Privacy Policy

Houston Chargers Sports LLC ("Houston Chargers", "we", "us", "our")

Last updated 24 September 2026

This Privacy Policy explains what personal information we collect when you use houstonchargers.com and our mobile applications (collectively the "Service"), how we use it, who we share it with, and the choices you have. By creating an account or using the Service you agree to this Policy.

1. Information we collect

1.1 Account & profile

Contact details: name, email address, phone number, mailing address.
Sign-in credentials: a hashed password (we never store the plain-text password) and, if you choose, a linked Google or Apple sign-in identifier.
Membership context: the signup intent you chose (Visitor, Existing Player, or New Player Request), club status, and roles granted by an administrator (Fan, Player, Club Player, Coach, Manager, Admin, etc.).
Notification preferences: opt-in/opt-out flags per channel (email, SMS, WhatsApp) and the UTC timestamp of your initial consent at sign-up.

1.2 Player & team data

Playing role, batting style, bowling style, biography ("About me"), CricClubs profile link, and member-since date.
Profile photo and team-uniform photo (uploaded by you or by team management).
Social-media handles (Facebook, X/Twitter, Instagram) — optional.
Fixture-specific data: availability ("Available", "Maybe", "Unavailable") and any "Maybe" note, squad selection (Playing XI / Extra / Coach / Manager / Physio / etc.), match-duty assignments, ride-share requests for matches.
Over-45 status flag, if marked by an administrator (used only to indicate league multi-team eligibility).

1.3 Children & certificates

If you add child dependants or upload coaching/umpiring certificates from your profile, we store the child's full name, date of birth, primary league, and an optional photo, and the certificate title, authority, level, expiry date, league, and an optional image. This information is visible to you and to club administrators only.

1.4 Payments & orders

We never store full card numbers or CVV. Card payments are processed directly by Stripe or PayPal; we receive only a transaction reference, last-4 digits where provided by the processor, and the outcome (succeeded / failed).
For Zelle payments we record the amount, status (Pending / Paid / Exempted / Cancelled), the admin who marked it received, and any free-text note (e.g. "Zelle ref ABC123").
Store orders: the items purchased, quantities and variants, your shipping address and contact, payment method, order status, and (if local pickup) your selected pickup option.
Ground bookings: the date and slot booked, booking type (cricket match, event, etc.), total price, applied promo code, payment method and status.
Game-day contributions: per-fixture per-player record of the $10 contribution (status, payment method, paid timestamp, admin note).
Fundraiser & event support: the amount you contributed, the fundraiser/event id, payment method and status.

1.5 Technical & usage data

Authentication cookies (set by ASP.NET Core Identity) to keep you signed in. These are required for the Service to function.
Anti-CSRF cookies on form submissions.
Login audit log: we log the email used, whether the attempt succeeded, the result reason, the source IP address and timestamp, for security investigation.
Email audit log: we log outbound emails (recipient, subject, success/error, timestamp) so admins can investigate undelivered messages.
Error log: server-side exceptions (path, method, signed-in user email, IP, stack trace, timestamp) for diagnostics.
reCAPTCHA: on sign-up we use Google reCAPTCHA to deter automated bots; Google may collect device-level signals (see Google's policy).

1.6 Fitness & activity data (Run, Bike, Hike)

The mobile app does two separate things here, and they collect different amounts: it can record a run, ride, walk or hike, which collects nothing unless you start a recording; and it can show your daily step count, which your phone counts on its own once you allow it. Both are optional, and the rest of the Service works normally if you use neither. Fitness data is stored on a dedicated Houston Chargers fitness server (fit.houstonchargers.com), separate from the main website database.

When you record an activity, we collect:

Location, including in the background. While — and only while — an activity is recording, we collect a stream of GPS points: latitude and longitude, altitude, accuracy, speed and timestamp. Recording continues when the screen is off or another app is in front, because a run does not stop when you put your phone in your pocket; Android shows a permanent notification for the whole time it is running. We do not collect your location at any other time — not in the background, not when the app is closed, and not when you are simply browsing fixtures or the store.
Derived activity metrics: distance, elapsed and moving time, pace and speed, elevation gain and loss, per-kilometre/mile splits, calories, training load and fitness/fatigue/form (CTL / ATL / TSB), and personal records.
Health metrics from a connected device, where you have one: heart rate (average, maximum and per-point), cadence and power. The phone alone does not measure these, and they stay empty unless a device supplies them.
Optional profile figures you enter yourself to make the calculations accurate: weight, height, date of birth, resting and maximum heart rate, lactate threshold heart rate, and FTP. All are optional and can be cleared at any time.
What you add to an activity: a title, a description, a perceived-effort rating, and up to five photos.

Daily step count. If you allow it, the app shows your steps for today and the past seven days. This is the one part of the Service that collects something without you starting it, so it is worth being exact about what happens:

Your phone counts your steps itself, whether or not our app is installed. Both iPhone and Android do this continuously in a low-power motion sensor and keep a short history. Our app does not run in the background to count anything — it reads the total your phone has already recorded, at the moment you open the fitness screen.
What we store: a daily total and the calendar date it belongs to, kept against your account so your history survives a new phone or a reinstall. We do not store where you were, what you were doing, or any minute-by-minute breakdown.
It needs your permission and you can withdraw it. iOS asks for Motion & Fitness; Android asks for Physical activity. Refuse it, or turn it off later in your phone's settings, and the step display simply disappears. Nothing else in the app changes.
Your steps are private to you. Other members cannot see them; there is no club step leaderboard, and no part of our system will return another member's step count.
Phone steps only, for now. We read the count from the phone itself. We do not currently read Apple Health, Health Connect, or any watch or fitness tracker, so steps taken while your phone is elsewhere are not included.

