Privacy Policy
Last updated August 16, 2026
VarsityFlow is team management software for middle school and high school sports. Schools, clubs and teams use it to keep rosters, publish schedules, organise meals and orders, and communicate with the families of their athletes. This policy explains what we collect, how it is used, and who it is shared with.
Who controls this information
Each school, club or program that uses VarsityFlow controls its own data and decides who at that program may see it. We store and process it on their behalf. If you are a parent or an athlete and want your information corrected or removed, contact the coach, athletic director or team manager who runs your program first - they can act on it directly. You can also contact us at privacy@varsityflow.com.
What personal information we collect
Accounts
Name, email address, a password (stored only as a one-way hash, never in readable form), the role you hold in your program, and the date you last signed in.
Athletes
First, last and preferred name; graduation year; date of birth; a school-assigned student or player identifier; jersey number and position; and whether the athlete has been cleared to play by their program. Athletes are usually minors, and this information is entered by the school or program, not collected from the child.
Parents and guardians
Name, email address, phone number, and which athletes you are linked to.
Text messages
If you choose to receive text messages, we store the mobile number you provide, the fact that you consented, and the date and time you did so. Consent is off by default and is never assumed from having your number.
Content you or your program create
Announcements, messages, sign-up responses, meal and order selections, and photographs uploaded by program staff. Photographs may be tagged with the names of athletes appearing in them. Location and camera metadata (EXIF) is discarded when a photo is uploaded and is never stored.
Payment records
Amounts owed for team meals and merchandise, whether a family has said they paid, and whether program staff confirmed the money arrived. We do not process payments and never collect card or bank details. Families pay their program directly by whatever method that program chooses.
Technical information
IP addresses of failed sign-in and invitation-code attempts, kept to limit brute-force guessing; a session cookie that keeps you signed in; and a log of administrative actions taken inside your program, such as who changed a role or removed an account.
How we use personal information
- To run the service: show rosters and schedules, take sign-ups, and let programs message their families.
- To send you notifications you have asked for - schedule changes, announcements, sign-up reminders, and reminders for a job you agreed to work.
- To verify who you are and keep accounts secure, including rate-limiting sign-in attempts.
- To let a program keep an accurate record of who owes what for meals and merchandise.
- To answer support requests and diagnose faults.
We do not sell personal information. We do not use it for advertising, and we do not build advertising or marketing profiles from it.
Who personal information is shared with
Inside your program, information is shared according to role. Parents see their own children and a restricted team roster showing only jersey numbers, last names and first initials. They do not see other families' contact details. Coaches and athletic directors see the athletes on the teams they are assigned to.
We share information outside your program only with these service providers:
- Twilio - delivers text messages. Receives the mobile number and the message content, only for numbers that have opted in.
- Anthropic - reads rosters from an uploaded spreadsheet, PDF or photo so they do not have to be typed in. The uploaded file is sent for processing. This is off unless your program turns it on, and the program records who enabled it and when.
- Our email provider - delivers invitations and account email. Receives the recipient address and message content.
- Push notification services operated by Apple, Google and Mozilla - deliver notifications to a device you have registered. They receive a device token, not your name.
- Our hosting provider - stores the data on servers we control.
We also look up public school records from the U.S. Department of Education directory when a program identifies its school. No personal information is sent in those lookups.
We may disclose information if required by law, or to protect the safety of a child or another person.
Text message consent
SMS consent is not shared with third parties or affiliates. Your mobile number and your agreement to be texted are used only to send you messages from your own program through VarsityFlow. We do not sell, rent or share that consent, and we do not pass your number to anyone for their own marketing.
Twilio delivers our messages on our behalf and may only use the number for that delivery. See our SMS Terms of Service for message frequency, rates and how to stop messages.
Children
VarsityFlow is used by schools and youth sports programs, so most athletes in it are under 18. Their information is entered by the program, not collected directly from them, and it is visible only to that program's staff and to their own parent or guardian. Accounts for athletes are created only where the program chooses to. Parents and guardians may ask their program, or us, to see or delete their child's information.
How long we keep information
We keep information for as long as your program uses VarsityFlow. When a program removes an athlete, a roster entry or an account, that record is removed or archived from view. Programs may ask us to delete their data entirely, and we will do so.
Security
Traffic is encrypted in transit. Passwords are stored as one-way hashes. Invitation codes for parents are stored hashed, expire, and work only once. Access is restricted by role, and every program's data is separated from every other program's. No system is perfectly secure, and we do not claim otherwise.
Your choices
- Turn text messages on or off yourself, at any time, in Settings.
- Reply STOP to any text message to stop them.
- Turn off browser and phone notifications in your device settings.
- Ask your program - or us - to correct or delete your information.
Changes
If we change this policy we will update the date at the top. Material changes will be announced inside the app.