Privacy Policy

1. Information We Collect

Account & profile information

When you register or edit your profile, CT Soccer collects the information you provide directly. This information is stored server-side, using Google Firebase Authentication (to manage your login credentials) and Cloud Firestore (to store your profile and other account data). That means your account is tied to you, not a single device or browser. Once you're logged in, your profile and data are accessible across any device or browser you sign in from. The information stored this way includes:

• Registration details: first and last name and email address. Your password is managed directly by Firebase Authentication and is never stored by us in readable form.
• Age confirmation: creating an account asks for your date of birth. It's checked once, in your browser, to make sure you're at least 13, and it is never sent to us or stored. All we keep is a record that you confirmed you're 13 or older, and when. See Section 7.
• If you sign in with Google: we receive your Google account's email address, display name (which we split into a first and last name), and profile photo URL, and store them in the profile record described above. We never receive your Google password, and we don't ask Google for anything beyond that basic profile: no Gmail, Drive, Calendar or contacts access. You can revoke CT Soccer's access at any time from your Google account permissions page; doing so stops you signing in with Google but does not by itself delete your CT Soccer account.
• Profile details: username, bio, CT town/location, profile photo, and your selected role (Player, Coach, or Fan). A restricted copy of some of these fields (username, role, club, avatar; never your email) is also kept in a separate "public profile" record, which powers the People directory so other users can find and follow you without exposing your full account data.
• Player details: position, jersey number, preferred foot, and stats you enter (goals, assists, appearances), plus the club you follow or play for.
• Team manager details: managing club, club website, contact email, roster entries, and match results you submit. Match results are stored under the relevant club and are visible to other signed-in users viewing that club's page. If you request Team Manager access for a club, we store that request and our approval/denial decision so we can review and audit who has manager access to which club.
• Following relationships: the clubs you follow (stored on your profile) and the other CT Soccer users you follow or who follow you (stored separately, to power the People directory's follower/following counts and feeds).
• Match reactions: if you react to a club's match result (🔥/👏/😢), we store which emoji you picked, tied to your account and that specific match, so we can show reaction counts and remember your own reaction. There's no comment or text field. A reaction is the only user-generated content this feature collects.
• Security settings: if you enable two-factor authentication, we store an authenticator secret key and one-time backup codes in your Firestore profile record. This is real, standards-based verification (TOTP, RFC 6238): after your password, signing in genuinely requires a current code from your authenticator app or an unused backup code, checked with real cryptographic math. Honestly, one limitation worth knowing: this site has no paid backend, so that check runs client-side rather than being enforced by a server. It's real protection against the vast majority of account-takeover attempts, but not a strictly unbypassable guarantee the way a server-enforced check would be. The secret and backup codes themselves are protected by the same account-level Firestore access rules as the rest of your data, not by separate field-level encryption. That's a deliberate choice, not an oversight, since a password-derived encryption key would break irrecoverably (and silently) on password reset. We never store your password itself; that's handled entirely by Firebase Authentication.

Content you post

The Community feed is designed to let you upload photos or videos and write captions. Uploads require Firebase Cloud Storage, which isn't active yet (see Section 4), so as of this writing you can't upload photos or videos there, and no post content is currently being collected or stored. When Storage goes live, we'll describe here where and how that content is stored.

Automatically collected information

We use Vercel Web Analytics and Vercel Speed Insights (loaded on every page) to understand aggregate traffic and page performance: things like which pages are visited, how fast they load, and approximate geographic region. Vercel describes these tools as privacy-friendly and not reliant on tracking cookies to identify individual visitors; see Vercel's own documentation for the specifics of what they collect and how. We don't use this data to identify you individually. On our current Vercel plan, this aggregate analytics data has a guaranteed one-month reporting window, and individual visitor session identifiers are discarded after 24 hours. See Vercel's pricing documentation for their most current retention specifics, since this can change if our plan does.

Like most websites, we and our third-party providers may also automatically receive some technical information when you visit: browser type, device type, general region (from IP address), pages viewed, and referring pages.

