Legal
Privacy Policy
The short version: we collect as little as we can, we lock the sensitive parts and write down every time someone opens them, we show no ads and we sell nothing. The rest of this page is the detail behind that sentence.
1. Who this covers
This is how SameSide handles personal information for the youth sports club running it, whatever the sport, and for everyone in it: administrators, coaches, team managers, players, and the guardians and family members linked to a player.
2. What we collect, and why
Four kinds of information, treated differently:
| Category | Examples | Why |
|---|---|---|
| Team structure | Teams, seasons, rosters, events, who is coming | To run the schedule |
| Identity | Names, jersey numbers, roles | To show who is who |
| Contact | Email, phone, date of birth | To reach families, and to check a child is the right age to play |
| Sensitive | Medical notes, allergies, emergency contacts, agreement signatures | To keep a child safe on game day |
We collect as little as we can. There is no field for a health-card or OHIP number, so we never hold one. There is no home-address field either. The only street addresses we hold are the places teams play. We collect sensitive information only with consent, and only what a club needs for safeguarding and Rowan’s Law.
3. How it’s protected
- It’s encrypted where it’s stored. Phone numbers, dates of birth, agreement signatures, medical and emergency details, and the email address on a member’s record are all scrambled by the app before they are saved, so a copy of the database on its own does not reveal them. Our hosting provider runs the server the app runs on as well as the database, so it is technically able to reach what the app reaches. We do not give it access to that information for any purpose of its own. Two things stay readable: names, rosters, team memberships and the links between parent and child, because every list in the app needs them, and the address you sign in with, because a sign-in link has to go somewhere. Most people use one address for both. The copy on the member record is encrypted. The copy your account signs in with is not.
- Every look at sensitive data is written down. Opening a medical or emergency record writes a log entry before anything is unlocked. Staff have to have proved who they are shortly beforehand, either by signing in again or by unlocking for that day’s event. A guardian opening their own child’s emergency contacts isn’t asked to prove anything again, but that look is written down just the same. Families read the log themselves.
- People see only what their job needs. Assistant coaches and team managers see emergency contacts only. Head coaches see their own roster. Families see their own. An administrator can add medical access for one named person on one named team, with a typed reason, for three days at most. It can be taken back, and the family sees it in their own log.
- What it doesn’t stop. No system is absolute. This one doesn’t stop someone who takes over the running server, or an administrator misusing access they are meant to have. We write both up plainly on our security page rather than hide them.
4. Who can see what
It depends on your role. Administrators reach the club’s data, sensitive fields included, and every look is logged. Head coaches reach sensitive fields for their own roster, also logged. Assistant coaches and team managers see emergency contacts only, unless an administrator has granted the temporary medical access described above; team managers also see logistics and compliance information. Players and guardians see their own records. Role is the only thing that decides who sees a family’s contact details. There is no per-family setting. Other families never see them. Staff on that team do. We never make a member’s information public.
5. Children’s information
A player’s record is managed through their guardian, and we need a guardian’s consent before we collect a minor’s sensitive information. A minor’s messages are routed so a guardian can read them, and anything formal about a minor goes to the guardian, not the child. There is one exception, and it is deliberate. A child can start a conversation their own guardian is kept out of, because a child who needs to talk about an adult may need to talk about that adult. It is never unsupervised. The club’s safe-sport contact oversees it instead of the excluded guardian. We treat a minor’s information as sensitive by default.
6. Who else sees any of it
We do not sell personal information, and we do not use it for advertising. There is no ad tracker, no advertiser code and no tracking pixel in the product. Three outside services see personal information, and beyond them the company that runs our server and database (section 7):
- The service that sends the email, which delivers reminders, sign-in links and safety notices. It gets the address and the message itself. A reminder carries a child’s first name, the team, and when and where to be. A removal notice names the child and says a concussion is suspected, because Rowan’s Law says the guardian has to be told at once. It never gets the record behind the notice: no medical history, no emergency contacts, no list of families.
- Your phone’s own notification service (Apple’s, Google’s or Mozilla’s), if you turn notifications on. The message is locked to your device before it is handed over, so that service can’t read it.
- An AI service, if whoever runs this installation has switched on rulebook reading. That is one setting held by the operator, not by a club, so your club can’t turn it on or off. It sees a league rulebook’s text and the document’s name. It never sees a family’s information.
Calendar feeds and one-tap answer links, if you use them, are shared with whichever calendar or email provider you point them at.
7. Where data is stored
8. How long we keep it
We keep personal information only as long as it is needed for what it was collected for, or as long as the club’s league and governing body (for example Ontario Basketball (OBA)) and the law require. That covers records a club has to keep on file for a season, and the concussion records Rowan’s Law requires. How long that is, is set by the club as its own policy and told to members. Withdrawing medical consent deletes the encrypted record straight away rather than just flagging it. Old message bodies and archived game sheets are the two things the app erases on a schedule of its own; see the note below for what it does not.
9. Your rights
Subject to the law, you can ask to see the personal information we hold about you or your child, ask us to correct it, take back consent for anything optional, and ask how it has been used. Taking back consent for sensitive information may limit what a club can safely let a child take part in. Where it does, we will tell you plainly what the consequence is.
10. Contact
Questions about this policy, or about your information, go to the club’s privacy contact at hello@sameside.ca. Each club names its own privacy contact, and your club’s appears on its privacy page inside the app.
11. Changes
This policy will change as the product does. Anything that matters will be dated and shown to members. This draft is dated 15 August 2026.