Privacy policy

The short version

HQ2 Hoops is a check-in sheet for a private pickup basketball group. It stores the minimum needed to know who's playing: your Google name, email and photo, and whether you're in or out for each run. There are no ads, no analytics, no tracking, and nothing is sold or shared with anyone outside the group.

What we collect

• From Google, when you sign in: your name, email address and profile photo. That is the only Google data requested (the openid email profile scopes). We never see your password, contacts, calendar or anything else.
• From you, as you use the app: your in / out status for each run, whether you were marked a no-show, and whether a fee has been marked paid.
• Before you sign in: an admin may add your name to the roster so runs can be planned. Only the name is stored until you sign in and the admin links it to your Google account.
• Automatically: an audit log of changes (who marked whom in or out, and when) so disputes can be settled, and a session cookie that keeps you signed in.

That's the whole list. No location tracking, no device fingerprinting, no third-party analytics or advertising scripts.

Who can see what

• Nobody can see anything without signing in with Google and being activated by an admin.
• Activated players see each other's names, photos, patron / sub role, in / out status for each run, and the attendance stats derived from them — runs played, streaks, sub pickups and no-shows — on the roster and leaderboard. Email addresses and money are never shown to other players.
• Admins (the people running the group) can additionally see email addresses, the audit log, and fee status. They need this to activate accounts and collect court fees.

These limits are enforced by the database itself, not just the screens: a player's account cannot read another player's email even if they bypass the app.

How it's stored and protected

Data lives in a Supabase Postgres database and the site is served by Vercel; both encrypt data in transit and at rest. Sign-in is handled by Google — we never store a password. Every request is checked against per-row access rules, and every change to a check-in is recorded in the audit log.

Cookies

One cookie keeps you signed in. Optional preferences (light / dark theme, which release notes you've seen) are kept in your browser's local storage and never leave your device. There are no advertising or tracking cookies.

Retention and deletion

Your account and history stay for as long as you're part of the group so past seasons can be looked up. Ask an admin to remove you and your profile is deleted; your name may remain in past attendance records and the audit log. To disconnect the app from your Google account at any time, visit Google → Third-party access.

Children

The app is for adults playing in a private league and is not directed at anyone under 13.

Changes and contact

If this policy changes, the date at the top moves and the change appears in What's new. Questions or deletion requests go to the admin who runs your group — the same person listed under Who to ask on the home screen.