Every activity is private by default (private). You choose per activity, or as a default for your account, whether it stays private, is visible to people who follow you, or is visible to the club. An account belonging to a minor cannot share activities with the club at all.

Privacy zones. You can define circular zones of 100–1000 m — around your home, for example — and any part of a route inside one is cut out before anybody else sees it. Route maps shown to other members are drawn from the clipped route only, so a viewer receives a picture of a route rather than the coordinates behind it, and start and end markers are omitted from a clipped route so they cannot mark the zone edge.

We do not use fitness or health data for advertising, and we never sell or share it with data brokers, advertisers or insurers. It is used only to show you your own activity, to power the features described below, and to show whatever you have explicitly chosen to share with the club.

2. How we use your information

Create and maintain your account; verify your identity at sign-in.
Manage your club membership (approve, decline, deactivate) and grant roles.
Show you fixtures, schedules, the published squad, your availability, ride-share, your match duties, and your profile-completion status.
Send the email/SMS/WhatsApp notifications you opted in to at sign-up: squad announcements, game-day contribution reminders & receipts, fixture updates, event invitations, fundraiser updates, account-status changes.
Process payments and refunds through Stripe/PayPal, or record manual Zelle/Cash payments.
Display approved players on the public Team page (you can be hidden from this page by an administrator on request).
Generate per-recipient pay links and per-recipient Google Maps directions URLs (using your saved address as the origin where available).
Record an activity you start in the app, map its route, and calculate its distance, pace, elevation, calories, training load and personal records.
Show you your own fitness history, trends and dashboard on the website and in the app, and show other members only the activities you have chosen to share.
Detect and investigate fraud, abuse, and security incidents using the audit logs above.
Comply with applicable law and respond to lawful requests.

3. Who we share your information with

We do not sell or rent your personal information to anyone. We share it only with the following service providers, strictly to operate the Service:

Stripe, Inc. — card / Apple Pay / Google Pay processing.
PayPal, Inc. — PayPal payments.
Twilio, Inc. — SMS and WhatsApp delivery of opt-in notifications.
Google LLC — reCAPTCHA bot-check on sign-up; "Sign in with Google" identity verification (only if you choose that login method); Google Maps direction links (no data is sent to Google unless you click the link).
Apple Inc. — "Sign in with Apple" identity verification (only if you choose that login method).
Open-Meteo — game-day weather forecasts on the public fixtures page (only the venue city is sent, never your personal data).
Google LLC (Maps Static API) — to draw the background map behind a route image, the route line is sent to Google after your privacy zones have been cut out of it. Points inside a privacy zone are never sent. No name, email or account identifier accompanies the request.
Fitness hosting: recorded activities, GPS points and activity photos are stored on a dedicated Linux server we operate at fit.houstonchargers.com, separate from the website database. That server holds no password and no signing key.
Web hosting: InterServer (Plesk shared hosting) for the website and database.
Houston Chargers administrators & team management — they can see your full account, club status, squad assignments, contributions, profile completion state, and the contents of your audit logs.

We may also disclose information if required by law, court order, or to protect the rights, property, or safety of Houston Chargers, its members, or others.

4. Your choices & how to opt out

Per-channel opt-out: sign in and visit Edit Profile to disable any of Email, SMS, or WhatsApp independently. Administrators are automatically alerted when you opt out.
STOP / HELP keywords: reply STOP to any SMS or WhatsApp message to unsubscribe immediately (Twilio enforces this at the carrier level); reply HELP for support contact details.
Access / correct / delete your data: email support@houstonchargers.com from the email on your account and we'll respond within 30 days. Account deletion may be limited where we are required to retain transactional records (orders, bookings, payments) for tax, accounting or legal reasons.
Fitness data: revoke the location permission in your device settings at any time (recording stops working; nothing else does), change an activity's visibility or your account default, set privacy zones, or delete an individual activity outright from the app. Deleting an activity removes its route, its GPS points and its photos.
Hide from public Team page: an administrator can hide your player card from the public Team listing while keeping your account intact — just ask.

For full detail on how consent is recorded and respected see our public Proof of Consent page.

5. Data retention

We keep account and profile data for as long as your account is active. Transactional records (orders, ground bookings, game-day contributions, fundraiser and event support) are kept for at least seven (7) years for tax/accounting purposes. Login, email and error audit logs are typically kept for twelve (12) months.

Recorded activities and their GPS points are kept until you delete them or close your account; there is no fixed expiry, because a training history is only useful over years. Deleting an activity removes its route, points and photos.

6. Children's data

The Service is intended for adult sign-up. Information about children is only entered by a consenting parent or guardian for cricket-academy / family-membership purposes (full name, date of birth, league, optional photo) and is visible only to the parent account and club administrators. We do not knowingly market to children.

7. Security

The site is served over HTTPS only. Passwords are stored as one-way hashes (ASP.NET Core Identity defaults). Server-side secrets and sensitive Settings values (e.g. SMTP password, Apple Sign-in private key, Twilio auth token, Stripe secret key) are encrypted at rest using ASP.NET Core Data Protection with an enc:v1: marker. Card and CVV data are never seen or stored by us — they are tokenised client-side by Stripe.

8. International users

Houston Chargers Sports LLC is based in Texas, United States. Our hosting, payment-processor, messaging-provider and email-relay infrastructure are in the United States. If you access the Service from outside the U.S., you consent to the transfer and processing of your information in the U.S.

9. Changes to this Policy

We may update this Policy from time to time. Material changes will be announced at the top of this page. Continued use of the Service after a change is published constitutes acceptance of the updated Policy.

10. Contact

Privacy questions, data requests, or anything else relating to this Policy:
Houston Chargers Sports LLC
Email: support@houstonchargers.com
Web: https://houstonchargers.com