Privacy Policy

Roll Call renames a picture-day folder by matching the subject barcode written into each image against your roster. It runs in your browser and on our servers, and the split between the two is the whole point of the design.

What never reaches us

Your photographs. Roll Call reads roughly the first 256 KB of each file — enough to reach the metadata block — inside your browser, and for a PNG that keeps its metadata at the end, the last 512 KB. It does not upload the file, a thumbnail, a hash of the pixels, or a dimension. The renaming itself happens on your own disk, through your browser’s file access, and we never see the result.

What reaches us, and is not kept

Your roster. Matching against it is the job, so every row you load is sent with each plan request, cut down in your browser to the barcode column and the columns your name pattern uses — which usually includes children’s names. Other columns stay in your browser. They are not stored. They exist for the length of the request and are used to compute the plan; the reply carries back the new filenames and each file’s row number, not the rows. Per image, the request also carries the filename, the barcode read from its metadata, and its timestamps, plus the list of filenames in the folder (which is what lets Roll Call refuse to overwrite a file that is already there).

What we do keep

Roll Call is hosted on Cloudflare (Pages and the D1 database). Payments, when credit sales open, are processed by Stripe. Sign-in emails are sent through Resend from our own account. Roll Call’s pages carry no analytics, advertising or third-party script of their own — no counter, no tag manager, no font or script CDN — and set no tracking cookies. That is a deliberate limit rather than an omission: those pages hold a read-write handle on a folder of children’s photographs and the roster naming every child, and anyone who could serve a script to them could read and rewrite both.

To delete a Roll Call account and everything above, email support@lineupcentral.com from the address on it. One thing is kept afterwards: a normalised form of the address, with dots and +tags removed, so that the free credits cannot be claimed again by the same inbox.

Some leagues give a photographer a list of athlete names and nothing else — no way to reach the families whose children are being photographed. Sidelines is the page that asks the families directly: a parent opens a link from their league, enters the league password, finds their athlete, and leaves their contact details.

This is the one part of our software where we collect information directly from parents. Everywhere else, information about athletes and families reaches the photography business without passing through us, or passes through and is not kept.

What is held

What is not held

No photographs — Sidelines never receives an image of any kind. No child’s full surname. No date of birth, age, address or any other detail about a child beyond the shortened name, the team and, for a school, the grade and teacher described above. No marketing or messaging preference: the photographer keeps those in their own systems — their gallery platform, with its own unsubscribe, and, if they use Lineup, Lineup’s own opt-out list on their computer — and a second copy stored here would only go stale. No password of yours: the league password is stored as a keyed one-way hash and cannot be read back out.

How long it is kept

Usually days, not months. The photographer can confirm, on their own screen, that a download of this data has been imported into their own software — and that confirmation deletes from our servers, immediately, the parents’ contact details that download contained. Anyone who signed up after that download is untouched, because they were not in it. The shortened athlete names stay while the page is open, and go once it has closed and no contacts are left.

Failing that, there are two automatic deadlines. Every Sidelines page has a closing date, set when it is created and shown to the photographer. After it closes, the shortened athlete names and every parent’s contact details are deleted automatically: fourteen (14) days after the later of that closing date and the photographer’s most recent export of the data, or ninety (90) days after the closing date if the data was never exported. Deletion is carried out by an automated sweep that runs as the service is used — when a photographer opens their Sidelines pages, and on a share of parent visits — so the data is deleted the next time the sweep runs after that deadline. The photographer can also delete a league’s names and contacts immediately from their own screen, and a record that the league existed — its name, code, dates and settings, with no athlete or parent in it — is all that remains afterwards.

The point of that arrangement is that the data is here to be moved, not to be stored: once the photographer has downloaded it into their own systems, our copy is on a two-week timer.

Who it goes to

The photography business that created the page. They download it and load it into the software they use to run picture day, and pass it on to the gallery service they use to deliver your photos. We give it to no one else. We do not sell it, rent it, or use it to market anything to you, and it is not used to train AI or machine-learning models. The photography business is the data controller for what parents submit and is responsible for its own notices and consents to the families it serves; we process it on their behalf.

