Privacy Policy

1. Who we are

SideKrew (“we”, “our”, “SideKrew”) is an autonomous, agentic operations platform for grassroots team sports. Our service helps volunteer-run youth and amateur clubs manage registrations, schedules, and team travel through AI agents.

We are headquartered in Canada and store all primary data in a Canadian region (Montréal, ca-central-1). We are committed to handling personal information, especially children's data, with the highest level of care.

This policy applies to all personal information collected or processed by SideKrew, including information about minors. It is designed to meet or exceed the requirements of Quebec Act Respecting the Protection of Personal Information in the Private Sector (Law 25) and PIPEDA (Canada's federal private-sector privacy law). We will comply with stricter obligations (e.g., COPPA for US users) as we expand.

Some processing happens in the United States, by the providers named in section 7: see section 12.

If you create a family account yourself, without a club, section 15, Family accounts explains how we handle it.

2. Our approach to children's data

Minors are the core data subjects in grassroots sports. We treat this responsibility seriously. Our design principles for children's data:

• Minors do not have accounts. A child registered in our system is a participant record, not a user. Children do not log in and are never directly contacted by our AI agents or by SideKrew.
• All communication routes through guardians. Any message about a child goes only to their linked guardian or parent. This is an architectural constraint; it is not configurable by clubs.
• No advertising, no data sale, no behavioural tracking of minors. We have no advertising system. We do not sell data. We do not build behavioural profiles of children. We do not share children's data with third-party advertising or analytics networks.
• Data minimization. We collect only the information a season requires: name, date of birth, gender (for division placement), and contact information for guardians. Medical and sensitive notes are encrypted at rest and visible only to club administrators.
• No tracking technologies on minors. We do not use cookies, pixels, or similar tracking technologies that operate on or profile minors' activity, in compliance with Law 25's requirement for explicit opt-in consent for tracking.

A family account holds only each child’s first name and a colour: see section 15, Family accounts.

3. What information we collect and why

4. Legal basis and consent

We process personal information under the following legal bases (consistent with Law 25 and PIPEDA):

• Consent. Guardian consent is recorded when a participant is enrolled. For children under 14 (Quebec) or in jurisdictions with equivalent requirements, explicit parental consent is required before we process personal information.
• Contractual necessity. Processing registration, payment, and scheduling data is necessary to deliver the services a club has contracted for.
• Legitimate interest. Security logging and fraud prevention.

We do not rely on “legitimate interest” to override the rights of children. Any processing of a minor's data that is not strictly necessary for the contracted services requires explicit guardian consent.

For a family account, you consent when you create it: see section 15, Family accounts.

5. How we protect your information

• Encryption in transit: All data is transmitted over HTTPS/TLS.
• Encryption at rest for sensitive fields: Medical and health notes are encrypted at the field level using AES-256-GCM before storage.
• Row-level security: Our database enforces strict multi-tenant isolation; a club can never access another club's data.
• Access control: Only club staff with the org_admin role can view medical notes. Guardians can view only the records linked to their children.
• Audit logging: Every sensitive action (including erasure) is permanently audit-logged with the actor, timestamp, and before-snapshot.
• Data residency: Primary databases reside in Canada (ca-central-1).
• Least-privilege AI agents: Our AI agents never exceed what an org_admin could do manually, and all agent actions are logged. Agents never contact minors directly.

6. Sharing and disclosure

We do not sell personal information. We do not share data with advertisers or data brokers. We share information only as follows:

• Within the club: Club staff (admins, coaches, team managers) can see participant and registration data for their organization only.
• Service providers: the companies named in section 7 process information for us, only to run SideKrew.
• Legal obligation: We may disclose information if required by law, court order, or to protect the safety of children or the public.
• Referral partners: when a club signs up through a SideKrew partner's link or code, that partner sees whether the club is on a paid plan and the commission they earn; the club's name only if the club chooses; never its people.

7. The companies that process information for us

These companies process information for us, only to run SideKrew. Each receives only what its task needs, and we remain responsible for your information while they handle it.

