Privacy Policy

Last updated October 27, 2026 · RefTraq beta · What changed

RefTraq keeps an official’s season: games, pay, mileage, expenses and the records a tax preparer asks for. This policy says what we keep, where it lives, who can see it and what leaves your hands. It is in plain language on purpose.

What you give us, and what we keep

• Your account. The email address you sign in with. There is no password: sign-in is a one-tap link emailed to you. If “Sign in with Google” is offered and you use it, Google tells us your email address. We never see your Google password, contacts or mail.
• Your settings. Your name as your assigner lists it, what you’d like Chief to call you if you tell it (your first name, your initials or a name you type; deleted with your account), your home address (used to measure drives), any other places you leave for games from, like work (a name and an address, used to measure drives from there), which place you usually leave from, the associations that assign your games (a name, the sports they assign and your notes) and which one assigns each calendar feed’s games, and, if you choose, which one each is in RefTraq’s directory of officials’ associations and chapters, which association a chapter belongs to, and what it is to you (you belong to it, it assigns your games, it pays you), whether an assigner’s games are school games (UIL or TAPPS), if you say, your default fees, arrival times, which notifications you want, your quiet hours and time zone, and similar preferences.
• Your schedule. Games synced from the calendar links you add, imported from spreadsheets you paste or upload, or typed in: the date, time, sport, level, position, site, teams, assigning group, fees, what you were paid and when (each payment with its own date and, if you give one, the check’s number), and your notes. When you tell RefTraq to keep an imported game beside the same game from your calendar feed (“Keep both”), it keeps that answer in your account too, so it does not ask again on your other devices.
• Your calendar links. Each link your assigning platform gives you carries an access code. We store it to sync your schedule, show it masked in the app, and use it only to fetch your own calendar. We never have your assigning-platform password: RefTraq doesn’t ask for it and couldn’t use it.
• The crews on your games. Your calendar lists who else worked each game and their position, and RefTraq keeps that list with the game. You can also add who worked a game with you yourself, or import it from a spreadsheet. These are other people’s names. They stay in your account, and RefTraq never shows them to anyone else or sends them anywhere. They are never used to contact anyone, never sent to Quick add’s AI helper or with a question you ask Chief (they are taken out of it first), or with a document you have read with AI (a document you choose to send goes as it is), never included in support requests, never included in your tax export, and never on a season or career card you share. A game card you choose to print lists the crew and their positions, because that is what a game card is for; once printed, it is yours to hand out. If you tell RefTraq that two spellings are the same person (or are not), it keeps that answer in your account too, so it does not ask again.
• Mileage, expenses and your tax answers. Trips you log, expenses and their categories, your answers to the Deduction Review (including its notes for your preparer, such as a home office or a big purchase and when you bought it, so they show on your other devices and print on your tax meeting sheet and tax export), home-office and car figures you enter, who pays you, and the 1099 forms you record.
• Reminders lined up for you. RefTraq writes a reminder into your account ahead of time — when to leave for your next game, when a game is added to your calendar, moved, canceled or dropped from it, the morning after a game day with no drive logged, a weekly note when money is still owed, once at tax time, three times in December while the Founding Official price is open and you haven’t bought Pro (only once Pro is on sale), and when RefTraq replies to a request you sent (its number only, never the reply) — with when it may go and whether it went, so the same message is never sent twice. They are made from the schedule, drive log and settings already in your account. Only RefTraq’s server writes them; you can read your own, and they are deleted with your account.
• Devices you turn notifications on for. When you turn on notifications for a phone or computer, RefTraq keeps what your browser hands over so a message can reach it: the device’s notification address, the keys that let only that device read the message, and a short label such as “iPhone · Safari”. It is removed when you turn notifications off or remove the device, when you sign out on that device, when the notification service reports the device gone, and with your account. When you remove a device or turn its notifications off, RefTraq keeps only its notification address and the day, so that device can’t quietly turn notifications back on; that is cleared when you turn notifications on there again, and with your account. RefTraq also keeps when you last sent yourself a test notification, so tests stay half a minute apart; that goes with your account.
• What you have read. When you open, mark or clear something under the bell, RefTraq records that, and when, so the same item reads as read on your other phone or computer. It is deleted with your account. RefTraq’s owner can see how many people read an announcement, never who.
• News from RefTraq. Now and then RefTraq’s owner posts a note to everyone — a product update or something worth knowing. It appears under the bell for every account (an account sees the ones from 30 days before it signed up onward), and goes to your phone or computer as a notification only when the owner chooses that for the post and you have “News from RefTraq” switched on. RefTraq’s owner can see how many people read each one, never who.
• Photos you choose to keep.
  • Checks. Before a check photo is read or kept, RefTraq paints the bottom band of the check solid black. That is where the bank’s routing and account numbers are printed. Only the edited picture can be stored; the original never leaves your device. A pay stub torn off its check has no routing or account number, so when you say a picture is a stub with no bank line, nothing is painted out and it is kept as you cropped it. A check with its stub still attached is treated as a check. A screenshot of a payment made on your phone has no bank line either, so a picture you choose as a payment screenshot is kept as you cropped it, with nothing painted out.
  • Receipts. Kept as you took them. A shop receipt shows at most the last four digits of a card.
  • Files you attach to a support request or feedback (up to five screenshots, photos or PDFs with a message). Kept as you sent them, stored privately in your account. Only you and the RefTraq team can see them, they are never sent to GitHub with the request (the copy there says only how many files are attached, never a file, its name or a link), and they are deleted with your account.
  • Pictures and files are stored privately under your account and opened through links that expire after a few minutes.
• Bank and card accounts (optional).
  • If you link an account, it goes through Plaid. You sign in to your bank inside Plaid’s window, and we never see your bank username or password.
  • We keep the institution’s name, each account’s name, type, last four digits and balance, and its transactions (date, description, amount, merchant and category).
  • The code Plaid gives us to fetch them is encrypted by us before it is stored, and the app itself can never read it back.
  • Disconnecting an account ends the link at Plaid and deletes that account’s stored transactions.
  • What Plaid does is covered by Plaid’s End User Privacy Policy.
• Your RefTraq calendar link (optional). The link that puts your games in your own calendar (not the links your assigner gives you, above). If you make one, RefTraq keeps its private address and when a calendar app last read it. Making a new link or turning it off ends the old address at once, and it is deleted with your account.
• Support requests. What you write to us through Help, plus a short, fixed set of facts about the app: its version, your device type, and the screen you wrote it from (the address only). It never includes your fees, your email address or your calendar links. RefTraq’s owner may also start a conversation with you in the app, to follow up on something you sent or about your account: it appears under the bell and with your requests, and you can reply there. A conversation he starts is never filed in GitHub.
• How you found us. If you arrived through somebody’s link (a chapter newsletter, a partner, or another official’s card), we record which link it was, once, when your account is created. Whoever shared the link sees only counts: how many accounts arrived and how many became active, never who. The code on your own card is random and does not identify you.
• Free access. If RefTraq has promised you free access, that promise is recorded against your email address. If you redeem a promo code, we record which code, when, and the free access it gave you. A code that doesn’t work is counted, so guessing is slow — the time only, never what was typed — and those counts are deleted with your account.
• That you agreed to these terms. When you check the box agreeing to the Terms of Service and this policy, we record which version you agreed to and when. The record can’t be edited afterward, by you or by us, and is deleted with your account.
• How you use RefTraq. RefTraq records what features you use and when something goes wrong, along with your account, so we can see how people get started and where they get stuck. It never records what you typed or the amounts, names, addresses or pictures on the screen. The detail is kept for 90 days, then only daily counts. It stays in our own database; no outside analytics or advertising company receives it. Settings → “Help improve RefTraq” turns it off.

