Skip to main content

Privacy Policy

Last updated: August 2026

This Privacy Policy explains how Rosterly ("we", "us", or "our") collects and uses personal information through our services and websites. Personal information means information about an identifiable individual.

This Privacy Policy applies globally, but we have included additional information below for residents of the European Economic Area, the United Kingdom, Switzerland, and California.

This Privacy Policy does not apply to de-identified or anonymous information.

1. What information do we collect and why?

When you create an account as an athlete

We collect your name, email address, school, graduation year, sport, position, height, weight, bio, and performance statistics. We collect this to build your athlete profile and share it with prospective university recruiters.

When you create an account as a coach

We collect your name, email address, and organization affiliation. We verify your association with an accredited university before granting access to athlete profiles.

When you use our platform

We collect information about how you use our services, including pages visited, features used, and actions taken. We use this to improve our platform and provide a better experience.

We use PostHog (a product-analytics provider) for usage analytics, feature management, and session replay — a reconstruction of your on-screen activity that helps us diagnose issues and improve the product. Session replay applies masking: text you see and values you type into forms are redacted, and sensitive areas are blocked from recording. We do not attach your name, email, or date of birth to any analytics or recording. Analytics and session replay run only after you accept cookies; if you decline, nothing is collected by PostHog.

Authentication

We use Clerk, a third-party authentication provider, to manage sign-in and account security. Clerk may collect additional information as described in their privacy policy.

2. When and why do we share personal information?

We share your information in the following circumstances:

Athlete profiles

If you are an athlete and enable profile visibility, your profile information is shared with verified coaches at accredited universities who have onboarded to our platform. Your profile is not publicly accessible on the internet.

Service providers

We share information with third-party service providers who perform functions on our behalf, such as hosting, authentication, and analytics. These include Clerk (authentication), Nylas (email and calendar integration for coaches who connect an account — see the "Google user data" section below), PostHog (US-based; product analytics, feature flags, and masked session replay), OpenAI (automated extraction of academic data from documents athletes upload, via FileGraph, our document-processing service), and Anthropic (AI-assisted categorization of communications that coaches sync through the optional email integration). Analytics traffic is routed through our own domain, and PostHog receives no name, email, or date of birth. Neither OpenAI nor Anthropic uses your information to train AI models.

Legal requirements

We may share information with regulators, authorities, and enforcement agencies where we are under a legal duty to disclose your personal data or to protect our rights, property, and safety.

Business transfers

We may share information in connection with a merger, acquisition, or sale of assets, in which case your information may be transferred to the acquiring entity.

3. Google user data (email & calendar integration)

Coaches may optionally connect a Google account so Rosterly can organize their recruiting communications. The connection is made through Nylas, our email-integration provider, using Google's OAuth consent flow. We request the following Google scopes, and use each only for the purpose described:

  • Basic profile (openid, email, profile): to identify the connected account and display which mailbox is linked.
  • Read Gmail messages (gmail.readonly): to build the communication timeline that shows a coach their own email conversations with athletes they are recruiting. We store message metadata and snippets; full message bodies are fetched on demand when the coach opens an email.
  • Send email (gmail.send): to send scheduling invitations from the coach's own mailbox when they schedule a call with an athlete.
  • Calendar list (calendar.readonly): to see which calendars exist on the account so we know where to read and write meeting events.
  • Calendar events (calendar.events): to create and update meeting events on the coach's calendar and reflect athlete RSVPs.

Rosterly's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

We do not use Google user data to develop, improve, or train generalized artificial intelligence or machine-learning models, and we do not transfer Google user data to third-party AI tools for that purpose. Our AI-assisted categorization of synced communications runs through Anthropic's API under terms that prohibit the use of that data for model training. Google user data is never sold, never used for advertising, and is only visible to coaches within the connected coach's own program. Disconnecting the integration stops all syncing, and deleting a connection removes the synced data from Rosterly.

4. How do we keep your personal information secure?

We implement administrative, technical, and physical security measures to protect your information:

  • Encryption: Data encrypted in transit and at rest
  • Access control: Authentication and least-privilege access
  • Protected servers: Data stored on servers not publicly accessible
  • Audit logging: All data changes are logged for accountability

No data storage or transmission is without risk. We cannot guarantee absolute security, but we take reasonable measures to protect your information.

5. Where do we store your personal information?

Rosterly stores your data in the United States. Some of our service providers may be based outside of your jurisdiction. When we transfer your personal information, we ensure it receives appropriate protection as required by law.

6. How long do we keep your personal information?

We keep your information as long as your account is active or as needed to provide services. After account deletion, we may retain certain information as required by law or for legitimate business purposes. We may use anonymized information indefinitely to improve our services.

7. What are my rights?

Access and correction

You can access and update your profile information through your account settings. To request a copy of all personal information we hold about you, contact us.

Deletion

You can request deletion of your account and associated data by contacting us. Some information may be retained as required by law.

Profile visibility

You control whether your profile is visible to university recruiters through your account settings. You can disable visibility at any time.

Analytics and session replay consent

Product analytics and session replay run only after you accept cookies. The cookie banner gives you an explicit choice — Accept or Decline. If you decline, or have not yet answered, nothing is collected by PostHog. Session recordings are masked (the text you see and the values you type are redacted, and identifying areas are blocked), and we never attach your name, email, or date of birth. If you request erasure of your account, your analytics profile and any session recordings associated with you are also deleted.

8. Additional rights for European residents

In addition to the rights above, European residents may also be entitled to:

  • Restrict processing: Request that we limit or cease processing your information
  • Portability: Request transfer of your information to another organization
  • Object: Object to how we are using your personal information
  • Withdraw consent: Withdraw consent to our handling of your personal information

9. Additional rights for California residents

If you are a California resident, you can:

  • Request what personal information we have about you
  • Request deletion of your personal information
  • Request that we stop selling your personal information (we do not sell personal information)

10. Third-party links

Our platform may contain links to other websites that we do not operate. We have no control over such websites and no responsibility for how they handle your information.

11. Changes to this Privacy Policy

We may update this Privacy Policy from time to time. Changes will apply to information collected from the date we post the revised policy. The date of the last revision is shown at the top of this page.

12. Contact us

If you have questions about this Privacy Policy or want to exercise your data rights, contact us at:

Email: privacy@joinrosterly.com