wiped from active production databases within 7 business days.
• Backups: encrypted disaster-recovery backups may retain residual copies for up to 30 additional days before being permanently overwritten.
• Inactive accounts: an account with no logins or activity for 24 monthsis flagged as abandoned. We email the coach, and if the account remains inactive, it — along with all associated roster and parent data — is permanently deleted.
• Season-close de-identification:once a coach closes out a season, we minimize what that season's records hold, on two different schedules based on sensitivity. Within approximately 45 days, a parent's contact details (phone, email), any coach notes, and any selected walk-up song are automatically stripped — no manual step required. Player names and jersey numbers are kept longer, for up to approximately 18 months, so that if the same team returns next season, the coach can pick up the roster where they left off instead of re-entering every player from scratch; after that window, if the team hasn't returned, names and jersey numbers are automatically stripped too. Season statistics (games played, positions, innings) are kept in de-identified form indefinitely so a team's history and fair-play record stay intact without retaining who any of it belonged to. Regardless of either schedule, a parent can request full removal of their child's information at any time — see “Parent-initiated removal request” above — and it will be honored within 30 days.

RecStak uses Supabase, Inc. as its infrastructure, database, and file-storage provider (“Data Processor”). Supabase processes and stores RecStak data — including any optional player photographs — solely to provide hosting and database services to RecStak, under a Data Processing Addendum that binds Supabase to strict confidentiality, security, and data-protection obligations. Supabase does not access, use, share, sell, or retain this data for its own purposes, for advertising, or for any purpose other than delivering services to RecStak. Player photographs are held in private, access-controlled storage, are served only through short-lived signed links to that team's coaches and the uploading parent, and are permanently deleted at the end of each season.

RecStak also uses Resend to send transactional email. For teams registered within the United States, RecStak uses Twilio to send text-message updates to opted-in parents. SMS communication and child-photo upload features are strictly disabled for any team or organization registered outside the United States. Vercel provides application hosting. Stripe processes payment for the one-time paid Season Pass, including a coach's name, email, and card details; RecStak's servers never receive or store card data, which is handled entirely by Stripe under its own PCI-compliant systems. Google (Gemini API) receives a team's sport, age band, skill level, practice duration, and focus areas — along with the drill library — to generate AI practice plans; no child names or other player information is ever sent to Google. Coach-entered text inputs used to generate practice plans are processed by Google solely to return a practice plan and are not used to publicly train third-party models. Each third-party provider acts only as a processor delivering services to RecStak and is bound by its own confidentiality and security terms.

Children's photos are stored in private storage that is never publicly accessible. Access is restricted through row-level security to that team's coaches and the uploading parent, and images are delivered only via short-lived signed links. No public URLs to a child's photo exist.

Under Pennsylvania law and standard privacy practice, you may access, correct, or delete your personal data. To exercise these rights or ask a question about your child's information, contact your coach or RecStak directly — see Contact below. Deletion requests for a child's information are honored by RecStak within 30 days, as described above.

Questions about this policy or a request regarding your child's information can be sent to your coach or to RecStak at coach@recstak.app.

See also our Terms of Service and Refund Policy for the Season Pass.