Privacy Policy

This Privacy Policy explains how SquadTracker ("we", "us", "our") collects, uses, discloses, and protects your information when you use our web and mobile applications (iOS/Android via Capacitor) and related services (collectively, the "Service"). We comply with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and other applicable UK data protection laws.

By using the Service, you agree to this Policy and our Terms of Use.

1. Who We Are and How to Contact Us

Controller: HitQuill (provider of SquadTracker)

Privacy contact email: privacy@squadtracker.co.uk

We do not list a postal address in this Policy. Please contact us via email for privacy matters.

2. Scope

This Policy applies to all users, including coaches, team administrators, players, and invited participants who access or use the Service.

3. Categories of Personal Data We Process

Account/User Data:

• First name, last name
• Email address
• Password (hashed/salted)
• Email verification status
• Password reset tokens (time‑limited)
• Authentication/session tokens (e.g., NextAuth sessions)

Team & Role Data:

• Team name, colours, description, founded date
• Role assignments (Head Coach, Assistant Coach, Admin)
• Team invitations (invited email, status)
• Feature flags (e.g., cards tracking, minutes tracking)

Player Data:

• First/last name
• Jersey number, position
• Active/inactive status

Match & Training Data:

• Match date, venue, referee
• Home/away teams and scores
• Player participation and minutes played
• Goals (minute, assists, clean sheets
• Yellow/red cards (if enabled)
• Player of the Game awards (coach & player voting)
• Match notes
• Training date, venue, description
• Attendance records
• Trainer of the Week awards

Technical/Usage Data:

• Device and browser information
• Log data (timestamps, IP address, actions) for security/troubleshooting
• Cookies/local storage for authentication and session continuity

Consent Records:

• Name of the person providing consent (parent/guardian or player aged 13+)
• Consent type (parental or self)
• Consent decision (approved or declined) and timestamp
• Player matched to the consent record

When consent is declined, the player's display name is automatically anonymised to initials to protect their identity while allowing anonymous tracking to continue.

Media and Images:

• Club and team logos uploaded by admins/owners (PNG, JPEG, WEBP, or SVG; maximum 5 MB; resized and stored as WEBP)
• Drill diagram images uploaded by coaches as part of training drill content

Images are stored securely in our cloud object storage (Railway/S3-compatible). Club logos are publicly accessible to render within the app; drill diagrams are access-controlled and served only to authenticated users.

Coaching and Drill Content:

• Drill name, description, category, and tags
• Diagram images attached to drills
• Public/private visibility setting (drills are public by default; coaches may mark them private)
• Ratings and favourites associated with drills

Facility and Fixture Data:

• Facility/pitch name, type, colour label
• Booking records (date, time, team, facility)
• Imported fixture data (date, time, teams, division, venue) from CSV sources

Special category data: We do not intentionally collect special category data under UK GDPR (e.g., health, biometric, political opinions). Please do not input such data.

Children's data: Where minors are added as players, coaches are responsible for initiating the consent process via our built-in consent flow (see Section 13A). Players aged 13 or over may self-consent. For players under 13, parental or guardian consent is required before their full name is displayed or their data is processed beyond anonymous tracking.

4. Lawful Bases for Processing (UK GDPR Art. 6)

• Contract: To provide the Service and core features (accounts, team/player management, scheduling, stats/analytics).
• Legitimate Interests: To secure the Service, prevent abuse, improve features, and perform aggregated analytics, balanced against your rights.
• Consent: For optional features, non‑essential cookies, or marketing communications. You may withdraw consent at any time.
• Legal Obligation: To comply with applicable laws and regulatory requirements.

For minors' data, coaches/admins are responsible for ensuring a valid basis (including parental consent where required by law).

5. How We Use Your Information

• Operate and deliver the Service (authentication, roles, team/player management, scheduling, analytics).
• Maintain security and integrity (fraud prevention, access controls, auditing).
• Improve the Service (bug fixes, performance tuning, feature development).
• Communicate with you (account notices, service updates, invitations).
• Comply with legal obligations and enforce our terms.

We do not sell personal data.

6. Where We Store and Process Data

Hosting: Railway infrastructure with primary data storage in the Netherlands (EU/EEA).

International transfers: If limited transfers occur (e.g., support tools, content delivery), we use safeguards recognised under UK GDPR (e.g., UK International Data Transfer Agreement or UK Addendum to EU SCCs), or rely on UK adequacy regulations where applicable.

7. Data Sharing and Disclosure

• Service Providers/Processors: Hosting (Railway), authentication (e.g., NextAuth), cloud object storage (Railway/S3-compatible), logging/monitoring, email delivery, subscription/billing syncing (Adapty), and payment processing (Stripe). These providers act under data processing agreements and only per our instructions.
• Team visibility: Coaches/admins can see team-related data according to role-based permissions.
• Legal/Compliance: Where required by law or to protect rights, safety, and security.
• Business transfers: In a merger/acquisition, data may be transferred with appropriate safeguards and notice.

We do not allow third parties to use personal data for their own marketing.

8. Retention

• General: We retain personal data only as long as necessary for the purposes described.
• Inactive accounts: Accounts and associated personal data are deleted after 6 months of inactivity or following your deletion request, subject to legal obligations and backup cycles.
• Team and player records: Retained for active seasons and legitimate interests (e.g., historical stats) where allowed. Admins can delete specific records via in-product controls.
• Logs/security data: Retained for a limited period, then deleted or anonymised.

Backup copies may persist temporarily and are purged on a rolling basis.

9. Your Rights (UK GDPR)

Subject to conditions and exceptions, you have the right to:

• Access your data
• Rectify inaccurate data
• Erase data ("right to be forgotten")
• Restrict processing
• Object to processing based on legitimate interests
• Data portability (structured, commonly used, machine‑readable format)
• Withdraw consent (where processing relies on consent)
• Lodge a complaint with the UK Information Commissioner's Office (ICO): https://ico.org.uk

Contact us at privacy@squadtracker.co.uk to exercise your rights if in‑app tools are not sufficient.

10. Self‑Serve Data Export and Deletion Options

• Self‑serve export: Export your data directly in‑app.
• Account deletion: Delete your account in‑app; we delete or anonymise associated data per the Retention section.
• Player and team records: Coaches/admins can delete player profiles, attendance, match/training entries, notes, and teams.
• Emails: Unsubscribe links are provided for non‑essential emails.

For assistance, email privacy@squadtracker.co.uk.

11. Security

We implement appropriate technical and organisational measures, including:

• HTTPS/TLS encryption in transit
• Password hashing (never plaintext)
• Role-based access and session controls
• Environment hardening, monitoring, and least‑privilege access
• Multi-factor authentication (MFA) for club owners and admins

Incident response and breach notification: Our preferred contact method is email. We aim to notify the ICO (where legally required) without undue delay and, where feasible, within 72 hours after becoming aware of a personal data breach, and to notify affected users without undue delay where the breach is likely to result in a high risk to their rights and freedoms.

12. Cookies and Similar Technologies

We use cookies/local storage for:

• Authentication and session continuity
• Security (e.g., CSRF)
• Basic analytics to improve the Service (used only with consent where required)

You can manage cookies via your browser settings. Non‑essential cookies are used only with consent where required.

13. Player Statistics, Awards, and Tracking Features

• Feature flags: Certain tracking (e.g., cards) can be toggled at the team level.
• Purpose: Provide team management insights and season analytics.
• Transparency: Team admins should inform players (and parents/guardians for minors) about the nature and purpose of tracking. Our built-in consent flow supports this obligation — see Section 13A.
• Minimisation: Only enter data relevant to team management and performance.

13A. Player Consent System

SquadTracker provides a built-in digital consent mechanism to help coaches and clubs meet their data protection obligations when adding players, including minors.

• How it works: Coaches can generate a consent link at the club or team level. This link is shared with parents/guardians (for players under 13) or with players directly (for players aged 13 or over).
• Consent types: Parental/guardian consent (on behalf of a child) or self-consent (player aged 13+). Players under 13 may not self-consent; parental consent is required.
• On approval: The player's full name and data are retained and displayed within the platform for team management purposes.
• On decline: The player's name is automatically anonymised to initials. Anonymous performance tracking may continue. The player's identity is not displayed to other club users.
• Lawful basis: Consent records are processed under UK GDPR Article 6(1)(a) (consent) and, where applicable, Article 8 (conditions for child's consent in information society services).
• Withdrawing consent: A parent/guardian or player who previously approved consent may contact the club directly or reach us at privacy@squadtracker.co.uk to request withdrawal. On withdrawal, the player's name will be anonymised.
• Coaches' responsibility: Coaches and club admins remain responsible for ensuring the consent process is completed before displaying a minor's personal data on the platform.

13B. Coaching Drills and Shared Content

Coaches may create and upload training drill content (descriptions, diagrams) within the Service.

• Public drills: By default, drills are visible to other SquadTracker users as part of a shared coaching library. Coaches may mark individual drills as private at any time.
• Private drills: Visible only to the creator and authorised team/club members.
• Diagram images: Uploaded images are stored in our secure cloud storage and served only to authenticated users.
• No personal data in drills: Drills are intended to contain coaching content only. Do not include personal data (e.g., player names, images of individuals) in drill descriptions or diagrams.

14. Adapty, Stripe, and Subscription Data

We use Adapty to manage and synchronise subscription status across our mobile apps and website. Adapty receives limited identifiers and purchase metadata necessary to validate entitlements and renewals. For purchases via app stores, Apple and Google may process your payment information under their own terms and privacy policies.

For web-based payments, we use Stripe as our payment processor. Stripe may receive your billing information (name, email, card details) to process payments. We do not store full payment card details on our systems; this is handled entirely by Stripe under their own privacy policy and PCI-DSS compliance standards.

We do not store your full payment card details on our systems for in‑app purchases; payment data is handled by the relevant platform/store or payment processor.

15. Third‑Party Links

The Service may link to third‑party websites or services. Their privacy practices are their own; please review their policies.

16. Changes to This Policy

We may update this Policy from time to time. Material changes will be communicated via the Service or by email. Continued use after changes indicates acceptance.

17. Contact Us

Privacy email: privacy@squadtracker.co.uk

This Privacy Policy is aligned with our Terms of Use, including:

• Use of Adapty and Stripe for subscription/billing synchronisation and payment processing
• Monthly "cancel anytime" approach and yearly refund window policy (handled by the relevant stores/processors)
• Consent obligations for coaches adding players, especially minors
• Public/private settings for coaching drill content
• No postal address listed in this Policy
• Incident response timelines consistent with UK GDPR breach notification expectations