Privacy Policy

1. Introduction

RefRouter ("we," "us," or "our") operates the RefRouter application and website. This Privacy Policy explains how we collect, use, store, and protect your personal information when you use our service.

2. Information We Collect

We collect the following types of information:

• Account information: Your name and email address, provided through our authentication provider (Clerk) when you sign in with Google or email.
• Waitlist information: Your email, first name, primary referee ZIP, scheduling platforms, desired product outcome, and email consent when you request early access.
• Home address: Used to calculate driving distances and optimize your game routes.
• Scheduling platform credentials: For OSSRC, the account identifier and password you voluntarily provide to enable import. For HorizonWebRef, RefRouter stores only your account identifier and authorized session state; it does not collect your Horizon password.
• Game data: Game schedules, locations, pay rates, and assignment details imported from your connected scheduling platforms.
• Remote browser state: Horizon session cookies, an opaque Browser Use profile ID, and short-lived session and task identifiers used to complete an authenticated import.
• Other officials' contact details: Names, roles, permitted phone numbers, email addresses, and profile photos supplied with an eligible game assignment.
• Location data: Geocoded addresses of game venues used for route optimization.
• Payment information: Payment details processed securely through Stripe. We do not store your credit card number on our servers.

3. How We Store Your Credentials

We take the security of your scheduling platform credentials seriously:

• Credentials are encrypted using AES-256-GCM encryption before being stored in our database.
• Credentials are never stored in plaintext.
• Decryption occurs only server-side during sync operations to import your game data.
• Encryption keys are stored separately from the encrypted data and are never exposed to the client.
• Horizon session-cookie records use the same authenticated encryption boundary and are decrypted only in reviewed server-side import or revocation flows.

4. How We Use Your Information

• Scheduling platform credentials are used solely to access your own accounts on your behalf to import your game data. We do not use your credentials for any other purpose.
• Game data and location data are used to calculate optimal routes, rank games by profitability, and provide analytics on your earnings and mileage.
• Account information is used to identify your account and communicate with you about the service.
• Waitlist information is used to manage early access, identify regions and platform integrations to support, prioritize product improvements, and send the updates you consented to receive.
• Payment information is used to process your one-time payment for the service.

5. Third-Party Services

We use the following third-party services to operate RefRouter:

• Clerk — Authentication and user management. Clerk processes your name, email, and sign-in credentials. Clerk Privacy Policy
• Stripe — Payment processing. Stripe handles all payment card data. Stripe Privacy Policy
• Neon (PostgreSQL) — Database hosting. Your encrypted data is stored in a Neon managed database. Neon Privacy Policy
• Vercel — Application hosting and deployment. Vercel Privacy Policy
• Browser Use Cloud — Remote browser sessions and persistent authenticated profile state used for Horizon imports. RefRouter retains only the minimum opaque provider identifiers needed to control and delete that state.
• Google Cloud Run — Private processing environment for scheduled scraping and source actions, invoked by authorized service identities.
• Google Maps Platform — Geocoding of venue addresses for route calculations. Google Privacy Policy

6. Your Rights

You have the right to:

• View your data: Access all personal information we hold about you through your account settings.
• Disconnect platforms: Revoke the local integration immediately from Settings. Stored secrets and one-time tokens become unusable at once; RefRouter then stops exact-profile sessions and deletes the linked remote browser profile. A provider outage can delay remote deletion, but it does not restore local access.
• Delete your account: Request complete deletion of your account and all associated data at any time by contacting us.

7. Data Retention

• Scheduling credentials, session cookies, and import tokens become unusable immediately when you disconnect or replace a connection. A minimal opaque cleanup record is retained only while provider-side session or profile deletion is retried.
• Game data associated with a disconnected platform is retained for your analytics history unless you request its deletion.
• Other officials' contact details and unnecessary raw provider data are available only for eligible owned games and are purged no later than 30 days after the final game date.
• We process account-deletion requests and delete RefRouter-held data, subject only to documented legal or provider retention limits. Contact us at support@refroute.com to request account deletion.

8. Cookies

RefRouter uses essential cookies provided by Clerk for session management and authentication. We do not use advertising cookies, tracking cookies, or any third-party analytics cookies. No data is shared with advertisers.

9. California Privacy Rights (CCPA)

If you are a California resident, you have the right to request disclosure of the personal information we collect about you, to request deletion of your personal information, and to opt out of the sale of your personal information. We do not sell your personal information. To exercise these rights, contact us at support@refroute.com.

10. European Privacy Rights (GDPR)

If you are located in the European Union, you have the right to access, rectify, erase, restrict processing, and port your personal data. You also have the right to object to processing and to withdraw consent where processing is based on consent. To exercise these rights, contact us at support@refroute.com.

11. Children's Privacy

RefRouter is not intended for use by anyone under the age of 13. We do not knowingly collect personal information from children under 13. If we learn that we have collected information from a child under 13, we will delete that information promptly. If you believe a child under 13 has provided us with personal information, please contact us at support@refroute.com.

12. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will revise the "Last updated" date at the top of this page. We encourage you to review this policy periodically. Your continued use of RefRouter after changes are posted constitutes your acceptance of the updated policy.

13. Contact Us

If you have any questions about this Privacy Policy or our data practices, please contact us at: support@refroute.com