Version 1.0 — Effective August 19, 2026. Contact: privacy@puckdesk.com
PuckDesk is a software platform for hockey organizations. We are registered as a business partnership in Ontario, Canada. This Privacy Policy explains how we collect, use, disclose, and protect information in connection with the PuckDesk service (the “Service”).
PuckDesk operates in two different legal roles depending on the type of data being processed.
PuckDesk as Data Controller: For account, billing, security, and business-administration data, PuckDesk independently determines how and why data is used. PuckDesk is the data controller for this data.
PuckDesk as Data Processor:When an Organization (team, club, league) uses PuckDesk to store and manage information about its players, staff, or other individuals, the Organization determines why and how that data is collected and used. For that data, the Organization is the data controller and PuckDesk acts as a processor, processing the data only on the Organization's instructions to provide the Service.
For account-level data PuckDesk controls, contact PuckDesk. For player and roster data an Organization controls, contact that Organization's admin or coach.
When you create a PuckDesk account or subscribe, we collect:
Where GDPR applies, legal bases include: contract performance (to provide the Service); legal obligations (billing records); and legitimate interests (security, fraud prevention).
When authorized staff members use PuckDesk, they may enter player names, roster information, performance data, scouting notes, workout assignments, calendar events, and other content. PuckDesk processes this data only as directed by the Organization to provide the Service. The Organization is responsible for having a lawful basis for collecting this information.
We collect basic technical data incidental to providing the Service: IP addresses from server logs, session tokens, and error logs for debugging. We do not use third-party analytics, advertising, or tracking cookies.
Health-related information (such as heart rate, injury notes, or medical information) is treated as a restricted category.
Subscriber and staff accounts require the account holder to be at least 18. The Organization is responsible for having a lawful basis for entering data about players under the applicable age of consent for its jurisdiction, including parental consent where required.
Future player accounts (not yet available): players aged 18+ may activate directly; players aged 16–17 require a parental/guardian authorization process; accounts for players under 16 are not permitted under our current policy.
PuckDesk uses only cookies strictly necessary to operate the Service: authentication cookies to keep you signed in, session management cookies to maintain your active organization context, and security tokens to prevent cross-site request forgery. We do not use advertising, analytics, or behavioural tracking cookies.
We use account and technical data to create and maintain accounts; process subscriptions and payments; send necessary service communications; diagnose technical problems; detect and prevent fraud and abuse; and comply with legal obligations. We use team and player data solely to provide the Service as directed by the Organization.
PuckDesk does not use Customer Data for advertising. PuckDesk does not sell personal data. PuckDesk does not use Customer Data to train AI or machine-learning models, except that when a staff member actively uses the AI-assisted import feature, file content is sent to Anthropic's API solely to extract structured data (see section 8.5).
PuckDesk shares personal data only with the following service providers:
Stripe, Inc. processes payment transactions. Stripe receives billing contact information and payment instrument data. PuckDesk does not receive or store raw card numbers. Stripe is based in the United States.
Supabase, Inc. hosts our database, authentication system, and file storage. All Customer Data stored in PuckDesk passes through Supabase. Based in the United States (AWS infrastructure).
Resend, Inc. delivers transactional emails (invitations, welcome messages, trial confirmation, billing notices). Based in the United States.
Vercel, Inc. hosts the PuckDesk application. HTTP requests pass through Vercel's infrastructure, which includes a global edge network. Based in the United States.
Anthropic PBC provides the AI model for PuckDesk's optional import feature. When a staff member uses this feature (e.g. importing a player list from a file), the content of the uploaded file is sent to Anthropic's API solely to extract structured data. This occurs only when the feature is actively used. Based in the United States.
PuckDesk may disclose information where required by a valid legal obligation, court order, or lawful governmental request. Where legally permitted, PuckDesk will notify affected parties before disclosure.
Our infrastructure is primarily based in the United States. If you or your players are located in the EEA, UK, or other jurisdictions that restrict data transfers, your data may be transferred to the United States. Where required by applicable law, PuckDesk uses Standard Contractual Clauses or other appropriate safeguards for such transfers.
PuckDesk does not currently guarantee EU-only data hosting unless separately agreed in writing.
Data is retained for as long as your subscription is active. After cancellation or termination, PuckDesk intends to archive Organization data for up to 12 months to allow reactivation. After this period, data is deleted or irreversibly anonymized, subject to legal hold, unresolved disputes, or technical constraints on backup retention cycles.
Account-level data (name, email, billing records) is retained as long as required by applicable tax, accounting, and consumer law. Records of Terms of Service acceptance are retained for the duration legally required for contract evidence.
Depending on your location, you may have rights to access, correct, delete, restrict, or port your personal data, or to object to certain processing. For account data PuckDesk controls, email privacy@puckdesk.com. For player and roster data an Organization controls, contact the Organization's admin or coach directly.
If you are in the EU or UK and are not satisfied with our response, you may lodge a complaint with your local data protection authority.
PuckDesk uses encryption in transit (HTTPS/TLS), hashed passwords, role-based access controls, and limits staff access to what is operationally necessary. No internet service can guarantee absolute security. If you become aware of a security issue, contact support@puckdesk.comimmediately.
PuckDesk sends service and transactional communications necessary to operate your account. Optional marketing communications, if any, are sent only with appropriate consent and include an unsubscribe mechanism.
PuckDesk may update this Privacy Policy. We will notify subscribers of material changes by email or in-app notice before the change takes effect.
PuckDesk, 13 Sydenham Wells, Barrie, Ontario, Canada
Privacy questions or data requests: privacy@puckdesk.com — General support: support@puckdesk.com — Legal: legal@puckdesk.com
See also our Terms of Service.