Privacy Policy

Kolvo (kolvo.app and the Kolvo app for iOS and Android) is a platform for running rec-sports leagues and tournaments — schedules, live scores, standings, stats and streams. It is operated by Kolvo LLC, a small Illinois limited liability company, and this policy is written to plainly describe what data the app keeps and why. Questions or requests: email hello@kolvo.app.

Account data

When you create an account (as an organizer, scorekeeper or team captain) we store your name, email address and a hashed version of your password. We never store passwords in plain text. To keep you signed in we store session records tied to your account; you can end all sessions at any time from your account page.

League content you enter

Organizers and captains enter the content that makes a league page: competition and team names, logos and colors, schedules, venues, game results, announcements, and rosters — player names, jersey numbers, optional player photos, and per-game stats. Public league pages display this content to anyone with the link; that is the point of the product.

Players themselves do not hold Kolvo accounts. If you are an organizer or captain entering another person's name, number or photo, you are responsible for having that person's (or their guardian's) consent to publish it. If your information appears in a league and you want it removed, contact the league organizer, or email us and we will help.

Push notifications

Fans using the Kolvo app (iOS or Android) can follow a team, competition or league to get score and schedule notifications. This stores only an anonymous device push token linked to what you follow — no account, name or email is attached. Unfollowing or disabling notifications removes the link.

Livestreams and live scores

Games and competitions can link to YouTube livestreams. We store the video links and the live scoreboard state for each broadcast game (score, clock, period, timeouts and similar), including a history of score snapshots so past streams can show the scoreboard as it was. The video itself lives on YouTube, not on our servers.

Google and YouTube

Kolvo uses YouTube API Services to let organizers broadcast games from their phone to their own YouTube channel. Connecting your YouTube account is optional; nothing below happens unless you connect it, and only for the account you connect.

What Kolvo accesses through the YouTube API

• Your channel's name. Shown on the broadcast screen so you can see which channel you are about to go live on before you start.
• Live broadcasts and stream settings on your channel. Kolvo creates a broadcast for the game you are covering, reads back the ingest address and stream key your phone needs to send video, checks whether that broadcast is live, and deletes broadcasts it created that were set up but never started.
• The title and description of recordings Kolvo created. After a game, so it can append chapter timestamps (tip-off, lead changes, final) to that video's description.

What Kolvo stores

• Your Google OAuth refresh token, encrypted (see “How we protect your data” below). This is what lets Kolvo act on your channel when you tap Go Live.
• The video link of a broadcast Kolvo created, saved on that game so the league page can show the player. It is the same public link anyone watching the stream would use.

What Kolvo does not store, and for how long

Nothing else from the YouTube API is written to our database. Your channel name is read fresh from YouTube each time it is displayed and is not kept afterwards. Stream keys are passed straight to your phone and never saved. Broadcast status and video details are fetched when needed, used, and discarded — so there is no cached copy of your YouTube data to go stale. The video link stays on the game while that game exists, so a past season keeps its footage; we re-check every stored link against YouTube each week, and if a video has been deleted or made private the link is removed automatically. Clearing the game's stream link or deleting the game removes it too. Your refresh token is kept until you disconnect.

Kolvo does not access your other videos, your subscribers, comments, watch history or analytics; does not use any of this for advertising or profiling; and never sells or shares it.

Kolvo's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

By using this feature you also agree to the YouTube Terms of Service, and the Google Privacy Policy applies to Google's handling of your data. You can revoke Kolvo's access at any time by disconnecting your YouTube account inside the app (which also deletes the stored token), or from your Google account security settings.