• Supabase — Our database, sign-in and file storage.
  Receives: Everything SideKrew stores.
  Where: Canada (Montréal, region ca-central-1).
• Vercel — Hosts our website and runs our app server, including every request from the mobile app and the AI agents' code. Also counts page views (section 3).
  Receives: The requests that pass through it.
  Where: United States (Washington, D.C. area).
• Anthropic — Claude, the AI our crew of agents uses (section 8).
  Receives: Only what a task needs (section 8).
  Where: Stored in the United States; may be processed in other countries where Anthropic runs its service.
• Inngest — Runs the crew's background and scheduled steps, and keeps a record of each step.
  Receives: What started each step and its result, which can include names and registration details, and — for an email or text sent to the club — the sender, the subject and, for a text, the message.
  Where: United States.
• Stripe — Card and bank payments.
  Receives: The payment details you enter (card numbers go to Stripe, never to SideKrew), amounts and invoice references.
  Where: United States.
• Resend — Sends our email.
  Receives: The recipient's address and the message.
  Where: United States.
• Twilio — Sends and receives texts, WhatsApp messages and calls.
  Receives: The phone number and the message.
  Where: United States.
• Expo, with Apple's and Google's push services — Delivers notifications and app updates to the mobile app.
  Receives: Your device's notification token and the notification's text (a first name and what changed, such as a game time).
  Where: United States.
• Your browser's push service (Google, Mozilla, Apple or Microsoft) — Delivers notifications to a web browser where you turned them on.
  Receives: Your browser's notification address, when a notification is sent, and the notification itself, encrypted so only your browser can read it.
  Where: United States.
• Google and Meta — Advertising pixels, on our public marketing pages only, and only if you opt in (section 9).
  Receives: Only what section 9 describes.
  Where: United States.
• A platform your club connects, or that you connect yourself (such as TeamSnap) — If your club connects one, we exchange the club's roster and schedule with it, as the club set it up. If you connect your own TeamSnap account, we read your family's teams, schedules, answers and duties and, when you open a team's page, its roster, posts, your messages and balance (read live, not kept), and send back only the answers, posts and replies you tap (below: “Teams from other apps that you add”).
  Receives: The club's roster and schedule; from your own connection, only the answers you send.
  Where: Where that platform operates.

8. AI in SideKrew (Anthropic's Claude)

• What it does. SideKrew's crew of AI agents uses Claude, made by Anthropic, PBC (United States), to plan its work, draft messages from your club (registration and paperwork reminders, travel messages including consent letters, and schedule-change notices), and answer questions in the family assistant and the Operations Assistant. Club staff can also choose to use AI tools: the Operations Assistant, the form builder (create a form from a description, import a PDF, translate) and the website builder.
• What it receives. Only what a task needs: names (a parent's, a child's), what is left to do for registration and paperwork and the amount owed, schedules and trips, the subject and opening lines of messages from your club, what you type to an assistant, and, for an email you send the club, the sender address and subject line. A staff member's assistant receives what they type and the club records it looks up for them; an AI tool receives what the staff member submits to it (for an imported PDF, the whole file).
• What we never put in a prompt. Medical notes, dates of birth, card numbers and passwords. Anything you type or upload yourself, and anything a club administrator chooses to submit to an AI tool (such as a filled-in form), is sent as written.
• Training and retention. Anthropic's commercial terms do not allow it to train its models on what we send. Anthropic deletes it within 30 days, unless it must keep it longer to comply with the law or to enforce its usage policy (up to two years if its safety systems flag a request).
• Where. Anthropic stores it in the United States. It may process it in the United States or in other countries where it runs its service.
• Your choice. The first time you use the app, and before you first use the family assistant on the web, we ask whether the assistant and the crew may use Claude for you. You can change your answer any time: in the app (Settings › AI help), in Family settings on the web, or on the Assistant page.
• Until you agree. The family assistant is off for you (on the web, by text, WhatsApp and phone), and the messages the crew writes to you — registration and paperwork reminders, travel messages including your child's consent letter, and schedule-change notices — still reach you, written from a standard template, without the AI. A registration reminder or travel consent letter that names your child also uses the template until each of the child's guardians has agreed. A message you send the club is passed to a person without the AI reading it.
• If you choose Not now. All of the above stays (or goes back to) that way, and the Operations Assistant does not answer you.
• What your answer does not cover. AI tools your club's staff choose to use with club records (above), which may name you or your child, and the sender address and subject of an email you send the club, which the crew reads to plan what happens next. If you have a concern about these, write to privacy@sidekrew.com.
• Club staff. For a staff member who has not answered yet, the Operations Assistant works and sends what they type, and the club records it looks up, to Claude; it says so where they type (the Assistant page and the assistant panel on every page), with a switch to turn it off.
• The demo phone number. The SideKrew demo club's phone number answers with the assistant: what you text it is sent to Claude, and its first reply says so.

