Privacy Policy

This Privacy Policy describes how cesh (“cesh,” “we,” “us”) collects, uses, and shares information through cesh.app and the per-league subdomains we host. By using cesh, you agree to the practices described here.

Who we are

cesh is a software service that helps amateur sports leagues run their concession stands — scheduling volunteer shifts, displaying menus, and capturing donations. You can reach us by mail at the address at the bottom of this page.

What we collect

League managers sign in to the admin area using a one-time email link. We collect:

• The email address used to request a sign-in link.
• The name of the league or organization being managed.
• Any additional manager email addresses added to the league.
• The configuration you enter — stand details, menu items, divisions, and shifts.

Volunteers (typically parents and team members) claim shifts on a league’s public schedule page. We collect:

• The name, email address, and phone number entered when claiming a shift.
• The specific shift(s) claimed and the time of the claim.
• A private cancellation token that lets the volunteer release the slot without involving the league’s managers.

Prospective customers who submit the early-access form on cesh.app. We collect:

• The name, email address, league name, and any optional message you include.

Everyone using cesh. Our hosting and authentication providers automatically record basic technical information for security and abuse prevention:

• IP address, user agent, and access timestamps.
• A secure session cookie set by our authentication provider while a manager is signed in.

Google Analytics. We use Google Analytics 4 to understand how cesh is used — page views, navigation paths, and aggregate event counts (volunteer signups, QR scans, donation form submissions). On first visit we show a consent banner; analytics cookies are only set if you accept. If you decline, GA still runs in a cookieless mode that sends only minimal, non-identifying signals so we can size traffic. We do not use advertising trackers, remarketing tags, or social-media pixels.

How we use what we collect

We use your information to:

• Send one-time sign-in links to managers.
• Send volunteer confirmation emails (with the private cancel link) and league-side notifications.
• Render schedules, menus, donations, and the other features you ask for.
• Respond to early-access and support inquiries.
• Maintain the security of the service and prevent abuse.

We do not sell your personal information, share it with advertisers, or use it to build profiles about you.

Who we share it with

Inside a league’s own data, volunteer signups are visible to that league’s managers — that is the point of the product. Beyond that, we share information only with the following service providers (“subprocessors”), each operating in the United States:

• Google / Firebase — authentication, database, infrastructure, and analytics (Google Analytics 4).
• Resend — sends transactional and lead-followup email on our behalf.
• Vercel — hosts the cesh.app web application.

We may also disclose information if we believe in good faith that doing so is required to comply with the law, to enforce these policies, or to protect cesh, our users, or the public.

Cookies and similar technologies

cesh sets two kinds of cookies:

• Functional / strictly necessary cookies — primarily the session cookie issued by our authentication provider while you are signed in as a league manager. These are required for the service to work and are never optional.
• Analytics cookies (Google Analytics) — _ga and _ga_<measurement-id>. These help us understand which pages are visited and how features are used. We only set them after you click Accept on the consent banner; if you decline, they are not set, and the Google tag falls back to a cookieless measurement mode. You can revisit your choice at any time via the Cookie preferences link in the footer.

We do not use advertising or cross-site tracking cookies.

How long we keep your information

We keep league data while a league is actively using cesh and for a reasonable backup window after the league stops using the service. You can ask us to delete your information at any time by writing to the address below; we will respond within a reasonable period and confirm what was removed. Some limited records (for example, a deletion log) may persist as required for security or accounting.

Children’s privacy

cesh is built for league managers and adult volunteers. We do not knowingly collect personal information from anyone under 13. If you believe a child has provided information through cesh, please contact us and we will delete it promptly.

Your rights

You can:

• Request a copy of the personal information we hold about you.
• Ask us to correct inaccurate information.
• Ask us to delete your information, subject to legitimate retention obligations.
• Stop using the service at any time.

Residents of California, the European Union, the United Kingdom, and certain other jurisdictions may have additional rights under local law (such as data portability, the right to object to processing, or non-discrimination for exercising these rights). Send any request to the mailing address below and we will respond as required by applicable law.

Security

We rely on HTTPS for all traffic, on our authentication provider for sign-in (no passwords are ever stored), and on the access controls built into our cloud providers. No system is perfectly secure; if we become aware of a breach affecting your data, we will notify you and the appropriate authorities as required.

Changes to this policy

If we make material changes to this policy, we will update the “Last updated” date above and, where appropriate, post a notice on cesh.app. Continued use of cesh after a change means you accept the updated policy.

Contact

Questions, deletion requests, or other privacy concerns can be sent to: