Privacy Policy

1. Who this policy covers

RosterCap is an independent fantasy sports management product operated under the KHM Fantasy Sports brand. This Privacy Policy applies when you visit rostercap.app, sign in, create a Front Office, upload or import information, or otherwise use RosterCap.

For privacy questions, access or correction requests, or account-data deletion requests, contact the RosterCap Privacy Contact using the information at the end of this policy.

2. Information RosterCap collects

Google Sign-In information

RosterCap uses Google Sign-In for authentication. The sign-in flow may provide basic account identity information made available by Google and the authentication provider, such as your email address, display name and provider account identifier. RosterCap uses this information to authenticate you, associate your Front Offices with your account, and display basic signed-in account information.

RosterCap does not request access to your Gmail messages, Google Drive files, Google Calendar, Google Contacts, or other Google account content. RosterCap does not receive or store your Google password.

Front Office information you provide

When you use RosterCap, you may provide or create information such as:

• Front Office, fantasy league and fantasy team names;
• sport, season, roster, salary-cap or budget settings;
• player names, teams, positions, ages, roster locations and statuses;
• contract terms, salaries, cap overrides and financial adjustments;
• draft picks, rights and other fantasy assets;
• transactions, notes and depth-chart or lineup assignments;
• team logos or other images that you choose to upload; and
• CSV data that you choose to import from Fantrax or another source.

Technical and browser information

RosterCap and its service providers may process technical information needed to deliver, secure and troubleshoot the service, such as IP address, browser or device information, request logs and authentication/session information.

RosterCap may use browser storage or session storage for essential application functions, including authentication state and temporary caching. For example, RosterCap may temporarily cache signed URLs used to display private team-logo files. RosterCap does not currently use advertising cookies or third-party behavioural advertising.

3. How information is used

RosterCap uses personal information and Front Office information for reasonable purposes connected to providing the service, including to:

• authenticate users and maintain account sessions;
• create, load and save private Front Offices;
• sync roster, contract, cap, asset and transaction information across devices;
• store and display team logos and user-selected files;
• process CSV imports and exports requested by the user;
• protect accounts, investigate errors, prevent misuse and maintain service security;
• respond to support, privacy, access, correction or deletion requests; and
• maintain and improve the reliability and functionality of RosterCap.

RosterCap does not sell or rent personal information. RosterCap does not currently use personal information for targeted advertising.

4. Google user data

Google user data obtained through Google Sign-In is used only for account authentication, account identification and basic account display within RosterCap. It is not used for advertising, sold to third parties, or used to build advertising profiles.

Google identity information may be processed by RosterCap's authentication infrastructure, including Supabase, as needed to create and maintain the authenticated RosterCap session. RosterCap shares Google user data only as required to provide, secure or comply with the service, as described in this policy or as required by law.

5. Service providers and disclosure

RosterCap relies on third-party infrastructure providers that process information on RosterCap's behalf or as part of their own service terms. Current core providers include:

• Google — identity and sign-in services;
• Supabase — authentication, database and private file-storage infrastructure; and
• GitHub Pages — public web application hosting.

RosterCap may also disclose information where reasonably necessary to protect users or the service, enforce legal rights, investigate abuse, or comply with a valid legal requirement.

Service providers may process or store information outside Canada. Information processed in another jurisdiction may be subject to the laws of that jurisdiction.

6. Security

RosterCap uses safeguards appropriate to the nature of the service, including authenticated access, database access controls, row-level security policies, private file storage for team-logo uploads, and restricted application write paths.

No internet service or storage system can guarantee absolute security. Users should also protect their Google account and devices and should not share access to authenticated sessions.

7. Retention and deletion

RosterCap keeps information for as long as reasonably needed to provide the service, maintain security, meet legal obligations or resolve disputes. Information that is no longer required should be deleted or anonymized when reasonably practicable.

Front Offices can be deleted using RosterCap's deletion controls. Deleted information may remain temporarily in service-provider backups or logs until normal backup or retention cycles expire.

To request deletion of your RosterCap account information, or to ask what personal information RosterCap holds about you, contact the Privacy Contact below. RosterCap may need to verify your identity before completing a request.

8. Access and correction

You can edit much of your Front Office information directly in RosterCap. You may also request access to personal information associated with your account or ask for inaccurate personal information to be corrected, subject to applicable law and permitted exceptions.

9. Children and legal capacity

RosterCap is intended for users who can lawfully agree to the Terms of Use in their jurisdiction. If a user is not legally capable of agreeing on their own, a parent or legal guardian should supervise and authorize the use of the service.

10. Changes to this policy

RosterCap may update this Privacy Policy as the service changes. Material changes will be reflected by updating the effective date and, when appropriate, providing additional notice within the service.

11. Privacy contact

Operational note: this contact address must be configured and monitored before public launch so users can make privacy, access, correction and deletion requests.