← Back to app

Privacy Policy

Last updated: October 14, 2026

1. Who we are

EvenSides is a software platform operated by EvenSides LLC, a Massachusetts limited liability company ("we," "us," "our"). The platform is accessible at evensides.com.

For privacy questions or requests: privacy@evensides.com

This policy describes what personal data we collect, why, and what your rights are. By using the platform, you agree to the collection and use of information as described here.

2. What we collect

We collect only what's needed to run the platform.

You give us directly when you sign up and create a profile:

• Name (first and last)
• Email address (used for sign-in and transactional notifications)
• Phone number (optional; organizers of your groups can see it for on-field coordination)
• Date of birth (required; we use it to confirm you are 18 or older. Organizers of your groups see your age in years, not your date of birth. Other players see neither.)
• City or town (organizers of your groups can see it)
• Profile photo (required, used by organizers and other players to recognize you on the field)
• Sport profile information: the positions you play and, for soccer, your dominant foot, years played, and league experience. If your group plays another sport, the positions you pick for that sport
• Your answers to the short skill questionnaire you complete when you join a group (for example, how long and how often you have played and at what level). We use them to set your starting skill rating.
• Gender. We ask you to select Male, Female, or Prefer not to say. Your selection may have been pre-filled from information your group gave us, and you can change it at any time in your profile settings. We collect it so we can offer gender-aware team balancing in the future; no team balancing uses it today. It is not shown to other players or organizers.
• Free-text notes you choose to share with organizers

You create while using the platform:

• Your RSVPs to games, including the names of any guests you bring and whether you tick that you are bringing beer
• Teammate preferences (players you would like to play with or avoid), if your group uses them
• Peer ratings and MVP votes you give after games, and the ratings you receive
• Messages you send with a request to join a group
• Reports you file about a player or a problem, including any photos or videos you attach
• Results you report after a game (the score and outcome for your team), and, if you paid for a game, a report that the game did not happen, with an optional note
• Notifications in the app, and announcements organizers send to you
• The versions of the Terms of Service and the Community Rules you accepted, and when you accepted them
• If you use the calendar feed: a private link to a feed that lists your games, their venues, and whether you are playing or on the waitlist. Anyone who has the link can read the feed, so share it only with a calendar app you trust.
• If you link Telegram: your Telegram user ID and username
• If an organizer invites you by email: the name and email address the organizer entered, used to send the invitation

We collect automatically when you use the platform:

• Authentication data via Supabase: login timestamps, session tokens, and the IP address and browser string of each signed-in session. Supabase's own authentication logs are kept under Supabase's retention settings.
• Sign-in via Google OAuth (if you use it): your Google email and basic profile info
• Sign in with Apple (if you use it, in the iOS app): Apple's account identifier for you, and the name and email address you choose to share. If you choose Hide My Email, the address is a private relay address that forwards to your own inbox. We also keep the sign-in token Apple issues to us, only so we can revoke it when you delete your account.
• When you accept the Participant Agreement: the time, the document version and a fingerprint (hash) of the exact text you accepted, the channel you accepted through (website, app, email link, or Telegram), and, where the channel provides them, your IP address and your browser's user-agent string. If you accept through Telegram, your Telegram user ID and the message you tapped are recorded instead. These are kept as the record that you agreed, and every acceptance is kept, not only the latest. When you accept the Terms of Service we keep the version, the time, and your IP address; for the Community Rules, the version. For the organizer agreement we keep the time and your IP address.
• Server logs related to errors and abuse prevention (IP address, browser, request paths)
• On our website only: aggregate, cookieless page-view and performance measurements via Vercel Web Analytics and Vercel Speed Insights (see section 5). The mobile apps do not include them.
• Search terms organizers type into the organizer feature search, stored with the group and not with anyone's account, to improve search. We delete them after 180 days.
• If you sign up as an organizer, on our website or in the app: a Cloudflare Turnstile check, and your IP address, kept to limit repeated sign-up attempts and deleted after 30 days

If you pay for a game, or if you are an organizer who gets paid for one:

• Payment records. When you pay, we send Stripe your email address, so Stripe can send your receipt, and our game and player identifiers, so the payment matches the right game. For each game you pay for we keep the amount, the currency, the status (paid, refunded, released, disputed), the Stripe identifiers for the charge and any transfer or refund, the processing fee, and the timestamps. These are linked to your player account. We need them to know what you paid, to refund you, and to keep our own books.
• Card details: we never see them. Your card number is entered on Stripe's own checkout page, not ours. EvenSides does not receive or store your full card number at any point.
• Organizer identity verification. If you are an organizer enabling paid games, Stripe collects what the law requires it to collect to pay you: your legal name, date of birth, home address, government identification (which may include the last four digits of a Social Security number), and your bank account details. You give this to Stripe directly through their hosted onboarding. EvenSides never sees or stores it. All we keep is your Stripe account identifier and whether Stripe has cleared you to receive transfers.
• What appears on a receipt. Stripe emails a receipt for a game payment. It carries the EvenSides business support address, which is public information about the company. It does not carry your organizer's home address or any of the identity data above.

We do not collect:

• Tracking pixels, or analytics that follow you across other websites or build a profile of you
• Advertising or third-party tracking cookies
• Your device's location. The only location we hold about you is the city you type in; game venues are set by organizers.
• Contacts, calendars, or other data from your phone. The app uses your camera or photo library only when you choose a photo to upload.

3. About profile photos

A profile photo is required to use EvenSides. Organizers build teams quickly with players they may not know personally, and a photo helps them and other players recognize you on the field.

You do not have to use a photo of your face. Acceptable photos include face photos, side profiles, photos showing you in your sport's gear, or any image that meaningfully aids in-person recognition. We do this so that players who prefer not to display a face photo (for religious, personal, safety, or any other reason) can still participate.

What's not acceptable: blank avatars, default placeholders, photos of other people, photos of pets or objects, celebrity photos, or images so distant or low-quality that nobody could recognize you from them. We may ask you to replace a photo that does not reasonably support recognition.

We do not perform facial recognition or biometric processing on profile photos. Photos are stored and displayed only. They are not analyzed by automated systems to identify, classify, or match faces.

Profile photos are stored at an unlisted web address. Anyone who has that address can open the photo, so choose one you are comfortable sharing with your group.

If you no longer wish to have a photo on the platform, you must delete your account. The photo cannot be removed while keeping your account active.

4. How we use your data

We use your data to:

• Create and maintain your account
• Show your name and photo to organizers and other group members
• Let organizers build balanced teams using your skill rating, positions, and dominant foot, and, if your group uses them, teammate preferences and ratings set by organizers. Your starting rating in a group comes from your questionnaire answers, your organizer's assessment, or a neutral default; after that, scored games, peer ratings, and MVP votes move it. Ratings stay inside each group and are not shared between groups, with one exception that is yours to choose: when you join a new group you can tick "Use my skill level from [group name]" to start there at the skill level you already have in your best-rated other group, instead of answering the skill questions. The box is unchecked by default. If you tick it, the new group's organizers see that your level was carried over and see that level as your starting rating, but not which group it came from, and we record your choice and the time you made it. Players never see a rating number or tier for it.
• Send you transactional emails (game RSVPs, reminders, account notifications) and sign-in emails (sign-up confirmation, magic links, password reset) via Brevo
• Send notifications via Telegram if you or your group link it: posts in your group's Telegram chat (RSVP invites, team lists with short names such as "Alex B.", reminders) and direct messages to you (for example, organizer announcements, cancellations, and a request to accept an updated Participant Agreement). Your group's Organizer decides who is in that Telegram chat; anyone they admit can see those posts, including your short name and RSVP, whether or not you use Telegram yourself
• Show a small map of your group's venue, and look up venue addresses that organizers type in
• Send a weather forecast for your group's game venue before a game
• Pass reports to your group's organizers or to EvenSides support, and keep records of the reports and of any action organizers take
• Investigate abuse, technical problems, or violations of our Terms
• Take payment for a game you reserve a spot in, refund it when the rules in the Terms call for that, and pay your organizer their share after the game

We do not sell your data. We do not share your data with advertisers. We do not show you ads. We do not use your data to train AI models.

5. Who sees your data

EvenSides provides the software. Organizers run their own groups and games and are responsible for them, including for how they use the information they can see about the players in their group.

Within your group: Other members of groups you join can see your name, photo, positions, dominant foot, the number of games you have played, and, if the group shows tiers, your skill tier (Bronze to Master). If an organizer has marked you as a donor, members also see a heart next to your name on team lists. Your exact skill rating, date of birth, phone number, city, email address, and notes to organizers are not shown to other players.

Organizers: Organizers of your groups can also see your age in years (not your date of birth), city, phone number, notes you share with them, years played and league experience, your Telegram username if you linked it, your exact skill rating and rating history, your conduct record in the group, and whether you have signed the waiver. When you ask to join a group, its organizers see the email address and profile details on your request. Organizers never see your gender.

