Privacy Policy

1. Information We Collect

1.1 Information you provide

• Account information: your email address and name, and authentication identifiers managed by third-party sign-in providers (Google, Apple).
• Organization and membership information: organization names, roles, rosters, team and program details, and member profiles you or your organization create.
• Player and member profiles: display name, profile photo, sport(s), and competition details (such as registrations, results, and ratings).
• Tournament and registration information: entries, divisions, schedules, scores, and standings.
• Communications: messages, support requests, and feedback you send us.
• Additional profile details you choose to add: date of birth, gender, and a public @handle.
• Home location: a place you type in to personalize your home feed and tournament recommendations. We resolve what you type into a city, province or state, country, and postal code, and store that on your profile. The postal code is used for regional ranking and is not displayed back to you.
• Contacts you choose to share: if you grant the mobile app permission to your device address book, we send us a one-way hash of each contact email address so we can show you which of your contacts already use iMatch. We do not retain those hashes.
• Invitations you send: if you invite one of your contacts, we store that person's email address in plain text so the invitation can be attributed to you and reconciled. That person is not contacted by us and does not receive an iMatch account; the record is deleted when your own account data is purged.
• Video, photo, and audio you upload or capture: match video you submit for review, images you attach, and live audio and video when you broadcast a match.

1.2 Information collected automatically

• Usage data: pages viewed, features used, and basic device/browser information, used to operate and improve the Service.
• Essential cookies: required for sign-in, sessions, and security on the authenticated portal. The public organization websites are read-only and do not set first-party tracking cookies.
• Content engagement in the mobile apps: which cards in your home feed were shown to you, which you tapped, and how long each was on screen. These events are linked to your account, are used to rank what we show you, and are retained for 90 days.
• Analytics and crash reporting: we use Google Firebase Analytics and Firebase Crashlytics in the mobile apps. These collect app and device identifiers, screen views, session activity, and diagnostic reports on crashes. On Android, the analytics library also collects the device advertising identifier at its default setting.
• Push notification tokens: issued by Apple or Google so we can deliver match and tournament notifications to your device.

1.3 Payment information

• Tournament entry fees and registration payments are processed by our payment processor (Stripe). We do not store full payment card details on our servers.
• We receive transaction confirmations and limited billing metadata needed to reconcile registrations.
• Subscriptions bought inside the mobile apps are processed by Apple or Google. We receive a purchase token, the product identifier, and the subscription status so we can activate and renew your entitlement. We do not receive your payment card details from either store.

2. How We Use Your Information

We use the information we collect to:

• Provide the Service: operate organization accounts, memberships, tournaments, ratings, and public organization websites.
• Authenticate and secure accounts: verify identity and protect against unauthorized access.
• Process registrations and payments: complete tournament entries and send confirmations.
• Communicate with you: send service-related notifications, respond to inquiries, and (where permitted) share updates.
• Improve the Service: understand usage to enhance features, reliability, and performance.
• Comply with law: meet legal, regulatory, and safety obligations.

3. Information on Public Organization Websites

Public organization pages (rosters, rankings, news, tournaments) may display a member's display name, profile photo, sport, and competition details such as rating, results, and standings.

Public pages do NOT expose legal name, date of birth, email address, phone number, authentication identifiers, or internal account metadata. Organizations control which sections of their site are published and which members appear.

4. Organizations as Controllers; Roles and Responsibilities

Many users interact with iMatch through an organization (a club, league, or academy). The organization decides what member information to collect and publish on its site and is responsible for having a lawful basis and any necessary consents for that information. We process member information on the organization's behalf to provide the Service.

If you are a member and have questions about how your organization uses your information, please contact your organization directly. You may also contact us using the details in Section 12.

5. Children's and Youth Information

We do not knowingly collect personal information directly from children outside of an organization's managed membership. If you believe a minor's information has been provided to us without appropriate consent, contact us and we will work with the organization to address it.

6. How We Share Information

We do not sell, rent, or trade your personal information. We share information only as follows:

• Within your organization: with administrators and members as needed to operate the organization on iMatch.
• Service providers: with vendors who help us run the Service under confidentiality obligations. These currently include Google Cloud and Cloudflare (hosting and delivery), Google Firebase (authentication, push notifications, analytics, and crash reporting), Google Sign-In and Apple Sign-In (authentication), Stripe (payments), and Apple and Google (in-app subscriptions). Where you enter a home location, the text you type is sent to the Google Geocoding API to resolve it.
• Legal and safety: when required by law, legal process, or to protect rights, safety, and the integrity of the Service.
• Business transfers: in connection with a merger, acquisition, financing, or sale of assets, subject to this Policy.
• With your consent: for any other purpose disclosed to you at the time.

7. Data Security

We use technical and organizational measures designed to protect personal information, including encryption in transit, encryption at rest for stored data, access controls that limit who can access data, and reputable cloud infrastructure. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

8. Data Retention

We retain personal information for as long as needed to provide the Service, while your account or organization membership is active, and thereafter as required to comply with legal obligations, resolve disputes, and enforce our agreements. Payment records are retained as required by law. When information is no longer needed, we delete or de-identify it.

• Content engagement events (Section 1.2) are retained for 90 days.
• Contact email hashes used for matching are not retained.
• An invitation record, including the invited person's email address, is retained until your own account data is purged.
• Payment and subscription records are retained for 7 years.
• Support correspondence is retained for 2 years.
• Deleted data may persist in encrypted backups for up to 90 days before those backups age out.

9. Your Privacy Rights

Depending on where you live, you may have rights to access, correct, delete, or port your personal information, and to object to or restrict certain processing. To exercise these rights, contact us using the details in Section 12. Members managed by an organization should also contact that organization.

9.1 Canada (PIPEDA)

If you are in Canada, you may access and request correction of your personal information, withdraw consent (subject to legal or contractual limits), and complain to the Office of the Privacy Commissioner of Canada.

9.2 California (CCPA/CPRA)

If you are a California resident, you may request disclosure or deletion of your personal information and may not be discriminated against for exercising your rights. We do not sell personal information.

10. International Data Transfers

We are based in Canada, and our infrastructure may process information in Canada and other jurisdictions. If you access the Service from outside these jurisdictions, you consent to the transfer and processing of your information there, with safeguards as required by applicable law.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will post the updated Policy on this page and revise the "Last Updated" date and version. Your continued use of the Service after changes take effect constitutes acceptance of the updated Policy.

12. Contact Us

If you have questions about this Privacy Policy or our data practices, contact us at the details below.