Privacy Policy

Introduction

This Privacy Policy describes how Reestir Labs LLC, a California limited liability company (“Reestir Labs,” “we,” “us,” or “our”), operating Path2Playoffs, collects, uses, and shares your information. It applies to the Path2Playoffs mobile application and the path2playoffs.com website (collectively, the “Services”).

By using our Services, you agree to the collection and use of information in accordance with this Privacy Policy.

The Services are offered to residents of the United States. They are not directed to, or offered in, other countries.

This policy is written in English. We provide a Spanish translation for convenience; if the two versions ever conflict, the English version controls.

Information We Collect

Account Information

When you create an account, we collect account information through our authentication provider (Firebase Authentication), which may include your email address, your name or display name as provided by you or by the sign-in method you choose (email and password, Google, or Apple), and a unique account identifier. We do not collect or store passwords directly.

App Usage and Preferences

• Team preferences and favorites — the clubs, age groups, conferences, and favorite teams you follow in the app.
• Predictions and what-if scenarios — playoff scenarios and predictions you generate within the app.
• Push notification tokens — Firebase Cloud Messaging (FCM) tokens used to deliver notifications you have opted into.

Newsletter Signup

• Email address — collected only if you subscribe to our newsletter through the website.
• Newsletter delivery data — our newsletter provider (EmailOctopus) processes your email address to deliver the newsletter, and records delivery information and whether an email was opened or a link in it was clicked, which helps us understand whether the newsletter is useful. You can unsubscribe at any time using the link in any email.

Photos

• Player photos (optional cloud background removal) — by default, the app's photo tools process images entirely on your device. If you choose the optional higher-quality cloud background removal, the photo you selected is sent over a secure connection to our own servers, where it is processed in memory and the result is returned to you. The image is not shared with any third party, not stored or written to disk, deleted immediately once the result is returned, and never used to train any AI model. Location and other embedded metadata are removed before processing. This happens only when you explicitly choose the cloud option.
• Feedback messages — if you send feedback through the app, the text you write is sent to us together with the app version and platform so we can act on it.
• Feedback screenshots — if you send feedback through the app and include a screenshot, that image is uploaded to us with your feedback.

Device Location (Optional)

• Map centering — on your device only. If you grant the app location permission, your device's location is used to center the interactive game map on where you are. Your location is used on your device only — it is never sent to our servers and never stored by us, and you can use the map without granting location permission. When a map is displayed, map imagery is loaded from the map providers listed under Third-Party Services below.

Information Collected Automatically

• Website usage data — pages visited, features used, and interactions on the path2playoffs.com website.
• Device and app information — device type, operating system, and app version.
• Server logs — like most websites and online services, our servers automatically record standard request information, including your IP address, the date and time of the request, the page or resource requested, and your browser's user-agent string. We use these logs to operate and secure the Services — for example, to diagnose errors, to detect abuse, and to investigate security incidents. They are kept for a limited operational period and then deleted.
• Account activity records — when you are signed in and you change something in your account, our servers record that the action happened, together with your account identifier, your IP address, and your browser or device user-agent string. Examples include updating your settings, saving or removing a favorite team, changing your notification preferences, sending us feedback, and deleting your account. We use these records to support your account, to investigate problems you report to us, and to detect and investigate abuse or unauthorized access.
• Website analytics (Google Analytics 4) — not currently active. If we re-enable it, it will be used on the path2playoffs.com website only (not in the mobile app) and may collect cookies and pseudonymous usage data to help us understand how the website is used.
• App crash diagnostics (Firebase Crashlytics) — the mobile app reports crash and device telemetry tied to a persistent installation identifier. This data contains no app-level personal information (no email address, account identifier, or login token) and is used solely for internal operations to diagnose and fix problems.
• In-app usage analytics — the mobile app records a small number of anonymous events describing how it is used: that a Pro upgrade screen was shown, that a purchase was started, completed, canceled, or failed, that a previous purchase was restored, that a special-offer pop-up was shown, tapped, or closed, and which step of the initial setup was finished. We use these to see which features people actually use and where the app is confusing. This is first-party: the events go to our own servers, and the app contains no third-party analytics SDK — no analytics provider receives them. Each event carries only a random identifier that is created fresh every time the app is opened, the time it happened, the app version, the platform, the language setting, and a short fixed label such as which screen the upgrade prompt came from. It never carries your name, email address, account identifier, device identifier, or any free text, and no IP address is stored with it. When you are signed in the request travels over the app's normal authenticated connection, but the account that sent it is discarded on arrival and is never stored alongside the event. You can turn this off at any time in the app under Settings → Privacy & Data → “Share anonymous usage data”, and it is switched off entirely for users who indicate they are under 13.