How we protect your data

Sensitive data gets specific, technical protection — not just a promise:

• Encryption in transit. All connections to Kolvo — the website, the iOS and Android apps, and our connections to Google's APIs — use HTTPS/TLS. There is no unencrypted access.
• Encryption at rest for Google OAuth tokens. The refresh token stored when you connect your YouTube account is encrypted with AES-256-GCM using a key held outside the database, before it is written. A copy of the database alone cannot reveal a usable token.
• Password hashing. Passwords are hashed with bcrypt and never stored or logged in plain text.
• Access controls. Google user data is used only server-side to perform the action you asked for (creating your live broadcast). Tokens are never sent to browsers or apps, never written to logs, never shared with third parties, and never used for advertising or profiling. No human reads this data except with your explicit permission for support, or where required for security or by law.
• Retention and deletion. Disconnecting your YouTube account inside the app deletes the stored token immediately and revokes Kolvo's access with Google. Deleting your Kolvo account deletes your data, including any stored tokens.
• Incident response. If we ever discover unauthorized access affecting your data, we will notify affected users promptly at their account email and revoke the affected credentials.

Payments

Paid plans, league registration fees, merch orders and sponsor slots are all processed by Stripe, our payment provider. Your card details go directly to Stripe and never touch our servers. What we keep is the record of the transaction: which plan an account has, whether a team's or player's fee has been paid, the amount, and the name and email address Stripe collects at checkout, so the organizer can tell who paid. The next section lists that by flow. Stripe's handling of your payment information is governed by Stripe's privacy policy.

People who pay, buy or sign up without an account

Most people who use Kolvo never create an account. Registering a team, signing up as a free agent, paying a fee, buying from a league's merch store and sponsoring a league all work without one. Each of those flows stores a small amount of information about the person who used it, and nothing beyond it:

• Team registration. The team name and requested color, plus the captain's name and email address. The organizer needs a way to reach whoever registered, and if the registration is approved that email address is where the invitation to set up a captain account is sent.
• Free-agent signup. Your name and email address, and optionally your phone number, the position you play and a short note to the organizer. It is how an organizer places you on a team and tells you about it.
• Fee payments and fee shares. The name and email address on the payment, which Stripe collects at checkout and passes to us, along with the amount and which team or roster spot the money covers.
• Merch orders. The buyer's name and email address from Stripe, the item and size ordered, the amount, and whether the order has been picked up, so the organizer can hand you the right thing.
• Sponsor purchases. The business name, a contact email address, the logo image you upload, the website the logo links to, and the amount and package bought. The logo and link are public on the league's pages once the organizer approves the sponsorship; the email address is not.

How long we keep it. All of it lives with the competition it belongs to. When that competition is deleted, or the organizer deletes their account, these records are deleted with it. You can also ask us to remove your information sooner, at any time, by emailing hello@kolvo.app. We never use any of it for advertising, and we do not sell it.

Cookies

We use a single cookie, and it does one thing: keep you signed in. There are no advertising cookies, no cross-site trackers and no third-party analytics scripts. We do not sell or rent your data to anyone, and we do not use it for advertising.

Error and crash reports

To find and fix bugs, Kolvo uses Sentry, an error-monitoring service. When something breaks — a crash in the app or an error on the site — a report is sent with technical context: device model, operating system, app version, and what the code was doing at the time. These reports are used only to diagnose and fix problems, never for advertising or profiling, and they age out of Sentry on a rolling schedule.

Children

Kolvo accounts are for adults — organizers, scorekeepers and captains must be 18 or older. Players themselves never hold accounts. When a minor appears in a league — a name on a roster, a jersey number, a photo — that information was entered by their organizer or captain, who is responsible for having a parent or guardian's consent first. If your child appears in a league and you want their information removed, contact the organizer, or email hello@kolvo.app and we will remove it.

Deleting your data

You can delete your account yourself from your account page — it permanently removes your account and its data, including any stored Google tokens. Or email hello@kolvo.app from the address on your account and we will do it for you. If you want a specific player entry, photo or league page removed, tell us which one and we will take care of it.

Changes to this policy

If this policy changes in a way that matters, we will update the effective date above and note the change on this page. Continued use of Kolvo after a change means you accept the updated policy.