Privacy Policy

Rostara is a sports team management app for organizing pickup games, tracking ratings, balancing teams, and managing shared group expenses. This policy explains what data we collect, why we collect it, and what your rights are. We aim to collect the minimum needed to make the app work.

Rostara is operated by Canvas & Core Labs LLC, a California limited liability company ("we", "us"). We are responsible for your personal data (the "controller" under the GDPR). Our contact details are at the end of this policy.

What we collect

• Account info. Email address and display name when you sign up, plus a password hash managed by Firebase Authentication. We never store your raw password.
• Group activity. Groups you belong to, your role in each group, events you create or RSVP to, ratings you submit or receive, ledger entries you create, and notices or reactions you post. This is the data the app needs to function.
• Optional event metadata. If an admin enters a venue, date, or notes for an event, that text is stored alongside the event. Rostara does not request or use your device's GPS location.
• Push notification tokens. If you enable notifications, we store the FCM token for your device so we can deliver alerts (event go-live, RSVP closed, payment approvals, etc.). You can disable individual categories in the in-app notification settings.
• Diagnostic data. Server logs (timestamps, IP address, error traces) are kept by Firebase for security and reliability. The mobile app also reports crash and error diagnostics to Firebase Crashlytics — stack traces, device model, OS version, and app state at the moment of the crash — and performance measurements to Firebase Performance Monitoring: how long the app takes to start, how smoothly screens render, and how long network requests take. We use them to fix the problems real users run into. These reports are linked to your Rostara account through its internal account ID; they do not contain your name or email. You can turn both off at any time from Menu → Privacy & data in the mobile app; the setting is per-device and takes effect immediately. The web app reports page errors (the error message and where it happened) to our own server, together with your account ID.
• App integrity checks. To keep automated abuse away from our servers, the app proves that requests come from a genuine copy of Rostara using Firebase App Check. It relies on Apple's App Attest, Google's Play Integrity, and, on the web, Google reCAPTCHA, which receive information about your device and app and handle it under their own privacy terms.
• Usage analytics. The app uses Firebase Analytics to understand which features are used and how well the product works — for example, whether signups complete successfully, how often events are created, and whether the team balancer is used. The events we log carry only counts and fixed values, such as a reply status or a plan's product name — never names, emails, group names, or other free-text fields. The one exception is the sign-up event: it also carries the advertising campaign (the source, medium and campaign tags) and any ad-click identifier (Google's gclid or Meta's fbclid) in the link you first arrived by, so we can tell which ads lead to sign-ups. Events are linked to your Rostara account through its internal account ID. Approximate city-level location may be derived from your IP address by Firebase. We do not run advertising SDKs and the Apple/Google advertising identifier is disabled. You can turn usage analytics off at any time from Menu → Privacy & data, in the mobile app and on the web.
• The free team generator. The team generator at rostara.app/team-generator/ works in your browser, without an account: the players and ratings you enter are never sent from the page. If you press "Create this group in Rostara", the page saves your list (names, ratings, goalkeepers and the sport) in this browser's storage on rostara.app, so that the Rostara web app can add the players to the group you create after signing up. The app deletes the saved list as soon as it reads it, and ignores one more than 24 hours old. The players reach our servers only when you add them to your group. To learn whether it helps, the page tells our server when it is opened and the first time each of its features is used during a visit (for example teams made, copied or saved as an image), with only the sport, the number of teams, a rough group size such as "10 to 14 players", and whether you arrived from a search engine, another site or directly. Our server adds these to daily totals and keeps nothing else: no record of the visit, no IP address, and no cookie. If your browser sends Global Privacy Control or Do Not Track, the page sends nothing. If you send us a message from the page, we keep the message, the sport picked on the page, and your email address if you give one, and email it to our team so we can read it and reply. The page also sends how long it had been open, which our server uses only to turn away automated messages and does not keep.
• The free tournament schedule maker. The schedule maker at rostara.app/tournament-schedule-maker/ works in your browser, without an account: the teams and scores you enter are never sent from the page or saved. To learn whether it helps, the page tells our server when it is opened and the first time each of its features is used during a visit (for example a format picked, a score entered or the schedule copied), and whether you arrived from a search engine, another site or directly. Our server adds these to daily totals and keeps nothing else: no record of the visit, no IP address, and no cookie. If your browser sends Global Privacy Control or Do Not Track, the page sends nothing.
• Purchases. If you buy a Rostara subscription, we receive the details of the purchase: the plan, when it started and renews or ends, its status, the store it came through, and the price, currency, and country. We never receive your card number or other payment details: Apple, Google, or Link (Stripe's checkout service, for web purchases) collect and handle those.
• Warnings, blocks, and reports. If a group admin gives a member a warning or a suspension, the record and the reason the admin writes are visible only to that group's admins and to that member; a fine that comes with it is entered in the group's ledger, which members can see. If you block someone, your block list is private to you and the person you blocked is not told. If you report a notice or a member, the report comes to us, not to the group, and the person you reported is not told who reported them.

