Last updated: 26 October 2026
This privacy policy applies to the xsyte application and the xsyte platform (xsyte.com and all club websites it hosts), operated by XSYTE Solutions (ABN 38 721 302 026). It explains what personal information xsyte collects, how it is used, stored and shared, how long it is kept, and how to have it deleted. Section 5 describes xsyte's access to and use of Google user data through the YouTube Data API.
The xsyte app requests one Google OAuth scope, https://www.googleapis.com/auth/youtube.force-ssl, and only when a club administrator chooses to connect the club's YouTube channel. xsyte uses it to create, schedule, start and end the club's game livestreams on that channel, set their cover images, add them to the club's playlists, and write game chapters into their descriptions.
xsyte stores only the channel name and id, the OAuth refresh token, and the ids of the broadcasts, videos and playlists it creates. Google user data is never sold, never shared with third parties, never used for advertising, and never used to develop or train AI or machine-learning models. It is encrypted in transit and the token is never shown in any page.
Disconnecting the channel (Communications → Social → Disconnect YouTube) deletes the stored token immediately. Access can also be revoked at myaccount.google.com/permissions, and full deletion of all Google user data can be requested at tracy@xsyte.com (completed within 30 days). Full details are in section 5.
xsyte's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
xsyte is a website and administration platform for sports clubs, leagues, tournaments and fitness studios. It is operated by XSYTE Solutions (ABN 38 721 302 026), based in Brisbane, Queensland, Australia ("xsyte", "we", "us").
This policy covers personal information handled by xsyte.com and by every club website that runs on the xsyte platform (sites on hockeysyte.com, sportssyte.com, netsyte.com, soccersyte.com, fitsyte.com and the other xsyte domains, and clubs' own custom domains). Each club website is run by that club. The club decides what information it asks its members for and how it uses it; xsyte provides the platform and processes the information on the club's behalf. Where this policy says "your club", it means the club whose website you are using.
We handle personal information in accordance with the Australian Privacy Act 1988 and the Australian Privacy Principles.
Club administrators and staff (people who run a club site): name, email address, phone number, login credentials, and the actions you take in the admin area.
Members, players, officials and parents (people a club registers or who register themselves): name, date of birth, gender, email address, phone number, postal address, emergency contact, team and division, jersey number, position, photos or headshots the club or you upload, attendance and check-ins, and game statistics recorded by the club (goals, assists, penalties, results). A club may add its own registration questions; those answers are held for that club.
Website visitors: the pages you view, your IP address, browser and device type, and the referring site, collected through server logs and the analytics described in section 7. If you buy something, enter a competition or fill in a form on a club site, the details you enter.
Content you publish: news, photos, videos, comments and forum posts you add to a club site are visible to whoever that club has made them visible to, which is often the public.
We do not collect payment card numbers or bank account details (section 4), and we do not collect government identifiers.
We use personal information to run the platform: to register you with your club, publish rosters, schedules, results and statistics on the club's site, send the emails and notifications your club has turned on (game invitations, reminders, news), process registrations and purchases, let officials and scorers do their jobs, and support clubs when they ask for help.
Your club controls its own members' information. The club chooses what appears on its public pages (for example, whether player names are shown in full, as initials, or not at all), who receives emails, and what registration questions are asked. Questions about how a particular club uses your information should go to that club first; we will help if you cannot reach them.
xsyte uses information for its own purposes only to operate, secure and improve the platform, to bill clubs, and to tell club administrators about platform changes. We do not use members' or players' information to market to them, and we do not profile individuals for advertising.
Payments on club sites are processed by Stripe or Square, whichever the club has connected. Your card or bank details are entered directly with the payment processor and are never stored on xsyte's servers; we receive a transaction reference, the amount, and the last four digits of the card so the club can match the payment to your order or registration. Stripe's and Square's own privacy policies apply to the information they hold. xsyte charges clubs a platform fee on transactions; that fee is between xsyte and the club.
A club administrator can connect the club's YouTube channel to the club's xsyte website so that xsyte can schedule and manage the club's game livestreams on that channel. This section explains how the xsyte application accesses, uses, stores, shares and protects Google user data obtained through Google APIs, how long it is retained, and how it is deleted.