Sidelines is hosted on Cloudflare (Pages and the D1 database). Its pages carry no analytics or advertising script of their own and set no tracking cookies. The photographer’s pages and the sign-up status page are marked so that search engines do not index them. The public page at lineupcentral.com/sidelines can be indexed: it holds no athlete names, which load only after the league password is entered.

To correct or remove what you submitted, contact the photography business running your picture day, or write to support@lineupcentral.com and we will remove it.

Lineup includes an optional relay: a small web service that a photography business deploys to its own hosting account (Lineup’s setup assistant uses the business’s own Fly.io account). Coordinators, parents, crew and the business’s own customers use links on it to answer questions, upload rosters, view photographs, sign agreements or order. We do not host the relay, hold any credential for it, or have access to what is on it. The business is the data controller for everything on its relay, and its hosting provider is the business’s processor, not ours. The relay is off until the business turns it on in Lineup and accepts a disclosure.

What a relay can hold

Most personal data on a relay is stored unencrypted by the relay software; family photo pages, coordinator job pages, the client portal, store orders and a few other items are encrypted, as the Data Retention table below says for each. How long each item stays is in the same table. Some items have no automatic expiry, and the table says so.

We also run a relay and an online store of our own, at addresses under lineupcentral.com (companion., intake., verify. and store.) and thepicturedayrig.com, for our own photography business, The Picture Day Rig. They are not provided to other studios. Everything in this section applies to them as well, with JM Photography LLC, not a studio, as the operator and the data controller.

Removing a family’s data

When a studio runs Lineup’s Family data request for a child, Lineup removes the child from the studio’s own computer and asks the studio’s relay to delete the child’s family photo page (and the “Find my photos” entries for it), the child’s entry in the companion app’s roster copy, the child’s parent sign-ups (and, where the whole family is leaving, every sign-up and Find my photos entry for the parent’s email address), and the family’s store orders. It also takes the child’s gallery link down and moves the gallery folder to the Google Drive or Dropbox trash. Lineup reports each as done or not done, and if the relay cannot be reached or needs an update it tries again by itself once a day. When a job is delivered Lineup drops its companion roster copy from the relay, and when a job is archived it also withdraws the coordinator job page and the requests and client-portal records tied to it.

A family data request does not remove every copy of a family’s data. Roster changes entered in the companion app (walk-on athletes, edited names and numbers, and claimed spare spots, which include a parent’s name, email address and phone number) stay on the relay with no expiry and are not removed by it; neither are email delivery events, the relay’s list of email opt-outs, or the up to three copies of the relay’s database it keeps from before an update. Every other item in the Data Retention table expires on its own schedule, not on request. Copies at Stripe, GotPhoto, the studio’s email provider and in backups are outside Lineup’s reach, and Lineup’s report lists what the studio must still do by hand.

Lineup optionally connects to a Google account, at the operator’s initiation, to deliver finished photos to the operator’s own Google Drive, to send and draft email from the operator’s own Gmail, to read mail for the features the operator turns on, and to create video-call events on the operator’s own calendar. This section discloses exactly what we access and why, in compliance with the Google API Services User Data Policy. Lineup asks for five scopes.

Scopes requested

Storage. The Google authorization token is stored in the operator’s macOS Keychain, on the operator’s own computer, and in a studio backup file only if the operator chooses to include saved keys (that file is encrypted with the operator’s passphrase). It is never transmitted to or stored on our servers.

Sharing. Data obtained via these scopes flows only between the operator’s device and the operator’s own Google account, and is sent to no other third party, with one exception: for operators who add their own Anthropic key and turn an AI-assisted feature on, message content read through these scopes (for example, the subject and what the sender typed this time in a new email, for sorting, with private details replaced by markers) is sent to Anthropic, as the next section lists.