Cookies & local storage

We use your browser's local storage to keep you signed in between visits and to remember a few settings: your light/dark theme, that you've dismissed the cookie notice, the clubs you've recently viewed, your choice of view on Clubs by Town, and when you last checked notifications. Pages that show match results also keep TheSportsDB's answers in your browser's session storage, and a club page with a game-day forecast keeps the National Weather Service's answer there (see Section 4); those copies are public data, not information about you, and are cleared when you close the tab. The town you type into Find a Club or the Soccer Assistant is used in your browser to work out distances; it isn't sent to us or saved. If the age question at sign-up is answered with an age under 13, we also store the time of that answer in that browser for 24 hours, so a new account can't be started from it in the meantime; it isn't tied to any name or account. None of this is sent to us automatically.

The Google AdSense ad code is on some pages (see Section 3). Google hasn't approved the site for ads yet, so no ads are shown, but the code still loads from Google's servers on those pages, and Google may set or read its own cookies when it does.

2. How We Use Information

• Create and secure your account, and authenticate you when you log in.
• Operate core features: showing your followed clubs on the Dashboard, letting you follow and be followed by other users in People, powering match reactions, and (once Community is fully live) displaying your posts.
• Communicate with you about your account (e.g., security alerts).
• Maintain the safety and integrity of the platform, including detecting abuse.
• Understand aggregate usage, via Vercel Analytics, so we can improve the site.
• Serve and measure advertising through Google AdSense once Google approves the site (see Section 3), and (once the Amazon Associates program is active) affiliate links.

We do not sell your personal information.

3. Advertising & Affiliate Links

Google AdSense (awaiting approval)

Once Google approves the site, CT Soccer will display ads served by Google AdSense on some pages. Google and its advertising partners use cookies and similar technologies to serve ads based on your prior visits to this and other websites.

For more detail on how Google uses information from sites that use its services, see How Google uses information from sites or apps that use our services.

Amazon Associates (pending)

CT Soccer also plans to participate in the Amazon Associates affiliate program. Once active, some links on the site (for example, recommended gear) may be affiliate links. If you click one and go on to make a qualifying purchase, we may earn a small commission at no extra cost to you. We'll clearly label affiliate links as such once this is live, consistent with FTC endorsement-disclosure guidelines.

4. Third-Party Services

We rely on the following third parties to operate CT Soccer. Each processes data under its own privacy policy:

• Google Firebase: CT Soccer actively uses Firebase Authentication (including Google Sign-In, where Google acts as the identity provider and passes us the profile fields listed in Section 1) and Cloud Firestore to store and manage the account, profile, and match data described in Section 1. Firebase Cloud Storage (which would be used for Community photo/video uploads) is not yet active; no photo or video content is presently stored there. See Firebase's privacy policy for reference.
• Vercel: hosts the site and provides Vercel Web Analytics and Speed Insights, described in Section 1. See Vercel's privacy policy.
• Google AdSense: ad code on some pages since August 22, 2026, awaiting Google's approval, so no ads are served yet (see Section 3). The code still loads from Google and may set Google's own cookies. See Google's privacy policy.
• Amazon Associates: pending activation; see Section 3 for how it will work once live. See Amazon's privacy notice.
• FormSubmit: the contact form on the home page and the correction/suggestion form on Suggest a Club are delivered by FormSubmit, a third-party form-relay service. What you type into those forms (your name, email address, and message) passes through FormSubmit's servers on the way to our inbox. Worth knowing: this is also the channel Sections 8 and 10 point you to for data-rights requests, so a request sent that way reaches us through FormSubmit as well. If you would rather not use a relay for a data-rights request, you can email us directly at privacy@ctsoccerhub.com. Before passing a message on, FormSubmit shows a Google reCAPTCHA check on its own page, which sends information about your browser and how you use that page to Google, under Google's Privacy Policy and Terms of Service.
• Google reCAPTCHA, through Firebase App Check: being set up, not on yet. Once it is, the pages with sign-in and member features (sign-in, registration, your account, People, Community, club pages and the dashboard) will use reCAPTCHA Enterprise to check that requests to our database come from a real browser and not an automated script. It runs in the background, with no puzzle to solve. reCAPTCHA collects information about your device and how you use the page and sends it to Google, under Google's Privacy Policy and Terms of Service. CT Soccer never sees that information; Firebase only tells our database whether a request passed.
• Google Fonts: the site's fonts load from Google's servers; like any web request, these requests can expose your IP address to Google.
• TheSportsDB: a public sports-data service. When you open a club's page, the Dashboard or News, your browser asks it for recent home results and fixtures for Hartford Athletic, CT United FC, AC Connecticut and CT Rush. Like any website, it receives your IP address and browser details with that request; no account information is sent. The answers are kept in your browser's session storage, reused for up to five minutes, and cleared when you close the tab.
• National Weather Service: when a club's own page shows a game-day forecast (Hartford Athletic's, as of October 2026), your browser asks the U.S. National Weather Service's forecast service (api.weather.gov) for the forecast at the club's stadium. The only location in that request is the stadium's, never yours. Like any website, the Weather Service receives your IP address and browser details with it. The answer is kept in your browser's session storage for up to 30 minutes and cleared when you close the tab. See the Weather Service's privacy policy.
• OpenStreetMap: the map on Clubs by Town loads its map images from the OpenStreetMap Foundation's tile servers (tile.openstreetmap.org) once the map is on your screen. Like any website, they receive your IP address, your browser details and our site's name (ctsoccerhub.com) with those requests. See the OpenStreetMap Foundation's privacy policy.

