1. Who we are and how to contact us
my Roster Reach is an invitation-only college-recruiting application at myRosterReach.com. This policy covers the public information pages and private athlete and administrator workspaces. It explains the information used to operate the service, including information received when you connect Google or Microsoft.
For support, privacy questions, account closure, or data requests, contact thomas.emmons.01@gmail.com. Please identify your account email and request, but do not send passwords, authorization tokens, API keys, identity documents, or sensitive records in the initial message.
Athlete profiles are not publicly searchable or published as public profile pages. Administrators operate the service and manage invitations, data quality, sport approvals, sending permissions, and usage.
2. Information we collect
Account and profile information. Your administrator supplies invitation information such as your name, email, and initial sport. You may provide your school, graduation year, academic interests, GPA, contact details, sport positions, measurements, statistics, goals, schedule, and team information. We store a password hash, verification and security records, and your age attestation. We do not store your application password as plain text.
Recruiting content. We store saved programs, contacts selected from the directory, templates, drafts, approved outgoing email content, selected media, notes, tasks, manually updated statuses, and sending history. Message records include recipient and sender information, subject and body, time, provider response identifiers, and delivery-submission status. A submission record is not proof that a coach read the message.
Approved batch outreach. When enabled for an athlete by an administrator, we store selected recipients, approved message and photo snapshots, sending-account identity, day and time preferences, time zone, permission settings, queue status, and batch activity. The server can submit approved messages later without an open browser. Athletes can view their own batches; administrators can view all batches and manage access. Pausing or cancelling stops pending work but cannot recall messages already submitted or in flight. Disconnecting the sending account blocks further submission.
Media and links. We store uploaded photos, video references or uploads where enabled, and optional social profile links. Adding a social link does not authorize us to log into that social account.
Usage and security information. The application and hosting service may record request times, IP addresses, browser information, authentication events, errors, administrative actions, quota usage, and AI request details. These records support security, troubleshooting, and operation of the service.
3. Google and Gmail data: access, use, storage, and sharing
Connecting Gmail is separate from signing in to my Roster Reach. Google handles your Google login and consent. my Roster Reach never asks for your Google password. The current integration requests openid, email, profile, and https://www.googleapis.com/auth/gmail.send.
| Data or permission | Purpose and handling |
|---|---|
| Basic account identity | We obtain account information from Google’s identity service, including your account identifier, verified email, and display name. These identify and display the mailbox connected to your athlete account. A profile photo may be present in the identity response but is not saved or used as your athlete photo by this integration. |
| Access and refresh tokens | We store authorization tokens encrypted on the server so the application can submit your approved email without asking for your Google password. Tokens are used only for the authorized integration, not shown to other athletes, and removed from the active mailbox record when you disconnect. |
| Send-email permission | When you explicitly send a draft, or an approved batch message becomes eligible under your sending schedule, we transmit its recipient, subject, body, and chosen embedded media to Gmail for delivery from your connected account. We retain the message you composed and provider submission identifiers in your private recruiting history. |
| Inbox and existing Gmail content | Through the connected Gmail integration, we do not request inbox-reading scopes or retrieve existing messages, attachments, contacts, incoming replies, labels, or mailbox settings. Separately, Coach Inbox can receive messages you deliberately forward to a private address after accepting its processing notice. We do not scan your inbox or automatically update relationships based on replies. |
Who can see the information. Your connected address and status, in-app message history, and usage are available to you and authorized administrators for the disclosed recruiting and support functions. Google receives email content for sending; the recipients you choose and their email providers receive delivered messages. Our hosting infrastructure processes the stored data to operate the service. We do not expose Google authorization tokens in the admin interface.
Google Limited Use commitment. my Roster Reach’s handling of information received from Google APIs follows the Google API Services User Data Policy and its Limited Use requirements. We use that information only for the disclosed, user-facing connection and sending features. We do not sell Google user data, use it for advertising or creditworthiness decisions, or use it to develop, improve, or train generalized AI or machine-learning models.