What stays on your device

The app keeps a few conveniences in your browser’s own storage:

• that you’re signed in;
• which “What’s new” entry and which milestone you’ve already seen;
• an unfinished Deduction Review, and which of its notes are already saved to your account;
• the nights away you cleared, whether you have looked at them, and any per-night rate you typed, for each year;
• which possible duplicate drives you told it to keep, and an imported game you told it to keep beside the same game from your calendar feed until that answer reaches your account;
• that none of the names it offered from your crew lists was you, and when your saved name was on none of those lists, that name;
• whether you’ve agreed to Quick add’s helper (Quick add was called Hey Ref, then briefly Whistle, until September 27, 2026);
• whether you’ve agreed to have a document read with AI;
• whether you’ve closed the tip about installing the app;
• whether you’ve closed the Season Pass note on Home, for each stage of it;
• whether you’ve said “Not now” to turning on notifications from Home;
• whether you skipped bringing in last season during setup;
• which paid games you said “Not now” to filling the travel on (the games only, no amounts);
• whether you put away the setup meter on Home, and which setup steps were still open then, so it comes back only when a new one is;
• for Chief’s setup suggestions on Home, the day this device first saw your account, the last day one was shown, which steps you said “Not now” to and until when, and whether you said “Stop these” (kept after you sign out, so a “Stop these” holds);
• a promo code you entered before signing in, until it is used (for up to 30 days);
• the page you were heading to when you signed in (for an hour);
• the email address a sign-in email was just sent to, so the page can ask for its code again after a reload (in this tab only, for an hour);
• that you’ve agreed to the terms, so you aren’t asked again on this device, and which “Terms updated” note you’ve put away, so it isn’t shown again;
• which account turned notifications on in this browser, so a renewed notification address is saved again for that account only;
• the link that brought you here (for up to 90 days, until you sign up);
• after you sign out, a one-line note for the sign-in page (in this tab only, until it is shown).

