Top Tier ID Roster — Privacy Policy

Effective date: October 5, 2026
Last updated: October 12, 2026

This Privacy Policy explains what information Top Tier ID Roster (also called Top Tier Roster; the "Platform") collects, how we use it, who can see it, and the choices you have. It covers the website at www.toptieridroster.com and the services offered there.

The Platform is run by Top Tier ID, LLC, a California limited liability company ("we," "us," or "our"). Top Tier ID Roster is separate from the Top Tier ID recruiting marketplace at toptierid.com. This policy covers only the roster Platform.

This policy is part of our Terms of Service. If the two conflict on a privacy matter, this policy controls.

1. The short version

Coaches and club directors create team rosters. Parents and guardians submit player profiles for athletes who are 13 or older.
Roster pages are public. Anyone with the roster link or QR code can see the player profiles on it, including photos, grad year, GPA, and any contact email that was entered. A player appears only after a parent or guardian has consented. Roster pages are hidden from search engines.
College coaches may create an account to save stars and text notes. Those notes are private to that coach.
We don't sell personal information, and we don't show ads.
We use a few service providers to run the Platform: Vercel (hosting), Neon (database), Resend (password reset email), and Stripe (payments).
We use one sign-in cookie. We don't use advertising cookies or third-party analytics trackers.
The Platform is not for children under 13.
To access, correct, or delete information, email support@toptierid.com.

2. Information we collect

What we collect depends on how you use the Platform.

2.1 Coaches and club directors (account holders)

When you create an account, we collect:

Email address and password. We store your password only as a one-way hash. We never store it in readable form.
Your first and last name. For coach accounts, your name is saved as the team's coach name, which appears on the team's public roster page. For club director accounts, we save your first and last name privately. It isn't shown publicly, and we use it only for account management and support.
Team or club details: team name, club name, division, season, and team or club logos. We remove location and other embedded (EXIF) metadata from uploaded logos.
A team password that you choose and share with parents so they can submit player profiles. We store it only as a hash.

In team settings you can also add a coach email and coach phone number. If you add them, they're shown on the public roster page so college coaches can reach you.

If you use a discount code, we record the code, your account email, your club, and the price before and after the discount.

Payments: Payments are handled by Stripe (see Section 6). We receive information such as your plan, team count, billing status, and Stripe customer and subscription IDs. We don't receive or store full card numbers.

2.2 Parents, guardians, and players (age 13 and up)

Player profiles reach the Platform in one of two ways:

A parent or legal guardian submits the profile through the team's sign-up link and team password, and agrees to the Terms when submitting.
A coach adds the player from the coach dashboard. The profile stays pending and hidden from the public until a parent or guardian consents through a link the coach sends them. A pending profile is visible only to the team's coach or club director and to Platform administrators.

Coaches can also edit the profiles on their team. A player profile can include:

Full name (required)
Jersey number
Photo
Graduation year
GPA
Height
Dominant foot
Playing positions
High school
College commitment status
Contact email, which may be the player's or the parent's

Photos: Uploaded photos are stored in our database along with the rest of the profile. iPhone (HEIC) photos are converted to JPEG in your browser before upload. We remove location and other embedded (EXIF) metadata from uploaded photos.

Age check: We use graduation year to screen out players under 13. The form won't accept a graduation year that would make a player younger than 13.

Consent record: When a parent submits a profile, or consents to a profile a coach added, we keep a record that they agreed to the Terms. The record includes the date and time, the Terms version, the type of consent, and a hashed IP address (see Section 2.4). We keep similar records when coaches and club directors sign up.

We don't ask for the parent's own name or email address during profile submission, unless the parent enters their own email as the contact email.

2.3 Roster visitors, including college coaches and recruiters

You don't need an account to view a public roster. When you visit one, we log:

That the roster page was viewed
Which player profiles were opened
That a player was starred, that a note was added, or that the "email my shortlist" feature was used

Each event is stored with the team, the player (if any), a random visit ID, the time, and a hashed IP address.

Stars and notes. Visitors who are not signed in save stars and scouting notes in their own browser's local storage. Those notes aren't sent to us, and the club can't see them. We only record that a star or note happened, not what the note says.

A college coach can create an account with their name, college or program, and email. When that coach is signed in, the stars and text notes they save are stored in our database on their account. A coach can read, edit, and delete only their own stars and notes. Other college coaches, team coaches, club directors, parents, and Platform administrators cannot see them. We don't store voice notes. The first time a signed-in coach uses a browser that already has stars or notes saved on that device, we offer a one-time import into their account. They can decline, and that device-only copy stays in the browser.

Emailing one player or a whole list opens the coach's own email app and is sent from them to whatever address they choose. We don't send that email, and we don't keep a copy of it.

