Start a RecHero trial | Your league, set up our way

Last updated: 19 October 2026

This policy explains how we collect, use, and share personal information when you use the RecHero websites (rechero.app and its subdomains), apps, and services (together, “RecHero” or the “Service”). “We” and “us” mean the legal entity that operates RecHero.

1. Two roles: our data vs. your league’s data

RecHero handles personal information in two distinct capacities:

RecHero as the responsible organization (“controller”). For our marketing website, account registration, demo requests, league referrals, support, and the operation of the platform itself, we decide how and why personal information is used, and this policy applies fully.
RecHero as a service provider (“processor”) for organizations. League data — rosters, player names and contact details, scores, photos, posts — is entered and controlled by the organization that runs your league. We process it on the organization’s behalf to provide the Service and per our contract with them. If you are a player with questions about how your league uses your information, or you want your information corrected or removed from a league, contact your league organizer first — we support them in honouring those requests, and you can always reach us too (Section 14).

2. Information we collect

You provide it:

Account information — name, email address, password (stored hashed), optional phone and profile details.
League participation data — teams, rosters, schedules, scores, standings, ratings, and attendance (which games a player was present for, and who recorded it); community posts and comments; photos, documents, and team icons you or your organizer upload.
Demo requests — name, email, phone, organization or league name, league website, sport, team count, and how you run things today.
Trial requests — the details you enter in the trial form: your league’s name, sport, size and location, how you run your season, and your name, role, email and phone. The form saves your progress as you complete each step and when you leave the page, so we receive what you have entered even if you do not press submit. We use it to set up your trial and to follow up; partial requests are deleted on the same schedule as demo requests.
League referrals — your name (and optional email), the league’s name, and the organizer’s name and contact details that you provide about them (see Section 5).
Billing information — for organizations on a paid plan: the billing contact’s name, email, and phone, the organization’s name and address, and records of invoices and payments. If you pay by card, the card details go directly to our payment processor; we do not receive or store full card numbers.
Payments collected by your league — if we offer a way for organizations to collect payments from players and your league uses it, we receive records of those payments (for example, payer name, amount, date, and status) so your league can see them. The payment processor collects your card details directly under its own privacy policy; we do not receive or store full card numbers.
Support and correspondence — whatever you send us.

Collected automatically:

Log and device data — IP address, browser type, pages requested, timestamps; used for security, debugging, and abuse prevention.
Marketing-site analytics — when you visit our marketing site we record the page you viewed, the site that referred you, any campaign parameters in the link you followed, and your IP address and browser user-agent. See Section 6 for what we do with these, how long we keep them, and what we don’t do. We set no cookies on the marketing site and use no third-party analytics, advertising trackers, or session replay.
Product usage events — actions within the app (e.g., a schedule generated, a score finalized) tied to your account, used to operate, secure, and improve the Service.

From others: organizers may enter your information to add you to a roster or invite you; teammates may add you to a team; a player may refer their league organizer (Section 5).

3. How we use personal information

Provide, operate, and secure the Service (including authentication, scheduling, standings, ratings, league websites, and community features).
Respond to demo and trial requests and referrals, and communicate about the Service (see Section 7 for marketing-email rules).
Understand how our marketing site is found and used — which pages and campaigns bring people to RecHero, roughly where visitors are located, whether a visit is a repeat, and which traffic is automated. This is the purpose for which we process the IP address and user-agent described in Sections 2 and 6.
Improve the Service and develop our products — debugging, aggregate analytics, feature usage. Where feasible we use de-identified or aggregated data for this. De-identified, aggregated data derived from league data is used only as our Terms of Service permit (Section 7.5), and never in a form that identifies a person or organization.
Enforce our Terms, prevent abuse and fraud, and comply with law.

We do not sell personal information, and we do not “share” it for cross-context behavioural advertising (as those terms are defined under the CPRA). We do not use personal information for automated decisions with legal or similarly significant effects. Ratings, standings, and schedules that the Service generates are not decisions of this kind.

4. Public content

League websites and community pages that an organizer publishes are public: standings, schedules, team names, rosters as configured by the organizer, posts, and photos on those pages can be viewed by anyone and indexed by search engines. Ask your organizer about your league’s visibility settings.

5. League referrals (information about someone else)

If you refer your league, you give us your organizer’s name and contact details. We use that information only to contact them about RecHero on your behalf — a single introduction that identifies you as the referrer — and to keep a record of the referral. We do not add referred organizers to marketing lists without their consent, and they can ask us to delete their details at any time. Only refer someone you know in the context of the league — that’s also what Canada’s anti-spam law (CASL) requires of referral messages.

6. Cookies and analytics

Essential cookies only. The app uses signed session cookies to keep you logged in and protect against request forgery. No advertising or third-party analytics cookies. Our marketing site sets no cookies at all and stores nothing on your device.
First-party marketing analytics. Our marketing site uses a measurement system we built and run on our own servers — there is no third-party analytics provider, no advertising pixel, and no session replay or heatmap tool. When you view a page, your browser sends us the page path, the site that referred you, and any campaign parameters in the link you followed. Our servers also record your IP address and browser user-agent string, which every web server receives with every request.

What we use them for. To see which pages and campaigns bring people to RecHero, to approximate a visitor’s general location (country/region), to tell repeat visits from new ones, and to filter out bots and automated traffic.

How long we keep them. Records containing your IP address and user-agent are deleted after 90 days. After that we keep only aggregate statistics — counts by page, referrer, campaign, and device type — that do not identify you.