When an administrator connects a channel, Google issues xsyte an OAuth token for that channel under the YouTube Data API scope https://www.googleapis.com/auth/youtube.force-ssl. Using that token, xsyte accesses: the connected channel's name and id; the channel's reusable live stream keys (names and ids only, to bind broadcasts to the right rink); the live broadcasts and videos xsyte itself creates on the channel, including their status, start and end times, titles, descriptions and privacy settings; and the channel's playlists. xsyte does not access comments, captions, ratings, subscriber lists, watch history, analytics, or any Google service other than YouTube.
xsyte uses Google user data only to provide the livestreaming features the administrator connected the channel for: to create and schedule a live broadcast for each game on the club's fixture; to bind each broadcast to the club's existing stream key; to set each broadcast's cover image to the game's matchup graphic; to start and end broadcasts when games begin and are finalised; to add each game's video to the club's playlists; to write game timestamps (chapters) into the video description; and to read the resulting video ids so the club's website can embed the stream and, later, the recording. xsyte does not use Google user data for advertising of any kind, does not use it to build databases or profiles, and does not use it to develop, improve or train artificial intelligence or machine-learning models.
xsyte stores the connected channel's name and id, the refresh token Google issues for the connection, the ids of the broadcasts, videos and playlists xsyte creates, and the broadcast status it last read. xsyte does not store video content, stream keys' secret values, or any other Google account information.
xsyte does not sell, rent, trade or otherwise transfer Google user data to any third party, and does not share it with data brokers or advertisers. The ids of broadcasts and videos are embedded on the club's own public website, which is the purpose of the connection. Google user data is processed only on xsyte's own servers, hosted by Amazon Web Services in Sydney, Australia, which acts as our infrastructure provider and does not access the data for its own purposes. xsyte may disclose Google user data where required by law.
Google user data is protected by the following mechanisms: all transfers between xsyte, Google and the administrator's browser are encrypted in transit (HTTPS/TLS); the refresh token is stored in the club's own database in xsyte's production environment, which is accessible only to xsyte's servers and to xsyte staff with production access, and it is never displayed in the administration interface or in any page; access to the administration area that manages the connection requires an authenticated club administrator account; and xsyte staff read this data only to resolve a support request at the club's request, for security, or as required by law. xsyte requests only the single scope it needs and no more.
xsyte retains the stored token and the ids above for as long as the channel remains connected and the club's website remains active. When a club administrator disconnects the channel (Communications → Social → Disconnect YouTube), xsyte deletes the stored refresh token immediately; broadcast and video ids remain on the game records so the club's website keeps showing its recordings, and are deleted when the club's website is deleted. A club or administrator can also request deletion of all Google user data xsyte holds about the channel at any time by emailing tracy@xsyte.com; we complete such requests within 30 days. You can also revoke xsyte's access directly in your Google Account at https://myaccount.google.com/permissions; revocation makes any stored token unusable. Broadcasts and videos already created remain on the club's YouTube channel under the club's control.
If xsyte changes how it uses Google user data, this policy will be updated and connected club administrators will be notified by email before the change takes effect. xsyte's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
We do not sell, rent or trade personal information, and we do not share it with third parties for their own marketing.
We share personal information only:
If xsyte is ever sold or merged, personal information would transfer with it to the new operator under this policy, and you would be told.
xsyte sites use a session cookie to keep you logged in and to remember preferences such as your language. This cookie is essential and is deleted when your session ends or you log out.
We use Google Analytics to understand how sites are used, in aggregate. Analytics cookies do not identify you to us by name. You can block cookies in your browser; the site will still work, but you will need to log in each visit.
Club sites may embed content from YouTube, Facebook, Instagram or other services, and may show sponsor advertisements. Those services may set their own cookies under their own policies when the embedded content loads.
xsyte is hosted on Amazon Web Services in Sydney, Australia. Each club's data is kept in its own database. Connections to xsyte sites are encrypted (HTTPS), passwords are stored hashed, and access to production systems is limited to xsyte staff who need it. No system is perfectly secure, and we cannot guarantee that information will never be accessed without authorisation; if a breach is likely to cause serious harm, we will notify affected people and the Office of the Australian Information Commissioner as the law requires.
We keep personal information for as long as the club's site is active, because rosters, results and statistics are the club's historical record. When a club leaves xsyte, its database is deleted within 90 days after the account closes, apart from transaction records we must keep for tax purposes. A member can ask their club, or us, to remove their profile at any time; the club may keep statistics in anonymised form.
Many players on xsyte sites are children. Clubs register junior players with a parent or guardian's consent and parents' contact details are held alongside the player's. Clubs control how junior players are shown on public pages and can display names as initials or hide them. We do not knowingly collect information directly from a child under 16 without a parent or guardian, and we do not use children's information for marketing. A parent or guardian can contact their club or us to review or remove a child's information.
You can ask to see the personal information we hold about you, to correct it, or to have it deleted. For information held by your club, ask the club first; for anything else, or if the club does not respond, contact us at tracy@xsyte.com or by post at 42 Ivedon Street, Banyo, QLD, 4014 - Australia. We respond within 30 days. If you are not satisfied, you can complain to the Office of the Australian Information Commissioner (oaic.gov.au).
You can unsubscribe from club emails using the link in any email, or by asking your club. Essential service messages (for example, a payment receipt or a password reset) are sent regardless.
We may update this policy from time to time. The date at the top shows when it last changed; material changes will be announced on xsyte.com and to club administrators.