Revocation and deletion. Operators can revoke Lineup’s access at any time from their Google Account permissions (myaccount.google.com/permissions). Disconnecting Google within Lineup’s Settings deletes the token from the Mac’s Keychain; it does not withdraw Lineup’s permission at Google, so to do that, also remove Lineup on that Google page. Neither deletes anything from the operator’s own Gmail or Drive, since Lineup never held a separate copy of that data.

Compliance note. Lineup’s access to and use of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.

Restricted scope. gmail.readonly is classified by Google as a restricted scope, not merely sensitive. Google’s published guidance is that its annual CASA (Cloud Application Security Assessment) requirement applies to applications that access restricted data “from or through a third-party server” — which describes the AI-assisted features in the next section that send email content, for operators who enable them.

Lineup includes optional AI-assisted features that use Anthropic’s API. This section is the complete list of what each one sends, and when.

AI features are off unless the operator adds their own Anthropic API key (Settings → AI Features) and agrees to Lineup’s in-app AI notice. Lineup keeps the key in the operator’s Mac’s Keychain (and in an encrypted studio backup file only if the operator chooses to include saved keys), never on our servers, and each request goes from the operator’s Mac straight to Anthropic (anthropic.com), not through Lineup’s servers. Photographs are never sent. Withdrawing agreement in Settings stops every feature at once.

Nothing is sent unless the operator clicks a button or talks to the assistant, except two things, and only while the Parent Inbox Responder is on (it cannot be switched on without a key): the sorting of each new email and the reading of a booking inquiry. Before text is sent, Lineup replaces email addresses, links, access codes and phone numbers in it with markers such as [email] or [link]. It also replaces names it knows (the roster’s, for the sender’s address) and names a message introduces in a way Lineup can read (a greeting, a sign-off, “my son …”). A name written any other way inside a sentence cannot be recognised and is sent.

1. Parent Inbox — sorting new mail. While the Parent Inbox Responder is on, each new email to the address it watches (read via the gmail.readonly scope above) that comes from a person — not the operator’s own address, not a no-reply or notification sender, not bulk mail — is sent automatically so that Claude can say what the message is asking. What is sent is the subject and what the sender typed this time. The earlier messages quoted under it, and the signature, are not sent, and neither is the sender’s address. Email addresses, links, access codes, phone numbers and the names Lineup knows for that sender (theirs, and the athletes’ and parents’ on the operator’s rosters whose address matches) are replaced by markers first. Claude is asked once; if its answer cannot be used, the message is left for the operator. Sorting never changes, labels, archives, deletes or sends mail.

2. Booking inquiries that arrive by email. When sorting says a message is a booking inquiry, Lineup automatically sends today’s date, the subject and what the sender typed this time, once, with email addresses, links, access codes, phone numbers and the sender’s name replaced by markers, so that Claude can read the group, sport, size, dates and questions in it. The sender’s name and address are not sent: Lineup takes them, and the phone number, from the email on the operator’s Mac. Claude writes nothing in the reply. Lineup saves a Gmail draft built from the operator’s fixed template — their open dates and the link where the client picks a date — and sends it by itself only if the operator turned on automatic inquiry replies (off by default) and the email is less than a day old. Either way it carries no text written by Claude. A paragraph answering the client’s questions is written only when the operator clicks Write draft (4).

3. Parent Inbox — Draft with AI and Polish my text. When the operator presses Draft with AI in a message’s reply box, that message’s subject and the sender’s own words, as they wrote them (the earlier messages quoted in it are removed), are sent with the studio’s name, pricing link, price list and saved notes, and nothing from the operator’s records about the family or the athlete. Polish my text sends the same, plus the reply the operator typed, exactly as typed. Only when the button is pressed. The result appears in the box for the operator to edit; nothing goes to the family until the operator takes the two clicks to send it.

4. Draft with AI in the client email window. When the operator clicks Write draft, Lineup sends the client’s message in the box (for a client with an open inquiry the box starts with that inquiry’s message, and the operator can edit it), the email being written, the client’s name and the contact’s first name, and the studio’s name, pricing link, deposit, open dates, price list and saved notes. Email addresses, links (the date-pick link included), access codes and phone numbers in the message and the email are replaced by markers first. Nothing is sent when the window opens or when a template is picked.