Cookies and Local Storage

Our website uses a small number of cookies and similar browser storage. We do not use advertising cookies, and we do not use cookies to track you across other websites.

• Language preference — if you switch between English and Spanish, a cookie remembers your language choice so pages load in the language you picked.
• Security and bot protection — Cloudflare, which provides our content delivery and DDoS protection, and Cloudflare Turnstile, which distinguishes people from bots on our forms, set cookies necessary to perform those functions.
• Checkout — if you buy merchandise, Shopify sets the cookies needed to keep your cart and complete your order.
• Shopping cart — the shop keeps the contents of your cart in your browser's local storage so it is still there when you come back. That information stays in your browser and is shared with Shopify only when you check out.
• Website analytics — Google Analytics 4 would set analytics cookies, but it is not currently active, so it sets none today.

You can block or delete cookies in your browser settings. Blocking the security and checkout cookies above may prevent forms or checkout from working. The Path2Playoffs mobile app does not use cookies; it stores your preferences and sports data locally on your device. If you open our website from a link in the app, the website cookies described above apply.

How We Store and Sync Your Information

The Path2Playoffs app stores sports data, your team preferences, and your favorites locally on your device using SQLite. Account information and a subset of preferences may be synchronized across your devices through a server-side sync proxy operated by Reestir Labs. We do not sell your data, and we do not share it with third parties for advertising purposes.

Where We Process Your Information

We are a United States company, and the Services are offered in the United States. Your information is processed and stored in more than one country:

• Our website runs on servers located in the United States.
• Our application database and backend services (Hetzner) are located in Germany. Account information and synchronized preferences are stored there.
• Our other service providers — including Google (Firebase), Cloudflare, Shopify, and those listed under Third-Party Services below — operate global infrastructure and may process information in the United States or other countries.

Wherever your information is processed, we apply the protections described in this Privacy Policy.

Sports Data We Display

The standings, schedules, scores, rosters, and related information shown in Path2Playoffs are aggregated from publicly available league sources, including team and club names as they appear on those sources. We do not currently display individual player names. This public sports data is not collected from app users and is not personal information that users provide to us.

Payment Processing

We use third-party payment processors and do not store or have access to your full credit card information. In-app purchases and Pro subscriptions are processed by the Apple App Store and Google Play. Merchandise purchases on the path2playoffs.com store are processed by Shopify, our e-commerce platform and payment processor, and orders are produced and shipped by our print-on-demand fulfillment partner, Printify, which receives the name and shipping address needed to deliver your order. Payment processing is subject to the terms and privacy policies of the respective provider.

How We Use Your Information

• To provide, maintain, and improve our Services.
• To understand how the app is used — which features people use and where they get stuck — using the anonymous in-app usage analytics described above.
• To authenticate your account and synchronize your preferences across devices.
• To deliver push notifications you have opted into.
• To send you newsletter updates (only if you opt in).
• To detect and prevent technical issues, fraud, or abuse.
• To comply with legal obligations.

