How ClubTree protects your club's information

Every member of your club gets their own sign-in. What they can see is decided by your club, member by member.

A regular member sees the things members should see: the club directory, the calendar, their own attendance record, their own dues, and any documents the club has marked as visible to members.

Officers and chairs get more, but only where you grant it. Access is controlled separately for each area of the system: membership, calendar and programs, budget, website, newsletter, applications, and documents. For each one you choose whether a person can view it or also change it.

So your treasurer can manage the budget without being able to edit the website. Your programs chair can schedule speakers without seeing anyone's dues. Nobody has more access than their role actually needs, and you can change any of it at any time.

Every piece of information in ClubTree belongs to exactly one club, and that ownership is checked on every single request. One club's members, dues, attendance, documents and website content are not visible to another club. Not through the app, and not through the database underneath it.

Each member is invited by email and is prompted to set a password the first time they sign in.

If someone forgets their password, they don't have to reset it. They can ask for a sign-in link by email, click it, and they're in. It's also there for the member who would simply rather not manage another password.

Passwords are never stored in readable form. Neither ClubTree nor a club administrator can retrieve a member's password.

Sign-in links are rate limited: one per member per minute, with hourly caps per club and per IP address.

When someone leaves the club, their access ends. Their history stays with the club's records, but they can no longer sign in and see the directory, documents, or anything else.

In transit: all traffic between the browser and ClubTree is encrypted with HTTPS/TLS.

At rest: member records, club information and files are encrypted at rest with AES-256.

Club documents are stored privately. They aren't sitting at a public web address where a lucky guess would find them. When a member with permission opens one, the system issues a temporary link that works for them, at that moment, and then expires.

Photos and website images are public by design, because they appear on your public website. That is the same as any photo on any club's site today.

Payments are processed by Stripe. Card details are entered on Stripe's own pages and never reach ClubTree's servers. ClubTree stores only Stripe's reference identifiers.

The database is backed up daily and can be restored to a previous point if something goes badly wrong.

ClubTree is hosted in the United States, in AWS's US East (Ohio) region.

A small number of services process data on our behalf:

• Supabase - database and files
• Stripe - payments
• Resend - email delivery
• Cloudflare - DNS and hosting

Your club's information belongs to your club. If you ever decide to leave, you can take it with you. We'll export your members, attendance, dues history, documents and website content in standard formats. There is no lock-in and no exit fee.

Club admins can also download a complete archive of the club at any time, including the "Download everything" export from the account settings page.