Signing out removes the ones that are about you, so the next person to sign in on a shared browser starts without your drafts, your answers or your agreements to the helpers. What stays is which “What’s new” entry this browser has seen, the install tip, the sign-in page’s note, and three kept for your account only: the Season Pass note, that you’ve agreed to the terms, and the “Terms updated” note you put away. Deleting your account removes those two about the terms on this device too. Clearing your browser’s data removes them all.

What leaves RefTraq, and why

We use a small number of service providers, each for one job:

• Supabase (hosted on AWS, in the US) stores your account and everything in it. Every table is locked to its owner by the database itself: your records are readable and writable by your account only.
• Cloudflare serves reftraq.com and app.reftraq.com. Its server logs give us daily visit totals for each site.
  • reftraq.com (this site and the guide) counts visits with Cloudflare Web Analytics, a small script from Cloudflare that counts visits and measures how quickly pages load. It sets no cookie, stores nothing in your browser, keeps no personal data, and doesn’t follow you to other sites. For each page it sends Cloudflare the page’s address, the page you came from, how long the page took to load, and your browser and device type. Cloudflare works out the country from your connection and then discards your IP address. From it we see totals — visits, pages, countries, browsers, load times — never who you are. This site runs no ad pixel and no tracking cookie, and its security settings block every other script.
  • The app (app.reftraq.com) has the same Cloudflare Web Analytics script today: Cloudflare adds it to the app’s pages too, and it works as described above. That “never who you are” is about Cloudflare’s script only (how you use RefTraq, recorded with your account in our own database, is described above). The app keeps the addresses of its own requests for your records out of what the script can read.
• Google
  • Email. Sign-in links are sent through Gmail from RefTraq’s mailbox.
  • Drive distances. When you ask RefTraq to measure drives, your home address (or the address of another place you saved, like work, when you ask for the drive from there) the venue addresses and the addresses of stops you add on the way to a game are sent to Google’s Routes service. When you ask RefTraq to measure a site from your chapter’s center point (the public address UIL gives the chapter you linked, which its mileage rule measures from), that center’s address and the site’s address are sent the same way, and RefTraq keeps the miles with that site (or, when Google can’t find a route, a note that it couldn’t, so RefTraq doesn’t offer to measure that site again for a week). That happens only when you ask.
  • Sign-in. “Sign in with Google”, where offered.
• Plaid, only if you link a bank or card account (above).
• Your browser’s notification service — Apple’s, Google’s, Mozilla’s or Microsoft’s, whichever your browser uses — only if you turn notifications on. It carries each message to your device encrypted so that only your device can read it; the service sees that a message went to that device, and when.
• Cloudflare Workers AI, only if you use Quick add’s helper or ask Chief how RefTraq works.
  • Quick add reads the sentences you type or dictate on your device. When it can’t, it can offer to ask an AI model, and does so only after you agree, once.
  • What is sent is your sentence, plus the names of your venues, teams and assigning groups so the model can recognize them. Anything containing a number, such as a street address or a ZIP code, is removed first.
  • Chief answers questions about your own records on your device. A question about how RefTraq itself works that Chief can’t answer that way (“what is a travel fee band?”) is sent to an AI model with the sections of RefTraq’s public guide that match it, so the answer comes from the guide. No records are attached: before the question goes, the names of your venues, teams, groups and crewmates, your own name, and anything that looks like an amount, an email address, a web link or a long number are taken out of it, and none of your games, pay, miles or other records are sent.
  • We don’t store the sentence, the question or the reply. We count how many times you asked each day, to keep the free helper within its limit.
• GitHub, for support. A copy of each support request is filed in RefTraq’s private GitHub repository, which is how we’re notified. Before it is filed, email addresses, web links and long codes are removed from what you wrote, and it carries nothing that identifies you.
• Your calendar app, only if you add your RefTraq calendar link to one. Whoever holds the link can read your games from it — the date and time, the level and sport, the teams, the place, your position and when to leave (from where, if you saved a place like work: its name, never its address), and the names and times of any stops you add on the way (never their addresses or who you meet) — and a calendar service (Google, Apple, Microsoft) keeps its own copy of what it reads. Fees, payments, notes and the other officials’ names are never in it. Make a new link or turn it off in Settings and the old one stops working at once.
• Anthropic, only when you tap a reading button for a file, photo or pasted text: “Read the check”, “Read the receipt”, “Read the picture” or “Have Chief read it”. This is the only way RefTraq reads a photo (a check, a receipt, a fee sheet): nothing on your device reads one. A photo you never ask to have read is never sent to be read; you can type what it says instead, and a check or receipt picture you keep is kept either way.
  • The document you chose is sent to Anthropic’s Claude API to be read, with the names of your venues, teams and assigning groups so it can recognize them (anything containing a number is removed first). When you attach a photo of a check to a payment (Quick add → Payment → “Attach a photo of the check”), a picture of a check has its bank line (the routing and account numbers) blacked out on your device before anything is sent. A picture you choose as a payment screenshot or mark as a stub with no bank line is sent as you cropped it, and so is a picture you tell the Import screen is not a check.
  • Under Anthropic’s commercial terms, what we send is not used to train its models by default.
  • We don’t store the document or the reading. The values come back to your device for you to review, and only what you then save is kept. We count how many reads you have used, to keep within your allowance.

