Privacy policy

This policy applies to the VB League website at vbleague.com, to every organization site served under it (for example yourclub.vbleague.com), and to the VB League app for iPhone and Android. It covers everyone who uses them: players who enter events, organizers who run them, and visitors who only look.

VB League is the platform. Each event is run by its organizer, who decides how the event works and who sees your entry. Where this policy says what an organizer may do with your information, read it as a description of what our service shows them, not as a policy the organizer has adopted. An organizer’s own handling of your information outside VB League is between you and them.

Your account

When you create an account we collect your full name, email address and password. Your password is stored only as a one-way hash by our authentication provider; we never see it and cannot read it back. If you sign in with Google or Apple, that provider tells us your name and email address and we create the same kind of account (Apple may give us a private relay address in place of your own, which is where our email will reach you).

You can delete your account at any time from Player settings on the web or the Profile screen in the app. Deleting it removes your name, email address, phone number, picture and profiles and ends your sign-in everywhere; records of entries and payments are kept for the organizer’s and our own accounting, without your name on them. While you are the only owner of an organization, or hold an entry in an event that has not finished, we ask you to hand over the organization or withdraw first.

Your player profile

A player may answer a gender question — Male, Female or “Prefer not to say” — when setting up their profile, or leave it unanswered. Divisions can be men’s, women’s, co-ed or open, and the answer decides which ones the player can enter: a men’s division admits only a player who answered Male, a women’s only one who answered Female, and a co-ed team must have both on it; a men’s or women’s division asks the question at entry when it was left unanswered. The organizers of an event the player enters can see the answer, since they form co-ed teams from free agents, and so can the player’s own teammates on their team’s roster page; the public never sees it. A player may also say where they play from — a city and a state or province, both optional — which is shown on their public player page beside their name and picture: anyone can open that page from a name on an event’s Teams tab, and it shows nothing else. A player may also add a phone number, a date of birth (asked for only when an event or division has an age rule), a self-described skill level, preferred sports, a profile picture, an emergency contact’s name and phone number, and notification preferences. Everything beyond name and email is optional.

Your organization

An organizer gives us the organization’s name, its type, a contact phone number and email address, a mailing address, an optional website, and the sport it runs. If the organization accepts payment by Venmo, Zelle or another method outside VB League, we store the account names or links the organizer types so players know where to send money. If the organization connects Stripe, we store the identifier of its Stripe account and whether charges and payouts are enabled — never its bank or identity documents, which Stripe collects directly.

Events and entries

When you enter an event we record the division you entered, your team and its name, who you invited and who accepted, when you signed the event’s waiver, the price you were quoted, and the state of each payment. Organizers’ events, sessions, courts, venue addresses, banners, descriptions and waiver text are stored as they are entered. Results and standings are stored as the organizer records them.

Payments

Card payments are handled by Stripe on the organizer’s own Stripe account. Your card number never reaches VB League. We receive from Stripe the amount, the time, an identifier for the charge, the fees Stripe and VB League took, and any refund. When you tell us you have paid an organizer outside VB League, we record that you said so, which method you named, and when the organizer verified it.

Where you are

The home page lists upcoming events near you. In the app we ask your phone for its location once, only if you allow it, and use the answer to run that search; we do not store your position. On the website we use the approximate city that our hosting provider derives from your network address, or a browser location you choose to share, for the same purpose. An address you type into an address search is sent to an address-lookup service so it can suggest matches.

Security signals

To keep bots and credential-stuffing out of sign-up, sign-in, password reset and the contact form, we record the network address, the country it is stamped with, an identifier for the browser or device, the browser’s user-agent string, how long a form took to fill in, and the outcome of each attempt. Network addresses and device identifiers are stored hashed. We keep a list of the devices you have signed in from, also hashed, so we can email you when a new one appears. A security check from Cloudflare may run when a request looks unusual.

Push notifications

If you turn on push notifications in the app, we keep the notification token of each phone you turned them on, so we can send messages to it, and a record of each message sent for ninety days. You can turn them off in the app or remove a phone from Player settings on the website.

Messages

When you write to us through the contact form we keep the email address and message you sent. When you invite a teammate we keep the address you invited and the state of the invitation.

Usage

The website uses Vercel Web Analytics, which counts page views and referrers without cookies and without identifying you. We keep ordinary server logs, which include network addresses and requested pages, for a short time to diagnose problems.