9. Advertising cookies on our public marketing site (opt-in only)

Our public marketing site (the marketing pages such as the homepage, comparison pages, and guides) may use advertising cookies and pixels from Google and Meta (Facebook/Instagram), but only after you explicitly opt in. When these identifiers are configured, a banner asks for your consent before any pixel loads — consistent with Law 25's requirement for prior, explicit consent to tracking technologies.

• Purpose: advertising measurement to reach new clubs. These pixels help us understand which ad campaigns bring clubs to discover and try SideKrew. That is their only use.
• Never in the signed-in app, never on minor-associated accounts. No advertising pixels run inside the signed-in app, or on any account associated with minors. Advertising tracking is limited to the public marketing site and only with your consent. (The only measurement in the signed-in app is the cookieless page count in section 3, which never runs in the family area.)
• No data sale, no child profiling. We do not sell any personal information and do not build behavioural profiles of children. Children are participant records, never users, and are never tracked.
• Nothing loads by default. If you decline or make no choice, no advertising pixel is loaded. While SideKrew has no advertising identifiers configured, the banner does not appear and no pixel exists at all.
• How to withdraw consent. You can withdraw consent at any time by clearing this site's cookies and site data in your browser (which brings the banner back so you can choose “Decline”), or by emailing us at privacy@sidekrew.com. Withdrawal does not affect your use of SideKrew.

10. Your rights: access, correction, and erasure

Under Law 25 and PIPEDA, individuals (and guardians acting on behalf of minors) have the right to:

• Access. Request a copy of personal information we hold about you or your child.
• Correction. Request correction of inaccurate or incomplete information.
• Erasure (deletion). Request permanent deletion of a participant record and all associated data. This is a true hard delete (not an archive). All registrations, compliance records, invoices, and guardianship links are permanently removed. The action is audit-logged for accountability.
• Withdrawal of consent. Withdraw consent for processing not required for the contracted services. Withdrawal may affect the ability to participate in programs that require the relevant data.
• Complaint. Lodge a complaint with the Office of the Privacy Commissioner of Canada (OPC) or the Commission d'accès à l'information (CAI) if you believe your rights have not been respected.

How to exercise these rights: Guardians may erase a child's record themselves, at any time, from Settings in the family area of the platform (Family › Settings › Your data rights). For access, correction, or other requests, contact our privacy officer at privacy@sidekrew.com.

Deleting your account: you can delete your own SideKrew account at any time, in the app or on the web. See Delete your SideKrew account for exactly what happens and how.

We will respond to access and correction requests within 30 days. Complex requests may require up to 90 days; we will notify you if an extension is needed.

Family accounts: removing a child or deleting your account deletes that information right away; see section 15, Family accounts.

11. Data retention

We retain personal information for as long as it is necessary to deliver the contracted services, comply with legal obligations, or resolve disputes. Typical retention:

• Participant records: Retained for the duration of active participation in the club. On erasure request, immediately and permanently deleted.
• Registration and payment records: Retained for 7 years for financial and tax compliance, unless a guardian exercises erasure rights and the legal basis for retention no longer applies.
• Audit logs: Retained for 3 years for security and accountability.
• Partner tax records: commission, payout and tax records for SideKrew partners are kept for 6 years after the end of the year of the partner's last payout, as Canadian tax law requires. A partner's other details are anonymised when they leave the program.
• Outside teams: events from a week back to six months ahead while the team is shown; the TeamSnap answer history (and your posts and replies), 90 days; a team page's roster, posts and messages are never kept. Everything is deleted at once when you remove the team or disconnect TeamSnap (section 7). After you disconnect, SideKrew keeps the encrypted TeamSnap sign-in only until TeamSnap confirms the revoke, at most 2 days.

Family accounts follow the retention rules in section 15, Family accounts.

13. Privacy officer

SideKrew has a designated privacy officer responsible for compliance with Law 25, PIPEDA, and this policy.

You may also contact the Office of the Privacy Commissioner of Canada at priv.gc.ca or the Commission d'accès à l'information du Québec at cai.gouv.qc.ca.

14. Changes to this policy

We will update this policy as our practices evolve or legislation changes. Material changes will be communicated to active clubs at least 30 days before they take effect. Continued use of the platform after that date constitutes acceptance of the updated policy.

All previous versions of this policy are available on request from our privacy officer.