What we don’t do

• We don’t sell your data, and we don’t share it with assigning platforms, chapters, schools, partners or anyone else.
• We don’t use it for advertising, and we don’t let anyone train AI models on it.

Who at RefTraq can see what

• RefTraq’s own dashboard shows counts and totals across all accounts, and the member list described next. It never shows one person’s games, fees, payments, destinations or transactions.
• The person who runs RefTraq can see each member’s name, email and account status (when you signed up and last signed in, the link you arrived by, whether a calendar is connected, how many games you have, and whether you agreed to the terms) and what features you use (described above) so they can find your account and help you when you reach out during the beta. They don’t see your games, fees, income, drives, expenses or notes except as described here.
• We count how many members each association has, and never show anyone who. RefTraq’s owner sees, for each association in RefTraq’s directory that five or more members have chosen, how many chose it. An association with fewer isn’t shown at all, and no association, chapter or partner sees these counts.
• If a friend joins with your link, you see whether they count, never who they are. Your points page lists them as “Friend 1”, “Friend 2” and so on, each with whether they count yet, the date they started counting or will start, and, once RefTraq charges, whether they pay. You never see their name, email, games or money, and they see nothing of yours.
• Beyond that, two things carry a name, because they have to: a support request, whose reply has to reach you, and a free-access promise, which is made to a named person.
• The people who run RefTraq can reach the database to operate and repair it. We look at your records only to answer a request you made, to fix a problem you reported, or when the law requires it.

Answers to support requests

Some questions are answered automatically from RefTraq’s own guide, under RefTraq’s name. An answer that touches money or taxes is held until a person has read it.

How long we keep things

• Your records stay until you delete them or your account.
• Deleting a game keeps a copy of it, so your calendar can’t quietly bring it back and so you can undo the delete. Deleting your account removes those copies too.
• A game’s history (when it was removed from your calendar, canceled, hidden or deleted) is kept with the game.
• Imports keep a fingerprint of each file and row, so the same sheet is never imported twice. They don’t keep the file.
• Two things outlive an account, by design: the copy of a support request in GitHub, which carries nothing that identifies you, and a free-access promise, which is recorded against an email address. We remove the promise if you ask.
• Our hosting provider keeps backups for a limited time, and they expire on its schedule.

Your data is yours

• Export. The Schedule C export gives you every game, mile and expense for a year in one file, any time. The tax meeting sheet and the pay sheet print or save the rest.
• Deletion. In the app, Settings → Delete my account deletes the account and everything in it: you type your email to confirm, any bank you linked is disconnected at Plaid first, then your kept pictures are removed, then the account and every record in it. Or email hello@reftraq.com from your account’s address and we will do it for you.

Security

• Everything travels over encrypted connections (HTTPS).
• Data is encrypted at rest by our hosting provider, and the bank access code is encrypted a second time by us.
• Access is limited to your account by the database itself, not only by the app.
• If something goes wrong with your data, we’ll tell you.

