RosterBack to Roster

Privacy Policy

Last updated 22 April 2026

This Privacy Policy explains what personal data GetRoster Ltd (“Roster”, “we”, “us”) collects, how we use it, who we share it with, and your rights. Roster is operated by GetRoster Ltd, a company registered in England and Wales (company number 17179578) with registered office at 124 City Road, London EC1V 2NX. This Policy is written to comply with the UK GDPR and Data Protection Act 2018.

1. About this Policy

For the purposes of the UK GDPR, GetRoster Ltd is the data controller for your personal data. Our contact for privacy matters is [email protected].

2. What data we collect

Details you give us

  • Name, email address, phone number
  • Password (stored securely, hashed, never in plain text)
  • Your role (coach, parent, player, admin)
  • Emergency contact details if you provide them

Details about players on your team

  • Full name, date of birth, jersey number, preferred position
  • Photos if uploaded
  • Match participation and RSVPs
  • Optional fun facts (favourite team, favourite player, favourite number)

Payment data

Handled by Stripe. Roster does not store card numbers or bank details. We store a Stripe customer identifier and payment summaries only.

Usage data

  • Session cookies to keep you logged in
  • Basic anonymised analytics to understand which features are used and to fix issues

3. How we use your data

  • To operate Roster's core features: schedules, RSVPs, squads, communications, payments
  • To let coaches and admins see contact info of team members they need to reach
  • To send emails you have asked for or that support the Service (invites, RSVP reminders, announcements from your club)
  • To improve Roster (understanding what works, fixing bugs)
  • To comply with our legal obligations (safeguarding, tax, accounting)

4. Legal bases we rely on (UK GDPR)

  • Contract: to provide the Service you signed up for
  • Consent: for optional things like fun facts or player photos
  • Legitimate interests: to improve Roster, prevent fraud, keep the Service secure — balanced against your rights and freedoms
  • Legal obligation: where required by law

5. Who we share your data with

  • Other users in your club (coaches, admins, other parents as needed to run the club — only what's necessary; for example parents do not see other parents' contact details)
  • Supabase (database and authentication provider, storing data in the EU/UK region where possible)
  • Vercel (hosting provider)
  • Stripe (payment processing)
  • Resend (email delivery)

We do NOT sell your personal data.

6. Data about children (under 18)

Roster is used by young people through their parents or guardians. Where a parent signs up on behalf of a child, the parent is responsible for how their child's data is used within Roster. Players aged 13 or over can create their own account, but we recommend a parent signs up for younger players. Parents can request deletion, correction, or export of their child's data by emailing [email protected]. We respond within 30 days.

7. How long we keep your data

We keep your data while your account is active and for a reasonable period after (usually 6 months) in case you return. Financial records are kept for 6 years to meet UK accounting requirements. Deletion requests are honoured except where legal retention applies.

8. Where your data is stored

Our providers store data in the UK, EU, or US depending on the service. Where data is transferred outside the UK/EU we rely on standard contractual clauses or equivalent safeguards.

9. Cookies

Roster uses essential cookies to keep you logged in and the app functioning. We do not use third-party advertising cookies. If we ever add analytics cookies we will ask your permission.

10. Your rights

Under UK GDPR you have the right to:

  • Access the personal data we hold about you
  • Correct any inaccurate data
  • Ask us to delete your data (subject to legal exceptions)
  • Ask us to restrict how we use your data
  • Object to certain uses of your data
  • Data portability (get your data in a format you can move)
  • Withdraw consent at any time where consent is the legal basis
  • Lodge a complaint with the UK Information Commissioner's Office (ICO) if you are unhappy with how we handle your data — ico.org.uk

To exercise any of these rights, email [email protected]. We respond within 30 days.

11. Security

Roster is built with security best practices: HTTPS everywhere, encrypted passwords, database-level access controls (row-level security), and secure payment processing via Stripe. We cannot guarantee 100% security online but we take it seriously and would notify affected users and the ICO within 72 hours of a serious data breach.

12. Changes to this Policy

We may update this Policy from time to time. We will notify you of significant changes by email or via the app. The “Last updated” date always shows when it was changed.

13. Contact

Questions about your data or this Policy? Email [email protected] or write to GetRoster Ltd, 124 City Road, London EC1V 2NX.

For formal complaints about how we handle your data, contact the ICO: ico.org.uk