Privacy Policy

1. Who we are

Headcount (headcount.today and the Headcount apps) is run by Route 128 Works (“we”, “us”), based in Massachusetts, USA. Headcount helps sports clubs, coaches and families run their teams: schedules, rosters, who’s coming, messages and reminders.

This policy explains what we collect, how we use it, who can see it, and the choices you have. Questions? Email route128works@gmail.com.

2. Who this policy covers

It covers everyone whose information is in Headcount: club administrators, coaches and team staff, parents and guardians, players, and people a club adds to a roster before they have an account.

Clubs decide what to put into Headcount and who in the club can see it. We host and process that information so the club and its teams can use the service, and we use it only as this policy describes.

3. Information we collect

Information you give us

• Your account: your name and email address, your password (we never store the password itself, only a one-way scrambled version of it), and your phone number and profile photo if they’re added. You can add these yourself; your club’s administrators can also update a member’s name and phone number, coaches can add a phone number, and administrators can add a coach’s photo.
• Your settings: notification choices, whether other families can see your contact details, and your appearance choice. If you turn on text alerts, we record the phone number you agreed to receive them on and when you agreed.
• What you do in Headcount: availability answers (going, maybe, can’t go) and any note you add, messages you send (including replies, reactions and edits), announcements, files you upload such as forms and flyers, and to-dos.
• Support requests you send us, including account deletion requests.

Information your club, coach or another parent gives us

• Club and team details: the club’s name and logo, teams, seasons, and the schedule of games and practices, including venue names and addresses.
• Rosters: players’ names, jersey numbers and positions, which parents or guardians belong to which player, and staff titles. A parent or guardian may add a photo of their own child.
• People added before they have an account: a club may add you by name, email or phone number, and may send you an invitation by email.
• Club to-dos and, when payment features are available, fee records for each player.

Information collected automatically

• Sign-in records: the email address typed, when, whether it worked, and if not, why (for example a wrong password). We don’t store your IP address in these records. We record when you sign in, and failed sign-in attempts, to keep your account secure.
• Security counters: to stop password guessing, we count sign-in and reset attempts using a scrambled (hashed) form of the email address or IP address involved.
• Our own usage counts: which pages are visited (with ids and codes, such as a conversation’s or an invitation’s, removed from the address), the general kind of device (phone, tablet or computer), and the general source of a visit (such as “Google” or “Direct”). To count visitors we use a short code made by scrambling the day, your IP address and your browser details together. The code changes every day, and we don’t store your IP address or browser details with it. We don’t use any outside analytics service.
• Notifications: the notifications you’ve received in Headcount (your notification list). If you turn on phone or browser notifications, we also store the delivery address your phone or browser gives us and a simple device label such as “iPhone”. For the Android app, we also keep an installation identifier linked to your account so signing out or turning notifications off stops updates on that phone.
• Error records: the address of the page that had a problem and the error message, so we can fix it.
• Like any website, our hosting provider records technical details of requests, such as IP addresses, while running the service.

What we don’t collect

We don’t collect your device’s location, your phone’s contacts, or card numbers.

4. How we use information

• To run Headcount: show schedules, rosters and who’s coming, deliver messages, and keep each club’s information in the right place.
• To send the emails and notifications you and your club set up, such as event changes and reminders.
• To sign you in and keep accounts and the service secure.
• To answer support requests.
• To keep the service working, find and fix problems, and understand overall use through our own counts.
• To follow the law and enforce our Terms of Service.

We don’t show ads, we don’t sell personal information, and we don’t share it for targeted advertising.

5. Who can see your information

People on your team

Members of a team (its coaches and families) can see the team’s roster (players’ names, numbers, positions and photos, and their parents’ names), the schedule, everyone’s availability answers and notes, whole-team messages, announcements and team files.

Contact details

On a team’s roster, the club chooses who sees phone numbers and email addresses: the whole team, coaches and admins only, or admins only. In Settings you can also choose to show your phone number to other families, or to hide your contact details from them.

Club administrators

People your club gives administrator access to can see and manage the club’s information, including family members’ names, email addresses, phone numbers and when they last signed in, whatever the roster settings above say. A club can narrow what each administrator can see and do.

Private conversations

In Headcount, a conversation between particular people can only be read by the people in it. A deleted message shows as “This message was deleted” to everyone in the conversation.

Your calendar link

If you add your schedule to a calendar app, Headcount gives you a private link. It includes your teams’ schedule details (times, opponents, places and notes) but no player names or contact details. Anyone who has the link can see those details, so keep it to yourself.

Our team

Our staff can access information when needed to run, support and secure Headcount, such as account details, club memberships, sign-in records and support requests.

