Privacy Policy

Effective date: August 14, 2026

This Privacy Policy explains how WhereTheyPlay (wheretheyplay.com), operated by WhereTheyPlay LLC, a Washington limited liability company, collects, uses, and protects your information.

1. Information We Collect

From parents/visitors: name, email, and message when you contact an organization; general search inputs (sport, zip code, radius, child's age range). We don't require an account to search or contact an organization.

From organizations: account email (used for magic-link sign-in), organization name, contact email, location/address, bio, staff names/roles/photos, team and recruiting information, and facility photos.

Compiled pages: some organization pages are compiled by us from information the organization publishes on its own website, without the organization giving us anything. For each compiled page we store the web address we read the information from and the date we read it, and both are shown on the page. An organization can correct or remove its compiled page at any time, at no cost.

Automatically: IP address (used for rate-limiting and abuse prevention on contact forms, and recorded with any request to correct, claim or remove an organization page so that we can see a pattern of bad-faith requests), basic usage data (e.g., page views), and CAPTCHA verification results.

Payment data: handled entirely by Stripe. We do not receive or store full card numbers. We store limited billing metadata (subscription status, Stripe customer ID) to manage your listing.

2. How We Use Information

• To operate the directory (search, display listings, geocode zip codes to show distance)
• To deliver contact-form messages from parents to organizations (via Resend)
• To process and manage organization subscriptions (via Stripe)
• To prevent spam and abuse (hCaptcha, IP-based rate limiting)
• To communicate with you about your account or a support request

We do not sell your personal information.

3. Third-Party Services We Use

Each of these providers processes data under its own privacy policy and security practices.

4. Cookies, Tracking and What We Count

We use only the minimum cookies and local storage this site needs. That is: your sign in session (Supabase Auth), bot protection (hCaptcha), a random tag your browser creates for each visit so that we can count visits without identifying you, and a cookie on the owner's own devices so that his own visits are left out of the counts. We do not use third-party advertising trackers.

What we count

We count how the site is used. Here is exactly what that means.

On an organization's page, we count that the page was opened, and that someone clicked the link to the organization's own website.

When you search, we save what the search was for. That is the sport, the age you entered, the age group, the zip code you entered, the distance you chose, whether you asked for organizations that are actively recruiting, how many results came back, and which organizations were shown. We do not save the words you type into the keyword box. We only save whether you used it.

We never ask for a child's name and we never store one. We do not store your IP address in these records. We do not use advertising trackers. We do not sell or share any of this, and we never use it to contact anyone.

Each visit is tagged with a random number so we can tell one visit from another. It is not based on anything about you or your device, and it is thrown away when you close the tab. We also use a cookie on the owner's own devices so that his own visits are left out of the counts.

We delete these individual records after 90 days. After that we keep only daily totals for each organization.

Right now these numbers are seen only by the owner of WhereTheyPlay, on a private admin page, and by each organization on its own dashboard, about its own page only.

When we start sending organizations a monthly summary of their own page, they will see totals only. They will never see anything about an individual visitor or an individual search, and any number under 5 will be shown as "fewer than 5" rather than the exact number, so that no organization can work out anything about a single family.

This site also uses Vercel Web Analytics, an outside service that counts visits by page address. It is not used to advertise to you.

5. Children's Privacy

WhereTheyPlay is intended for use by parents, guardians, and organization staff who are 18 or older. We do not knowingly collect personal information directly from children. Any child-related information (e.g., a team's age group) is provided by organizations or parents in the context of describing programs, not as a profile of an identifiable child.

6. Data Retention

We retain account and listing data for as long as an account is active, and contact-form submissions for as long as needed to prevent abuse and handle support inquiries. Requests to correct, claim or remove an organization page are kept as a permanent record of why a page changed, including the IP address the request came from. We keep those because a page going up or coming down is something we may need to account for later. You can request deletion at any time (see Section 8).

7. Data Security

We use industry-standard practices, including database access controls (row-level security), encrypted connections (HTTPS), and third-party providers with their own security certifications. No system is perfectly secure, and we can't guarantee absolute security.

8. Your Rights

You can request access to, correction of, or deletion of your personal information by emailing leads@wheretheyplay.com. Organization owners can edit or delete most of their own listing data directly from their dashboard.

9. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be reflected by updating the effective date above.

10. Contact

Questions about this policy: leads@wheretheyplay.com