5. Rewrite with AI. When the operator clicks Write options, Lineup sends the subject and message the operator wrote and the tones to try, including any tone the operator describes in their own words. On the Communication tabs the message goes exactly as typed, with placeholders such as {parent_first_name} unfilled. In the client email window the email goes as a template with its blanks unfilled: names, email addresses, links (the date-pick link included) and phone numbers are swapped for placeholders first, and put back into the options that come back.

6. Field corrections. When the operator clicks Extract Corrections, the text the operator pasted in (for example, “his jersey number is actually 23”) is sent so Claude can turn it into roster corrections for the operator to review. Email addresses and phone numbers in it are replaced by markers first, and Claude is not asked for a parent’s email or phone. Names in the notes are sent. Nothing is applied until the operator applies it. This feature does not read Gmail or Google Drive.

7. The Lineup Assistant (voice). While the operator talks to the assistant, what they say (converted to text) is sent, with the results of what the assistant looks up: for an athlete search, the athlete’s full name, team and job, the parent’s name and whether an email address is on file; for a job’s status, its stage, shoot date and what is holding it up; and after it sends an email, whether it went and the address with only its first letter and its domain showing. Parents’ and coordinators’ email addresses, gallery access codes, gallery links and roster links are not sent, and a failed action is reported as a short reason with addresses, links and phone numbers hidden. The assistant can send an access-code email, a gallery email or a roster reminder through the operator’s own email provider, and Lineup refuses any send unless the operator has just said yes out loud to the assistant’s question about that send; one yes allows one send. It cannot change a picture day’s date: that always needs the operator to approve it on screen.

Nothing is sent or changed for the operator without their confirmation. Items 1 and 2 run automatically, only while the Parent Inbox Responder is on; every other feature runs only when the operator presses its button or talks to the assistant. Replies are drafts the operator reads and sends themselves; the one exception is the booking-inquiry reply, a fixed template with nothing written by Claude, which goes out by itself only if the operator turned on automatic inquiry replies (off by default). Nothing is applied to a roster until the operator applies it.

Model training. By default, Anthropic does not use API inputs or outputs to train its models. Lineup’s use of the Anthropic API does not opt in to any exception to this.

Retention. Anthropic automatically deletes API inputs and outputs within 30 days under standard operation. If content is flagged by Anthropic’s own automated trust-and-safety systems as violating its Usage Policy, that content may be retained longer — up to 2 years for the input/output itself, and up to 7 years for the safety classification score. We do not separately store the content of these requests on our servers beyond what is needed to display the result to the operator in the moment.

Lineup can send us a report when it meets an unexpected error. Crash reports are off by default, and stay off unless the operator turns them on in Settings, after reading an in-app disclosure; a materially changed disclosure stops them until the operator accepts it again, and turning them off stops new reports immediately.

A report is built from a fixed list of fields: the kind of error; where in Lineup’s code it happened; the Lineup, Python and macOS versions; whether it happened in the main window or a background task, and a fixed label for the kind of task; a random report identifier and the time; and the error message, rebuilt so that only programming terms and ordinary error-message words remain, with names Lineup knows, file paths, addresses and non-technical numbers removed. A report carries no identifier of the operator or the computer, no stored values, and no log files. At most 20 are sent per session, and each distinct error once. A name that is not yet on Lineup’s list of names to remove can occasionally survive in part; the in-app disclosure states that limit.

Reports go to Sentry (Functional Software, Inc.), the error-tracking service we use. Sentry necessarily sees the network address a report is sent from; we configure it not to store that address. We use reports only to diagnose and fix defects, and keep each for 30 days.

Payment for Lineup software purchases is handled by our Merchant of Record, Lemon Squeezy. Lemon Squeezy processes billing information necessary for your subscription and license — payment card information is processed by Lemon Squeezy and is not received or stored by us.

