Privacy

Written in plain language, by the person who built this. Every commitment below was written by reading the code that implements it, not from a template. If any of it turns out not to match what the product does, the code is what we will change.

Who we are

RosterFilm is operated by SoloFive LLC, a California limited liability company, which is the controller of the information described here.

SoloFive LLCc/o Northwest Registered Agent, Inc.2108 N St, Ste NSacramento, CA 95816[email protected]

Your clips stay on your phone

Source video is never uploaded. The reel is assembled on your device and only the finished file leaves it. If you delete the app, the originals are exactly where they always were: your camera roll.

Pages about minors belong to the parent

A player under 18 does not hold the account — a parent or guardian does. You choose what appears: name, grad year, school, city, measurables, academics. You can unpublish a page at any time and it stops resolving immediately, though search engines may hold a cached copy for a while afterwards.

A new page is shareable but unlisted. It works at a URL you send to a coach, and it is not listed anywhere on this site and not offered to search engines. Making it findable by name is a separate choice you make, not a default we picked for you.

Consider carefully before publishing a home address, a full date of birth, or a school schedule. We don’t ask for any of them.

Nobody under 13

A page may only be about an athlete aged 13 or over. The graduation year you enter is checked when a page is created, when a coach stages one, when a family claims one, and when one is edited — so this is a rule the product enforces rather than a request it makes.

This service is not directed to children under 13 and we do not knowingly collect personal information from one. If you believe a child under 13has a page here, or that a child’s information is on this site without a parent’s involvement, email [email protected] and we will take the page down while we sort it out — before asking questions, not after.

What we count, and what we refuse to

When you send a page to a college program, that link carries a token unique to that program. If someone opens it and stays, we record a view against that program. If they play the reel, we record how far they watched.

We do not track email opens.Mail apps pre-load images and manufacture opens that never happened, and mail security gateways click links automatically to scan them. Both would let us show you impressive numbers that mean nothing. We’d rather show you fewer, true ones.

Traffic with no token — a coach who found the page through a search engine — is recorded as anonymous. We will never guess which program it was.

Outreach comes from you

Emails to coaches are sent through your own email account, with your permission, from your address. We don’t send on your behalf from our domain, and we don’t email coaches on our own initiative.

Coaches

Program contacts come from publicly listed athletic department staff directories. What we collect, what we promise about how we collect it, and how a coach removes themselves in one click are set out at rosterfilm.com/coaches.

What we collect

From you:your email address, your player’s name, graduation year, positions, school, city and state, and whatever else you choose to put on the page — measurables, statistics, GPA, a transcript, a parent and travel-coach contact. The page is yours to fill in; none of those fields is required.

From your phone, if you use the app: the finished reel only. Source clips are read on the device to build it and are never uploaded.

From visitors to your page: the time, which program link was used if any, how far the reel was watched, the browser string, and a one-way hash of the IP address. We never store the address itself, and we cannot turn the hash back into one.

From MaxPreps, if you paste your link: we fetch that one page to read the season statistics, when you ask us to and when their robots.txt allows it. We do not crawl them.

From Perfect Game, if you paste your link: the same — one page, only when you save the link, and only the main profile page. We read the event results published there, with the date each was measured, because a number timed by somebody else is worth more to a coach than one you typed yourself. We do not read their stats, bio or video tabs: their robots.txt asks us not to. We do not take the photograph, and we never replace a measurement you entered — an imported number only ever fills a blank or updates one we imported before.

Cookies

Four cookies, and every one of them does a job you asked for. There is no advertising, no tracking pixel and no third-party script anywhere on this site. Nothing here follows you to another one, so there is no banner to dismiss. We do measure whether the product works, from our own servers — see how we measure it below.

• sp_session — keeps you signed in.
• sp_link — set for a few minutes while you use a sign-in link, so the link can only be used by the browser that asked for it.
• sp_player — remembers which of your children you were last looking at, if you have more than one.
• sp_preview — set only if you have been given a preview link while the site is not yet public.

How we measure whether it works

Six things, none of them about your child. We record when a page is created, when a reel is added to it, when you share the link, when you tell us you have emailed a coach, when a coach opens the page, and when an account starts paying. That is the entire list, and it is a closed one in the code rather than a description of current practice.

Each one is sent with an internal account number and nothing else that could identify anybody. No name, no email address, no school, no city, no page address, nothing about the child, and nothing identifying the coach who opened a page. Properties are checked against a fixed list before anything is sent, so a future change cannot add one by accident.

It happens on our servers, not in your browser.Nothing is loaded into the page you are reading, which is why the paragraph about cookies above is still true: no script from another company runs here, no pixel is fetched, and no cookie is set for this. It also means the analytics company sees our server’s address rather than yours.

One thing is stored in your browser, and it is not a cookie: if you arrive from a link carrying campaign parameters, those parameters are kept in your browser’s local storage for thirty days so that, if you go on to create a page, we know which link brought you. It is never sent to another site, it is not attached to your requests, and clearing site data removes it. If you never create a page it never leaves your machine.

We do this for one reason: to know which of the things we try actually helps families, so we stop spending on the ones that do not.

Writing your outreach email

Only if we have it switched on, and only for the email you are about to send. When you open a draft for a college program, we can have a language model write it for you.