How We Protect Your Information

We use reasonable administrative and technical safeguards designed to protect personal information, including encrypting data in transit, limiting access to those who need it, and storing data with established service providers, including those named in this policy. However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security. If a security incident affects your personal information, we will respond in accordance with applicable law, including notifying you and the relevant authorities where the law requires it.

Third-Party Services

We rely on the following third-party service providers. Their use of your information is governed by their respective privacy policies:

• Firebase Authentication, Firebase Cloud Messaging, and Firebase App Check (Google LLC) — account authentication, push notifications, and a device-integrity check that confirms requests come from a genuine copy of the app.
• Firebase Crashlytics (Google LLC) — crash and stability diagnostics for the mobile app (persistent installation identifier, no app-level personal information), used for internal operations.
• Google Analytics 4 (Google LLC) — website analytics and usage tracking on path2playoffs.com only (not currently active); not used in the mobile app.
• ElevenLabs — text-to-speech generation for optional audio briefings (receives the generated script text; no personal account information).
• Anthropic (Claude) — AI text generation used to draft and fact-check audio-briefing scripts and for internal data-quality checks (receives sports data and script text; no personal account information).
• EmailOctopus — email newsletter delivery.
• Cloudflare — CDN, DNS, and DDoS protection for our website; Turnstile bot verification on our signup forms (Turnstile may process limited device and network signals to distinguish people from bots); and Cloudflare R2 cloud object storage for application data and backups.
• Hetzner — cloud server hosting for our application database and backend services.
• Discord — our internal operations and alerting workspace. A small number of automated operational alerts are posted to a private channel that only we can see. Where an alert concerns a specific account, it can include your account identifier and whether that account has a Pro subscription. No name, email address, payment details, or message content is sent.
• OpenStreetMap (OpenStreetMap Foundation) — map imagery for the app's map screens. When a map is shown, your device requests map images directly from OpenStreetMap's servers, which necessarily shares your device's IP address and the map area being viewed; no account information is shared.
• Esri (ArcGIS Online) — satellite map imagery for the app's map screens, requested the same way and with the same limited information as OpenStreetMap above.
• Apple App Store and Google Play — billing for in-app purchases and Pro subscriptions.
• RevenueCat — in-app purchase and subscription management (receives a pseudonymous app-generated account identifier and your purchase and subscription status to process and validate purchases; no name or email address).
• Shopify — merchandise storefront checkout and payment processing for the path2playoffs.com store.
• Printify — print-on-demand production and fulfillment for merchandise orders (receives your name and shipping address). Product images on our shop pages are also served from Printify's image servers.

Children's Privacy (COPPA & Google Play Families)

Path2Playoffs is a general-audience product primarily intended for parents and families who follow competitive youth soccer. On Google Play it is classified as Mixed Audience, meaning some users may be children under 13.

Account creation requires users to be 13 or older. We do not knowingly collect personal information (such as an email address or account identifier) from children under 13. Account creation is age-gated at 13+. Our website also collects an email address if you subscribe to our newsletter or join the launch waitlist; those forms are intended for adults and older teens, and we do not ask or encourage children to sign up. If we learn that we have collected an email address from a child under 13, we delete it promptly — see “Contact Us” below to tell us about one.

When a user indicates they are under 13 (via the age screen shown when the app first opens), the app applies child-directed treatment:

• No device location. Location features such as “Near Me” are disabled; the app uses only a non-precise, user-entered home area.
• On-device-only personal fields. Any optional details a user enters about a player they follow (such as a nickname or relationship) are stored only on the device and are never transmitted to our servers or any third party.
• No advertising. The app contains no advertising SDKs and serves no ads. If advertising is ever introduced, child-tagged users will receive only non-personalized ads in accordance with Google Play Families policy.
• No behavioral or cross-app tracking analytics. The operational identifiers that leave the device — a crash-reporting installation ID and, if push notifications are enabled, a messaging token — are not tied to app-level personal information, and nothing that leaves the device is used to track the child.
• No in-app usage analytics. The anonymous usage events described above are not collected on a device where the user has indicated they are under 13 — that device sends none of them. Nothing is sent while the age question is still unanswered, either.