5. How We Share Information

We don't sell your personal information. We may share it only:

• With the service providers listed in Section 4, to the extent necessary for them to provide their service to us.
• Publicly, when you choose to make it public: for example, a Community post, or your public profile fields (username, photo, bio).
• If required to comply with a legal obligation, protect the rights and safety of CT Soccer or its users, or investigate abuse.
• In connection with a merger, acquisition, or sale of assets, in which case this policy would continue to apply to your information.

6. Data Retention & Security

Your account and profile information (see Section 1) is stored server-side using Firebase and persists for as long as your account is active, or until you delete it. This includes your two-factor authentication secret and backup codes, if you've enabled that feature. Deleting your account (in Account Settings) removes your profile, your public profile, any posts you made, the follows you created and any match reactions you left, and then deletes your login itself. This may take up to 30 days to fully propagate, though in practice it happens immediately.

A few records stay after you delete your account, because they aren't only yours: match results you submitted as an approved Team Manager (see below), any Team Manager access request you made, and other people's follow records that point to your account, which contain only an internal account ID. Ask us (Section 10) if you'd like any of those removed, and we will.

We rely on Firebase's server-side security infrastructure, including access-control rules that restrict who can read or write your data, to protect your account and profile information. No method of storage is 100% secure, and we can't guarantee absolute security.

Firebase and Vercel, both active today, may process and store data on servers located outside your country of residence, including in the United States. By using the Service, you consent to this kind of international transfer where applicable.

Team Manager data

If a Team Manager's access to a club is approved, their submitted match results are stored in a record tied to that club (tagged with their name and account for attribution) and remain on the club's page even if that person's Team Manager status later changes. Roster entries a manager adds are stored on their own account rather than in a separate club-wide record, so they're removed only if that manager deletes their account. Honestly: as of this policy's date, we don't yet have an in-app way to revoke an already-approved manager's access, or to review or remove their previously-submitted data as a distinct action. If we build that capability, we'll update this section to describe what happens to existing data when it's used.

If the Service is discontinued

If we ever stop maintaining or operating CT Soccer Hub, we intend to post advance notice on the site and give you a reasonable opportunity to export or request deletion of your data before shutdown, where practical. We can't guarantee this in every circumstance (for example, a sudden, unplanned shutdown), but it's our stated intent and commitment.

7. Children's Privacy

Our audience

CT Soccer covers everything from professional and semi-pro Connecticut clubs to youth academies for players as young as 5, so our audience spans adults and minors alike. Our Terms of Service require account holders to be at least 13, and roster information for younger players (name, position, jersey number, stats) is meant to be entered by an authorized Team Manager or coach on that player's behalf, not by the child directly.

