GameDay DinnerLog In

Privacy Policy

Last updated: October 27, 2026Effective date: October 11, 2026
Jump to section

Plain-English summary: GameDay Dinner is run by CM Squared Digital LLC. We collect what we need to run team dinners: the team parent's account and payment handles, the team's roster, menus and orders. We don't sell data or use it for advertising. We don't use third-party product analytics or advertising pixels, and nothing on our site sends your information to an ad platform. Parents pay the team parent directly; we never see or handle that money. Players (usually minors) are added by adults, never have accounts, and appear on the public order link only as a shortened name like "Jake Sm." Roster and menu photos are read automatically and not stored. You can ask us what we have and ask us to delete it: thomas@gamedaydinner.com.

This summary is provided for clarity and is not a substitute for the full policy below.

1. Who we are

This Privacy Policy describes how CM Squared Digital LLC ("Company", "we", "us", "our") collects, uses and shares information through the GameDay Dinner Service at https://gamedaydinner.com and related subdomains.

Contact:

California residents: see Section 10. Texas residents: see Section 11.

2. What we collect

2a. Team parent account

When a team parent signs up (with Google or email and password), we collect:

  • Identifiers: name and email address (and your Google profile name and picture if you use Google sign-in)
  • Account credentials: passwords are stored hashed by our authentication provider, never in plaintext
  • Team details: team name and sport
  • Payment handles you choose to add: Venmo username, Cash App $cashtag, Zelle phone number or email, whether you accept cash, and an optional note to parents. These are shown to anyone who opens your team's order link, because parents need them to pay you.
  • Pass purchases: plan, purchase date and amount. Card details are entered on Stripe's checkout page; we receive a customer ID and payment status, never your full card number.
  • How you found us: if you arrive through a link tagged with campaign labels (for example, one of our own ads), we save those labels, such as the source and campaign name, and add them to your account when you create a team. This tells us which of our ads work. It stays with us and is never shared with an advertising platform.

2b. Roster information (entered by adults about players)

  • Player name and jersey number
  • Optionally, a parent name and parent email the team parent enters

How you add a roster:

  • Typed or pasted: we store what you save.
  • Spreadsheet: the file is read in your browser; it isn't uploaded to us. Only the rows you choose to save are stored.
  • Photo: the photo is sent to our AI provider (see Section 5a) only to read the names and numbers, is not stored by us, and you review the result before anything is saved. We keep a log of how many photos a team imported (for daily limits), not the photos.

When a parent places an order, we collect:

  • The player the order is for (chosen from the roster, or a name the parent types)
  • What was ordered, special requests and allergy notes the parent chooses to write, and the order total
  • How they plan to pay (Venmo, Cash App, Zelle, cash) and whether they tapped "I've paid"
  • Optionally, the parent's name, email and phone. The email is used to send an order confirmation.

We don't process or see the payment itself; it happens in the parent's own payment app.

2d. Restaurant orders

If a team parent uses "Send to restaurant", we collect the restaurant's email address (saved with that menu if you choose) and send it the order summary: the item counts, each player's order (with the player name as shown in the app), special requests and your note. Replies go to the team parent's email.

Menu imports: if a team parent imports a menu from a link or a photo, we fetch that public web page (or take the photo) and send its text or image to our AI provider (see Section 5a) only to read the menu items and prices. The page and photo are not stored by us; only the items the team parent reviews and saves are kept. We keep a log of how many menus a team imported (for daily limits), not the pages or photos. Please don't photograph anything other than the menu.

2e. Usage information

When you use the Service we automatically collect standard technical data: browser and device type, IP address, pages and actions within the app, timestamps, and error reports.

We also count visits to our welcome and sign-up pages as anonymous daily totals by campaign source and ad (Section 6). We don't use a third-party product-analytics service.

2f. Communications with us

If you email us, we keep those messages to respond and to improve the Service.

3. How we use information

  • Run the Service: host your team, show order links, record orders and payment status, send the order to a restaurant, and produce reports.
  • Send transactional emails: order confirmations to parents, order summaries to team parents and restaurants, sign-in and account emails.
  • Sell and manage passes: process purchases through Stripe, apply your plan, enforce event limits and handle refunds.
  • Support, security and fraud prevention: respond to requests, investigate misuse, enforce our Terms and protect users.
  • Improve the Service: understand which features are used and fix problems, using aggregated data where we can.
  • Meet legal obligations: tax and accounting records, and lawful requests.

We do not sell personal information, share it with advertisers, run targeted advertising, or use parent or player information to market anything.

Anyone who has an event's order link can see:

  • The team name, the event name and date, the order deadline and the menu
  • The team parent's payment handles and note to parents (Section 2a)
  • The roster, shown as first name and the first two letters of the last name (for example "Jake Sm.") with jersey numbers. If two players would look the same, we show just enough extra letters to tell them apart. Full player names are never sent to the order page.

A parent who places an order sees their own order and payment options. Parents can't see other parents' orders, contact details or payment status. Only the team parent, signed in, sees the full roster, all orders and payments.

Share order links only with your team.