2.4 Information collected automatically

IP addresses. When we log analytics or consent events, we don't store your IP address. We store a salted, one-way hash of it instead. For password resets, we briefly hold the raw IP address in server memory (up to about an hour) to limit abuse, and we don't write it to our database. A hashed IP address may still count as personal information under some laws.
Server logs. Our hosting provider, Vercel, automatically processes standard request data such as IP address, browser type, the pages requested, and the time. It does this to deliver and secure the site. Vercel keeps these logs for a limited period under its standard settings and then deletes them.
Analytics tools. We don't use any third-party analytics or advertising tools.

3. How we use information

We use information to:

Create and manage accounts, teams, and clubs
Build roster pages and the QR codes and printable flyers that link to them, and show player profiles to visitors
Let parents submit and coaches manage player profiles, and let coaches lock and unlock rosters
Send password reset emails and keep accounts secure. This includes signing users out of other devices after a password reset.
Measure roster activity, such as page views, player views, stars, notes, and shortlist exports, so we can understand how the Platform is used and improve it. Only Platform administrators can see this visit analytics data.
Keep records of who agreed to the Terms and when
Prevent fraud, abuse, and security problems, and enforce our Terms
Process payments through Stripe
Meet our legal obligations

We don't sell personal information. We don't use it for targeted advertising. We don't let third parties use it for their own marketing.

4. What's public

Roster pages (addresses that start with www.toptieridroster.com/t/) are public. They have no login. Anyone with the link or the QR code can view them. Each roster page can show:

Team and club names, division, season, logos, and how many players are on the roster
The coach's name, plus the coach email and phone number if the coach added them
Each player's name, jersey number, photo, graduation year, GPA, height, dominant foot, positions, high school, commitment status, and contact email (any field that was filled in)

Only players whose parent or guardian has consented appear on a public roster. A profile a coach added stays pending and hidden until the parent consents.

QR codes and printable flyers just link to the roster page. They show the team name, club name, division, season, logo, roster link, and player count.

Please keep in mind:

Roster pages are hidden from search engines. They're marked "noindex," blocked in our robots.txt file, and left out of our sitemap. Even so, anyone who has the link or QR code can still open the page and pass it along.
Once a roster has been viewed, we can't control who saves, screenshots, or shares it. Removing a profile from the Platform won't delete copies other people have already made.
Parents should only submit information they're comfortable making public. Every field except the player's name is optional.

The Platform also has non-public areas: pending player profiles, the coach and director dashboards, the parent submission form (protected by the team password), and admin pages.

We share information only in these situations:

With the public, through roster pages, as described in Section 4.
With the team's coach or club director. Coaches and directors can see and edit the player profiles on their teams.
With our service providers, who handle data for us to run the Platform:

- Vercel hosts the website and handles web requests.
- Neon hosts our database, which stores account, team, player, photo, analytics, and consent data.
- Resend delivers password reset emails. It receives your email address and the reset link.
- Stripe processes payments. Card details stay with Stripe; we receive the billing information described in Section 6.

For legal reasons. We may share information to comply with the law or a valid legal request, to protect the rights, safety, or property of users, players, or others, or to enforce our Terms.
In a business transfer. If we're involved in a merger, acquisition, reorganization, or sale of assets, information may be transferred as part of that deal. It will remain subject to this policy or a policy that is at least as protective.
With your permission, in any other case.

Platform administrators can access account and roster data to run the Platform, provide support, and handle requests. Access is limited to administrators who need it.

6. Payments

Payments are processed by Stripe. Stripe collects your card details directly under its own privacy policy (https://stripe.com/privacy). We receive only what we need to manage your subscription, not your full card number.

7. Cookies and similar technologies

We keep this minimal:

Sign-in cookie (`ttid_session`). This cookie keeps coaches, directors, and administrators signed in. It's a secure, HTTP-only cookie that lasts up to 7 days and is cleared when you log out or reset your password. Roster visitors and parents don't get this cookie.
Browser local storage (`ttid_board_…`). For visitors who are not signed in, this stores stars and notes on their own device. It isn't sent to us. Signed-in college coaches store stars and notes on their account instead, as described in Section 2.3. A one-time flag in local storage remembers whether that browser was already asked to import device notes. You can clear local storage at any time in your browser settings.
Parent submission token. After a parent enters the team password, a short-lived token (2 hours) is held in the page's memory to authorize the submission. It isn't saved as a cookie.

We don't use advertising cookies or cross-site tracking cookies. Since we don't track you across sites, we don't respond differently to "Do Not Track" signals.

If you block cookies, you can still view public rosters, but you won't be able to sign in.

8. Security

We use reasonable technical and organizational safeguards, including:

HTTPS encryption for data in transit, plus security headers on every page
One-way hashing (bcrypt) for account passwords and team passwords
Password reset links that expire after one hour, can be used only once, and are stored only as a hash
Signing users out of other devices after a password reset
Rate limits on password reset requests
Hashed IP addresses in our analytics and consent records
Admin areas limited to authorized administrators

Our database provider, Neon, encrypts stored data at rest with AES-256.

