My Pickle Roster ("we", "us") is a scheduling tool for organizing pickup pickleball events. This policy explains what information we collect, why, and how it's handled. It applies to mypickleroster.com and any pages linked from it.

If you create an organizer account: your name, email address, and password (stored and hashed via Better Auth, running on our own Cloudflare infrastructure — we never see or store your raw password), and optionally a phone/mobile number if you choose to add one to an event so players can contact you.

If you join an event as a player (no account required): your name, the playing level you select, and optionally a DUPR rating, phone number, and email address, if you choose to provide them.

Automatically, for security and abuse prevention: your IP address (used for rate limiting sign-in attempts, event creation, and similar actions — see "How We Use Information" below), and results from Cloudflare Turnstile, a CAPTCHA alternative used to block automated abuse.

Automatically, for basic site analytics: aggregate, anonymous visit data via Cloudflare Web Analytics, which does not use cookies or track individuals across sites. We separately log a small number of product events (such as "an event was created") tied to an event or account ID, used only to understand overall usage — not to profile individual behavior.

To operate the service: creating and displaying events, managing rosters, and sending transactional email (password resets, sign-in links, email verification) from noreply@mypickleroster.com.

To protect the service: detecting and rate-limiting abusive sign-up, sign-in, or event-join attempts.

To understand aggregate usage of the app (how many events are created, how many players join) — not to build individual profiles or for advertising.

We do not sell your information, and we do not use it for advertising or share it with third parties for their own marketing purposes.

We use a small number of infrastructure providers to run the service, each of which processes data on our behalf under their own privacy and security terms:

Cloudflare — hosting, our database (D1), the Turnstile CAPTCHA, transactional email delivery, and site analytics. Account credentials and all event and player data are stored in our Cloudflare D1 database.

We don't share your information with anyone else, except where required by law.

We use a session cookie to keep organizers signed in, and Cloudflare Turnstile may set a short-lived cookie as part of verifying you're not a bot. We don't use advertising or cross-site tracking cookies, and our site analytics is cookie-less.

Browser and device push notifications are entirely optional, for both organizers and players who join an event without an account, and only ever turned on if you explicitly choose to enable them — we never request notification permission automatically or before you've joined an event.

If you enable notifications, your browser gives us a push subscription (a delivery endpoint and a couple of encryption keys) that we store so we can deliver the specific notifications you asked for — such as being told a spot opened up on a waitlist. This isn't used for advertising or any other purpose, and each device you enable it on can be turned off independently at any time from the app.

Subscriptions that a browser or push service reports as no longer valid (for example, after uninstalling the app or clearing site data) are automatically removed.

Creating a player account is entirely optional and never required to join or play in any event. If you choose to create one (email and password, the same system organizers use), we send a verification email to confirm you actually own that email address.

Once verified, we automatically link that email to every past and future roster entry across every organizer's events that used the same email address, so your match history and stats follow you. We only ever link by a verified email match — never by phone number, and never by an email we haven't confirmed you own.

You can optionally save a phone number, playing level, and DUPR rating to your account to speed up filling out future join forms. These saved preferences are never used to link any roster entry to your account — they only pre-fill what you'd otherwise type again yourself.

Event and player information is kept until an organizer deletes the event (which also removes its players and match data) or their account. Aggregate usage-event records (e.g. "an event was created") may be retained after an event is deleted, since they're used only for overall usage counts, not to identify individuals.

Organizers can edit or delete their own events at any time from their dashboard. To request access to, correction of, or deletion of your personal information — including as a player who joined an event without creating an account — contact us using the details below.

My Pickle Roster is not directed at children under 13, and we don't knowingly collect personal information from children under 13. If you believe a child has provided us with personal information, contact us and we'll remove it.

We may update this policy as the service changes. We'll update the "Last updated" date above when we do.

Questions or requests about this policy can be sent to privacy@mypickleroster.com.