Privacy Policy

1. Who We Are

2. Data We Collect and Why

2.1 Account Information

When you create a SquadTracker account we collect your first name, last name, email address, and a password. Passwords are stored as a one-way cryptographic hash — we cannot read or recover your password. We also store whether your email address has been verified and security metadata such as the date your password was last changed (used to invalidate old sessions) and the date of any account suspension.

Legal basis: Contract performance — this data is necessary to provide your account.

2.2 Two-Factor Authentication (2FA)

If you enable two-factor authentication, we store an encrypted one-time password (TOTP) secret and a set of hashed backup codes. The TOTP secret is encrypted using AES-256 before being stored and cannot be read in plaintext. 2FA is mandatory for club owners and administrators.
Legal basis: Legitimate interests (account security).

2.3 Team and Club Management Data

When you use SquadTracker to manage teams and clubs, you provide and we store:

• Team and club names, descriptions, logos, colours, and settings
• Match details: dates, venues, scores, statistics, and match events (goals, cards, substitutions)
• Training session details: dates, venues, and descriptions
• Season information and fixture data
• Facility names and booking details
• Referee names, email addresses, and contact details you enter
• Training drills: titles, instructions, diagrams, and difficulty settings

Legal basis: Contract performance — this is the core service you have contracted us to provide.

2.4 Player Data

Coaches enter player records containing first name, last name, jersey number, position, and optionally a player photo. Players are associated with teams and their match statistics are recorded against their records.

Where players are minors, SquadTracker includes a consent management system. Coaches can request parental or guardian consent before storing a player's data. We record whether consent is required, the consent type (parental or self), the consent status, the name of the person who gave or declined consent, and the date consent was given or declined.
Legal basis: Legitimate interests of the club / consent where required for minors' data.

2.5 Teamsheet Signatures

The digital teamsheet feature allows home coaches, away coaches, and referees to sign match teamsheets within the app. These signatures are captured as image data and stored securely. Completed teamsheets are exported as PDF documents and stored in our private cloud storage, accessible only to the relevant club.
Legal basis: Legitimate interests (record-keeping for league and competition purposes).

2.6 Parent and Guardian Contact Data

Club administrators may add parent or guardian contact details — specifically first name, last name, email address, and optionally a phone number — in order to send payment requests, manage player subscriptions, and request data consent. This information is stored securely and is only accessible to authorised administrators of the club that added it.
Legal basis: Legitimate interests of the club (managing payments and consent).

2.7 Photos and Images

When you upload a team logo, club logo, player photo, or training drill diagram, the app requests access to your camera or photo library. We only access the specific image you choose to upload — we do not scan, index, or store any other content on your device. Logos and drill diagrams are stored in our cloud storage with public read access (they are accessible via a direct URL). Uploaded images are automatically resized and converted to WebP format before storage.
Legal basis: Contract performance / Consent (permission requested at point of use).

2.8 Push Notification Token

If you grant permission for push notifications, we store a device push token issued by Apple (APNs) or Google (Firebase Cloud Messaging) against your account. This token is used solely to deliver notifications about your teams, including:

• Match reminders (1 hour and 24 hours before kick-off)
• Training reminders (1 hour and 24 hours before a session)
• Lineup published notifications
• Post-match stats and teamsheet reminders (coaches only)
• App update announcements (What's New)

You can disable push notifications at any time in your device settings or within the app. Stale tokens that can no longer receive notifications are automatically removed from our systems.
Legal basis: Consent.

2.9 Payment and Subscription Data

We do not store full payment card details. Payments are processed by Stripe (for web subscriptions and club payment collection) and by Apple or Google (for in-app purchases). We store the identifiers these payment processors assign to you (Stripe customer ID, Stripe subscription ID, Adapty profile ID), your subscription status, tier, and expiry date, and payment request records including amounts, descriptions, and payment status. These records are necessary to grant you access to paid features and to maintain accurate financial records.

Stripe Connect: Clubs that enable the payments feature connect a Stripe Express account to receive payments from parents and guardians. In this case, Stripe collects identity and banking information directly from the club as part of their Know Your Customer (KYC) process. We store only the Stripe Connect account ID and onboarding status.
Legal basis: Contract performance / Legal obligation (financial record-keeping).

2.10 Contact Enquiries

If you submit a contact enquiry through our website, we collect your name, club name, email address, phone number, and your message. This information is used solely to respond to your enquiry.
Legal basis: Legitimate interests.