Roll Call credits are separate, and are processed by Stripe. Card details go to Stripe directly; we never receive or store them. What we keep of a purchase is the ledger row and Stripe’s payment identifier, which is what lets a charge be traced back if you query it. Credit sales are closed during the Roll Call beta, so nothing is charged today.

You choose your own transactional email provider for parent- and coordinator-facing mail — Gmail or Resend — in Settings. This determines which provider handles access-code emails, delivery notifications, and roster reminders on your behalf, as described in How Information Is Shared above. If you run a relay, it sends some mail itself (Find my photos links, store order confirmations and companion app sign-in links) through the Resend key you give it, whichever provider Lineup uses.

Roll Call is different: its sign-in links, and the confirmation sent when you use a “notify me” form on this site, are sent through our own Resend account rather than one you configure. Those are transactional emails — we do not send marketing to a Roll Call account address, and the “notify me” list exists to tell you when the product it was for actually launches.

So that nobody can use those forms, or the support form, to fill a stranger’s inbox, each counts how often it is used per email address and per network in the past hour. The count is kept against a one-way keyed hash of the address or network, never the address itself, and it is deleted once its hour is over, the next time any of those forms is used.

You can contact us to update an email address on your own account or support communications with us.

Lineup is software used by youth sports photography businesses. Athlete information may be submitted by a parent, guardian, league, coach, or authorized organizer — or entered directly by the photography business using Lineup — so that the business can run picture day, identify galleries, fulfill orders, and support families.

Sidelines is the exception to the local-first design described below. A league’s athlete names and the contact details its parents submit are stored on our servers, for a stated and short time, because that is the only way a page can collect them at all. The Sidelines section above is the detail, including the deletion clocks.

Roll Call handles the same kind of information and holds less of it. The roster a photographer loads is usually a list of children’s names. Its barcode column, and the columns the photographer’s name pattern uses, reach our servers so that it can be matched against the barcodes in their photographs. It is not stored. The photographs themselves are never transmitted at all. What survives a job is a count, a price, and a list of subject barcodes against a one-way key for each frame — no filenames, no names, no teams, no contact details. The photography business running Roll Call is the data controller for the roster it uploads, and is responsible for its own notices and consents to the families it serves.

The photography business using the software is the data controller for athlete, parent, and guardian information, and is responsible for the privacy notices, consents, and legal basis (including COPPA) for processing that information with the families it serves.

Our design and practices with respect to minors’ information follow these principles:

Local-first, by default. Athlete and roster data entered into Lineup stays on the operator’s own computer until the operator uses a feature that sends it: a relay feature, delivery to their own Google Drive, Dropbox or GotPhoto (folder and file names carry athletes’ names), email to families, or a Sidelines page (the shortened roster only).

Data minimization on the relay. A relay holds what its features need, as listed in The Relay section above, and only when the operator enables it, with one exception: the delivery reports the email provider sends back are kept whole, including the email’s subject, any link clicked, and the recipient’s network address and browser. It is the operator’s own relay, not ours. Emails inviting parents to verify their child’s information contain no athlete details; athlete information is shown only within the secure relay portal behind a unique token-protected link.

Who receives a child’s photo link. Lineup sends a child’s photo link to that child’s family. Someone who has paid for that child’s digital photos also gets their own copy of the link, in a separate email that shows none of the family’s addresses, when the order is tied to that child: the buyer’s email address or name matches the child’s parent contact on the roster, or the studio matched the order to the child by hand.

Retention on the relay. A coordinator’s or parent’s answer is removed once the operator’s copy of Lineup confirms it has it. One that is never collected is removed 30 days after it was given, and not before its link expires. Other relay data stays for the times in the Data Retention table below, and some of it has no automatic expiry; the table says which.

No profiling, no AI training. We do not analyze or profile athlete, parent, or guardian information, and we do not use it to train AI or machine-learning models. (Information on a relay is held for the operator, not used by us.) (The AI-assisted features described above work on the operator’s own email, messages, voice requests and pasted notes; they can include athletes’ and parents’ names, but they are not used to analyze or profile athletes.)