Service providers

We use these companies to run Headcount. They receive only what they need to provide their service, under their own terms:

• Vercel hosts the app, and Neon hosts our database.
• Brevo delivers our emails (it receives the recipient’s address and the message).
• Bird delivers text alerts to people who turn them on (it receives the phone number and the alert).
• Browser and phone makers’ push services (such as Google, Apple, Mozilla and Microsoft) deliver notifications. The notification content is encrypted on the way. The Android app uses Google’s Firebase Cloud Messaging and a Firebase installation identifier to deliver these updates. We don’t include Firebase Analytics.
• An address-search provider (Google Maps Platform or the OpenStreetMap-based Photon service) receives the address text a club administrator or coach types when adding a place. It doesn’t receive anyone’s name or account details. Our servers also fetch map images for venues, so your browser doesn’t contact the map provider.
• Google Drive stores our encrypted backups, which are made by an automated job on GitHub.
• Stripe will process payments when payment features are available (for example the payer’s email address, the club’s name, the fee’s name and the player’s first name). Card details go straight to Stripe, never to us.

When you tap “Open map”, you pick Apple Maps, Google Maps or Waze, and you leave Headcount for that maps app or site; its own privacy policy applies.

When the law requires it, or to keep people safe

We may share information if the law requires it, to protect the rights, property or safety of our users, the public or us, or as part of a merger, sale or reorganization of our business. In that last case, this policy would continue to apply to your information.

6. Children

Headcount is for adults who run and follow youth teams, and for teens aged 13 and older. Nobody under 13 may create an account, and Headcount doesn’t create sign-ins for players.

Information about children (names, jersey numbers, positions, photos, availability answers and fee records) is added by their club, their coaches or their parent or guardian. Please add only what your team needs, and don’t post sensitive details such as medical information in messages, notes or files.

Parents and guardians can ask their club’s administrator, or email us at route128works@gmail.com, to review, correct or delete their child’s information. We’ll work with the club to do it. If we learn that a child under 13 has created an account, we’ll close it.

7. Cookies and similar technology

Headcount uses only the cookies it needs to work:

• a sign-in cookie that keeps you signed in for up to 7 days;
• a cookie that remembers which view you’re using (for example parent or coach);
• an Android app installation cookie that lets us stop that phone’s notifications when you sign out;
• a cookie that remembers your appearance choice (Dark, Clean white, Mint wash or Match my phone).

Your browser may also keep small notes for us, such as a site message you dismissed or a payment you started. A small background script lets your browser receive notifications. We don’t use advertising cookies or outside analytics.

Our Cookie Policy lists each one, how long it lasts, and how to clear them.

8. Emails and notifications

We send emails to set up and protect your account (confirming your email address, invitations, password links, and a notice when your password changes), and emails your club or coach sets up, such as event changes, reminders to answer whether you’re coming, and club to-do reminders. Club administrators can also choose a weekly summary.

In Settings you can choose which notifications reach your phone, and whether you get emails about event changes. Account and security emails, and reminders your club sends, still arrive. We don’t send marketing emails.

Text alerts

Text messages are optional and off unless you turn them on in Settings for your own phone number. If you do, you may get texts when your team adds an event, changes an event’s time or place, or cancels one. We keep a record of each text we ask our provider to send (the number, when, and the provider’s message reference). Message and data rates may apply. To stop, turn text alerts off in Settings or reply STOP to any of our texts. We never send marketing texts.

9. How long we keep information

We keep information while your account, or your club, uses Headcount, and until you or your club ask us to delete it. Many things are marked as removed rather than erased straight away, so a club’s history stays intact and mistakes can be undone. For example, a removed player, an archived team, a deleted message, and a photo that was removed or replaced are hidden but kept, and when a message is edited we keep its earlier wording in our records.

We also keep sign-in records, activity records, notification lists, usage counts and error records to protect accounts and run the service, and encrypted backups so we can recover from a technical problem. We don’t yet delete these on a fixed schedule. When we set one, we’ll update this policy.

To have your information deleted, see Your choices below.

10. Your choices

• Update your details: change your name, phone number, photo, notification choices and contact privacy in Settings. Ask your club’s administrator to correct roster information.
• Get a copy or correct something: email route128works@gmail.com and we’ll help.
• Delete your account: use “Delete my account” in Settings, or visit headcount.today/delete-account. We review each request (for example, if you run a club, we’ll help hand it to someone else first) and then delete or de-identify your account and personal information. We aim to finish within 30 days and will email you when it’s done. Some records that belong to your club, such as messages you sent to others or past availability answers, may be kept in a form that no longer identifies you, and copies may remain in our encrypted backups. We’ll also keep what the law requires us to keep.

Depending on where you live, you may have legal rights to access, correct or delete your information. We honor these requests from everyone, wherever they live, and we won’t treat you differently for making one.

11. Security

We protect information with encrypted connections, scrambled passwords and sign-in tokens, limits on sign-in attempts, an extra emailed sign-in code for Headcount’s owner accounts, encrypted backups, and access limited by role. No system is perfectly secure, so please use a strong password and tell us at route128works@gmail.com if you notice anything wrong.

12. Where information is processed

Headcount is run from the United States and is meant for teams there. Your information is processed in the United States and in other countries where our service providers operate.

13. Changes to this policy

When we change this policy we’ll update the date at the top. If a change is significant, we’ll tell you in the app or by email before it takes effect.

14. Contact us

Route 128 Works, Massachusetts, USA. Email: route128works@gmail.com.