Transfers of Google user data are limited to providing these user-facing features with your consent, security and abuse prevention, legal requirements, or a business transfer with any consent required by Google’s policy. Human access to Google user data is limited to your affirmative authorization, necessary security investigation, legal compliance, or permitted aggregated internal operations. The connected Gmail integration does not collect inbox content. Deliberately forwarded Coach Inbox content is not displayed in the application administration interface; authorized hosting and database operators may still have access for necessary support and security.
Microsoft connections. When enabled and chosen, the Microsoft integration similarly uses account-identity and delegated send-mail permissions, stores encrypted tokens, and submits your approved messages. It does not request mailbox-reading permission.
4. How we use your information
We use information to verify invitations, maintain accounts, personalize your private workspace, organize recruiting contacts, construct and send the messages you approve, display history, enforce sport allowances and coach-specific restrictions, process requests for access or support, and protect the service.
Administrators can review account and recruiting records available to them, approve sports, manage the contact directory, resolve uncertain sends, and view athlete-attributed AI usage and estimated costs. Other athletes are not given access to your private workspace.
We do not use email-open tracking pixels or automatically detect coach replies. We do not sell your personal information or use it for targeted advertising.
5. Optional AI assistance
AI assistance is optional and requires the acknowledgement in your athlete profile. Manual drafting and editing remain available without it. When you request research or a rewrite, the application sends selected context to the OpenAI API: the target college, sport/team, contact name and role, official website addresses, graduation year, academic interests, position, development goals, and your existing personalization text. It also sends a pseudonymous safety identifier derived from your account and the application address.
The integration does not automatically include your connected mailbox identity, authorization tokens, Gmail inbox contents, full athlete profile, or full email body. Information you type into the selected fields is still sent, so do not paste private correspondence, passwords, transcripts, health details, or other sensitive records there.
We retain returned suggestions, supporting source links, request identifiers, model names, token/tool usage, timestamps, and estimated cost records for your workflow and administration. The request uses store=false; that does not mean the provider retains no data. OpenAI may retain data under its security, abuse-monitoring, and other applicable controls. Its API data practices are described in OpenAI’s data controls documentation.
We do not authorize the use of Google API user data to train generalized AI models. We do not opt application content into optional provider model-training programs. You can turn off AI assistance in your profile to stop future requests; this does not automatically erase prior records. Request deletion through the contact in this policy.
Coach Inbox: messages you choose to forward
Separate from mailbox permissions. When your administrator enables Coach Inbox, you can accept its notice and verify a private forwarding address. Forward only messages you are entitled to share, from your verified account address or an authorized connected mailbox. This does not grant my Roster Reach access to browse your inbox. Protect the private receiving address; you can rotate it or pause forwarding in Coach Inbox.
Receiving and AI processing. Postmark receives the forwarded email and delivers it to my Roster Reach. The application stores the readable subject and message text, quoted forwarded headers, forwarding address and date, attachment names/types/sizes, and processing metadata. It sends the readable subject and selected forwarded text to the OpenAI API to suggest summaries, questions, tasks, dates, and a draft response. Your profile, other inbox messages, private calendar blocks, and attachment contents are not sent with this extraction request. The request uses store=false; that setting does not remove all provider security logging or provider retention.
Attachments and third parties. Attachment contents pass through the receiving provider when included in a forwarded email, but my Roster Reach does not save or analyze those contents. Forward text without unnecessary attachments, transcripts, medical details, identity documents, or credentials. Receiving-provider records, AI-provider records, mailboxes, and hosting backups have their own retention settings; deleting an import here does not delete those copies.
Your review is required. AI suggestions are not commitments and may be inaccurate. Check the original coach message and every date, year, time zone, duration, request, and link. Only items you explicitly approve become your tasks or calendar entries. Draft responses are for editing and copying into your email app. This workflow does not send a reply, register for a camp, book a visit, or accept an invitation automatically.
