Data processing

The organization (school, club, or league) is the controller.

Kickoff is the processor. Tinker and Scribe Workshop Inc., 1146 Route 895, Elgin, NB E4Z 2M3 runs Kickoff on the organization’s instructions for league operations (registration, roster, attendance, rooms, bookings, fee status).

Kickoff is not the merchant for parent registration fees. Those payments, when enabled, go to the organization’s connected Stripe account. Season invoices are charged to the organization, not to parents.

Account, household, roster, attendance, messages, bookings, and paid / unpaid status, plus error reports and usage events linked only to an internal account code — as described in the privacy policy. The organization decides what to collect on a registration form.

Only services this app actually uses:

• Vercel — Hosts the web app when it is deployed.
• Neon — Production Postgres when DATABASE_URL is set. Account and league data live there.
• Stripe — Parent registration fees are charged on the club’s connected Stripe account. Kickoff is not the merchant for those fees. Season invoices are charged to the organization on Kickoff’s own Stripe account.
• Proton — Proton AG. Proton SMTP sends password-reset mail from noreply@tinkerandscribe.com. Resend is not used. The same mailbox sends chat-report notices to club and organization admins and to chris@tinkerandscribe.com, trial-request notices to chris@tinkerandscribe.com, and trial reminders to club admins. A club admin can unsubscribe from trial reminders. Kickoff stores that email address so those reminders stop. Pause notices and password-reset mail still send. Kickoff does not send commercial or marketing email.
• Cloudflare — Cloudflare Turnstile checks public forms for bots (sign-in, sign-up, password reset, feedback, the facility start form, and trial requests). The widget loads from challenges.cloudflare.com. Cloudflare may process IP address and device signals to decide if the visitor is a bot.
• Google Fonts — The site loads Barlow Semi Condensed and Figtree from fonts.googleapis.com. Google may receive the browser’s IP address when that stylesheet loads. Kickoff does not send account or player records to Google for fonts.
• Tinker & Scribe Workshop Board — Internal Tinker and Scribe tool. Feedback submissions are forwarded there. A scheduled job also sends each Kickoff account’s name and email, plus signup counts.
• Sentry — Functional Software, Inc. Error reports from the website and server: the error, the page address, browser and device type, and an internal account code. No names, email addresses, player records, form answers, or chat messages. IP addresses are not stored. Stored in the United States. Error reports are deleted after 30 days.
• PostHog — PostHog, Inc. Usage analytics: which pages and features are used, browser and device type, an internal account code, and a random browser code. No names, email addresses, player records, form answers, chat messages, or screen recordings. IP addresses are discarded. Stored in the United States. Events are kept for 1 year.

These providers may store information in the United States or another country, where local authorities may be able to reach it. We do not sell personal information.

We answer access and correction requests within 30 days.

Tinker and Scribe Workshop Inc., 1146 Route 895, Elgin, NB E4Z 2M3. Privacy and processing questions: chris@tinkerandscribe.com.