No system is perfectly secure, and we can't guarantee that information will never be accessed without permission. If you think your account has been compromised, email support@toptierid.com right away. If a breach affects your personal information, we'll notify you as the law requires.

9. How long we keep information, and deletion

Accounts, teams, and player profiles: We keep them while the subscription is active. After a subscription is canceled or ends, we keep the associated personal information for 30 calendar days, then permanently delete it from our active systems.
Player profiles removed by a coach: When a coach deletes a player, the profile is removed from the roster and our active database, and that player's analytics events are deleted with it.
Teams deleted by a coach, director, or administrator: The team is removed from public view. Its player profiles and analytics events are deleted with it. Consent records are kept as described below.
Consent records: We keep these after the related team or player is deleted, as proof of consent. We keep them for 3 years after the related account or team is deleted, and then delete them automatically.
Analytics events: We keep these for 12 months, and then delete them automatically.
College coach stars and notes: Deleted when that coach's account is deleted, and when the player they refer to is deleted. Administrators cannot view them.
Password reset tokens: They expire after one hour. Expired or used tokens are deleted after 30 days.
Parent consent links: They expire, and expired or used links are deleted after 30 days.
Backups: Deleted data may stay in backups for up to 90 days after it's deleted from our active systems.
Server logs: Our hosting provider, Vercel, keeps these for a limited period under its standard settings and then deletes them.

Removing a player profile: A parent or guardian can ask us to remove their child's profile at any time. Email support@toptierid.com with the subject line "Player Data Deletion Request." Include the team name and the player's name. We'll remove the profile from the public roster within 72 hours of receiving a valid request, and we'll permanently delete the stored data within 30 calendar days, except for consent records we keep as described above. A parent can also ask the team's coach to delete the profile.

Deleting an account: There's no self-serve account deletion right now. To close your account and delete its data, email support@toptierid.com.

10. Your rights and choices

No matter where you live, you can:

Access the personal information we hold about you or your child
Correct information that's inaccurate. Coaches can edit player profiles and team settings directly.
Delete your information, or your child's player profile
Choose what to share. Only the player's name is required on a profile. Coach email and phone are optional.

To make a request, email support@toptierid.com. We may need to confirm your identity, or your relationship to the player, before we act on a request. For example, we may ask you to confirm details about the team. We'll respond within the time the law requires, or within 30 days if no law sets a deadline.

If a coach or club entered your child's information, you can also contact the coach directly. We'll still help if you contact us.

11. Children's privacy

The Platform is not directed to, intended for, or designed for children under the age of 13. We do not knowingly collect, solicit, or retain personal information from children under the age of 13. If you are under 13, you may not access or use the Platform in any capacity. Coaches and club directors may not add players under 13, and the sign-up forms don't accept graduation years that would make a player younger than 13.

If we learn that we've collected personal information from a child under 13, we'll promptly delete it. If you think this has happened, email support@toptierid.com with "COPPA DELETION REQUEST" in the subject line.

Players aged 13 to 17: A parent or legal guardian must consent through the Platform's parent consent process before a player's profile appears on a public roster. If a coach adds a player, the profile stays pending and hidden from the public until a parent or guardian consents through the link the coach sends. Coaches, club directors, and parents who submit profiles must be 18 or older.

12. Privacy rights under U.S. state laws

Depending on where you live, state privacy laws may give you more rights. These can include the right to:

Know what personal information we collect, use, and disclose, and get a copy of it
Correct inaccurate personal information
Delete personal information
Opt out of the "sale" or "sharing" of personal information, targeted advertising, and certain profiling
Not be discriminated against for using these rights

We don't sell or "share" personal information (as those terms are defined in laws like the California Consumer Privacy Act). We don't use it for targeted advertising, and we don't use it for profiling that produces legal or similarly significant effects.

To exercise any of these rights, email support@toptierid.com. You may use an authorized agent if your state allows it. We may ask the agent for proof that you authorized them, and we may need to verify your identity. If we deny your request, you may be able to appeal by replying to our decision with "Appeal" in the subject line. If your state gives you the right, you can also contact your state attorney general.

Some of these laws apply only to businesses above certain size or revenue thresholds. We offer these rights to everyone anyway.

13. Changes to this policy

We may update this policy from time to time. When we do, we'll post the new version here and change the "Last updated" date. If we make material changes, such as turning on payments, adding a new analytics tool, or changing what appears on public rosters, we'll give notice on the Platform or by email to account holders before the changes take effect.

14. Contact us

The only way to reach us about privacy is by email. Send questions, requests, or concerns to support@toptierid.com.

Top Tier ID, LLC
Email: support@toptierid.com
Website: www.toptieridroster.com

This policy is governed by the laws of the State of California, consistent with our Terms of Service.