Guest estimates: When an organizer adds or rates a guest for a game, the skill estimate (1 to 10) is entered by the organizer, used only to balance that game's teams, stored with the game's teams, and never linked to an account.

Third-party service providers we use:

• Supabase - database and authentication (Privacy Policy)
• Vercel - web hosting (Privacy Policy)
• Vercel Web Analytics and Speed Insights - aggregate traffic and page-performance measurement. It records the page you visited, referrer, country, device type, browser, operating system, and page load timings. It does not set cookies, does not store an identifier on your device, and does not track you across other websites. Used on our website only; the mobile apps do not include them (Privacy Policy)
• Brevo - email delivery: our game and account emails, and the sign-in emails Supabase Auth sends through Brevo's SMTP relay (Privacy Policy)
• Telegram - posts in your group's Telegram chat and direct messages to you, if you or your group link Telegram. Telegram receives the message text, which can include your short name (Privacy Policy)
• Google - if you sign in with Google OAuth (Privacy Policy)
• Apple - if you use Sign in with Apple in the iOS app (Privacy Policy)
• Stripe - organizer subscription billing on our website, player payments for individual games, and identity verification and payouts for organizers who get paid. Stripe receives your card details directly, your email address and our game and player identifiers when you pay for a game, a billing name and address for organizer subscriptions, and, for organizers, the identity and bank information described in section 2 (Privacy Policy)
• Cloudflare - Turnstile bot check when you sign up as an organizer, on our website or in the app. Receives your IP address and browser details (Privacy Policy)
• Mapbox - map images of group venues. Your device requests the image directly, so Mapbox receives your IP address and the venue location (Privacy Policy)
• OpenStreetMap Foundation (Nominatim) - turns venue addresses that organizers type in into map coordinates. Receives the address, and the organizer's IP address when they search (Privacy Policy)
• Open-Meteo - weather forecasts. Receives only the venue's coordinates (Terms and Privacy)

These providers process data on our behalf. Each is bound by its contract with us to protect your data and to use it only to provide its service to us.

We will share data with law enforcement if required by valid legal process.

6. How long we keep your data

We keep your account data while your account is active.

Deleting your account. You can delete your account yourself at any time: tap Delete account at the bottom of your Profile, then tap Delete account again to confirm. This is the only deletion option in the app. When it completes:

• Your name, photo, phone number, date of birth, city, gender, notes to organizers, Telegram link, and the waiver signature details on your profile (time, version, IP address, and browser string) are removed, and your photo file is deleted.
• Your sign-in account, including your email address, is deleted. You can sign up again later with the same email. That creates a new account with none of your old data.
• If you signed in with Apple, we revoke the connection with your Apple ID and delete our stored copy of the token Apple issued to us.
• You are taken out of any games that have not been played yet.
• You are removed from your groups. Your past game records stay as an anonymous record.
• Copies of your name and email in our activity records, invitations, and pending approval requests are removed.
• Your in-app notifications and your calendar feed link are deleted.
• Your questionnaire answers are deleted, and so are teammate preferences you set and teammate preferences other players set about you.

What stays. Games you have already played stay as an anonymous record. The game, the teams, the scores, and your ratings remain, shown under "Deleted user" with no name, photo, or contact details, so other players' game history stays complete. Messages already delivered to other people, such as emails, Telegram posts, and notifications, are not recalled.

These records are also kept after you delete your account:

• Your sport profile (positions and, for soccer, dominant foot, years played, league experience), on the anonymous record with no name attached
• The record that you accepted the Participant Agreement: the version, a fingerprint of the exact text, the time, the channel, and the IP address and device information captured with it. We keep it, with your name removed, for 4 years after your last game so that we and your Organizers can show what you agreed to if a claim is made
• Your group waiver acceptances: which group, which waiver version, when, and how you accepted
• If you accepted the organizer agreement: the time you accepted it and your IP address
• Peer ratings and MVP votes you gave or received, on the anonymous record
• Reports and their attachments, and messages you sent with join requests
• Your conduct record in each group (warnings, suspensions, bans, and the reasons recorded for them) and the versions of the Terms of Service and the Community Rules you accepted, and when
• Your RSVPs to games already played (without guest names), results you reported after a game, and reports that a paid game did not happen, on the anonymous record
• A donor mark, if an organizer set one

If you hold a paid spot in a game that has not been played yet, the app asks you to cancel it first. If you organize a group with an active subscription, the app asks you to cancel the subscription first. If you own a group, the app asks you to transfer ownership to another organizer first, or to email us. If you are the organizer named on a minor participation waiver, the app cannot delete your account; email privacy@evensides.com and we will complete the deletion. If you cannot use the app, email privacy@evensides.com from the address you sign in with. We verify the request matches the account, complete the deletion within 30 days of confirming your identity, and email you when it is done.