• To run your account, sign you in, and let you switch between a player and an organizer view.
• To list events, take entries, form teams, collect waivers, record payments and confirm spots.
• To show organizers who has entered their events and what each entry still needs.
• To send the email the service needs: confirmation, sign-in codes, password reset, invitations, new-device notices, and a payment-problem notice to an organizer.
• To send a push notification to the phones you turned them on for, about entries and events you are part of: an invitation, a payment confirmed, your spot, a schedule change, and for organizers a payment to verify.
• To bill organizers the platform fee described in the Terms of use.
• To find events near you, when you allow it.
• To detect and block abuse, fraud and automated traffic.
• To answer your messages.
• To understand, in aggregate, how the site is used.

We do not sell your personal information, we do not share it with advertisers, and we do not use it to build a profile of you for any purpose other than running the service you signed up for.

Other people on VB League

• Organizers of an event you enter see your name, your email address, your skill level, when you signed the waiver, and how and when you paid. If you gave a date of birth and the division has an age rule, they see that you meet it. If you enter as a free agent they see your name in the pool so they can form teams.
• Teammates and captains see the names of everyone on the team and whether each member has accepted, signed and paid.
• The public event page shows each confirmed team’s name and the names of its accepted players, along with results and standings once they are recorded. Nothing else about you is public: not your email, phone, date of birth or payment details.
• Organization pages show the organization’s name, its events and the contact details the organizer chose to publish.

When the law requires it

We will disclose information when a law, court order or government request genuinely requires it, or when it is necessary to protect the safety of a person, to enforce our terms, or to defend our rights. If VB League is ever sold or merged, your information would go with it to the new owner under this same policy.

We set a few cookies, all first-party, none for advertising. Each is limited to the exact site that set it: a cookie for vbleague.com is not sent to an organization’s site and vice versa.

• A session cookie that keeps you signed in.
• A view cookie remembering whether you last used the player or the organizer view.
• A device cookie holding a random identifier so we can tell a new sign-in device from a familiar one.
• A short-lived cookie tying an emailed sign-in code to the browser that asked for it.

The browser also keeps an organizer’s unfinished event draft in local storage so a closed tab does not lose it, and remembers for the length of a tab whether you declined to share your location so we do not ask again. The app keeps its device identifier and your session in the phone’s secure storage.

You can clear any of these through your browser or by uninstalling the app. Blocking the session cookie means you cannot stay signed in.

• Your account and profile: for as long as the account exists.
• Entries, teams, waivers, results and payment records: for as long as the event’s organizer needs them and as long as we must keep financial records, which is generally seven years for anything involving money.
• Security counters for sign-in and sign-up attempts: rolling windows measured in hours or days; the attempt log itself is trimmed regularly.
• Known-device hashes: for as long as the account exists.
• Contact-form messages: until the question is settled, then deleted from our inbox in the ordinary course.
• Server logs: a matter of weeks.
• The record of actions VB League staff take on accounts: kept permanently, as an audit trail.

• See and correct. Your profile and organization settings pages show what we hold and let you change most of it. Anything you cannot change yourself, write to us and we will.
• Delete. Write to us from the email address on the account and we will delete it. We will keep only what we are required to keep: payment records, and the entries an organizer needs for an event that has not yet finished. Deleting your account does not cancel an entry or refund a payment; arrange those with the organizer first.
• Email. The messages we send are the ones the service needs to work. We do not send marketing email, so there is nothing to unsubscribe from.
• Location. The app asks once; refuse it and every event is listed instead of the nearby ones. You can change the permission in your phone’s settings at any time.
• Export. Ask and we will send you a copy of the information we hold about you in a readable format.

Residents of California and other states with privacy laws, and residents of Canada, have the right to know what we collect, to have it corrected or deleted, and to not be treated differently for exercising those rights. We honor them for everyone. We do not sell or share personal information for cross-context advertising, so there is nothing to opt out of. If you believe we have not handled a request properly you may complain to your state’s attorney general or, in Canada, to the Office of the Privacy Commissioner.

VB League accounts are for people aged 13 and over. A player under 18 may hold an account only with a parent or guardian’s permission, and the parent or guardian is who signs an event waiver on their behalf. We do not knowingly collect information from anyone under 13; if you believe a child has created an account, write to us and we will remove it.

Everything travels over encrypted connections. Passwords are hashed, card details never touch our systems, network addresses and device identifiers are stored hashed, and sensitive operations run on the server rather than in your browser or phone. Access to the database is restricted row by row, so an organizer can read only their own events’ entries and a player only their own. We will tell you promptly if we learn of a breach affecting your information.

VB League serves players and organizers in the United States and Canada, and our systems run in the United States. If you use the service from Canada, your information is transferred to and stored in the United States, where it is subject to United States law.

When this policy changes we update the date at the top. If a change affects what we collect or who sees it in a way that matters, we will say so on the site or by email before it takes effect. The current version is always at this address.

Questions, corrections, deletion requests and complaints all go to info@vbleague.com, or through the contact form. We answer from the same address.