Privacy policy
The short version. Hashmark keeps what a football team needs to plan, practice and play, and nothing more. We don't sell data, show ads or track you around the web. Your playbook belongs to your team.
Who we are
Hashmark (usehashmark.com) is run by Vantry LLC, 2524 Van Beek Road, Green Bay, WI 54311, USA. Questions about privacy: [email protected].
Two kinds of information
- Your account and billing. Hashmark decides how this is used (Hashmark is the "controller").
- Your team's information: playbook, roster, game logs, stats, practice, injuries and absences. The team (the club, school or coach who runs it in Hashmark) decides what goes in and who can see it. Hashmark stores it for the team (Hashmark is the "processor"). Questions about a team's records go to that team's coaches first; we help them answer.
What we keep
| What | Examples | Why |
|---|---|---|
| Account | Email address, name, your password (stored only as a one-way scrambled hash), when you signed in, the kind of device for each cloud backup ("iPad") | To sign you in and keep your account safe |
| Team and membership | Team name, who is on it, each person's role and title, join requests, invites, join codes | To run the team: approvals, roles, who sees what |
| Joining details | For a person asking to join: name, jersey number, chosen role, age group (under 13, 13 to 15, 16 or older); for 13 to 15: a parent's email and their answer | So a coach can approve the right person, and so we follow the law for young players |
| Playbook and team records | Plays and drawings, call sheets, wristbands, practice plans, scouting, game logs, stats, depth charts, roster (names, numbers, positions), attendance and grades | The service itself |
| Injuries and absences | Status (out, doubtful, limited ...), a reason (injury, illness, work, school ...), an expected return, a short note | So coaches plan around who is available. Teams should keep notes short and never write diagnoses. |
| Billing | Plan, monthly or yearly, renewal date, payment status, our reference to the Stripe customer | To take payment and give access. Card numbers go straight to Stripe; Hashmark never sees or stores them. |
We don't ask for birthdates, home addresses or phone numbers.
On your device
Hashmark saves your playbook in your browser's own storage, so it works with no signal on game day. It also remembers small settings (language, last tab, your sign-in). This is storage the app needs to work. We use no advertising or tracking cookies and no analytics tools.
Who helps us run Hashmark
These companies process information for us, only to provide their service, under data processing agreements:
| Company | What for | Where |
|---|---|---|
| Supabase | Database, sign-in, file storage, server functions | Ireland (EU), on Amazon Web Services |
| Cloudflare | Hosting the website, our domains, forwarding our email | Global network |
| Resend | Sending emails (sign-in codes, invites, parent emails, daily summaries) | European Union and United States |
| Stripe | Payments, invoices, fraud checks | United States and European Union |
| Google Fonts | The website's typefaces (your browser asks Google for them, which shows Google your IP address) | United States |
If you turn on voice entry on Game Day, your browser sends what you say to its own speech service (Google for Chrome, Microsoft for Edge, Apple for Safari) to turn it into text. Hashmark gets only the text. Voice entry is off unless you turn it on.
When information goes to the United States, it is protected by the European Commission's Standard Contractual Clauses or the EU-US Data Privacy Framework.
We never sell or rent personal information, and we don't share it for advertising. We only disclose it if the law requires us to.
Young players
- Hashmark accounts are not for children under 13. A coach can list a younger player on the roster, but that player has no account.
- Players aged 13 to 15 need a parent or guardian's OK before joining. We email the parent a link to approve or decline; until they approve, the player sees nothing from the team.
- A parent can take the OK back at any time with the link in that email. That deletes the player's account.
- A coach also approves every player before they join a team.
How long we keep it
- Your account: until you delete it (Settings, Team & people, Delete my account). Then your email, name and sign-in are deleted.
- Team records about you (for example your stats or attendance) belong to the team and stay with it, no longer linked to an account.
- Cloud backups: the newest copy, one an hour for a day, one a day for 30 days, and copies you make by hand until the team deletes them.
- A deleted team: its records and files are deleted.
- Join requests and invites: requests are kept until a coach answers them; invites end after 14 days.
- Billing records: as long as tax and accounting law requires.
Why we're allowed to use it (for people in the EU and UK)
- To provide the service you signed up for (contract): your account, your team, payments.
- Legitimate interests: keeping Hashmark secure, preventing fraud and abuse, fixing problems.
- Consent: a parent's OK for players aged 13 to 15, and voice entry. You can take consent back at any time.
- Legal obligations: tax and accounting records.
- Injury and absence information is health information; the team records it for its players, and Hashmark keeps it only to provide the service to that team.
Your rights
You can ask to see, correct, export or delete your information, to limit or object to how it is used, and to take back consent. Much of it you can do yourself in Hashmark: change your name, export a full copy of the playbook, delete your account. For anything else, email [email protected]; we answer within 30 days. If something is about a team's records, we may pass your request to that team's coaches.
In the EU or UK you can also complain to your data protection authority (in France, the CNIL). California residents: we don't sell or share personal information, and you have the rights above as well.
Keeping it safe
Everything travels encrypted (HTTPS). Database rules let people see only their own teams, and within a team only what their role allows. Passwords are stored only as hashes. No system is perfectly secure; if a breach affects you, we tell you and the authorities as the law requires.
Changes
If we change this policy in a way that matters, we tell account owners by email or in Hashmark before it takes effect. The date at the top shows the latest version.