Privacy Policy
Effective October 13, 2026
Who We Are and What This Covers
OpenLeague is a free, open-source team and league management service for youth and amateur sports, operated by Mark Beacom ("OpenLeague", "we", "us"). This policy explains what personal data the hosted OpenLeague app at openl.app collects, how it is used and shared, and the choices you have.
The OpenLeague Planner at openleague.dev/planner runs in your browser without an account and has its own privacy policy, summarized in The OpenLeague Planner below. If you run your own copy of the open-source code, you are responsible for the data your copy handles, and this policy does not apply to it.
Information We Collect
We collect information you and other users enter, and a small amount of technical data:
- Account details: your name, email address and password. Passwords are stored only as a one-way hash.
- Roster information entered by team administrators: players' names, email addresses, phone numbers, jersey numbers and positions, and optionally emergency contacts, USA Hockey member IDs and dates of birth. Team officials' names, roles and email addresses. Links between players and their parents or guardians.
- Parental consent records: when a player under 13 is added, a record of the consent attestation, including the child's name and date of birth, the team, the version of the consent text and who confirmed it.
- Team and league activity: events, RSVPs, invitations (including invitees' email addresses), messages, notification preferences, schedules and scores.
- Event signups and registrations: participants' names, email addresses, phone numbers and notes, check-in status, and organizers' contact details and payment handles (such as Venmo, Zelle or Cash App) that they choose to publish.
- Payments: amounts, status and Stripe reference IDs. Card details are entered on Stripe's pages and never reach OpenLeague.
- Photos, videos and logos that users upload to events, teams, leagues and venues, with any captions.
- Rink and venue information: venue staff accounts and roles, venue addresses and contact details, ice time and lesson requests, and session registrations.
- Gear program information: donors' names and contact details when they pledge gear and agree to be contacted.
- Technical data: IP addresses and email addresses used to limit repeated sign-in, sign-up and similar requests, server logs, and, where enabled, analytics and error reports (see Cookies, Analytics and Error Monitoring).
Much of this information is about people other than the person entering it, such as players and their families. Team and league administrators who enter it are responsible for having the right to do so.
How We Use Information
We use personal data only to run OpenLeague:
- to provide team, league, scheduling, registration, rink and communication features;
- to send emails you request or need, such as invitations, verification and password resets, event notifications, RSVP reminders and messages from your team or league;
- to process registration payments through Stripe;
- to keep the service secure, prevent abuse and enforce rate limits;
- to understand how the service is used and fix errors, using the tools described below.
We do not sell personal data, do not use it for advertising, and do not share it for cross-context behavioral advertising.
Cookies, Analytics and Error Monitoring
- Sign-in uses essential cookies: a session cookie that lasts up to 7 days, a CSRF protection cookie and a callback cookie. Changing your password or email signs out your other sessions.
- Your browser’s local storage keeps preferences such as light or dark mode and practice planner display settings.
- Where enabled, Umami records page views. Where enabled, Google Analytics records usage with IP anonymization and with Google signals and ad personalization turned off. When your browser sends Do Not Track or Global Privacy Control, the Google Analytics script still loads but is told not to collect anything.
- Where enabled, Sentry receives error reports and performance samples. It is configured not to send default personal data.
- Pages reached through private links, such as invitation links, are excluded from analytics.
See the Cookie Policy for more detail.
Children's Privacy
OpenLeague accounts are for adults: coaches, administrators, parents and guardians. Rosters can include players under 13, entered by a team administrator.
When an administrator saves a player with a date of birth that makes the player under 13, OpenLeague requires the administrator to confirm that the player's parent or guardian has consented, and records that confirmation. Only administrators can see a player's date of birth, emergency contact and consent status.
A parent or guardian can ask to review or delete their child's information, or withdraw consent, by contacting the child's team administrator or emailing support@openl.app. We will respond and, where we cannot verify the request ourselves, work with the team administrator.
Data Retention
- We keep information for as long as your account, team or league uses it, until it is deleted.
- When you delete your account, your account, memberships, RSVPs, registrations, notification preferences, activity log entries and the records of your uploads are deleted. The uploaded files themselves can remain in storage at their unlisted addresses; email us to have them removed. Roster entries that administrators created for you remain on the team’s roster until an administrator removes them. Parental consent records are kept as a record of consent.
- When an administrator deletes a player, the player’s roster entry is deleted.
- Records used to limit repeated requests expire within an hour and are removed by routine cleanup some time after that. Expired sign-in tokens are removed when new ones are issued for the same account, and when the account is deleted.
- Email delivery records may keep the address an email was sent to.
- Payment records are kept for the organizer’s and Stripe’s records.
Your Rights & Choices
- Access and export: you can download a copy of your account data from your account settings.
- Correction: you can update your name and email in your account settings. Ask your team administrator to correct roster information.
- Deletion: you can delete your account in your account settings. If deletion is blocked because you own a season, venue or similar record, contact us.
- Email: you can turn notification emails off in your notification preferences, or with the unsubscribe link in league message emails.
Depending on where you live, you may have further rights, such as to object to or restrict processing. To make any request, email support@openl.app.
Data Security
- All traffic uses HTTPS.
- Passwords are hashed with bcrypt.
- Access to team and league data is checked against each user’s role on every request.
- Sign-in, sign-up, password reset and other sensitive actions are rate-limited.
- Security headers, including a Content Security Policy, protect pages in the browser.
No system is perfectly secure. Report security issues to security@openl.app.
The OpenLeague Planner
The OpenLeague Planner keeps your practices and rankings in your browser. It has no account and sends nothing to OpenLeague. If you choose to save to Google Drive or Microsoft OneDrive, files go directly between your browser and your own Drive or OneDrive. The Planner requests only access to the files it creates or you pick, and its use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Read the full Planner privacy policy.
Changes to This Policy
When this policy changes, we publish the new version on this page with a new effective date. For significant changes, we may also notify account holders by email or in the app.
Contact Us
Questions or requests about privacy: support@openl.app.
OpenLeague is open-source software. You can review how it handles data in its source code.