Storage and deletion. Imported source text, extracted suggestions, and response drafts are encrypted using the application encryption key. Source content expires after the administrator-configured period, initially 30 days. Expired content is hidden, and the processing worker or administrator cleanup removes it from active storage. You can delete an imported source sooner. Approved tasks and calendar entries remain until you remove them separately. Minimal non-content identifiers and duplicate-detection digests remain to prevent replay until account deletion; de-identified usage facts may be retained. Full test resets delete Inbox content and replace the private address rather than copying email content into an admin-readable test history.
Access and choices. Other athletes and coaches cannot access your Inbox. Application administrators can see access settings, processing status, and usage, not forwarded message text. Hosting/database administrators may have necessary operational access. You may pause forwarding, withdraw profile AI consent to stop new processing, or delete imported messages. A provider request already in progress cannot always be recalled; returned content is discarded if the application detects consent withdrawal before publishing it.
7. Retention, disconnection, and deletion
We keep active account and recruiting records to provide the service and maintain the history and restrictions you use. There is no universal automatic expiration period for all records. Retention depends on the record’s purpose, account status, your verified requests, security needs, and applicable legal requirements.
Disconnecting Gmail or Microsoft: choose Disconnect under your connected mailbox. This removes the encrypted tokens from the active mailbox record and prevents new sends through that connection. It does not erase your in-app message history or remove email already sent. To revoke Google’s grant as well, remove my Roster Reach in your Google Account third-party connections. Revoking at Google alone does not delete records already stored in my Roster Reach.
Requesting deletion or account closure: email thomas.emmons.01@gmail.com from your account address when possible. We will verify the request, explain its scope and any necessary retention, and delete or anonymize information no longer needed. Account closure and broader erasure are handled by the operator rather than an automatic self-service purge. Do not send credentials or identity documents unless a secure verification process is specifically arranged.
Important limits: archiving is not erasure. Removing a media item hides or revokes it in the app but does not automatically purge its private file or a separately hosted video asset. Those removals require operator/provider action. Message history, audit records, and records needed for security, legal compliance, or resolving disputes may need to be retained for those purposes. Backups may contain earlier copies until their retention cycle ends; restored copies must be subject to the same deletion instructions. We cannot delete messages from a coach’s inbox or content controlled by another provider or recipient.
Contact us for the status and expected completion of a particular request. We do not treat disconnecting a mailbox, deactivating a sport, or clearing a draft as deletion of the whole account.
8. Security and cookies
The application uses access controls, password hashing, encrypted mailbox tokens, protected server-side configuration, and HTTPS for live provider operations. No system can guarantee absolute security. Keep your password unique, protect your devices, and tell us about suspected unauthorized access.
The private application uses necessary session cookies to maintain sign-in and protect requests. These public information pages include no advertising trackers, analytics scripts, third-party fonts, or marketing cookies. The web host may still keep ordinary access/security logs. External services may apply their own cookies when you visit or authorize them.
9. Young athletes and your choices
my Roster Reach is intended for invited high school athletes aged 13 or older and their administrators. It is not directed to children under 13. Activation includes an at-least-13 attestation; it is not independent age verification. Do not create an account for a child under 13. Contact us if you believe one has been created so we can investigate and take appropriate action, including removing information where required.
If you are under 18, review the service and these notices with a parent or guardian and obtain any permission required for your circumstances. No guardian accounts or automated parental-consent workflow are offered in this release.
You can edit available profile fields, choose not to connect a mailbox, disable optional AI assistance, omit social links, and decide which media to include in a message. For access, correction, deletion, objections, or other privacy requests that may apply where you live, contact thomas.emmons.01@gmail.com. We may need to confirm identity and explain any applicable limits.
10. Changes and contact
We will keep this policy aligned with the service’s information practices and update the date when it changes. For material changes to how Google or other personal data is used, we will provide an appropriate in-app or email notice and obtain any additional consent required before using the data for a new purpose.
Questions, concerns, or requests: thomas.emmons.01@gmail.com.