5. Who we share information with

5a. Service providers

These companies process information for us under contract, only to run the Service:

  • Lovable Cloud (built on Supabase): hosting, database, authentication, server functions and our app's AI gateway. Almost all Service data is stored here.
  • Lovable Emails: sending transactional email (addresses and message contents).
  • Google (via the Lovable AI gateway): reads roster photos to extract names and jersey numbers, and reads menu pages or photos to extract menu items and prices. Each photo or page is sent for that single request and isn't stored by us.
  • Stripe: processes Season Pass and Founder's Deal purchases. Card data goes directly to Stripe. See Stripe's Privacy Policy.
  • Google sign-in: if you choose to sign in with Google, Google shares your name, email and profile picture with us.

5b. People you choose to share with

  • Parents with your order link see what's described in Section 4.
  • Restaurants you send an order to receive the order summary (Section 2d).
  • Payment apps: when a parent taps a pay button, their Venmo or Cash App opens with the amount and a note (team name, date and the player's short name). That information is then handled under the payment app's privacy policy.

We may disclose information if required by law, or if we reasonably believe it's necessary to protect someone's safety, investigate fraud or security issues, or defend legal rights. If CM Squared Digital LLC is part of a merger, acquisition or sale of assets, information may transfer as part of it, and the new owner must honor this Policy or give you notice and a choice.

6. Cookies and local storage

We use essential browser storage to keep you signed in, to remember which team you last viewed and, if you arrived from a tagged link, to hold its campaign labels for up to 30 days (see Section 2a). On our welcome and sign-up pages we also use your browser's session storage, which clears when you close the tab, to note that we've already counted your visit and steps such as playing the demo video or opening the sign-up form, so each is counted only once. For that count we keep only anonymous daily totals by campaign source and ad, never linked to you or your device. We don't use advertising cookies or advertising pixels, and nothing on our site sends your information to an ad platform. Stripe's checkout page sets its own cookies for payment and fraud prevention. If you block storage, you won't be able to stay signed in.

7. Data about minors (players)

The Service is not directed at children, and players never have accounts, never sign in, and never receive messages from us. Player information is entered by adults (the team parent or a parent) for meal coordination and is limited to what's described in Sections 2b and 2c. Allergy information appears only if a parent writes it in an order's special requests.

Parents' rights: a parent can ask the team parent, or email thomas@gamedaydinner.com, to correct or delete their child's information. We'll act within 30 days, except for limited records we must keep for legal or accounting purposes. If you believe your child's information was entered without your permission, email us and we'll investigate and remove it promptly.

We don't knowingly collect personal information directly from children under 13. If we learn we have, we'll delete it.

8. How long we keep information

  • Accounts and team data: while the account exists, plus 30 days after deletion in case you change your mind.
  • Orders and rosters: while the team exists. When a team or account is deleted, its roster and orders are deleted within 60 days.
  • Pass purchase records: up to 7 years for tax and accounting.
  • Email logs: typically up to 3 years for delivery and support history.
  • Technical logs: typically up to 90 days, longer for security incidents.
  • Roster and menu photos, and imported menu pages: not stored.

9. Your choices and rights

  • Access and correction: you can view and edit most information in the app. For anything else, email thomas@gamedaydinner.com.
  • Deletion: email us to delete your account and data. We'll complete it within 30 days, except for records we're required to keep.
  • Email: transactional emails are part of the Service. We don't send marketing email unless you've separately subscribed.

10. California residents (CCPA/CPRA)

If you're a California resident, you can ask us what categories and specific pieces of personal information we have about you, the sources, the business purposes and the categories of recipients; ask us to delete or correct it; and exercise these rights without discrimination. We don't sell or share personal information for cross-context behavioral advertising, so there is nothing to opt out of.

Categories collected in the last 12 months: identifiers (name, email, phone if provided, IP address); customer records (account and pass purchase details); commercial information (orders and purchases); internet activity (usage logs); and approximate location derived from IP address for security only. We don't collect biometric data, precise geolocation, or sensitive personal information other than account credentials used only to sign you in.

Sources: you, parents who use your order link, your use of the Service, Stripe and Google (if you use Google sign-in). Disclosed for business purposes to: the service providers in Section 5a. Sold or shared: none.

Email thomas@gamedaydinner.com with the subject "CCPA Request". We may verify your identity by confirming access to the account email, and we'll respond within 45 days (extendable once by 45 days with notice). You may use an authorized agent with your written permission.

11. Texas residents (TDPSA)

The Texas Data Privacy and Security Act gives Texas residents rights to access, correct, delete and obtain a copy of their personal data, and to opt out of its sale, targeted advertising and certain profiling. We don't sell personal data, run targeted advertising, or profile people for significant decisions. Email thomas@gamedaydinner.com with the subject "Texas Privacy Request" to exercise your rights. If we decline a request, you can appeal by replying to our decision, and we'll respond within 60 days.

12. Security

We encrypt data in transit, restrict access to production systems, enforce access rules in our database so each team parent can only see their own team, and rely on established providers for payments, hosting and email. No system is perfectly secure; if an incident affects your information, we'll notify you as required by law.

13. International users

The Service is operated from and intended for the United States. If you use it from elsewhere, your information will be processed in the US.

14. Changes to this Policy

We may update this Policy. For material changes, we'll email account holders at least 30 days before they take effect, unless a change is required sooner by law. The "Last updated" date shows the latest version.

15. Contact

Questions about this Privacy Policy or your data? Email thomas@gamedaydinner.com.

Thomas Minnick, Founder, GameDay Dinner CM Squared Digital LLC Round Rock, Texas