Privacy

Last updated 14 September 2026.

Crest is the administrative system of record for youth soccer clubs. This page describes what it holds, who can see it, and how to get it changed or removed. It is written to be read, not to be survived.

Who is responsible

Each club is the controller of its own members' records. Crest is operated by Nipomo Soccer Club, which processes those records on each club's behalf. For anything about your own or your child's record, contact your club first; for anything about the platform, write to info@nipomosc.org.

What Crest holds

• Identity and contact details supplied at registration: name, date of birth, email address, phone number, and a postal address where the club collects one.
• Who is a guardian of whom, which is a club administrative fact set at registration.
• Membership: which club, season, team and role a person holds.
• Access grants: the switches a guardian sets for a player, and the history of changes to them.
• Photographs and video the club uploads, where consent allows.
• The Google account identifier of anyone who signs in, so that a return visit recognises them.

Date of birth is held because age decides what the system permits, not for marketing. There is no advertising in Crest, no advertising identifier, and nothing here is sold or rented to anybody.

Children

Most people in a club are minors, and the system is built around that rather than around it.

• Under 13, an account is provisioned by a guardian and a record of that parental consent is kept. There is no mechanism for a child under 13 to request more access.
• From 13 to 17, a guardian still holds every switch. A player may ask in the app, and a guardian answers. Asking is not granting.
• At 18, guardianship ends automatically, announced 30 days ahead.
• No message to or from a minor is ever hidden from that minor's guardian. A coach and a parent may hold a conversation the player cannot see; the reverse is not possible.
• There is one set of switches per player, shared by every guardian, and every change is logged and visible to all of them.

Photographs, and a limit worth stating plainly

Photo consent is two separate grants: appearing in posts inside the club, and appearing in material that can be shared publicly. Both default to off.

Images are published according to the permissions in force at the moment of publication, and a change applies from then on. Turning a grant off stops future publication and does not reach back into what has already been shared onward. Any promise to the contrary would be unkeepable. What Crest records instead is which consent was in force when something was published, which is provable.

Deleting your account

You can delete your Crest account yourself, from inside the app. Sign in, open Account, and use Delete account. You will be asked to type the full name on the record before anything happens, because this cannot be undone.

Deleting your account unlinks every Google and Apple account from your record, and signs you out of every device immediately, not only the one you asked from. A phone, a laptop and a tablet that were all signed in are all signed out the next time any of them asks Crest for anything. Your email address and phone number are removed from the record at the same time, so signing in again with the same Google or Apple account will not find you and will not bring the account back. If you want to use Crest again afterwards, your club has to register you again.

Accounts for people under 18

An account for someone under 18 is set up by their guardian, and only a guardian can delete it. A player under 18 who opens Account will be told to ask their guardian rather than shown the control. A guardian deletes a child's account the same way, from their own account, and types the child's full name to confirm. Guardianship ends on the eighteenth birthday. From that day the account belongs to the person themselves, and a former guardian can no longer delete it.

What the club keeps, and why

Crest is a club's system of record. Deleting your account deletes the account you created. It does not delete the club's record of a season that happened, which is not one person's to erase. The club keeps:

• The registration record. Legal name, date of birth, and the seasons, teams and roles you or your child were registered for. This is the club's record of who played, and it is what a league, an insurer or a governing body asks a club to be able to show.
• Guardianship links. Who was recorded as responsible for a child at registration. Removing that would leave the club unable to say who agreed to what on a child's behalf.
• The permissions log. Crest records which permissions were in force at the moment a photograph was published. Deleting that log would destroy the club's ability to show that a photograph was published with consent, for photographs that are already out in the world.
• The fact of the deletion. The date, and whether it was requested by the person or by a guardian. That is how a club answers a question about it later.

What the club does not keep is anything that let you in: no linked Google or Apple account, no session on any device, and no email address or phone number on the record.

Photographs already published

When an adult deletes their own account, every permission on the record is switched off as part of the deletion, so nothing new is published. Photographs that were already published stay published, and the log keeps the consent that was in force when they were. A permission change in Crest has always been forward looking only. We will not promise to take back something that has already been shared onward, because that is not a promise anyone can keep.

When a guardian deletes a child's account, the child's permissions are left as they are, because the guardian can still change them from their own account. Deleting a sign-in is not the same as withdrawing consent, and Crest does not treat it as if it were.

Who can see what

Personal records are visible to club staff whose role includes them, and to the person themselves and their guardians. Other apps in the stack (referee, video, fitness and game tools) receive a first name, a last initial and an opaque identifier, and are structurally incapable of receiving more: the token they hold cannot reach personal data through any endpoint, parameter or role.

Photographs are stored privately and reach a browser through short-lived links rather than from a public bucket.

Signing in

Signing in with Google tells Crest your Google account identifier, your name and your email address. Crest does not receive your password and asks for no access to your Google account beyond identifying you. A Google account that matches nobody in a club's records is refused; signing in does not create a person.

Where it is held, and for how long

Data is held in Google Cloud in the United States. Records are kept while a person is a member of a club and for as long afterwards as the club needs them for its own records, after which they are deleted.

Your choices

• See what is held about you or your child, and correct it.
• Change any access grant at any time, including both photo grants.
• Delete your account yourself, from Account inside the app. See Deleting your account.
• Ask for a record to be deleted. Where a club must keep something (a registration record a league requires, for example) the club will say so and say why.

Write to your club, or to info@nipomosc.org.

Changes to this page

If this page changes in a way that affects what is collected or who can see it, clubs are told before the change takes effect.