Some data may persist in encrypted backups for up to 90 days after deletion. Server logs are retained for up to 90 days for security and debugging purposes.

Our activity records are deleted automatically after 2 years, except records of conduct actions, reports, organizer and role changes, group ownership transfers, membership decisions (removals, rejected requests, roster links and merges), group archiving, and agreement acceptances, which are kept with no time limit. Your name and email are removed from activity records when you delete your account. Organizer sign-up attempt records (IP address) are deleted automatically after 30 days, and organizer search terms after 180 days.

Minor waiver consent records (section 8) are kept as legal records. They are not linked to any player account and are not deleted when a player account is deleted.

Payment records are not deleted. If you ever paid for a game, the payment record described in section 2 survives account deletion. It holds no name or email of its own: what remains is an amount, a date, a status, and Stripe identifiers, linked to the anonymous record. We keep these because we are required to retain financial records, and because a refund or a bank dispute can arrive after an account is gone.

Disputed payments. If a payment was disputed with a bank, we captured the payer's name, email, and any guest names with that payment when the dispute opened, so we can respond to it. That copy is kept after the account is deleted.

Stripe keeps its own copy. Stripe retains its records of any payment or payout independently of us, under its own retention obligations as a regulated payment processor. Deleting your EvenSides account does not delete those, and we cannot delete them on your behalf. To ask Stripe about data it holds, see Stripe's Privacy Policy.

7. Your rights

You can:

• See your data: visit your profile to view what we have. For anything not visible there, email privacy@evensides.com.
• Correct your data: edit your profile directly, or email us.
• Delete your account: use the Delete account button in your Profile (section 6 describes what it removes and what stays), or see /deletion if you cannot access the app. Requests submitted by email are completed within 30 days.
• Replace your photo: edit your profile to upload a different one at any time.
• Export your data: email privacy@evensides.com and we will provide a copy of your account data within 30 days.
• Withdraw consent: turn game emails off in your profile or with the unsubscribe link in any game email; unlink Telegram from your profile; or delete your account.

We do not send advertising or newsletters. Players receive emails about their games and account only. Organizers also receive emails about their own group's free trial and subscription, which may show our prices, because those are part of running a group. Game emails (RSVP invites and reminders, team lists, weather, rating prompts) can be turned off in your profile or with the unsubscribe link in any of them. Emails about your account, a payment, a cancellation, a conduct action, or a report are sent whether or not game emails are on.

If you are in California, the EU, or another jurisdiction with specific privacy rights, we will honor reasonable requests under applicable law to the extent practical for a small platform.

8. Age requirement

You must be at least 18 years old to hold an EvenSides account. Minors never have accounts, profiles, skill ratings, or any presence on the platform as players. The Participant Agreement that adult players accept does not cover a minor. Whether a minor may take part is the Organizer's decision, and the Organizer is responsible for obtaining the parent or guardian's consent.

A parent or legal guardian who is present at a game may sign a participation waiver on behalf of a minor. This is the minor participation waiver (version PM-4-2026). It can be signed online through our waiver form, or on paper directly with the group organizer.

When the online form is used, we store a consent record containing: the minor's name and age, the parent or guardian's name, the parent's phone number, an emergency contact, the group and game date the waiver covers, the photo consent choice, the parent's attestation that they were present, the parent's typed signature, the waiver version, a timestamp, the IP address the form was submitted from, and the browser user-agent string.

These records exist to document that consent was given. They are not player profiles. They do not create an account, a login, or a roster entry for the minor, and they are not visible to other users. Only the organizers of the group the waiver was signed for and EvenSides administrators can see them.

We do not otherwise knowingly collect data from anyone under 18. If you believe a minor has signed up, contact privacy@evensides.com and we will delete the account.

9. Security

We use industry-standard security measures including HTTPS, hashed passwords (via Supabase Auth), and access controls. No system is perfectly secure. If we learn that someone gained unauthorized access to personal data we hold about you, we will tell you without unreasonable delay, and we will notify regulators where the law requires it.

10. International users

The platform is operated from the United States. If you use it from outside the US, your data is transferred to and stored on US-based servers.

11. Changes to this policy

We may update this policy from time to time. Material changes will be communicated through the platform or email. The "Last updated" date at the top will reflect the most recent revision. Continued use after changes take effect constitutes acceptance.

EvenSides LLC is a Massachusetts limited liability company.