Privacy policy
The short version. Hashmark keeps what a football team needs to plan, practice and play, and nothing more. We don't sell data, show ads or track you around the web. Your playbook belongs to your team.
Who we are
Hashmark (usehashmark.com) is run by Vantry LLC, 2524 Van Beek Road, Green Bay, WI 54311, USA. Questions about privacy: [email protected].
Two kinds of information
- Your account and billing. Hashmark decides how this is used (Hashmark is the "controller").
- Your team's information: playbook, roster, game logs, stats, practice, injuries and absences. The team (the club, school or coach who runs it in Hashmark) decides what goes in and who can see it. Hashmark stores it for the team (Hashmark is the "processor", under section 14 of our terms). Questions about a team's records go to that team's coaches first; we help them answer.
What we keep
| What | Examples | Why |
|---|---|---|
| Account | Email address, name, your password if you set one (stored only as a one-way scrambled hash), when you signed in, the kind of device for each cloud backup ("iPad") | To sign you in and keep your account safe |
| Free trial record | A one-way hash (SHA-256) of the email that started a free trial, not the email itself, and when the trial was used | So each person gets only one free trial |
| Team and membership | Team name, who is on it, each person's role, title and sides (offense, defense, special teams), join requests, invites, join codes | To run the team: approvals, roles, who sees what |
| Joining details | For a person asking to join: name, jersey number, chosen role, age group (under 13, 13 to 15, 16 or older); for 13 to 15: a parent's email and their answer | So a coach can approve the right person, and so we follow the law for young players |
| Playbook and team records | Plays and drawings, call sheets, wristbands, practice plans, scouting, game logs, stats, depth charts, roster (names, numbers, positions), attendance and grades, quiz answers and scores, and what players and staff send to the coaches (snaps, injury reports, "I can't make it") | The service itself |
| Injuries and absences | Status (out, doubtful, limited ...), a reason (injury, illness, work, school ...), an expected return, a short note | So coaches plan around who is available. Teams should keep notes short and never write diagnoses. |
| Plays you share (only if you choose to) | For each play you share with the community: the call, its type, formation and concept tags, and the drawing. Linked to your account, but never shown with it. Reports other coaches send about a shared play. | So other coaches can find the play and add it to their library, and so you can change or take back what you shared |
| Billing | Plan, monthly or yearly, renewal date, payment status, our reference to the Stripe customer | To take payment and give access. Card numbers go straight to Stripe; Hashmark never sees or stores them. |
We don't ask for birthdates or home addresses. Coaches can add a player's email and phone for team messages; only coaches see them.
Who in a team sees what
Inside a team, each role sees only what it needs. Coaches decide each person's role and sides.
| Role | What they see |
|---|---|
| Coaches | The team's playbook and records, as their role and sides allow, including injury reports, attendance, quiz answers and scores, and players' contact details |
| Players | The playbook for their sides; the wristband and installs once a coach sends them; the schedule; the depth chart; the team calendar, except events marked "Staff only" |
| Statisticians | Snap calls and the box score |
| Trainers | The injury report and attendance |
| Broadcasters | Depth charts, rosters and the game box score |
When a player answers a quiz, the answers and the score go to the coaches. Other players don't see them.
On your device
Hashmark saves your playbook in your browser's own storage, so it works with no signal on game day, once it has been opened on that device. It also remembers small settings (language, last tab, your sign-in). This is storage the app needs to work. We use no advertising or tracking cookies and no analytics tools.
Plays you share with the community
Hashmark has a play bank where coaches can find starter plays and plays other coaches share. Sharing is off for every play unless you turn it on yourself, one play at a time, in the play editor.
- What becomes public: the play's call, its type, formation and concept tags, and its drawing. Anyone can see a shared play, and any coach can add a copy of it to their own library.
- What never goes with it: your name, email, team, roster, notes, situations, game results, or anything else in your playbook. Other coaches can't see who shared a play. Only plays drawn in Hashmark can be shared, so pictures you uploaded never go up.
- Taking it back: turn sharing off for the play, or delete the play, and it leaves the play bank right away. Deleting your account takes back everything you shared. Copies other coaches already added to their own libraries stay with them.
- Reports: a signed-in coach can report a shared play that isn't a football play, is rude, copies someone else's work without permission, or has someone's private information in it. We record which account sent each report, so it counts only once. A play reported 3 times is hidden until we look at it, and we may remove plays that break our terms. Anyone can also report a play by email; section 6 of the terms explains how.