How we keep accounts to 13 and older

Creating an account, by email or with Google, asks for your date of birth. If the answer is under 13, no account is created, and that browser can't start a new account for the next 24 hours. The date itself is never sent to us or stored: it's checked in your browser, and all we keep for an account is a record that its holder confirmed being 13 or older, and when.

Accounts created before this question existed are asked it once, the next time they sign in or open Account Settings. If the answer is under 13, the account and the information in it are deleted. If that session is too old for our login provider to allow deleting the login itself, everything else is deleted right away and the login is deleted automatically at the next sign-in.

What this doesn't do, stated plainly: it relies on what people tell us. Nothing on this site can verify anyone's age, and someone determined to lie about it can. We also don't collect verifiable parental consent, which is why we don't offer accounts to children under 13 at all, rather than offering them with a parent's permission.

What we'd do if we learn an account belongs to a child under 13

If we become aware (through a report, a support request, or otherwise) that we've collected personal information directly from a child under 13 without a parent or guardian's verifiable consent, we will:

• Not use that information for anything beyond what's necessary to respond to the parent or guardian and address the account.
• Delete the information and/or the account promptly, or work with the parent or guardian to obtain proper consent to keep it, whichever they prefer.
• Not disclose that information to any third party in the meantime.

What COPPA would require of us if it applies

COPPA and its implementing rule (16 CFR Part 312) place specific obligations on operators that are "directed to children under 13" or that have "actual knowledge" they're collecting personal information from a child under 13. In plain terms, if COPPA applies to a given account or feature, we would be required to:

• Give parents direct notice of what we collect, how we use it, and whether we disclose it, before collecting it.
• Obtain verifiable parental consent (through a method like a signed form, a payment-card transaction, a toll-free call, or an ID-verification method) before collecting, using, or disclosing the child's personal information.
• Let a parent review the information we've collected about their child, have it deleted, and refuse further collection.
• Collect no more information than is reasonably necessary for the activity.
• Maintain a stated data-retention and deletion policy for children's information, and not keep it longer than necessary.
• Get separate parental consent before disclosing a child's information to a third party, if we ever needed to.

We haven't built this infrastructure: there's no parental-consent flow, no child-specific data-retention schedule, and no verified-parent review process. That's why accounts are limited to people 13 and older. This section describes what the law would require, not a system we're claiming exists.

If you're a parent or guardian

If you believe your child has created their own account, or that their information appears on the platform in a way you're not comfortable with (whether entered by a Team Manager or by the child themselves), contact us using the details in Section 10. We'll act on it promptly, including reviewing, correcting, or removing the account or information.

8. Your Choices & Rights

• Access & update: review and edit your profile information anytime from Account Settings.
• Delete your account: use the "Delete Account" option in Account Settings to permanently remove your account. Section 6 lists exactly what that removes, and the few records it doesn't. If you signed in a while ago, you'll be asked to sign out and back in first; that's a security rule of our login provider.
• Turn off two-factor authentication: disabling 2FA in Account Settings removes your stored authenticator secret and backup codes.
• Unfollow clubs or people: manage who and what you follow anytime from the Dashboard or People.
• Delete individual posts: once Community is live (see Section 1), you'll be able to remove your own posts at any time.
• Ad personalization: opt out of personalized ads via the links in Section 3.
• Cookies: control or clear cookies and local storage through your browser settings.

If you're in a jurisdiction that grants additional data rights (such as the EU/UK GDPR or the California CPRA), contact us and we'll do our best to accommodate applicable requests. We aim to respond to data-rights requests (including access, deletion, and correction) within 30 days.

9. Changes to This Policy

We may update this Privacy Policy from time to time as the site changes. We'll update the "Last updated" date above when we do. Material changes will be reflected here. We encourage you to review this page periodically.

10. Contact Us

Questions about this policy or your data? Email us at privacy@ctsoccerhub.com, or use our contact form. That form is delivered by FormSubmit, a third-party relay (see Section 4), so anything you send through it passes through their servers on the way to us.