Child safety
Your child is not a public profile.
Youth sports software collects a startling amount about children: full names, birthdates, photographs, home addresses, where they'll physically be on Saturday morning. We think how a platform handles that is worth reading about before you hand any of it over.
Here is what KickarooFC does today — and, further down, what it doesn't do yet.
What's on today, without configuring anything
None of the below is a setting an administrator can forget to switch on.
Children don't have logins
A child is never an account. They exist as a registrant inside a family's household, and the adults in that household act for them. There is no password for a ten-year-old to lose and no inbox for a stranger to reach.
Full names are never published
Anywhere a stranger can reach — a club's public page, our own demo — a child appears as a first name and a last initial. If you'd rather they appeared as something else entirely, set a display name and we use that instead.
No public leaderboards for kids
Standings rank teams. We don't publish per-child statistics, rankings, or scouting profiles, and there is no setting that turns them on. A program run for under-12s produces no league table at all — that's refused where the table is calculated, not just hidden on the way out.
Photo consent is per child, per purpose
Saying yes to a team photo isn't saying yes to Instagram. You answer separately for each child and each use:
- photo on team page
- photo on the club's public website
- photo on club social media
- photo in sponsor materials
No adult-to-child direct messages
Messaging runs between the adults: coaches, parents, administrators. Because children have no accounts, there is no private channel between a coach and someone else's child to police in the first place.
Access is scoped, and it's on the record
A coach sees their team. A club administrator sees their club. Nobody browses the platform. Privileged actions — granting a role, changing a registration, exporting data — write an audit entry that administrators can read back.
Two-factor auth, properly built
Every administrator is prompted to add an authenticator app, and we make it a one-minute job. Turning it on is their choice rather than a wall we put in front of them — but the implementation underneath is the careful kind: attempts are rate limited, recovery codes are single-use and never appear in a link, and enrolling again can't quietly switch off protection that's already on.
You can prove what you signed
Waivers are versioned and content-hashed. Your signature is pinned to the exact wording you saw, so nobody can quietly edit a document you already agreed to. If the club republishes it, you're asked again.
Your family's data is yours to take
Export everything held about your household — registrants, registrations, consents, signatures — as a single file, whenever you want, without asking anyone.
What we're still building
KickarooFC is young. These are real gaps, and we'd rather you hear them from us.
- Automated background checks
- We track each volunteer's clearance, its status and its expiry, and we chase renewals before they lapse. Running the check itself still happens with your existing provider — direct integration is in progress.
- Independent security audit
- We haven't had a third-party penetration test yet. When we do, we'll say who did it and what they found.
- Legal review of our policies
- Our privacy policy and terms are drafted and readable, but they haven't been through outside counsel. They're marked as such on the page rather than dressed up.
- Accounts for older players
- Players aged 13 and over will eventually be able to hold their own parent-consented account. The age floor and the guards are written; the accounts aren't switched on.
Read it, don't take our word for it
The demo is a real club. Look at a roster and see how a child's name renders before you decide.