- Don't put anyone's name or personal information in a play you share.
Who helps us run Hashmark
These companies process information for us, only to provide their service, under data processing agreements:
| Company | What for | Where |
|---|---|---|
| Supabase | Database, sign-in, file storage, server functions | Ireland (EU), on Amazon Web Services |
| Cloudflare | Hosting the website and the app, our domains, forwarding our email | Global network |
| Resend | Sending emails (sign-in codes, invites, parent emails, daily summaries) | European Union and United States |
| Stripe | Payments, invoices, fraud checks | United States and European Union |
Hashmark serves its own typefaces, so no font request goes to Google. A drill video from YouTube or Vimeo loads only when you press play; then that site gets your IP address, as it does for anyone who watches there.
If you turn on voice entry on Game Day, your browser sends what you say to its own speech service (Google for Chrome, Microsoft for Edge, Apple for Safari) to turn it into text. Hashmark gets only the text. Voice entry is off unless you turn it on.
When information goes to the United States, it is protected by the European Commission's Standard Contractual Clauses or the EU-US Data Privacy Framework.
We never sell or rent personal information, and we don't share it for advertising. We only disclose it if the law requires us to.
Young players
- Hashmark accounts are not for children under 13. A coach can list a younger player on the roster, but that player has no account.
- Players aged 13 to 15 need a parent or guardian's OK before joining. We email the parent a link to approve or decline; until they approve, the player sees nothing from the team.
- A parent can take the OK back at any time with the link in that email. That deletes the player's account.
- A coach also approves every player before they join a team.
How long we keep it
- Your account: until you delete it (Settings, Team & people, Delete my account). Then your email, name and sign-in are deleted.
- Free trial record: only the one-way hash of the email is kept, never the email, so we can tell a second trial from the same email. It can't be turned back into the email.
- Team records about you (for example your stats or attendance) belong to the team and stay with it, no longer linked to an account.
- Messages to the coaches (snaps, "I can't make it" and its reason, injury updates in the team inbox): deleted 30 days after they are sent. What a coach copies into the team's records stays with the team.
- Cloud backups: the newest copy, one an hour for a day, one a day for 30 days, and copies you make by hand until the team deletes them.
- A deleted team: its records and files are deleted.
- Shared plays: until you take them back or delete your account. Reports about a play are deleted with it.
- Join requests and invites: a request is kept until a coach answers it, and deleted 30 days after the answer. Invites end after 14 days, and are deleted 30 days after they end or are used.
- Feedback (the Feedback button: what you write, the email you add if you want an answer, the screen you were on, your language and the app version): deleted after one year.
- Age group (13 to 15, or 16 and older, given when joining a team): kept with your account, so the answer can't be changed later, and deleted with it. Records of sign-in and join attempts, kept to stop abuse, are deleted after 2 days.
- Parent email log: the record that we emailed a parent (so the same parent isn't emailed again and again) is deleted after 2 days.
- Billing records: as long as tax and accounting law requires.
Why we're allowed to use it (for people in the EU and UK)
- To provide the service you signed up for (contract): your account, your team, payments.
- Legitimate interests: keeping Hashmark secure, preventing fraud and abuse (including one free trial per person), fixing problems.
- Consent: a parent's OK for players aged 13 to 15, voice entry, and each play you share with the community. You can take consent back at any time.
- Legal obligations: tax and accounting records.
- Injury and absence information is health information; the team records it for its players, and Hashmark keeps it only to provide the service to that team.
Your rights
You can ask to see, correct, export or delete your information, to limit or object to how it is used, and to take back consent. Much of it you can do yourself in Hashmark: change your name, export a full copy of the playbook, delete your account. For anything else, email [email protected]; we answer within 30 days. If something is about a team's records, we may pass your request to that team's coaches.
In the EU or UK you can also complain to your data protection authority (in France, the CNIL). California residents: we don't sell or share personal information, and you have the rights above as well.
Keeping it safe
Everything travels encrypted (HTTPS). Database rules let people see only their own teams, and within a team only what their role allows. Passwords are stored only as hashes. No system is perfectly secure; if a breach affects you, we tell you and the authorities as the law requires.
Changes
If we change this policy in a way that matters, we tell account owners by email or in Hashmark before it takes effect. The date at the top shows the latest version.