What we don’t do with them. We do not track you across other websites, build advertising or behavioural profiles, sell or share this information, or attempt to identify you personally from it. If you fill in a form, we know who you are — but only because you chose to tell us.

No cookie banner. Because our marketing site stores nothing on your device and sets no cookies, there is nothing to consent to beyond what this policy describes.

Your control (opt out of analytics). If your browser or a browser extension sends a Global Privacy Control (GPC) signal, or a Do Not Track (DNT: 1) header, our analytics endpoint detects it and records nothing for that visit — no IP address, no user-agent, no page event. This works at our server on every request, with no account and nothing stored on your device. It is both the “means to deactivate” contemplated by Quebec’s Law 25 and the opt-out signal recognized under applicable US state privacy laws.

7. Email

Transactional email (invites, password resets, score notifications, responses to your requests) is part of the Service.
Marketing email is sent only with consent required by law (express or implied under CASL in Canada; opt-out honoured under CAN-SPAM in the US). Every marketing email identifies us and includes a working unsubscribe that we honour promptly (within 10 business days at most, per CASL).
We keep records of consent (what, when, how) as CASL requires.

Your league. Organizers and (as configured) league members see league data — that’s the product.
Service providers working for us under contract, only as needed: application hosting, content delivery and network security, and transactional email delivery. A current list of these providers is available on request.
Payment processors. If you pay us by card, or your league collects payments through RecHero, a third-party payment processor handles the payment and receives your payment details directly, under its own privacy policy. When your league collects payments, the processor also shares your details with your league as the seller.
Legal and safety — when required by law or to protect users, the public, or RecHero (we narrow requests where we can and notify affected users where permitted).
Business transfers — if RecHero is involved in a merger, acquisition, or asset sale, personal information may transfer as part of it, subject to this policy.

9. Where data is stored; cross-border transfers

Our infrastructure is hosted in the United States. If you are in Canada, your personal information is transferred to and processed in that region, where it is subject to local law and lawful access by local authorities. For Quebec residents (Law 25): personal information is communicated outside Quebec for hosting and the service providers above; we assess these transfers to ensure adequate protection, and contractually require it.

10. Retention

Account and league data: kept while the account/organization is active. After deletion or closure, personal information is deleted or de-identified within 90 days, except backup copies (rotated out within 35 days) and records we must keep by law (e.g., tax, consent records).
Demo requests, trial requests and referrals: kept up to 24 months after last contact, then deleted.
Marketing analytics records containing IP address and user-agent: 90 days (Section 6), then deleted; aggregate statistics that do not identify you are kept indefinitely. Security logs: 12 months.

11. Security

We use industry-standard measures: encryption in transit (TLS), hashed passwords, tenant scoping in the application (each organization’s data is isolated by design), least-privilege access, and audit logging. No system is perfectly secure; we maintain an incident-response process and a privacy-incident register (as Law 25 requires), and we will notify you and regulators of breaches as applicable law requires (PIPEDA’s “real risk of significant harm” standard, Law 25, and US state breach-notification laws).

12. Your rights and choices

Everyone: access, correct, or delete your information; withdraw consent; close your account; unsubscribe from marketing. Contact us (Section 14) — we verify requests and respond within the time required by applicable law (30 days under PIPEDA/Law 25; 45 days under CPRA, extendable once).

Marketing-site analytics. These records are keyed to an IP address, not to an account. To avoid collection entirely, send a Global Privacy Control or Do Not Track signal (Section 6) and we record nothing. To remove records already collected, tell us the approximate date and IP address and we will locate and delete them; in practice they age out on their own within 90 days (Section 6).

Canada (PIPEDA / provincial laws): you may request access to and correction of your personal information and information about how it has been used and disclosed, and you may withdraw consent subject to legal or contractual restrictions. You may complain to the Office of the Privacy Commissioner of Canada or your provincial regulator (in Quebec, the CAI).

Quebec (Law 25) additionally: the right to data portability in a structured, commonly used technological format; the right to be informed of and object to fully automated decisions (we don’t make them — Section 3); privacy matters are handled by RecHero’s privacy contact, reachable at [email protected].

US state privacy laws (California CPRA and similar): the rights to know/access, correct, delete, and to portability; the right to opt out of sale/sharing and targeted advertising (we do not sell or share personal information, and we do not serve targeted ads); the right to limit use of sensitive personal information (we don’t use it beyond providing the Service); and the right not to be discriminated against for exercising rights. You may use an authorized agent; we verify agent requests. California residents: no “Notice of Financial Incentive” applies because we offer none.

League data: where your request concerns data controlled by your league’s organization (Section 1), we will refer the request to them and assist — this is the PIPEDA accountability and CPRA service-provider model working as intended.

13. Children

The Service is not directed to children under 13, and we do not knowingly collect their personal information directly. Accounts require users to be 16 or older. Organizers who run youth leagues are responsible for parental consent before entering minors’ information (see Terms of Service, Section 3). If you believe a child’s information was provided to us improperly, contact us and we will delete it.

14. Contact us

Privacy questions, requests, and complaints:

RecHero [email protected]

We respond to privacy requests at this address. If you need a postal address for a regulatory filing, ask and we will provide one.

15. Changes to this policy

We’ll post updates here and change the “last updated” date; for material changes we’ll notify you (email or in-product) before they take effect. Prior versions are available on request.

Try RecHero with your own league

Start your trial