The under-13 indication is stored only on the device and is never transmitted.

Optional cloud photo tool. The app's optional cloud background-removal tool may be used on a photo that shows a child. It is off by default and runs only when a parent or guardian chooses it and confirms they are the child's parent or guardian (or otherwise have permission). The selected photo is sent over a secure connection to our own server, processed in memory to remove its background, and deleted immediately — it is never stored, shared with any third party, or used to train AI, and location and other metadata are removed first. No other personal detail about a child leaves the device.

We do not disclose children's personal information to third parties. What leaves a child-tagged device is limited to the operational signals needed to run the app securely, such as a crash-report identifier, a messaging token if notifications are on, a device-integrity check that confirms the app is a genuine copy, and, if a map screen is opened, the standard map-image requests described under Third-Party Services, which carry the device's IP address but no account information. Because location features are disabled for under-13 users, that map shows where teams play, not where the child is. None of this is used to contact, profile, advertise to, or track the child.

If you believe a child under 13 has provided us with personal information, please contact us at the email below so we can delete it.

When We May Disclose Information

We do not sell your personal information. Beyond the service providers described above, we may disclose personal information only in these limited circumstances:

• Legal requirements. To comply with a law, regulation, subpoena, court order, or other valid legal process, or to respond to a lawful request from a government authority.
• Protection and enforcement. To enforce our Terms of Service, or to protect the rights, safety, or property of Reestir Labs, our users, or others — for example, to investigate fraud or a security incident.
• Business transfers. If Reestir Labs is involved in a merger, acquisition, financing, reorganization, or sale of some or all of its assets, personal information may be transferred to the successor or acquirer as part of that transaction. Any successor remains bound by the commitments in this Privacy Policy, or will notify you before materially changing them as described in “Changes to This Policy.”
• With your consent. For any other purpose you agree to.

These circumstances do not change the Children's Privacy commitments above — we do not knowingly hold children's personal information on our servers.

Aggregated and De-identified Information

We may create and use aggregated or de-identified information — statistics that describe how the Services are used without identifying any person, such as how many people follow a particular league. We maintain de-identified information in de-identified form, we commit to never attempting to re-identify it, and we share or publish only statistics that do not identify you.

Data Retention

We keep personal information only as long as needed for the purpose it was collected, and we delete it when that purpose ends. Our retention periods by category:

• Account information (email, account identifier) — kept while your account is active. When you delete your account — from within the app or by contacting us — it is scheduled for permanent deletion and remains recoverable for up to 30 days, so you can restore it if you change your mind or delete it by mistake. After that 30-day grace period, it is permanently erased from our active systems. Business need: to provide, authenticate, and synchronize your account across devices.
• Newsletter email address — kept until you unsubscribe.
• Push notification token — kept while notifications are enabled. Turning notifications off invalidates the token on your device, so no further notifications can be delivered to it; the registration record on our servers is removed when you delete your account.
• Crash diagnostics — kept for the limited window configured in the diagnostics tool (no account personal information is included). Business need: to diagnose and fix crashes.
• Website analytics — not currently active; if enabled, kept for the limited window configured in the analytics tool.
• Server logs — kept for a limited operational period, then automatically rotated and deleted. Business need: to keep the Services running, to detect abuse, and to investigate security incidents.
• Account activity records — kept while your account exists, and deleted automatically together with your account when it is permanently erased at the end of the 30-day recovery window described above. We do not currently apply a shorter fixed period while an account is active. Business need: to support your account, to investigate problems you report, and to detect and investigate abuse.
• In-app usage analytics — kept for 13 months, then automatically deleted. These events carry no account, device, or IP identifier, so they cannot be connected back to you or removed on request individually. Business need: to compare a season against the same point in the previous season.
• Photos processed by the optional cloud tool — not retained. The photo is processed in memory and deleted immediately once the result is returned; nothing is written to disk.
• Feedback screenshots — kept while we review your feedback and resolve any follow-up, and deleted when you delete your account or on request.
• Subscription and order records — kept as needed to provide the purchase and to meet legal, tax, and accounting obligations.