Direct collection, in one place only. On our own servers, Lineup and Roll Call collect nothing directly from athletes, parents, or guardians. (A page served by a photography business’s own relay collects information for that business, not for us.) Sidelines does, and only this: a parent’s own name, relationship, email address and optional phone number, typed by that parent, for an athlete they select from their league’s roster. We never collect information from a child, and a child has no reason to use the page. The roster of names behind the league password comes from the league, by way of the photographer.

Parents, guardians, and league organizers with questions about athlete information, opt-outs, corrections, or deletion requests should contact the photography business running their picture day, or reach us directly at support@lineupcentral.com.

We have no ability to retain production databases, athlete information, photographs, or other data stored solely on an Operator’s computer. The same is true of every folder Roll Call renames: the files, and the changes made to them, only ever exist on the computer that ran it.

To request correction, deletion, or a copy of information connected to you, email support@lineupcentral.com. Requests concerning athlete/parent data collected through Lineup should be directed to the photography business operating it, as the data controller.

For Lineup, we use Keychain storage for tokens and API keys on the operator’s Mac (if the Keychain refuses one, Lineup keeps it in its settings on that Mac until it can be moved; never on our servers). The relay software we supply, which runs in the operator’s own hosting account, is served over HTTPS (plain HTTP is redirected, and browsers are told to use HTTPS only); AES-256-GCM encryption at rest for the items the Data Retention table marks as encrypted, with a key derived from the link that opens them for some of those (family photo pages, coordinator job pages, store pages and the client portal), so the relay cannot open those on its own, and store orders sealed so that only the studio’s Mac, and the parent through their own confirmation link, can open them; authenticated internal endpoints gated by a secret generated when the relay is deployed and held in the operator’s own hosting account and on the operator’s Mac, never by us; a best-effort filter that removes email addresses, phone numbers and labelled names from the relay’s logs; and a web service that runs as an unprivileged user. Items the table does not mark as encrypted are stored unencrypted on the relay’s storage volume, and the relay does not encrypt its database as a whole. Encryption of that volume, and any snapshots of it, belong to the operator’s hosting provider. A deleted record can remain in the free space of the relay’s database file until it is overwritten.

For Roll Call: TLS in transit; no password to steal, because sign-in is a single-use link whose token we store only as a one-way hash and which expires in 20 minutes; a session cookie signed with a server-held secret, so it cannot be forged; and account, ledger and plan records held in Cloudflare D1. Two consequences worth stating plainly rather than leaving to be discovered. Anyone who can read your email can sign in as you, so the mailbox is the thing to protect. And signing out clears the cookie in that browser but does not invalidate a copy of it taken elsewhere before it expires.

No method of transmission or storage is completely secure, so we cannot guarantee absolute security. If you believe information has been exposed or used incorrectly, contact us promptly. Operators are responsible for protecting their own computers, backups, databases, passwords, and local storage.

Depending on your state of residence, you may have rights under state privacy laws, which may include the right to know, access, correct, delete, and obtain a portable copy of personal information, and to opt out of sale/sharing or targeted advertising (we do not sell, share for targeted advertising, or engage in such activities). These laws include, among others:

California’s Consumer Privacy Act (CCPA), as amended by the CPRA; Virginia’s Consumer Data Protection Act (VCDPA); Colorado’s Privacy Act (CPA); Connecticut’s Data Privacy Act (CTDPA); and Texas’s Data Privacy and Security Act (TDPSA).

To exercise any available right, contact support@lineupcentral.com. We will not discriminate against you for exercising your rights.

Lineup is operated from the United States. If you access our services from another country, your information may be transferred to and processed in the United States where permitted by applicable law. Because production data generally remains on the Operator’s own computer, international transfers by us are limited to licensing, billing and support information an Operator voluntarily provides, update checks, crash reports an Operator turns on, Roll Call records, and the Sidelines rosters and parent contacts described above.

We may update this Policy from time to time. When we make material changes, we will update the “Last updated” date at the top of this page. Continued use after the effective date constitutes acceptance where permitted by applicable law.