Privacy Policy

Last updated: September 2026

Glass is facility-management software built by 37TEN (“Glass”, “we”, “us”). This policy explains what information we collect when you use glass-fms.com, the Glass application at glass-fms.app, and the Glass mobile app (together, the “Service”), how we use it, and the choices you have.

Who this covers

The Service is used by two kinds of people, and we handle their information differently:

• Customers — the rinks and facilities that subscribe to Glass, and the administrators, managers, staff, and referees they add to their account.
• Members — the players, parents, and members of the public who register for programs, book ice, or receive communications from a Customer through Glass.

For Member information, the Customer decides what to collect and why; we process it on the Customer’s behalf. If you are a Member with a question about your information, contact the facility first. We will help them respond.

Information we collect

• Account information. Name, email address, and the sign-in method you choose (Google, Apple, a password, or an emailed sign-in link). Authentication is provided by Firebase Authentication, a Google service.
• Facility and scheduling information. Facility names, resources, schedules, bookings, team rosters, shifts, programs, and settings that Customers enter.
• Registration information. When a Member registers for a program: name, email, team preference, and any waiver the facility requires. A signed waiver records the typed signature, the time, the network address and the browser it was signed from.
• Information about a participant under 18. When a parent or guardian registers a young person, we store the participant’s name, the guardian’s name, and the guardian’s confirmation that they are the parent or legal guardian. We ask for the child’s date of birth only when the program has an age requirement, because that is the only time a facility needs it, and for a phone number only if the guardian chooses to give one. The account belongs to the adult; the child does not get one.
• Payment information. Payments are processed by Stripe. We never see or store full card numbers. We store Stripe identifiers, amounts, and payment status so facilities can see their ledger and issue refunds.
• Connected email. If a Customer administrator connects a Google account to send and read email inside Glass, we store an encrypted token that lets Glass act on that mailbox until the administrator disconnects it. We do not store copies of mailbox contents.
• Messages you post. Messages in a team space, visible to that team and the facility’s staff, and kept with the team.
• Lead and support requests. If you book a demo or contact us, the details you submit.
• Technical information. Server logs (IP address, browser type, pages requested, timestamps) and, on the marketing site, privacy-respecting analytics about page views. We do not use advertising trackers.

How we use it

• To provide, secure, and support the Service, including signing you in, showing schedules, sending booking and registration notifications, and collecting payments a facility has set up.
• To bill Customers for their subscription and to send receipts and invoices.
• To respond to demo requests and support questions.
• To keep an audit trail of security-relevant actions (sign-ins, role changes, bookings, payments) so Customers can see who did what.
• To understand how the Service is used and improve it, in aggregate.
• To comply with law and enforce our Terms.

We do not sell personal information, and we do not use Member information for our own marketing.

Who we share it with

We share information only with the service providers we need to run Glass, each under its own privacy commitments:

• Stripe — payment processing, subscriptions, and payouts to facilities.
• Google (Firebase) — authentication, and Gmail access when an administrator connects a Google account.
• Neon — database hosting.
• Vercel — application and website hosting, and file storage for lobby-display assets.
• Resend — transactional email delivery.
• Apple — distribution of the iOS app and Sign in with Apple.
• Sentry — error reporting, so we can find and fix faults. Reports can include the page or request that failed.
• Cloudflare — bot protection on public sign-up forms, which receives the visitor’s network address.

Within the Service, information is visible to the people a Customer has authorized: for example, a facility’s managers can see its registrations, and a team’s captain can see its roster. Public facility pages and lobby displays show schedules and team names but never individual contact details.

We may also disclose information if required by law, to protect the rights and safety of users, or as part of a merger or acquisition, in which case this policy continues to apply.

Children

Facilities run programs for children, so we are deliberate about how little we hold on them.

• Nobody under 18 gets a Glass account. A child or teenager takes part as a participant on a registration their parent or guardian makes and signs; they never receive a login, a password, or an email from us. If a facility needs a person under 18 to hold an account — a junior official, say — they have to ask us, and it is not on by default.
• We ask for the minimum. The child’s name, the guardian’s name, and the guardian’s confirmation that they are the parent or legal guardian. Date of birth is requested only where the program has an age requirement — a facility placing children in age groups needs it; one running an open session does not. A guardian phone number is optional.
• The guardian is the contact. All correspondence goes to the adult who registered.

If you believe someone under 18 has created an account, or that we hold a young person’s information without a guardian’s consent, email us and we will remove it.

Retention, and what happens when you delete your account

We keep account and facility information for as long as the Customer’s account is active. Registration and payment records belong to the facility’s books and are kept for as long as the facility needs them and as required by financial record-keeping rules.

You can delete your account from inside Glass at any time. When you do, straight away:

• your sign-in identity is destroyed, so you can no longer log in;
• your profile and your memberships are deleted;
• any pending invitation to you is deleted;
• your name and email are removed from our audit records, which otherwise remain so facilities keep a history of who did what;
• if you connected a mailbox, the access token is revoked with Google and deleted.

Signed waivers are the exception, and we want to be plain about it. A waiver is a facility’s record that a named person accepted a risk on a given date; anonymizing it would destroy the only evidence that it was ever signed. So a signed waiver is kept in full — including the participant and guardian details on it — for as long as the facility may need it. Glass tells you this, and how many waivers it applies to, before you confirm deletion.

Registrations, payments and anything you posted in a team space stay in the facility’s records after your account is gone. If you want those removed, ask the facility; we will help them action it.

Audit records are kept for the life of the facility’s account, with personal identifiers removed as described above. Short-lived security data, such as the counters behind rate limiting, is discarded within 24 hours.

Your choices and rights

• You can view and update your account information in the Service.
• You can disconnect a connected Google account at any time from Communications settings; you can also revoke Glass’s access from your Google account settings.
• You can ask us to access, correct, export, or delete your personal information by emailing support@glass-fms.com. We answer support requests within one business day, and any request about your information within 30 days. If the information belongs to a facility’s records, we may direct the request to that facility.
• Depending on where you live, you may have additional rights under laws such as the California Consumer Privacy Act or the GDPR, including the right to complain to a supervisory authority. We honor these requests regardless of location.

Security

All traffic to the Service is encrypted in transit. Credentials for connected services are encrypted at rest. Access to production systems is limited to the people who operate Glass. No system is perfectly secure; if we learn of a breach affecting your information, we will notify affected Customers without undue delay.

Cookies

The Service uses only the cookies and local storage needed to keep you signed in and remember your preferences. The marketing site uses cookieless analytics. We do not use third-party advertising cookies.

International use

Glass is operated from the United States and information is stored there. If you use the Service from elsewhere, you consent to that transfer.

Changes

We will post any changes to this policy on this page and update the date above. For material changes we will notify Customers by email.

Contact

37TEN · Glass FMS
support@glass-fms.com