2.11 Technical and Diagnostic Data

We use Sentry to automatically capture error reports and crash logs when the app encounters a problem. Sentry may capture:

• The error or crash details (stack trace)
• Your browser or app version and operating system
• A limited session replay of approximately 1% of sessions and 100% of error sessions, used to reproduce bugs. All text content is masked in these replays — Sentry cannot see what you have typed or read.

We also log your approximate IP address for security purposes such as detecting unusual login activity. We do not collect GPS location or any other geolocation data.
Legal basis: Legitimate interests (service reliability and security).

2.12 Marketing Communication Preferences

We record whether you have opted out of marketing emails. Every marketing email contains a one-click unsubscribe link. Unsubscribing does not affect transactional emails such as password resets, security alerts, payment confirmations, and team invitations.
Legal basis: Legitimate interests (with opt-out).

3. Emails We Send You

We send the following types of email. Transactional emails are sent regardless of marketing preferences as they are necessary to operate your account or complete a transaction you have initiated.

4. Third-Party Services

We use the following third-party services to operate SquadTracker. Each is subject to its own privacy policy and, where required, we have data processing agreements in place.

We do not sell your personal data. We do not share your data with any other third parties except as described above or where required by law.

5. Cookies and Sessions

SquadTracker uses a single session cookie to keep you signed in. This cookie:

• Is HTTP-only (cannot be read by JavaScript)
• Is marked Secure (transmitted over HTTPS only)
• Expires after 30 days of inactivity
• Is invalidated immediately when you sign out
• Is invalidated if you change your password

We do not use advertising cookies, analytics tracking cookies, or any third-party cookies for marketing purposes.

6. Data Relating to Children

SquadTracker accounts are for coaches, club administrators, and parents or guardians aged 16 and over. We do not knowingly provide accounts directly to children under 16.

Coaches may enter the names, positions, jersey numbers, and match statistics of players who are minors as part of managing their teams. This data is used solely for team management purposes and is not used to create profiles of individual children beyond what the coach enters.

SquadTracker includes a built-in consent management system. Coaches can be required to obtain verifiable parental or guardian consent before a player's data is stored. Consent requests are sent by email, and consent status (given, declined, or pending) is recorded alongside the name of the consenting person and the date consent was given. Coaches can withdraw or update consent at any time.

If you believe we have received data relating to a child without appropriate consent, please contact us immediately at support@squadtracker.co.uk.

7. Data Security

• All data is transmitted over HTTPS (TLS encryption in transit)
• Passwords are hashed with bcrypt — they cannot be reversed or read by anyone at SquadTracker
• Two-factor authentication (TOTP) secrets are encrypted with AES-256-GCM before storage
• Sensitive cookies are HTTP-only and Secure — inaccessible to JavaScript
• Login attempts are rate-limited to 10 per 15 minutes; 5 consecutive failures trigger a security alert email
• 2FA is mandatory for club owners and administrators
• Private files (e.g. signed teamsheet PDFs) are stored with private access controls and served via time-limited signed URLs
• Database and files are stored on Railway infrastructure with encryption at rest

8. Data Retention

9. Your Rights Under UK GDPR

You have the following rights regarding your personal data:

• Right of access: Request a copy of the personal data we hold about you.
• Right to rectification: Ask us to correct inaccurate or incomplete data. You can update your name and email directly within the app.
• Right to erasure: Request deletion of your account and associated personal data. To request deletion, email support@squadtracker.co.uk. Note that payment records may be retained for up to 7 years as required by law.
• Right to restriction: Ask us to pause processing of your data in certain circumstances.
• Right to portability: Receive your personal data in a structured, machine-readable format.
• Right to object: Object to processing based on legitimate interests, including receiving marketing emails. Use the unsubscribe link in any marketing email or contact us directly.
• Right to withdraw consent: Where we rely on consent (e.g. push notifications, marketing emails), you may withdraw it at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, contact support@squadtracker.co.uk. We will respond within 30 days. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk or by calling 0303 123 1113.

10. International Data Transfers

Your data is primarily stored on Railway infrastructure. Some third-party services we use — including Google Firebase and Sentry — may process data on servers in the United States. Where data is transferred outside the UK or EEA, we ensure appropriate safeguards are in place, including Standard Contractual Clauses approved by the Information Commissioner's Office.

11. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in the app or legal requirements. When we make significant changes, we will notify you by email and update the “Last Updated” date above. Continued use of SquadTracker after changes are posted means you accept the updated policy.

12. Contact Us

For questions, data access requests, or deletion requests relating to this Privacy Policy or your personal data, please contact us: