Privacy Policy

Lumen Innovation LLC, a New York limited liability company doing business as Team Assist ("we," "us," or "our"), operates the Team Assist website, web application, mobile applications, and APIs (collectively, the "Service"). This Privacy Policy explains what information we collect, how we use it, who we share it with, and the choices you have.

1. Who Is Responsible for Your Information

Two kinds of parties handle information in the Service:

Team Assist is responsible for your account, security, purchases you make from us, support, and the operation of the platform.
Organizations (clubs, leagues, schools, and teams) use the Service to manage their own members: rosters, registrations, participant and guardian details, schedules, communications, media, streams, and the fees they collect. For that information the Organization decides what to collect and how to use it, and we process it on the Organization's behalf. Questions about an Organization's decisions, including its registration questions, agreements, and refund policy, should go to that Organization first. We will help where the law requires it.

2. Information We Collect

2.1 Account information

When you create an account we collect your name, email address, and password (hashed with bcrypt, never stored in plain text). If you sign in with Google or Apple, we receive the name and email address that provider shares, and a profile photo from Google if you allow it. We never receive your Google or Apple password. If you enable two-factor authentication or passkeys, we store the secret or public-key material needed to verify you; we never receive the fingerprint or face data your device uses to unlock a passkey. We send a one-time code to verify your email address.

If you register a participant or act as a guardian, an Organization may also ask for your phone number and mailing address as registration contact details.

2.2 Organization, team, and registration data

Coaches, administrators, guardians, and other authorized users enter information through the Service. This may include:

Organization, Program, division, team, season, location, and staff details
Player names, jersey numbers, birthdates, gender, positions, external roster IDs, and team history
Guardian names, contact details, relationship to a player, and the capabilities each guardian has (view profile, receive communications, register, pay)
Registration answers, eligibility information, agreement and waiver acceptances (including the exact text accepted, the time, and who accepted it), enrollment offers, waitlist positions, and tryout attendance and decisions
Documents an Organization requires for registration, such as birth certificates or medical forms, as PDF or image files
Event schedules, venues, arrival times, attendance, lineups, live game statistics, and RSVP responses
Polls, announcements, event update timelines, team chat, direct messages, and attachments
Roster and participant import files and registration export files created by Organization staff

Registration forms may ask for health, allergy, accommodation, or emergency-contact information the Organization chooses to collect. Organizations should request only what they need. The Service is not a medical record system.

2.3 Guardian and minor information

Players are often minors. A player's roster and registration records are created and managed by adult guardians and Organization staff, not by the minor. We use a player's birthdate to apply protections such as guardian inclusion in direct messages (Section 3). A player may later be connected to their own account through a request that Organization staff review. We do not knowingly allow children under 13 to create accounts or provide personal information directly to us. See Section 8.

2.4 Payments

Purchases you make from us (media storage, streaming credits, family streaming subscriptions, viewer passes, and any legacy plan) are processed by Stripe on the web or by the Apple App Store and Google Play in the apps. We do not store card numbers, bank account numbers, or other payment credentials on our servers. We keep records of what was purchased, when, for how much, refunds, and the provider's transaction identifiers.

Fees you pay to an Organization (registration fees, dues, event costs, invoices) are processed by Stripe on the Organization's connected account, and the Organization is the merchant of record. We keep the invoice, installment schedule, autopay consent, payment attempt, receipt, refund, and dispute records needed to run those payments and to show you and the Organization what happened. If you pay through a guest payment link without an account, we collect the name and email address you provide so we can send your receipt. Organization staff may also record offline payments (cash or check) against an invoice.

2.5 Media, streams, and recordings

Users may upload photos, videos, and documents to team albums, chats, and registrations. Uploads are stored in private object storage (Backblaze B2, Cloudflare R2, or Amazon S3-compatible storage, depending on the file type and when it was uploaded) and are served only through short-lived signed links. We create optimized display copies of images; those copies strip embedded metadata such as camera details and location tags, and we keep your original file.

Live game streams are delivered through Cloudflare Stream. We record stream metadata, who is authorized to watch, playback sessions, delivered viewer-minutes, and recordings for replay. Replays are retained for the window that applies to the stream (for example, 48 hours after the final broadcast for a single-stream pass) and are then deleted. Media may show players, coaches, and spectators, including minors, and may include voices, uniforms, and venue locations.

2.6 Device, security, and usage information

Push tokens — Firebase Cloud Messaging registration tokens for the devices where you allow notifications, tied to your account and platform (iOS or Android).
Login and session records — the time, IP address, device or browser type, and app version each time you sign in or renew a mobile session. We use these to show you your active sessions, to send new-login alerts, and to detect unauthorized access. We do not turn IP addresses into locations.
Security events — email verification attempts, failed sign-ins, rate-limit events, and access to protected registration documents, which we audit.
Server and performance logs — standard request logs with IP addresses, request paths, response codes, and timing, plus application performance data we monitor on our own infrastructure. These are used for debugging, capacity planning, and security monitoring.
Bot protection — public registration pages may use Cloudflare Turnstile to tell people from automated scripts. Turnstile receives connection and browser signals from your device under Cloudflare's privacy policy.

We do not track your location in the background and do not use your device's GPS. Venue addresses are entered by team staff using Google Places. To show a forecast for an event, we send the venue's approximate coordinates (rounded, with no account or event details) to Open-Meteo and cache the result for 24 hours.

2.7 Cookies

The web application uses strictly necessary cookies: a session cookie for authentication, a CSRF token, and a per-account "known browser" cookie that lets us skip a new-login alert for a browser you have already used. The known-browser cookie is encrypted, lasts 30 days from your last sign-in, and is invalidated when you change your password, email, or sign-in provider. We do not use advertising or analytics tracking cookies. The mobile apps use token-based authentication and do not set cookies.

3. How We Use Your Information

We use the information we collect to:

Operate the Service: team and roster management, scheduling, RSVPs, attendance, statistics, chat, announcements, Programs and registration, media sharing, and live streaming
Process the purchases you make from us and the payments you make to Organizations, including receipts, installments, autopay, refunds, and disputes
Send the notifications you have opted into, such as event reminders, schedule changes, team messages, live-stream alerts, waitlist and enrollment updates, and invoice reminders
Protect minors, for example by automatically including a player's guardians in direct messages with a player under 18 and by limiting what invited stream viewers can see
Send security notices, such as new-login alerts and verification codes, which you cannot opt out of while you keep an account
Enforce storage and streaming limits, including warning you before excess media is deleted
Detect and prevent fraud, abuse, and unauthorized access, and enforce our Terms of Service
Respond to support requests and comply with legal obligations

We do not sell your personal information. We do not serve advertising. We do not share personal information for cross-context behavioral advertising, and we do not use your data to build advertising profiles.

4.1 Within your teams and Organizations

Information you provide (your name, profile photo, messages, RSVPs, and content you post) is visible to other members of the teams and Organizations you belong to, as determined by your role and the team's settings. Player roster information is visible to that team's coaches and staff and to the player's guardians. Registration answers, documents, and payment records are visible to the Organization staff authorized to review them and to the registering guardian or payer. Contact details for players and guardians are shown only to roles the Organization has allowed.

4.2 Stream viewers and guest payers

Invited viewers and viewer-pass holders can watch a stream and its replay within their access window. They see only the video feed and the event's basic details; they do not gain access to rosters, chat, statistics, or any other team data. Someone who pays an invoice through a guest payment link sees only that invoice.

4.3 Service providers

We share data with third-party providers solely to operate the Service:

Stripe — payment processing, subscription billing, connected accounts for Organization payments, and tax calculation
Cloudflare — live-stream ingest, recording, and delivery (Stream), private object storage (R2), content delivery, and bot protection (Turnstile)
Backblaze — private object storage for stream recordings
Amazon Web Services — S3-compatible object storage for media
Google — sign-in (OAuth), Places (venue search), Firebase Cloud Messaging (push notifications), and Google Play (in-app purchase verification)
Apple — Sign in with Apple, push notification delivery, and App Store in-app purchase verification
Open-Meteo — venue weather forecasts from approximate coordinates
Email delivery provider — transactional email such as invitations, receipts, verification codes, and alerts

These providers process data on our behalf under their own privacy policies and contractual terms and are not permitted to use it for unrelated purposes.

4.4 Organizations

When you join, register with, or pay an Organization, that Organization receives the information you provide to it and related activity, such as attendance, RSVPs, payments, and agreement acceptances. Organizations may export their registration and roster data as files for their own administration. Each Organization is responsible for its own use of that information.

4.5 Legal requirements and safety

We may disclose information if required to do so by law, court order, or governmental authority, or when we believe in good faith that disclosure is necessary to protect our rights, your safety, the safety of a minor, or the safety of others.

4.6 Business transfers

If we are involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will notify you before your information becomes subject to a different privacy policy.

5. Data Retention

Account data — retained while your account is active. When you delete your account, your profile and credentials are removed, your sessions and push tokens are revoked, and every Organization you own is deleted with its teams, rosters, media, and streams. Content you posted in team chats and shared albums that other members still have access to may be retained in anonymized form within those teams.
Player and registration records — retained while the player is part of a team or Program. Removed players are recoverable by team staff for a time and are deleted when the team or Organization is deleted. Submitted registrations, accepted agreements, and enrollment history are retained by the Organization as its records even after a withdrawal.
Registration documents — retained under the Organization's control, downloadable only through links that expire within minutes, and excluded from automatic storage cleanup.
Media — photos and videos are retained until deleted by their uploader or team staff, until the team or Organization is deleted, or until excess-storage cleanup runs. Cleanup happens only after an email warning and seven full days to reduce usage or add capacity, and then removes the oldest media first.
Stream recordings — deleted after the replay window that applies to the stream, and never while a paid pass still covers them.
Financial records — invoices, receipts, refunds, disputes, and purchase history are retained for as long as needed for accounting, tax, and dispute obligations, even if the related registration is withdrawn or the account is deleted. Stripe retains its own transaction records under its policies.
Exports and links — registration export files expire within 24 hours; guest payment links expire within 7 to 30 days as set by the Organization; team invitations expire after 30 days; unfinished uploads are discarded after 24 hours.
Login history and logs — login records are kept while your account is active so you can review your sessions; server logs are rotated and deleted within 90 days.

6. Your Rights & Choices

Access and correction — you can view and update your profile at any time in Settings. Roster and registration details are corrected by the Organization that manages them; contact your coach or administrator, or ask us for help reaching them.
Account deletion — you can delete your account from Settings. This cancels your web subscriptions and deletes any Organization you own, so transfer ownership first if others depend on it. Subscriptions bought through Apple or Google must be canceled in that store.
Notifications — you can turn off push notifications in your device settings, adjust notification preferences per team in the app, and choose whether to receive live-stream alerts. Security alerts and receipts are always sent.
Sessions and devices — you can review and sign out of active sessions and remove trusted devices from Security settings.
Data export — to request a copy of your data, contact us at the address below.
Guardian requests — a parent or legal guardian may ask us to review, correct, or delete information about their child; we verify your authority before acting and may refer requests about Organization-controlled records to the Organization.

If you are located in the European Economic Area, the United Kingdom, or a jurisdiction with similar data-protection laws, you may also have the right to request erasure, restrict or object to processing, and lodge a complaint with your supervisory authority. If you are a California resident, you have the right to know, delete, and correct your personal information and to not be discriminated against for exercising those rights; we do not sell or share personal information as those terms are defined under California law. Contact us to exercise these rights.

7. Security

We protect your data using:

HTTPS encryption for all data in transit
Private object storage with signed, time-limited URLs for media, documents, and stream playback
Hashed passwords (bcrypt), two-factor authentication, and passkey support
Email verification, new-login alerts, and rate limiting on sign-in and verification attempts
Short-lived mobile access tokens tied to trusted devices, with idle and absolute session limits
Scoped API tokens with the minimum necessary permissions
Malware scanning of uploaded registration documents and audit logs of who accessed them
Encrypted storage for sensitive credentials such as stream keys and provider tokens

No system is perfectly secure. If you discover a security vulnerability, please report it to support@theteamassist.com promptly.

8. Children's Privacy

The Service is designed for coaches, parents, and club administrators, that is, adults managing youth sports. We do not knowingly collect personal information directly from children under 13. Player records for minors are created and managed by their guardians and Organization staff, who are responsible for having the authority and consents to do so, including for photos, video, and live streams. Direct messages involving a player under 18 automatically include the player's guardians. Invited stream viewers never receive roster or contact information. If we learn that we have collected personal information from a child under 13 without parental consent, we will delete that information promptly. Parents may contact us at the address below to review or request deletion of their child's information.

9. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify you through the Service or by email before they take effect. Your continued use of the Service after the effective date of the revised policy constitutes acceptance of the changes.

10. Contact Us

If you have questions about this Privacy Policy or wish to exercise your data rights, contact us at:

Lumen Innovation LLC (doing business as Team Assist), New York
privacy@theteamassist.com