Privacy Policy

Last updated: April 9, 2026

This privacy policy explains how the High Sierra Lacrosse League ("HSLL," "we," "us") handles personal information on our schedule website at highsierralax.org and any related subdomains (the "Site"). HSLL is a Nevada nonprofit organization.

The short version: the Site is a schedule, standings, and score-reporting tool. We collect very little personal information, we do not run analytics or advertising, and most visitors can use the Site without giving us anything at all.

What we collect

From anonymous visitors. Nothing beyond the standard request information our hosting provider (Vercel) needs to serve a webpage — IP address, user agent, referrer, and timestamps. We do not run Google Analytics, Vercel Analytics, Plausible, or any other visitor-tracking service. We do not set tracking, advertising, or fingerprinting cookies, and we do not embed third-party trackers.

From signed-in users. A small number of league-authorized users — coaches, team managers, commissioners, and officials — sign in with Google in order to report game scores. When you sign in, Google supplies us with three pieces of information from your Google profile:

• Your email address (Google-verified)
• Your display name
• Your profile picture URL

That information is stored only inside an HttpOnly session cookie on your device (a signed JSON Web Token). We do not save it to a database, we do not keep an account record for you, and we never receive or store your Google password, OAuth refresh tokens, or any other Google account data.

How we use it

• Authentication. Confirming that you are a real person who controls a particular email address.
• Authorization. Comparing your verified email against the league's coach allowlist (a Google Sheet maintained by league administrators) to decide which teams, if any, you are permitted to report scores for.
• Score reporting audit trail. When you submit a final score for a game, we write your verified email and an ISO timestamp into the league's schedule spreadsheet alongside the score, so the league has a permanent record of who reported what and when.

We do not use your information for marketing, profiling, advertising, or any purpose other than running the score-reporting feature.

Information that becomes public

This is important enough to call out separately. When you submit a score, your email address and the time of submission are written to the league's schedule spreadsheet, which is published to the web as a CSV. Anyone who visits the schedule pages (or downloads the published CSV directly) can see who reported a given score.

This is intentional — it is the league's audit trail for game results. If you do not want your email address to appear in that public record, do not sign in and report scores. Browsing the schedule, standings, and other public pages does not require sign-in and does not write anything about you.

The coach allowlist itself (a list of team names and authorized coach emails) is also published as a public CSV, because the Site fetches it anonymously to decide who can report scores. If you have agreed to be on a team's coaching staff, your email is on that list.

Cookies

The Site sets exactly one cookie of its own: the NextAuth.js session cookie, which holds the signed JWT described above. It is HttpOnly, Secure, and SameSite=Lax. It is set only after you sign in and is removed when you sign out or when it expires. We do not set advertising, analytics, or cross-site tracking cookies, and we do not honor third-party cookies on this Site.

Our hosting provider may set its own infrastructure cookies (for example, for load balancing). Those cookies do not contain personal information about you and are not under our control.

Third-party services

The Site relies on a small number of third parties to function:

• Google — for OAuth sign-in, and for Google Sheets and Google Drive APIs that hold the league's schedule data and handbook content. Google's privacy policy applies to your Google account and the sign-in flow.
• Vercel — our hosting and content-delivery provider. Vercel processes requests on our behalf in order to serve the Site.
• AEXOO — appears as a credit link in the Site footer. No data is shared with AEXOO simply by visiting the Site.

We do not sell personal information to anyone, and we do not share it with any third party except as described above.

Data retention

• Session cookie: stored on your device until it expires or you sign out. Signing out removes the session immediately.
• Score-reporting audit entries (your email and timestamp on a reported game): retained for as long as the league keeps that season's schedule, which may be indefinite for historical record-keeping.
• Coach allowlist entries: maintained by league administrators. If you stop coaching, ask a league administrator to remove your email from the allowlist tab.

We do not have an automated mechanism for deleting individual audit entries. If you need a specific entry corrected or removed, contact us at the address below and we will handle it manually.

Children's privacy

HSLL operates youth lacrosse programs, but the Site itself is not directed at children. There is no public account creation, no sign-up form, no comments, and no way for any visitor — child or adult — to submit personal information without first signing in with a Google account that is on the coach allowlist. Only coaches, team managers, and league officials sign in. We do not knowingly collect personal information from anyone under 13. If you believe a child has somehow submitted personal information through the Site, please contact us and we will remove it.

Your choices

• You can browse the schedule, standings, calendar, handbook, and other public pages without signing in and without giving us any personal information.
• You can sign out at any time using the sign-out option in the user menu, which removes the session cookie from your device.
• You can ask a league administrator to remove your email from the coach allowlist, which prevents future sign-ins from being able to report scores.
• You can contact us to request correction or manual removal of audit entries that name you.

Depending on where you live, you may have additional rights under your local privacy laws — for example, the right to request a copy of personal information we hold about you, or to ask us to delete it. Email us at the address below and we will do our best to honor those requests within the limits of the league's record-keeping needs.

Changes to this policy

If we make material changes to this policy, we will update the "Last updated" date at the top of this page and post the revised policy here. Continued use of the Site after a change constitutes acceptance of the updated policy.

Contact

Questions about this policy, requests for correction or removal, or any other privacy concern can be sent to:

High Sierra Lacrosse League
Email: info@highsierralax.org