Why we collect it

• To provide core app features: authentication, group membership, ratings, team balancing, RSVPs, and bookkeeping.
• To deliver notifications you've opted into.
• To send you a few emails about groups you run, such as a reminder that your new group has no players yet. Each one has a link to stop them.
• To detect and prevent abuse (spam joining, unauthorized data access, fraud).
• To provide paid features to subscribers, by checking whether a subscription is active, and to keep the purchase records that tax and accounting law require.

Legal bases (for users in the EU and UK). We use your data to perform our agreement with you (your account, the app's features, and any subscription), for our legitimate interests in keeping the service secure, fixing bugs, and measuring how the app is used, to meet legal obligations (such as keeping purchase records), and with your consent where we ask for it (such as push notifications). You can withdraw consent at any time.

We do not sell your data, share it with advertisers, or use it to build a profile of you outside the app.

Who can see your data

Rostara groups have three roles, each with progressively more visibility into the group's data:

• Members can see your display name, your role label, your RSVPs to events, and anything you post in the group (notices, reactions, ledger entries you create). Individual ratings you give to other members are private — the rater is the only person who sees the score they entered. Members of a group see each member's average ratings, overall and per skill, but nobody, admins included, sees who gave which score. When only one person has rated someone, that average is that one person's score.
• Admins see everything members see plus group management surfaces: which member profiles have been claimed, rename non-owner members, remove members, override RSVPs, and approve or decline ledger entries. Admins still do not see individual rating scores — only the same averages every member sees.
• Owners see everything admins see plus group-level controls: regenerating the invite code, deleting the group, promoting or demoting admins. The owner is the user who created the group; there is exactly one per group.

Outside the group, your data is shared with:

• Service providers. Rostara is built on Google Firebase (Authentication, Firestore, Cloud Functions, Cloud Messaging, Hosting, Analytics, Crashlytics, Performance Monitoring, App Check). Firebase processes your data on our behalf under Google's privacy terms.
• Subscriptions and payments. RevenueCat manages Rostara subscriptions across the App Store, Google Play, and the web; it receives your Rostara account identifier and your purchase history, and processes them on our behalf. Apple, Google, and Stripe (through Link) process the payments as the sellers of those purchases, under their own privacy policies.
• Email. Resend delivers the emails we send, such as notices to our team when you send feedback or a report, and those emails to you about your groups. It receives the email address and the message content.
• Fonts and the web app's engine. The mobile app, the web app, our welcome page, and our guides load their typeface from Google Fonts, and the web app downloads part of its display engine from Google's servers (gstatic.com), so Google receives your IP address when your device fetches them. This page and our other legal pages load neither.
• Legal requirements. We may disclose data when legally compelled (subpoena, court order). We will tell you when permitted to.

We are based in the United States, and our providers may process data in the United States and other countries. Where the law requires, these transfers rely on the providers' data processing terms, including the European Commission's Standard Contractual Clauses.

Cookies and similar storage

We don't use advertising cookies. Our welcome page, our guides, the free team generator, and these legal pages set no cookies of their own and don't load analytics; the team generator only counts how it is used, and saves your list only when you ask it to, as described above. These pages load the Onest typeface from Google Fonts, so your browser asks Google's font servers for it, which sends them your IP address. The web app, and the services it relies on, keep the following in your browser:

• Your sign-in. Firebase Authentication keeps your signed-in session in the browser's storage, so you stay signed in until you sign out.
• App settings. The web app keeps a few settings in the browser's local storage: for example your analytics choice, your language, the group you last opened, and a flag that you've signed in before (rostara-has-session), which decides whether rostara.app shows the welcome page or opens the app. If you first arrived through a link with advertising tags, the campaign and any ad-click identifier in it are kept here too, so the sign-up event can carry them.
• A list from the team generator. If you press "Create this group in Rostara" on the team generator, your list waits in local storage (rostara-team-generator-list) until the web app picks it up after you sign in, which deletes it. The app ignores a list more than 24 hours old; clearing this site's data in your browser removes it too.
• Subscriptions. When the web app looks up your subscription, RevenueCat, which manages subscriptions, keeps your account ID in the browser's local storage.
• Google Analytics. Google Analytics sets its cookies only once the web app opens, and only while analytics is on.
• Abuse protection and Google sign-in. Google reCAPTCHA, which the web app uses through Firebase App Check to keep automated abuse away, and Google sign-in, which opens in a pop-up from Google, set their own cookies under Google's terms.
• Payments. Stripe and its Link checkout load only when you open the checkout to buy a subscription on the web, and set their own cookies to process the payment and prevent fraud.
• Fonts and the web app's engine. Fetching the typeface from Google Fonts and the web app's display engine from Google's servers (see above) gives Google your IP address.