It is never told who your player is.Before anything leaves our servers we replace your player’s name, their school, their town, their travel team and their page address with blank placeholders. The model writes the email around those placeholders, and we put the real details back afterwards, here, on our side. It is a little like sending a form with the name blacked out and filling it in yourself when it comes back.

What we do send is the part of the argument that names nobody: graduation year, position, height and weight, measurables, season statistics, GPA and state — together with the college you are writing to, its coach, and what we know about that program, all of which are public.

We would rather be exact than reassuring, so: a graduation year and a distinctive set of numbers could in principle narrow a search, which is why we say we remove every direct identifierrather than that the information is anonymous. It is sent only when you open a draft, never in bulk and never on a schedule. It is not used to train anybody’s model. We do not send your email address, your phone number, the coach’s address, or anything about another family. And every draft is checked against that same list of facts before you see it — anything it says that we cannot support is thrown away and you get our own plainly-written draft instead.

If this is switched off, which it is unless we say otherwise, no part of your page is sent anywhere and your draft is written by us.

Who else touches it

We use a small number of companies to run the service. Each processes data on our behalf under its own terms, and none is given anything to use for its own purposes:

• Neon — the database, hosted in the United States.
• Railway — the application server.
• Cloudflare — the network in front of the site, and storage for finished reels, photos and transcripts.
• Postmark — sign-in links and the emails we send you about your own account.
• Stripe — payment details, if and when you subscribe. Card numbers go to Stripe and never reach our servers.
• PostHog — the six product events described above, sent from our servers. It receives an internal account number and an event name; it is given no personal information and no script of theirs runs on this site.
• Anthropic— writes your outreach draft, if that is switched on. It is never given your player’s name, school, town, club or page address; those are replaced with placeholders before the request leaves us and filled back in afterwards. See writing your outreach email.

We do not sell personal information, and we do not share it for advertising. There is no arrangement under which anybody pays us for it, and there will not be one without telling you first.

How it is protected

The site is served over HTTPS only. Sign-in is by emailed link, so there is no password of yours for us to lose. Those links are stored as a hash and are single-use. IP addresses are hashed before they are written. Uploaded files are stored under names that cannot be guessed or enumerated. No system is perfect and we will not pretend otherwise, but the design goal throughout is to hold as little as the product can work with.

What you can ask us to do

Get a copy of everything we hold about your family. Correct anything wrong. Delete the account, the page, the reel and the view history together. Tell us to stop, at any point, for any reason or none.

Deleting is a button, on your account settings — it takes the page, the reel, the photo, the transcript and the view history together, and we keep no copy. It is a button rather than a request precisely because a page about a child should not wait on us reading our email. For anything else, write to [email protected]. There is no form, no retention offer and no phone call, and we will not ask why.

What survives a deletion, and why.A billing record, and nothing in it names your child: a reference to your customer at Stripe, the plan the account was on, and what was agreed and paid, and when. Alongside it, a dated list of what was done on the account — published, unpublished, subscribed — with the details that named anybody removed. Your email address is deleted from our side; Stripe still holds it against that customer, which is what a dispute is answered from. We keep that much because payment and consent records have to be kept — under California’s automatic-renewal law, for three years — and because it is what answers a question about a charge once the account is gone. If a subscription is live when you delete, it is cancelled at the end of the period you have already paid for, so nothing renews.

Several states — California, Colorado, Connecticut, Virginia, Texas and others — give residents rights to know, delete, correct, and opt out of sale or targeted advertising. Whether a given law currently applies to a business this size varies, so rather than argue the question: we extend those rights to everyone who asks, wherever you live, and we will not treat you differently for exercising them. If we ever have to refuse a request we will say which one and why.

What we keep, and for how long

Sign-in links are stored only as a hash and deleted a day after they are used or expire. A link confirming a change of sign-in address works the same way — only its hash is kept, alongside the address it would move the account to, and the row goes a day after it is used or expires. Unclaimed roster invites naming a child are deleted when they expire. Page views record the time, a hashed IP and the browser string — never the raw address — and are what produce the counts you see on your dashboard.

Deleting your account removes the page, the reel and the view history with it, immediately, and nothing is kept back for analytics.

A recruiting page has a natural end, and we act on it. On a schedule measured from your player’s graduation year:

• 12 months after graduation — we email to ask whether you still want the page.
• 15 months — if we have heard nothing, the page is unpublished. It stops resolving; nothing is deleted yet, so it can be brought back by asking.
• 24 months — the record is deleted.

Unpublishing comes well before deletion on purpose: it ends the public exposure, which is the part that matters, while the page is still recoverable if somebody says “wait, we’re still using that”. Keeping a former minor’s name, school and city online indefinitely because nobody remembered to say stop is not something we are willing to do by default.

If something goes wrong

If data about your family is exposed in a way that could harm you, we will tell you what happened, what was in it, and what we have done — directly, and quickly, rather than in a notice nobody reads.

Changes, and how to reach us

If we change this in a way that matters we will say so here and email you before it takes effect. Questions, requests and complaints all go to the same place: [email protected], or reply to any email we have sent you.

In effect 26 August 2026.