Who RefTraq is for

RefTraq is built for sports officials keeping their own records, and you must be 18 or older to use it. We don’t knowingly keep information about anyone younger; if we learn an account belongs to someone under 18, we delete it.

Not tax advice

RefTraq is a record-keeping tool, not a tax preparer. Its figures are estimates for planning. Confirm your filing with a tax professional.

Changes

We’ll post changes here with a new date. Before a change that affects what we collect or who sees it takes effect, we’ll tell you in the app.

What changed on October 27, 2026. RefTraq no longer reads photos in your browser. The reader on your device is gone, so reading a photo always sends it to Anthropic to be read, and only when you tap a reading button (“Read the check”, “Read the receipt”, “Read the picture” or “Have Chief read it”), with a check’s bank line blacked out on your device first. The October 25 version said a photo was read in your browser unless you chose “Have Chief read it”. What is sent, and what Anthropic and RefTraq keep, is unchanged.

What changed on October 25, 2026. A game can now be paid in more than one payment, so this page now says that RefTraq keeps each payment with its own date, and the check’s number when you type one, so the same check isn’t recorded twice. They are deleted with your account.

What changed on October 24, 2026. This page now says that reftraq.com counts visits with Cloudflare Web Analytics, which sets no cookie, stores nothing in your browser and keeps no personal data. reftraq.com still runs no ad pixel and no tracking cookie. It also says that Cloudflare adds the same script to the app’s pages today; the October 21 version said the app ran no outside analytics script. And it names one more thing kept in your browser for your account: which “Terms updated” note you’ve put away (you now agree to the terms once, and a later change is announced in the app). It also says that a question you ask Chief about how RefTraq works, when Chief can’t answer it from your records, may be sent to Cloudflare’s AI with the matching sections of RefTraq’s guide, with your names, amounts, email addresses, links and long numbers taken out of it and no records attached.

What changed on October 21, 2026. This page now describes:

• how you use RefTraq: what features you use and when something goes wrong, recorded with your account in our own database, never what you typed or what is on the screen, kept 90 days and then only daily counts, and turned off in Settings → “Help improve RefTraq”;
• that the person who runs RefTraq can see it for each member, beside your name, email and account status;
• what you see about a friend who joins with your link: whether they count for referral points, a date, and whether they pay, never their name, email, games or money;
• that the app runs no outside analytics script today: the Cloudflare Web Analytics it describes runs only if RefTraq turns it on, and only after you agree to these terms.

What changed on October 18, 2026. This page now says more exactly what “Have Chief read it” sends to Anthropic:

• it can send a pasted or spreadsheet text as well as a file or photo, and you can choose it whether or not the reader on your device managed;
• a check’s bank line is blacked out first on Photograph a check (now “Attach a photo of the check” in Quick add → Payment), while a payment screenshot, a stub with no bank line, or a picture you tell the Import screen is not a check is sent as you cropped it.

What changed on October 16, 2026. RefTraq now keeps a directory of officials’ associations and their local chapters (public facts, starting with the officials associations UIL recognizes in Texas and the chapters UIL lists for its mileage rule). This page now describes:

• which of your associations is which in that directory, which officials association a chapter of yours belongs to when the directory doesn’t say, and what each is to you (you belong to it, it assigns your games, it pays you), if you choose to say;
• the counts RefTraq’s owner sees: how many members each association has, only where five or more chose it, and never who;
• miles from your chapter’s center point to a site, measured by Google only when you ask, and kept with that site so a fee schedule that pays travel by distance from the chapter center can use them.

What changed on October 15, 2026. This page now has its own date, separate from the Terms of Service, so bringing it up to date doesn’t ask you to agree to the terms again. Since the last version (October 4, 2026) it also describes:

• Anthropic, which reads a file or photo only when you tap “Have Chief read it”, with a check’s bank line blacked out on your device first;
• what the person who runs RefTraq can see about your account: your name, email and account status, so he can help you when you reach out, and never your records;
• files you attach to a support request or feedback, kept privately in your account and never sent to GitHub;
• news from RefTraq, notes the owner posts to everyone’s bell, and what you have read there;
• conversations RefTraq’s owner starts with you in the app, which you can reply to and which are never filed in GitHub;
• the morning-after reminder to log the drive for a game day with no drive logged;
• printed game cards, which list the crew and their positions.

Contact

hello@reftraq.com. A person reads every message.