Your rights

• Access and export. Open Menu → Privacy & data → Export my data in the app to download a JSON file containing your profile, memberships, RSVPs, ratings (given, plus aggregates received), ledger entries and notices you authored, warnings and suspensions about you, notification settings, your subscription, feedback you sent us, reports you filed, the groups you were removed from (when, and the name the group kept for you), the count of wrong invite codes you entered, the tournaments you created for yourself, and the people you blocked. The download is immediate; if you'd rather receive it by email or need a different format, contact us and we'll respond within 30 days.
• Correction. You can edit your display name yourself on the app's Profile page. Your name inside a group is part of that group's member profile, which the group's admins can edit. To change the email address on your account, email info@rostara.app.
• Leaving a group. You can leave any group at any time from the group settings menu. Your link to the group (your membership and authentication tie) is removed immediately, but the group's historical record of you — RSVPs you submitted to past games, ratings you gave or received, ledger entries you created or were a party to — remains in the group under your former member profile, which keeps your name and is now marked as unclaimed. This protects the group's collective history (rating averages, ledger balances, attendance records) from being distorted for the members who stayed. Group admins or the owner may, at their discretion, rename that former profile, fully delete it, or keep it as part of the group's records.
• Account deletion. This is distinct from leaving a group. You can delete your account at any time from inside the Rostara app: Profile → Delete account (how to delete your account). We remove your authentication record, email, password hash, notification tokens, and your account's own profile immediately, and you can no longer log in. Ratings you have given to other members are deleted and their averages are recomputed. Warnings and suspensions recorded about you are deleted. Feedback you sent us is deleted, and reports you filed are kept without your identity. If you signed in with Apple, we also ask Apple to revoke the app's access to your Apple ID. Notices and ledger entries you authored remain in their groups for historical accuracy but are anonymized — the author is replaced with "deleted‑user". Your name stays on your former (now unclaimed) member profile in each group you belonged to, so the group's history stays readable; an admin of that group can rename or delete that profile. Your replies to upcoming games are removed. Your replies to past games and the team suggestions you made keep a copy of the name you had then. Your replies, your reactions to notices, and your votes on team suggestions also keep your former account ID, which no longer leads to an account. Other group records attributed to your former member profiles (RSVPs, ratings you received, ledger entries you were a party to) are governed by the rule above — they remain part of those groups' history unless an admin chooses to delete them. If you cannot access the app, email info@rostara.app and we will process the deletion within 30 days as required by GDPR. Deleting your account does not cancel a subscription, so cancel it first in the App Store, Google Play, or your Link account.
• Notification opt-out. Toggle off any notification category from the app's settings menu at any time.
• Complaints. If you live in the EU or UK, you can also complain to your local data protection authority.

Children

Rostara is for adult recreational sports groups and for people 18 and over. We do not knowingly collect data from anyone under 18. If you believe someone under 18 has registered, contact us and we will delete the account.

Data retention

We keep your data for as long as your account is active. Closed accounts are deleted within 30 days of request. Server diagnostic logs are retained for up to 90 days for operational and security purposes. Google Analytics deletes the individual usage events after at most 14 months (the maximum for a standard Google Analytics property); the reports built from them hold only totals. The team generator's daily totals hold no personal data. Messages sent from the team generator are kept until you ask us to delete them: write to us from the email address you gave, or tell us what the message said. Records of purchases (the plan, dates, price, and store) are kept for as long as tax and accounting law requires, even after an account is deleted.

Security

Data in transit is encrypted via HTTPS. Data at rest is encrypted by Firebase. Access to production data is restricted to the developer account holder. We patch dependencies regularly. No system is perfectly secure — if you spot a vulnerability, please report it responsibly to the email below.

Changes to this policy

We may update this policy as the app evolves. Material changes will be announced inside the app and the effective date above will be updated. Continued use of Rostara after a change constitutes acceptance of the new policy.

Contact

Questions, requests, or concerns: info@rostara.app

Canvas & Core Labs LLC, 700 El Camino Real, Ste 120, PMB 1431, Menlo Park, CA 94025, USA