Privacy Policy

Last updated: August 8, 2026

This Privacy Policy describes how Digital Reach Creative Content and Solutions, LLC (“Digital Reach,” “DRCCS,” “we,” “us,” or “our”), doing business as DRCCS and operating the My Play Codes service, collects, uses, and protects information when you use the My Play Codes website and application (the “Service”) at myplaycodes.com and related domains or hosting environments we operate.

1. Who we are

The Service is owned and operated by Digital Reach Creative Content and Solutions, LLC, a limited liability company doing business as DRCCS. We provide tools for coaches and teams to create, manage, and print randomized play communication cards and related coach sheets under the My Play Codes brand.

My Play Codes is a trademark of Digital Reach Creative Content and Solutions, LLC. The domain myplaycodes.com is owned by Digital Reach Creative Content and Solutions, LLC, which maintains the Service and related online properties.

References in this policy to “My Play Codes” mean the Service and brand operated by Digital Reach Creative Content and Solutions, LLC (DBA DRCCS).

2. Information we collect

We collect information you provide and information needed to operate the Service securely.

Account information

  • Email address (used for login and account communications)
  • Username
  • Password (stored only as a secure one-way hash; we never store your plain-text password)
  • Optional passkey (WebAuthn) credentials: public keys, credential identifiers, display names you choose, creation time, signature counters, authenticator transport metadata, and backup/sync eligibility flags. We store the public key material required to verify sign-in; the private key stays on your device or password manager and is never sent to us
  • Email confirmation status and related security metadata managed by our authentication system
  • Account registration time
  • Records that you accepted our Terms of Service and Privacy Policy (timestamp and document version identifiers), when you register through the Service
  • Account close / reopen status and related timestamps (when you or an administrator close an account, and when it is reopened), and audit records of those events for security and recordkeeping

Profile and branding content

  • Organization and team names
  • Organization and team logo images you upload
  • Optional navigation bar color preference
  • Other profile preferences (for example, whether template profiles appear in dropdowns)

Play code and content data

  • Play code profiles you create (names, codes, plays, layout/print settings, and related configuration)
  • Generated or stored content needed to preview and print player cards and coach sheets
  • Individual play codes and their descriptions are stored in the database in encrypted form (see section 6). Profile names, colors, frequencies, print settings, and other non-code fields are not encrypted the same way.

PDF download usage, credits, and billing records

  • PDF download credit balances for player cards and coach sheets (including free-tier grants and purchased pack credits)
  • Records of PDF download events (for example, what was downloaded, when, outcome, and related billing mode)
  • Credit ledger entries (for example, free grants, admin grants, and pack purchase grants)
  • Payment and subscription metadata needed to provide paid features: Stripe customer and subscription identifiers, plan or pack references, purchase amounts and status, coupon/promotion codes used at checkout when applicable, and subscription period or cancel-at-period-end status
  • Optional use of Stripe Customer Portal actions you initiate to manage billing

Technical and security information

  • Authentication session data (via strictly necessary cookies described below)
  • Basic request and operational logs that may include IP address, timestamps, and error diagnostics as part of hosting and securing the Service

We do not intentionally collect payment card numbers through this app, and we do not use third-party advertising or analytics cookies.

3. How we use your information

We use the information above to:

  • Create and maintain your account, and authenticate you when you sign in (including password, optional email multi-factor codes, and optional passkeys)
  • Provide core features (profiles, play codes, previews, PDF generation and downloads)
  • Meter PDF download usage, apply free or purchased credits, and enforce ownership/access rules for downloads
  • Process paid PCPacks, subscriptions, and promotional discounts through Stripe Checkout and webhooks
  • Send transactional emails (for example, email verification, password reset links, optional multi-factor authentication sign-in codes, account close confirmations, account reopen offers when you attempt to re-register a closed email, and optional email copies of PDFs you download)
  • Process account closure and limited reopen requests, including canceling subscription renewals at period end and retaining billing/download records as needed
  • Secure the Service (fraud prevention, abuse prevention, and integrity of forms/sessions)
  • Operate, maintain, and improve reliability of the Service
  • Respond to support requests you send us
  • Comply with legal obligations and protect our rights and users

We do not sell your personal information. We do not use your content for advertising targeted at you.

4. Cookies

My Play Codes uses strictly necessary cookies only. These cookies are required for the Service to function (sign-in, session security, and form protection). Because they are essential, they are not treated as optional preference/marketing cookies and we do not show a separate cookie consent banner for them.

Cookie Purpose Type Duration / notes
.AspNetCore.Identity.Application Authentication cookie that identifies your signed-in session so you can access protected pages (profile, editor, billing, etc.) without re-entering credentials on every request. Strictly necessary Approximately 6 hours, with sliding expiration while you remain active. Marked HttpOnly (not readable by page scripts), Secure (HTTPS only), and SameSite=Lax.
.AspNetCore.Antiforgery.* Helps protect against cross-site request forgery (CSRF) on forms and state-changing requests. Strictly necessary Session / request security cookie used by ASP.NET Core antiforgery.

You can clear cookies in your browser at any time. If you clear authentication cookies, you will be signed out and will need to log in again. Blocking strictly necessary cookies will prevent sign-in and normal use of account features.

We do not set advertising, tracking, or third-party analytics cookies. Payment pages hosted by Stripe may set cookies under Stripe’s control according to Stripe’s own policies when you complete checkout or use the Customer Portal.

5. Email, payments, and third-party processors

To send transactional email (account verification and optional PDF-related messages), we use SendGrid as an email delivery provider. Email content and recipient address are processed by SendGrid solely to deliver those messages. Operational copies of certain transactional messages may also be archived to addresses we control for support and delivery records.

