Privacy Policy
This policy explains what personal data Chicago Floorball LLC ("the club") collects through this site, who processes it, how long it is kept, and what stays after you delete your account.
What the club collects
- Account. Your first and last name, your email address and whether it is verified. Your password is held by Firebase Authentication, and the club doesn't store it.
- Optional profile details. A phone number, a home address and links to your social profiles, if you add them.
- Legal acceptances. Which version of each document you accepted, when, and from which IP address.
- Bookings and attendance. The classes you register for, your cancellations, and whether you attended or were marked as a no-show.
- Payments. Your email address, your first name, amounts, refunds, disputes and Stripe's references for them. You enter your card details on Stripe's hosted page, and they don't reach the club's servers.
- Signed waivers. Your full legal name, email address, date of birth, signature, IP address, browser user agent, the time of signing and a hash of the waiver you signed. You also give a mobile phone number and the name and phone number of an emergency contact. The mobile phone number is saved to your profile as well. The emergency contact's name and phone number are used only to reach them in an emergency during a class and are kept as part of the signed waiver record; please let your contact know you have listed them. The club records when you opened the waiver, when every page of it finished loading on your device, when you reached its end, and how long you spent in the viewer before signing. It records the date your signature covers through, and keeps the signed PDF.
- Media opt-outs. Whether you asked the club not to use photos, video or recordings of you, how you asked (on the waiver form, in writing or in person), and when. Each change is kept as a separate record.
- Age checks. Attempts to sign a waiver with a date of birth under 18, including the date of birth entered, the IP address, and any admin review note.
- Email records. Which messages were sent, with a hash of the recipient's address instead of the address itself.
- Analytics. The club uses Google Analytics on chicagofloorball.com and on this site to measure visits and bookings. Google Analytics records the pages you view and the page you came from, each without the part of the address after "?", the page titles, your device, browser and screen size, and your approximate location, which Google works out from your IP address. It also records when you create an account, start a checkout, complete a booking and sign a waiver, with the booking amount and the booking's reference number. The club sends Google no name, email address, phone number or date of birth.
- Technical data. Your IP address, used to limit request rates, and server logs. Google Cloud's request logs record the URL, IP address and browser user agent. The club's own application log lines replace fields such as names, emails, phone numbers and IP addresses with a redaction marker.
Cookies
When you sign in, the site sets one session cookie, which scripts on the page can't read. It lasts up to 14 days for players and 12 hours for admins.
Google Analytics sets two cookies, _ga and one whose name starts with _ga_, on chicagofloorball.com. The club's main site and this site share them. They hold a random identifier that lets Google Analytics recognize a returning browser, and they last up to 2 years. The admin pages, the Terms of Service, this policy and the Refund Policy don't load Google Analytics.
If your browser sends the Global Privacy Control signal, this site doesn't load Google Analytics. You can also install Google's opt-out browser add-on, or block or delete the cookies in your browser's settings. The site works the same either way.
Why the club uses it
- To run your account and check who you are.
- To take bookings and payments, issue refunds and handle disputes.
- To apply the attendance and refund rules in the Refund Policy.
- To keep signed waivers and evidence of how they were signed.
- To send emails about your account, bookings and waivers.
- To keep the site secure and keep an audit log of admin actions.
The club does not sell your personal data or share it for advertising, and uses no advertising trackers. It uses one analytics service, Google Analytics, to count visits and bookings, with Google's advertising features turned off.
Who processes it
| Service | What it does for the club |
|---|---|
| Firebase (Google) | Sign-in and passwords, and the emails for verification, email changes and password resets. Cloud Firestore holds the club's database. |
| Google Cloud | Hosts the site on App Engine, stores signed waivers and backups in Cloud Storage, and keeps logs. |
| Stripe | Takes card payments on its hosted checkout page, and handles refunds and disputes. Receives your email address and the class details. |
| Google Analytics | The club's analytics provider for chicagofloorball.com and this site. Receives the data listed under Analytics above and sets the cookies listed under Cookies. Google describes its own handling in its Privacy Policy and in how Google uses information from sites that use its services. |
| MailerSend | Delivers every other email, including your copy of a signed waiver. Receives your name, email address, message content, and the signed waiver PDF as an attachment. |
The site and its database run in Google Cloud's United States locations, and signed waivers are stored in a United States dual-region bucket. Stripe, MailerSend and Google Analytics process data in the United States and other countries where they operate.
How long it is kept
| Data | Kept for |
|---|---|
| Waiver records and signed PDFs | At least 10 years |
| Waiver viewing records (unsigned) | 30 days |
| Payments | At least 7 years |
| The audit log | 7 years |
| Registrations and attendance | At least 7 years |
| Age-check records | At least 7 years, unless removed for a confirmed minor |
| Email records | 2 years |
| Finished background jobs | 30 days after completion (failed jobs stay until an admin clears them) |
| Stripe event IDs | 90 days |
| Server logs | 30 days |
| Google Analytics data | Up to 14 months, in Google Analytics |
| Rate-limit counters | They expire on their own |
| Your account and profile | Until the account is deleted |
| Blocked-account email hashes | Indefinitely |
Database backups are kept for 7 days (daily) and 14 weeks (weekly), database point-in-time recovery keeps changes for 7 days, and a weekly export of sign-in records in the backups bucket is kept for 30 days. Deleted data can stay in a backup until that backup expires.
Deleting your account
You can delete your account from your profile page. That deletes your sign-in record and your profile, including your optional details and your legal acceptances.
The club keeps these, because it needs them as records of what happened:
- Waiver records and signed PDFs, as evidence of the agreement you signed.
- Media opt-outs, as the record of what you asked the club not to do.
- Payments, as financial records.
- Registrations and attendance, as booking, participation and financial records.
- Age-check records, as evidence that the age limit was enforced, unless removed at a parent or guardian's request or after the club confirms the account belonged to a minor.
- The audit log, as the record of admin actions.
Deletion is refused while you have a booking block, an open age review, or a booking for a class that hasn't ended. If an admin deletes the account of a blocked person, the club keeps a hash of the email address with the reason, so that a new account with that email starts blocked.
Requests about your data
You can ask the club for access to, correction of, or deletion of the personal data it holds about you (and you can opt out of media use at any time). Send your request from the email address on your account to contact@chicagofloorball.com. An admin handles each request and answers within 30 days.
Children
This site and the club's classes are strictly for adults aged 18 and older. The club does not knowingly collect personal data from anyone under 18, beyond recording blocked underage waiver attempts to enforce the age limit. If a parent or guardian believes a minor has created an account or submitted personal data, please contact the club and we will remove the account and any age-check record.
Changes to this policy
Each version of this policy has a version number. When it changes, the site asks you to accept the new version at your next booking.
Contact
Questions or requests about your privacy can be sent to contact@chicagofloorball.com.