Privacy Policy

1. Who we are

ClubKit is operated by Korey Enright ("we", "us", "our"). ClubKit is a club management platform for rugby clubs. If you have questions about this policy, contact us at korey@clubkitrugby.com.

2. What we collect

We collect information you provide directly when you create an account and use ClubKit:

• Account information: name, preferred name, email address, password (stored encrypted)
• Profile information: phone number, date of birth, gender, pronouns, profile photo, Discord username
• Club membership information: CIPP ID, CIPP status, dues status, positions, skill assessments
• Emergency contact information: emergency contact name and phone number
• Event information: availability responses for matches and events

We do not use analytics tracking, advertising cookies, or any third-party tracking scripts.

3. How we use your information

Your information is used to:

• Provide and operate the ClubKit platform
• Manage your club memberships and team assignments
• Display relevant information to club administrators, coaches, and captains as needed for club operations
• Send transactional emails (account confirmation, password reset)
• Communicate important updates about the service

4. Who can see your information

Your information is visible within ClubKit based on your club roles and permissions. Club administrators, coaches, board members, and captains may see member details relevant to club operations (such as contact information, availability, and CIPP status).

We do not sell, rent, or share your personal information with third parties for marketing purposes. We will never share your data outside the application without your explicit permission.

5. Third-party integrations

ClubKit offers optional integrations with third-party services. These integrations are activated by club administrators and only access the minimum data necessary for the stated purpose.

Google Calendar

Club administrators may connect a Google Calendar to their club to automatically sync club events (such as matches, practices, and social events) to a selected Google Calendar. When this integration is enabled:

• Data accessed: ClubKit requests permission to view your calendar list (to let you select which calendar to sync to) and to create, update, and delete events on your calendars.
• How we use this data: ClubKit uses Google Calendar access solely to push club event details (event title, time, location, event type, and opponent) to the selected Google Calendar and to update or remove those events when they change in ClubKit. We do not read, store, or process any existing events from your Google Calendar.
• Data stored: ClubKit stores an OAuth access token and refresh token (encrypted at rest) to maintain the calendar connection, the selected calendar ID, and a mapping of which ClubKit events have been synced. No other Google data is stored.
• Data sharing: Google Calendar data is not shared with any third parties, used for advertising, or used for any purpose other than the calendar sync feature described above.
• Revoking access: Club administrators can disconnect Google Calendar at any time from the club settings page. You may also revoke access from your Google Account permissions page. Events already synced to your Google Calendar will remain there after disconnecting.

ClubKit's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Discord

Members may optionally link their Discord account to enable automatic role syncing within their club's Discord server. ClubKit accesses your Discord user ID and username for this purpose. You can unlink your Discord account at any time from your profile settings.

Square

Club administrators may connect a Square account to sync payment and dues information. ClubKit accesses order and customer data from Square solely to match payments to club members.

6. Service providers

We use the following third-party services to operate ClubKit:

• Heroku (Salesforce) for application hosting
• Amazon Web Services (S3) for file storage (profile photos, club logos)
• Postmark for transactional email delivery
• Better Stack for application logging and monitoring
• QuotaGuard Shield for network proxy services

These providers only process your data as necessary to provide their services to us and are bound by their own privacy policies.

7. Data security

We take reasonable measures to protect your information. Passwords are encrypted using industry-standard hashing. All data is transmitted over HTTPS. Access to personal data within the application is controlled by role-based permissions. OAuth tokens for third-party integrations are encrypted at rest using Active Record Encryption.

No method of transmission or storage is 100% secure. If you become aware of a security issue, please contact us immediately at korey@clubkitrugby.com.

8. Data retention and deletion

We retain your information for as long as your account is active. You can permanently delete your account at any time from your profile settings. When you delete your account, all associated personal information is automatically and permanently removed.

When a Google Calendar integration is disconnected, the stored OAuth tokens and calendar mapping data are immediately and permanently deleted. Events already synced to the external Google Calendar are not removed.

9. Children's privacy

ClubKit is not intended for use by anyone under the age of 13. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has provided us with personal information, please contact us so we can remove it.

10. Your rights

You have the right to:

• Access the personal information we hold about you (visible in your profile)
• Correct inaccurate information (editable in your profile)
• Delete your account and all associated data
• Request a copy of your data by contacting us
• Revoke third-party integrations (Google Calendar, Discord, Square) at any time

To exercise any of these rights, email korey@clubkitrugby.com.

11. Changes to this policy

We may update this privacy policy from time to time. If we make significant changes, we will notify users through the application or via email. Continued use of ClubKit after changes constitutes acceptance of the updated policy.