Paid PCPacks, subscriptions, and applicable discounts are processed by Stripe. Card numbers and payment method details are collected and stored by Stripe, not in our application database. We store Stripe customer/subscription/session identifiers, purchase amounts, product references, coupon/promotion metadata, and credit or subscription status needed to provide the Service. You may manage payment methods and subscription renewals through Stripe’s Customer Portal when that feature is available. See also Stripe’s privacy policy for how Stripe processes payment data.

The Service is hosted on cloud infrastructure. Hosting and database providers process data as needed to store accounts, content, and run the application securely.

We do not share your personal information with third parties for their own marketing. Processors act on our behalf under service arrangements appropriate to their role.

6. How we store and protect data

  • Passwords are stored as salted cryptographic hashes, never in plain text.
  • Optional passkeys use public-key cryptography (WebAuthn / FIDO2). We store public keys and related authenticator metadata only; private keys remain under your control (including when a passkey is synced by your password manager or platform).
  • Authentication cookies are HttpOnly and require HTTPS. Passkey registration and sign-in require a modern browser and HTTPS.
  • Account features require a confirmed email address where the Service enforces email confirmation.
  • Access to administrative tools is limited to authorized admin roles.
  • Data is stored in our application database (currently PostgreSQL in deployed environments).
  • Play codes and descriptions at rest: the short code text and description for each play code entry are encrypted before they are written to the database (AES-256-GCM with a server-held application key). Someone who obtains a raw database dump without the application encryption key would not be able to read those fields as plain text. The application decrypts them only when an authorized user (or an Admin acting through the Service) loads profiles in the Play Code Editor or generates PDF downloads.
  • Admin access: users with the Admin role can still view and manage any user’s play codes through the application, which decrypts the fields for normal use. Authorized admins may also review billing, PDF download, and credit records as needed to operate and support the Service. Encryption protects against casual inspection of the database; it is not a way to hide content from platform administrators.
  • CSV export and import: when you export or import a profile as a CSV file, that file contains plain-text codes and descriptions, plus that profile’s print size and card format settings so you can edit or back up the file yourself. Protect exported CSV files the same way you would protect any other sensitive team document. Encryption applies to database storage, not to files you download or upload.

No method of transmission or storage is 100% secure. We take reasonable technical and organizational measures, but we cannot guarantee absolute security. Encryption keys are managed as server secrets; if a key were lost, encrypted play codes could become unrecoverable without a backup of both the data and the key.

6A. Account closure and retention

You may close your account from your Profile page. We soft-close the account: sign-in is disabled, passkeys are removed, multi-factor authentication is turned off, and email is marked unverified. We retain associated play code profiles, branding, and operational/billing records as needed to operate the Service, prevent abuse, and meet legal and accounting obligations. PDF download credits are not usable while the account is closed; if you reopen more than 30 days after the close date, remaining download credits may be cleared. Subscriptions are set not to renew at the end of the current period through our payment processor when applicable.

If you closed the account yourself and later try to register with the same email, we may email a time-limited reopen link to that address. Accounts closed by an administrator are not reopened through that self-service path. Usernames on closed accounts remain reserved. We may retain closed-account records for a limited period and then delete or anonymize personal data that is no longer needed, subject to legal holds and billing retention needs.

7. Data retention

We retain account and content data for as long as your account remains active and as needed to provide the Service. If you delete content (such as a play code profile), it is removed from active use in the application. Residual copies may remain briefly in backups or logs for a limited operational period.

PDF download, credit, and payment records are retained as needed to provide balances, support billing disputes, prevent fraud, meet accounting or legal requirements, and operate the Service. Stripe may retain payment records according to its own retention policies.

Authentication cookies expire according to the durations described above or when you log out.

8. Your choices and rights

Depending on where you live, you may have rights to access, correct, or delete personal data we hold about you. Within the Service you can typically:

  • View and update profile and branding information while signed in
  • Create, edit, and delete play code profiles and related content
  • View PDF download balances and purchase packs or subscriptions when checkout is available
  • Manage certain billing settings through Stripe’s Customer Portal when available
  • Choose whether to receive an email copy of a PDF you download
  • Sign out, which clears your authentication session cookie

To request account deletion or a copy of your account data, contact us using the details in the Contact section below. We may need to verify that the request comes from the account holder. Some billing records may need to be retained for legal or accounting reasons even after an account is closed.

9. Children’s privacy

The Service is intended for coaches, staff, and adults who manage team play communications. It is not directed at children under 13, and we do not knowingly collect personal information from children under 13. If you believe a child has provided personal information, please contact us so we can take appropriate action.

10. International users

The Service may be hosted in the United States or other regions where our infrastructure providers operate. If you access the Service from outside those regions, your information may be transferred to and processed in countries that may have different data-protection laws than your own.

11. Intellectual property and trademarks

My Play Codes is a trademark of Digital Reach Creative Content and Solutions, LLC (DBA DRCCS). All rights in the Service, including software, branding, and related materials (other than content you upload or create for your own use), are owned by Digital Reach Creative Content and Solutions, LLC or its licensors. Nothing in this Privacy Policy transfers ownership of your play-code content to us, except for the limited rights needed to host, process, display, print, and deliver the Service you request.

12. Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will change the “Last updated” date at the top of this page. Continued use of the Service after changes take effect constitutes acceptance of the updated policy, except where applicable law requires additional notice or consent.

13. Contact

Questions about this Privacy Policy or your personal data can be sent to:

© 2026 DRCCS. My Play Codes is a trademark of Digital Reach Creative Content and Solutions, LLC.

An unhandled error has occurred. Reload 🗙

Rejoining the server...

Rejoin failed... trying again in seconds.

Failed to rejoin.
Please retry or reload the page.

The session has been paused by the server.

Failed to resume the session.
Please retry or reload the page.