Privacy Policy

Lineup optionally connects to a Google account, at the operator’s initiation, to draft email replies and deliver finished photos to the operator’s own Google Drive. This section discloses exactly what we access and why, in compliance with the Google API Services User Data Policy.

Scopes requested

Storage. The Google authorization token is stored only in the operator’s macOS Keychain, on the operator’s own computer. It is never transmitted to or stored on our servers.

Sharing. Data obtained via these scopes generally flows only between the operator’s device and the operator’s own Google account, with one opt-in exception, described in full in the next section: if the operator turns on AI-assisted reply classification, the subject and body of unread parent emails are sent to Anthropic to classify intent. That is the only third party that ever receives Google-scoped data, and only for operators who opt in.

Revocation and deletion. Operators can revoke Lineup’s access at any time from their Google Account permissions (myaccount.google.com/permissions) or by disconnecting Google within Lineup’s Settings. Revoking access deletes the local token from Keychain; it does not delete anything from the operator’s own Gmail or Drive, since Lineup never held a separate copy of that data.

Compliance note. Lineup’s access to and use of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.

Restricted scope. gmail.readonly is classified by Google as a restricted scope, not merely sensitive. Google’s published guidance is that its annual CASA (Cloud Application Security Assessment) requirement applies to applications that access restricted data “from or through a third-party server” — which describes the AI-classification flow in the next section, for operators who enable it.

If a Lineup operator chooses to enable AI-assisted features (Settings → AI Features, using the operator’s own Anthropic API key, stored in the operator’s macOS Keychain — never on our servers), Lineup sends limited data to Anthropic (anthropic.com) for three specific purposes. Every feature below is off unless the operator turns it on, and each is independently optional.

1. Parent Inbox Responder — reply classification. When enabled, the subject and body of each unread parent email (read via the gmail.readonly scope above) is sent to Anthropic solely to classify what the message is likely about (for example, a schedule question vs. an order question). Lineup never asks Anthropic to draft or send a reply through this feature, and the classification never causes mail to be modified, labeled, archived, or deleted. If classification fails or is disabled, the message is simply flagged for the operator to handle manually.

2. Zoe, the voice assistant. When the operator talks to Zoe, what they say (converted to text) and related job/roster information from the operator’s own Lineup database are sent to Anthropic so Zoe can respond and, only after the operator confirms out loud, carry out an action — such as sending an access-code email, sending a delivery notification, or sending a roster reminder, through whichever email provider the operator has configured. If the action involves a Google Drive delivery, a confirmation (such as a delivery link) may be included in what’s sent back to Anthropic as part of the conversation. Zoe cannot change a picture day’s date on its own — that always requires a manual, on-screen confirmation.

3. Field-corrections extraction. Free-text or transcribed correction notes the operator types or dictates (for example, “his jersey number is actually 23”) are sent to Anthropic to turn them into structured, operator-reviewable roster corrections. This feature only ever sees text the operator directly entered — it does not read Gmail or Google Drive data.

Model training. By default, Anthropic does not use API inputs or outputs to train its models. Lineup’s use of the Anthropic API does not opt in to any exception to this.

Retention. Anthropic automatically deletes API inputs and outputs within 30 days under standard operation. If content is flagged by Anthropic’s own automated trust-and-safety systems as violating its Usage Policy, that content may be retained longer — up to 2 years for the input/output itself, and up to 7 years for the safety classification score. We do not separately store the content of these requests on our servers beyond what is needed to display the result to the operator in the moment.

Payment for Lineup software purchases is handled by our Merchant of Record, Lemon Squeezy. Lemon Squeezy processes billing information necessary for your subscription and license — payment card information is processed by Lemon Squeezy and is not received or stored by us.

You choose your own transactional email provider for parent- and coordinator-facing mail — Gmail, Postmark, or Resend — in Settings. This determines which provider handles access-code emails, delivery notifications, and roster reminders on your behalf, as described in How Information Is Shared above.

You can contact us to update an email address on your own account or support communications with us.

Lineup is software used by youth sports photography businesses. Athlete information may be submitted by a parent, guardian, league, coach, or authorized organizer — or entered directly by the photography business using Lineup — so that the business can run picture day, identify galleries, fulfill orders, and support families.

The photography business using the software is the data controller for athlete, parent, and guardian information, and is responsible for the privacy notices, consents, and legal basis (including COPPA) for processing that information with the families it serves.

Our design and practices with respect to minors’ information follow these principles:

Local-first, by default. Athlete and roster data entered into Lineup stays on the operator’s own computer unless the operator turns on an optional relay feature.

Data minimization on the relay. Only the narrow contact/roster data needed to route a coordinator or parent submission ever transits our relay, and only when the operator enables it. Emails inviting parents to verify their child’s information contain no athlete details; athlete information is shown only within the secure relay portal behind a unique token-protected link.

Minimal retention on the relay. Relay data is deleted immediately on retrieval or pickup by the operator. Data that is never retrieved is excluded from active use once it expires, and is cleared by a daily automated deletion sweep; see the Data Retention table below for specifics by data type.

No profiling, no AI training. We do not analyze or profile athlete, parent, or guardian information beyond transiently transmitting it to the operator’s installation, and we do not use it to train AI or machine-learning models. (The AI-assisted features described above are about an operator’s own inbox, voice, and correction-entry content, not about analyzing athletes.)

No direct collection. We do not collect information directly from athletes, parents, or guardians.

Parents, guardians, and league organizers with questions about athlete information, opt-outs, corrections, or deletion requests should contact the photography business running their picture day, or reach us directly at support@lineupcentral.com.

We have no ability to retain production databases, athlete information, photographs, or other data stored solely on an Operator’s computer.

To request correction, deletion, or a copy of information connected to you, email support@lineupcentral.com. Requests concerning athlete/parent data collected through Lineup should be directed to the photography business operating it, as the data controller.

For Lineup and its optional relay, we use TLS encryption for data in transit, Keychain storage for tokens and API keys (never plaintext on our servers), AES-256 encryption at rest for the brief window a relay file is held pending retrieval, Linux LUKS encryption for Fly.io backup snapshots, non-root hardened container deployment, authenticated internal endpoints gated by an operator-held shared secret, and personal-information scrubbing from relay logs.

No method of transmission or storage is completely secure, so we cannot guarantee absolute security. If you believe information has been exposed or used incorrectly, contact us promptly. Operators are responsible for protecting their own computers, backups, databases, passwords, and local storage.

Depending on your state of residence, you may have rights under state privacy laws, which may include the right to know, access, correct, delete, and obtain a portable copy of personal information, and to opt out of sale/sharing or targeted advertising (we do not sell, share for targeted advertising, or engage in such activities). These laws include, among others:

California’s Consumer Privacy Act (CCPA), as amended by the CPRA; Virginia’s Consumer Data Protection Act (VCDPA); Colorado’s Privacy Act (CPA); Connecticut’s Data Privacy Act (CTDPA); and Texas’s Data Privacy and Security Act (TDPSA).

To exercise any available right, contact support@lineupcentral.com. We will not discriminate against you for exercising your rights.

Lineup is operated from the United States. If you access our services from another country, your information may be transferred to and processed in the United States where permitted by applicable law. Because production data generally remains on the Operator’s own computer, international transfers by us are limited primarily to licensing, billing, and support information an Operator voluntarily provides.

We may update this Policy from time to time. When we make material changes, we will update the “Last updated” date at the top of this page. Continued use after the effective date constitutes acceptance where permitted by applicable law.