We may keep limited records beyond these periods where the law requires it (for example, order and tax records for merchandise purchases).

Children's data. We do not knowingly collect or retain personal information from children under 13. Creating an account is limited to users 13 and older, and the only other information we ask anyone for through our website is an email address for our newsletter or launch waitlist, which is not directed at children. Optional details a user enters about a player they follow (such as a nickname or relationship) remain only on the device and are never transmitted to us. The optional cloud photo tool processes a selected photo in memory and deletes it immediately, so no photo is retained. If we learn we have inadvertently collected personal information from a child under 13, we delete it promptly.

Your Rights

You have the right to:

• Access, correct, or request deletion of personal information we hold about you.
• Unsubscribe from our newsletter at any time.
• Disable push notifications through your device settings or in the app.
• Turn off in-app usage analytics at any time in the app, under Settings → Privacy & Data → “Share anonymous usage data”. Turning it off takes effect immediately and stops any events the app has not yet sent.
• Limit website analytics tracking by blocking cookies in your browser or installing the Google Analytics opt-out browser add-on.
• Delete your account from within the app or by contacting us at the email below. See our account deletion page for step-by-step instructions and what is deleted versus kept. Account deletion includes a 30-day recovery window before your data is permanently erased (see Data Retention above).

Our website does not respond to “Do Not Track” browser signals. We do not sell or share personal information, so an opt-out preference signal such as Global Privacy Control does not change how we treat your information.

How to Exercise Your Rights

To make a request, email [email protected] and tell us what you would like us to do. You can also delete your account yourself from within the app — see our account deletion page.

• Verifying who you are. So that we do not give your information to someone else, we will ask you to make the request from the email address associated with your account, or to confirm details that match our records. If we cannot verify you, we will tell you why.
• How long we take. We aim to acknowledge your request within 10 business days and to respond substantively within 45 days. If we need more time, we will tell you before that period ends and explain why.
• Authorized agents. You may use an authorized agent to submit a request on your behalf. We will ask for proof that you authorized them, and we may still ask you to verify your own identity directly.
• No charge, no penalty. Requests are free, and we will not deny you service, charge you a different price, or give you a lower quality of service because you exercised a privacy right.

Some information cannot be connected back to you and therefore cannot be retrieved or deleted individually — in-app usage analytics are the main example, because those events carry no account, device, or IP identifier.

Your US State Privacy Rights

Depending on where you live, US state privacy laws may give you the right to know what personal information we hold about you, to access a copy of it, to correct it, to delete it, and to opt out of its sale or of targeted advertising. Some states also give you the right to appeal if we decline a request.

We do not sell personal information, we do not share it for targeted or cross-context behavioral advertising, and we do not use it for profiling that produces legal or similarly significant effects — including as those terms are defined in the California Consumer Privacy Act. Because we do not do these things, there is no opt-out for you to exercise.

We never receive your precise location — the app's optional location feature works entirely on your device — and we do not collect government identifiers, biometric information, or health information.

To exercise any of these rights, follow the steps in How to Exercise Your Rights above. We will not discriminate against you for exercising them. If we decline your request and your state gives you a right to appeal, reply to our response and we will review the decision.

Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new Privacy Policy on this page and updating the “Last updated” date.

Contact Us

If you have questions about this Privacy Policy or our data practices, contact us at [email protected], or by mail at:

Reestir Labs LLC
2108 N St #16005
Sacramento, CA 95816

Path2Playoffs is a product of Reestir Labs LLC.