Cookies & device storage

Website preferences

The marketing website uses local storage for your light or dark theme. Local storage is a browser database, rather than a cookie, and the theme preference is not sent to SportHQ’s server. We do not use advertising or analytics trackers on the marketing website.

Accounts and offline coaching

The app uses browser storage for authentication and preferences, and IndexedDB for offline coaching data. This can include team records, notes and optional photos. It allows courtside use without a connection and synchronises changes later. The club office and family portal rely on server access.

The club office uses a secure, HttpOnly session cookie on the app’s host. In production it is named __Host-sporthq_console, expires at most seven days after sign-in and the server ends the session after eight hours of inactivity. HttpOnly prevents page scripts from reading this cookie.

Coaching and family sessions use authentication information stored in your browser. Maximum session lengths vary by role: 90 days for staff, 30 days for parents and 14 days for players, with shorter inactivity limits. Signing out or revocation can end a session sooner; browser data may still need to be cleared separately.

Where enabled, sporthq_signed_in is a seven-day cookie shared between the SportHQ website and app to select an account-navigation link. It contains a sign-in-status hint, not an account identifier or authentication token, and cannot authorise access. Theme preferences remain until changed or cleared, and offline records remain until removed using the app or browser’s storage controls.

Storage is private to the browser profile, not automatically to the person holding the device. Use a passcode and a separate profile on shared devices. Use the app’s sign-out and data-clearing controls. Clearing website data can remove unsynchronised work and require sign-in again. Revoked access or deletion cannot update a disconnected device until it reconnects.

External services

Cloudflare Turnstile loads when you start interacting with the waitlist form, if configured, and processes bot-detection signals. Stripe checkout operates on its hosted pages. YouTube’s privacy-enhanced player and Instagram embeds can still receive your IP address and browser information when loaded; “privacy-enhanced” does not mean no processing. Push notifications use the browser’s push provider only when permission is granted.

These services may use cookies or other browser mechanisms under their own policies. Read Cloudflare’s privacy policy, Stripe’s privacy policy, Google’s privacy policy and Instagram’s privacy policy.

Your controls

You can manage cookies and site data in your browser, revoke notification permission and choose whether to open external content. Blocking storage may prevent sign-in, preferences or offline tools from working. Before clearing app data, confirm that important changes have synchronised. Contact [email protected] for help. Further information appears in our privacy policy.