Privacy Policy

Our approach

One Grove is a private community for Stanford women's lacrosse players, alumni, and families. We use personal information only to operate, improve, and protect the community. We do not sell personal information, serve advertising, or track members across other companies' apps and websites.

Information we handle

• Account information: first and last name, email address, the team relationship you choose (alumni, current player, staff, parent, or friend), and optional playing or staff positions and jersey number. We also store account role, authorized roster connections, working groups, and support interests. A self-described relationship or position does not grant private team or administrator access.
• Optional personal profiles: a profile photo, class year, current city or region, company, job title, industry, bio, LinkedIn link, and willingness to help with mentoring or internships. You can edit or remove these details in Account → Edit my profile. Photos are resized and re-encoded before upload; the app does not request your full photo library or device location.
• Alumni and family directories: sharing is off by default. Alumni can choose the alumni directory; parents and alumni parents can choose the separate family directory. Existing parent profiles are not automatically listed. Their name, chosen photo, and optional profile details can be viewed and searched by signed-in One Grove members, including members who joined without an invitation. A listed member may separately choose to show a verified contact email on the detail page for their shared profile. Email sharing is off by default, requires a one-time link sent to the current account email, and is not required for directory listing or in-app messaging. Directory search results do not contain email addresses. Turning off email sharing or directory sharing removes the address from future views, although other members may already have seen, copied, or forwarded information previously shared. Private roster contact details and family access are never included. Profile information other than the separately verified email is self-described, not imported from Strya or independently verified by One Grove.
• Invitations: the recipient email, inviter account, delivery time, expiration and use status, and a one-way hash of the private invitation token. One Grove does not request access to your device contacts. An invitation can also include a group or teammate destination. After you sign in, this optional next step is saved to your account until you dismiss it or delete your account. It does not join a group or enable profile sharing for you.
• Community activity: messages you publish, the display name shown with them, and timestamps needed to organize the feed. Community posts can be read by signed-in members. Working-group posts remain limited to that group’s members. Blocking and moderation apply to both community posts and directory discovery. Members of a working group and administrators can see that group’s member names, designated lead, current goal and next step. The group member page does not reveal emails, phone numbers or private profile details. Blocked and suspended members are excluded from the displayed member list.
• Event photos: photos you choose to share in an event album, optional captions, your uploader account and display name, the game, and timestamps are stored in a private Supabase bucket. Authorized active members can view them; blocking, reporting, and moderation apply. The app resizes and re-encodes uploads to strip embedded location and other EXIF metadata. The original library asset and library filename are not uploaded. Share only photos you have the right and permission to share.
• Optional iPhone notifications: new-post and event-photo alerts are off by default and selected separately for this iPhone. When you choose alerts, One Grove stores your account identifier, a random app-installation identifier, Apple push address, category choices, and registration and delivery records in protected Supabase storage. Apple Push Notification service receives generic alert text and routing identifiers, not post text, names, captions, or photos. Opening content requires current account authorization. Website browser push is not enabled. Local game reminders are separate and do not opt you into community alerts.
• Game chat: messages you post in a scheduled game's chat, your display name, the game, and timestamps. A game chat opens 30 minutes before a confirmed start time and normally accepts new messages until three hours after the game; an administrator may archive it early or extend an active chat in one-hour increments, up to three times. Signed-in active members can read an available game chat and its archived history. Authors can withdraw their own messages, and blocking, reporting, moderation, and suspension controls apply. Game chat does not send email or push notifications.
• Family gatherings: active permanent alumni and parent members can host a game-day tailgate or watch party without publishing a directory profile. The host chooses the title, city, meeting place, time, and notes; these details, the host’s name, and the names of members who join are visible to eligible signed-in members. Do not include a private home address unless you intend to share it. Hosts can edit or cancel their own gathering, and members can withdraw their RSVP. Blocking and suspension controls apply.
• Private messages: conversation participants, message text, and timestamps. New conversations can target only alumni or parents who separately enable “Allow members to message me” on a shared profile. This setting is off by default. Senders review the named recipients before sending; regional selections do not add future members automatically. Messages stay in the app and do not reveal login email addresses or send email notifications. Conversation members can read the messages. Administrators cannot browse private conversations, but can review a specific message when it is reported.
• Pledges: the range you select or exact U.S. dollar amount you enter, your account identifier, and the timestamps needed to manage the pledge. The pledge is linked to your signed-in account. Authorized administrators can view your name, account email, and pledge range or amount so they can follow up with you. Pledges are private from other members, not anonymous to administrators. Saving a pledge authorizes an administrator to contact you at the email address on your One Grove account about that pledge. One Grove does not collect payment-card or bank details, process the donation, or transfer funds through the app. Pledging is optional and does not affect app access.
• Community safety: reports you submit, their reasons and details, your blocked-member list, and administrator moderation decisions. Reports are visible to authorized administrators, not to the member reported. Blocked lists are private to the member who created them.
• App feedback and support: the issue-or-feedback kind, subject, details you enter, and the app version and build. Each submission is linked to your signed-in account so authorized administrators can review it. If you separately opt in to email follow-up, an authorized administrator may contact only the email address currently on your One Grove account. Leaving that option off means the submission does not authorize feedback-related email follow-up.
• Team information: roster, schedule, and game information. Contact details and family notes are restricted to authorized linked members and administrators.
• Region and hometown: location information in a player's roster record, such as a city, state or province, or country. It may come from the team's public roster or be entered by an administrator. This information is linked to the player and is used to display and search the roster, including the roster lookup during sign-up. The app does not request your device's GPS location.
• Security records: sign-in and operational information needed to maintain sessions, diagnose failures, prevent abuse, and protect accounts.

