Privacy policy

Last updated 22 September 2026

This policy explains how Grassroo (“we”, “us”) handles personal data when you use the Grassroo website, web app, or iOS and Android apps. Grassroo is a club and team management product: a user signs in; a player participates. Parents and other linked users act on a player’s behalf.

Who is responsible

For the marketing site and for the Grassroo service itself, the controller is the operator of Grassroo. Contact us at hello@grassroo.com. Clubs that enter player and parent details into Grassroo also decide why that club data is processed; they are controllers of their own club records, and we process that data to provide the service they have asked for.

What we collect

• Account data — name, email address and/or mobile number, password hashes, and profile details you choose to store.
• Club data — club and team names, roles, seasons, events, availability responses, payment obligations and payment status, invitations, and club settings.
• Player data — player names and the link to the users who may respond or pay for them. Players do not have passwords. Youth squads routinely include children; we treat player records as data that may identify a child.
• Device data — on native apps, a push token and a device identifier so we can deliver asks and reminders you have requested. Refresh tokens are stored in the device Keychain or Keystore.
• Usage and diagnostics — request logs with a request id, and records of notifications we queued or sent (to whom, when, and on which channel).

We do not use player records for advertising. We do not sell personal data.

Why we use it

We process data to:

• create and secure accounts (including email or SMS verification codes);
• run events, availability, collections and reminders for your club;
• send transactional email (and push, where you have installed the native app);
• take payment via Stripe on behalf of the club that connected its Stripe account;
• keep the service available, debug faults, and meet legal duties.

SMS is used only for verification codes at sign-up or sign-in — never for availability requests or payment reminders.

Payments

Card, Apple Pay and Google Pay are handled by Stripe on hosted Checkout. We store that a payment was made, the amount in minor units, the currency, and Stripe identifiers needed to reconcile webhooks. We do not store full card numbers. The club’s connected Stripe account is the merchant. Stripe’s own privacy notice applies to data Stripe processes as a controller or processor.

Who we share with

We use processors to run the service, including:

• hosting and database (Railway);
• the web app and this site (Vercel);
• email delivery (Resend);
• SMS verification (Twilio);
• payments (Stripe);
• object storage for club logos (Cloudflare R2), when a club uploads one;
• native live updates (Capgo) for JavaScript and CSS on installed apps.

We share data with a club’s own managers and members according to the roles that club has set. We may disclose data if the law requires it.

How long we keep it

We keep account and club records for as long as the club or user needs the service, and for a limited period afterwards where we must retain records of payments, invitations or notifications. You can ask us to delete an account. Club admins can archive or remove player records they no longer need, subject to records the club must keep (for example payment history).

International transfers

Some processors may store or access data outside the UK. Where that happens we rely on appropriate safeguards offered by those providers (such as standard contractual clauses).

Your rights

Under UK GDPR you can ask for access, correction, deletion, restriction, objection, or portability of your personal data, and you can complain to the Information Commissioner’s Office. Email hello@grassroo.com. If you are a parent using Grassroo for a child, you can ask us about the player record linked to you; some requests have to go through the club that entered the record.

Children

Grassroo is used by youth clubs. Accounts are for adults (managers, parents, players who are old enough to hold an account). We do not knowingly create a login for a child in order to market to them. Player names and availability exist so the club can run sessions and fees.

Cookies

The app uses a secure, httpOnly refresh cookie on the API host to keep you signed in on the web. This marketing site does not use advertising cookies. If that changes, we will update this policy.

Changes

We will post updates here and change the date above. Material changes to how we use personal data will be notified to account holders where we can reasonably do so.