The Pledge feature records an account-linked statement of intent, not a completed donation or payment. Earlier anonymous giving-interest survey responses and receipt-based pledges remain separate and are not converted into account-linked pledges. Older app versions still support anonymous receipt-based pledges; these contain only a range and a hash of a random receipt, and administrators can see only their range totals. Highlight videos remain on the member's device unless the member shares them separately.

The feedback form automatically includes only the One Grove app version and build. It does not automatically attach a device identifier, device model, operating-system details, analytics, device or crash logs, location, contacts, photos, or other files. Please do not enter passwords, verification codes, invitation links, or password-reset links in a feedback or support request.

App usage reports

Starting with app build 55, One Grove records first-party usage to understand which features help the community and where actions fail. Reports include feature visits, approximate foreground time, fixed action categories and outcomes, timestamps, app version and build, a random session reference, and your account reference. Your current team relationship is used for aggregate reporting.

Usage events contain no message content, search text, names, email addresses, contacts, photos, precise location, advertising identifiers, or persistent device identifiers. They are stored with One Grove’s existing Supabase service. Only active administrators can view aggregate usage reports; the admin dashboard does not show individual activity histories.

Usage sharing is enabled by default. In Account → Privacy, turn off Share app usage to stop new reporting on that device. This does not affect your membership or app features. Events awaiting delivery are kept only in app memory and cleared when sharing is disabled or you sign out. Reports may be incomplete when a device is offline or an app closes.

Stored usage events are removed after 90 days by a daily cleanup, or when your account is deleted. Turning off sharing does not erase events already received. We do not use this information for advertising or tracking across other companies’ apps and websites.

How we use and share information

We use this information to create and secure accounts, confirm community eligibility, deliver invitations, show authorized team content, save working-group participation, let authorized administrators review and follow up on pledges, review app issues and feedback, and maintain the service. Access is limited according to a member's account and team connection. Individual pledges and feedback submissions are available only to authorized administrators.

We use service providers to host the website and database, authenticate accounts, store shared photos and optional notification registrations, and deliver invitation, recovery, email-sharing verification messages, and opted-in iPhone alerts. Supabase stores protected application data, and Apple delivers optional iPhone alerts through its Push Notification service. Those providers process information only to supply those services. Apple separately operates TestFlight and handles beta-app installation under Apple's own terms and privacy policy. A One Grove membership invitation is not an Apple TestFlight invitation.

Invitations and retention

A member must enter one recipient email and deliberately send each invitation. We do not send automatic reminders or use invited addresses for marketing. Private registration links expire after 48 hours, can be used once, and are replaced when the same member sends a new invitation to the same address.

An email-sharing verification link expires after 30 minutes and works once. Opening it does not share the address; the recipient must deliberately confirm on One Grove's review page. After safely retaining a valid link for that page, the site reads its private token from a URL fragment that is never sent to the web server, removes it from the browser address bar, and does not store it in browser storage. The confirmation result contains no token or email address. Verification records store one-way token and address hashes with delivery and use times, not another copy of the raw address. The address hash is cleared when a request is used, revoked, or found expired; terminal records older than 30 days are pruned in bounded batches during verification activity, and all remaining records are deleted with the account. Changing the account email disables visibility until the new address is separately verified and sharing is enabled again.

Account information is retained while the account is active. Invitation and security records are retained only as long as reasonably needed for delivery, account recovery, fraud prevention, and service integrity. The invitation service removes invitation records older than 30 days when it processes new invitations. Team roster and schedule information may remain as organizational records independent of a member login. Contact help@onegrove.org to request a correction or removal of roster information.

Reports reference the original message; they do not keep a separate copy of it. Deleting a message removes its reports. Deleting your account removes reports you filed, your authored messages and their reports, and block or suspension records tied to your profile. Administrator identifiers are cleared from retained moderation records when an administrator account is deleted.

Turning off message consent prevents new conversations but does not erase existing conversations. Blocking a participant hides their message content from you and stops further sending in conversations containing that blocked pair. You can withdraw a message you authored. Deleting an account removes its authored private messages and conversations it created, including their reports; conversations created by others retain other members’ messages but cannot receive further messages after a participant is deleted. The app does not persist private conversation content in its offline cache. Recipients may already have copied content.

You can withdraw a photo you shared. Withdrawal hides it from normal album views but does not immediately erase the stored image; authorized moderators may still review a reported photo. Account deletion removes the account's album metadata and related reports, but does not immediately remove every stored image file. Other members may already have saved a shared photo. Contact help@onegrove.org for help with photo removal.

Turning off all community-alert categories or signing out revokes this installation's server push address when connectivity permits. An alert already sent to Apple cannot be recalled. Registration eligibility expires after 30 days without refresh; this does not mean the registration record is immediately deleted. Preferences remain until account deletion. Deleting an account clears its push addresses, account links, preferences, and associated deliveries. A random installation identifier and request-revision marker remain to reject delayed requests from previously signed-in accounts. Expired delivery records become eligible for bounded cleanup seven days after their 24-hour delivery window expires.

Archived game chats remain readable but do not accept new posts. An author can withdraw a game-chat message, and an administrator can remove it. Deleting an account removes that account's game-chat messages and related reports. Other members may already have read or copied a message before it was removed.

You can update or withdraw your pledge while signed in. Withdrawing it deletes the active pledge record. Deleting your One Grove account also deletes the pledge linked to that account. An administrator may already have contacted you or recorded information needed to follow up before a pledge is withdrawn or the account is deleted.

Older anonymous pledges cannot be located through your account. The original device keeps a private receipt so you can withdraw an older anonymous pledge from the Pledge page after upgrading. The receipt does not sync to other devices. Account deletion does not remove those anonymous records; it clears the local receipt. Withdraw an older anonymous pledge before deleting your account if you want that record removed. Losing the receipt or original device can prevent you from withdrawing it.

Pending reports remain until reviewed or deleted with the associated account or message. Resolved reports older than 30 days are removed when a report is submitted or the review queue is opened. Removing a message from member feeds hides it; it does not automatically delete the underlying message record.

In-app issue reports and feedback remain linked to the submitting account and are deleted when that account is deleted. Choosing email follow-up authorizes an administrator to use the account email only for that submission; it does not add the address to a marketing list.

Your choices

• You can choose new-post and event-photo alerts independently in Account → Community notifications. Both start off for each iPhone. You can change these choices in the app or disable One Grove notifications in iPhone Settings. Choosing local game reminders does not enable community alerts.
• You can change your working groups and support interests in the app.
• You can initiate permanent account deletion from the Account screen. This removes the login, member profile (including its photo, alumni or family listing, and email-sharing consent), pending invitations sent by the account, community and game-chat messages authored by the account, and app issue or feedback submissions and active pledge linked to the account.
• Listed members can turn verified contact-email sharing off at any time without removing the rest of their directory profile.
• If you receive an unexpected invitation, you can ignore it. The link will expire without creating an account.
• You can use the in-app feedback form for an app issue or idea, or contact help@onegrove.org about your account, privacy, invitations, roster information, or community safety.

Children and changes

One Grove is not directed to children under 13. We may update this policy as the service changes. The effective date above will identify the current version.