Privacy Policy

1. Who We Are

PlayFoot (playfoot.app) is a personal project providing a recreational football match organiser. For privacy enquiries, contact us at support@playfoot.app.

2. Data We Collect

2.1 Account Data

When you register or sign in, we collect:

• Email address — used to authenticate you via one-time code or Google OAuth.
• Display name — the name shown to other members of your groups and matches.
• Avatar — a choice from a set of preset avatar images; no photo upload is required.
• Google profile data — if you sign in with Google, we receive your Google account email and display name. We do not store your Google profile picture, phone number, or any other Google data.

2.2 Match and Group Data

PlayFoot stores data you actively create on the platform:

• Groups you create or belong to (name, description, members).
• Matches you schedule (date, time, location, team configuration, enrolled players, results).
• Guest players you add on behalf of a group member (guest name and the inviting member — no email or personal data beyond the name you provide).
• Player statistics accumulated from closed matches (goals, assists, wins, losses, etc.).

2.3 Technical Data

When you use PlayFoot we automatically collect minimal technical information required to operate the service:

• Session cookie (playfoot_token) — a secure, HttpOnly cookie containing your session token. It never contains personal data and is never readable by JavaScript.
• Server logs — standard HTTP access logs (IP address, timestamp, request path) retained for up to 30 days for security and debugging purposes.

3. Why We Collect This Data

We collect data strictly to operate PlayFoot and deliver its features to you:

• To authenticate you and keep your session secure.
• To show your name and avatar to fellow group members when you join a match or are listed on the field.
• To maintain your match history and statistics within your groups.
• To send you one-time sign-in codes to your email address when requested.
• To diagnose technical issues and ensure the platform remains available.

We do not use your data for advertising, profiling, machine-learning training, or any purpose unrelated to operating PlayFoot.

4. Data Sharing — We Share Nothing

We do not sell, rent, trade, or otherwise share your personal data with any third party, including advertising networks, data brokers, analytics providers, or social networks.

The only external service involved in authentication is Google OAuth 2.0, used only when you choose to sign in with Google. In that case your browser communicates directly with Google under Google's own privacy policy; PlayFoot only receives the token confirmation and your email address.

Your data may be disclosed if required by law or a valid court order; in that case we will notify you where legally permitted to do so.

5. No Advertising

PlayFoot is completely free and contains no advertising of any kind. We do not display ads, sponsor links, or promoted content. We do not integrate any advertising SDK, tracking pixel, or third-party analytics library.

6. Data Retention

• Active account: your data is retained for as long as your account exists.
• Account deletion: when you delete your account all personal data (name, email, avatar, statistics) is permanently erased within 30 days. Match records in which you participated may retain anonymised participation counts but will no longer be attributed to you.
• Past matches: completed and cancelled matches that are older than 7 days are automatically removed from active listings.
• Server logs: retained for up to 30 days, then deleted.

7. Cookies

PlayFoot uses a single, strictly necessary cookie:

We do not use tracking cookies, analytics cookies, advertising cookies, or any third-party cookies.

8. Security

We take reasonable technical measures to protect your data:

• All traffic between your browser and PlayFoot is encrypted over HTTPS.
• Session tokens are stored in HttpOnly, Secure, SameSite cookies — they are not accessible to JavaScript.
• Passwords are never stored; authentication is via OTP code or Google OAuth only.
• Database access is restricted to the application server; no direct external access is permitted.

No security measure is 100% perfect. If you discover a vulnerability, please disclose it responsibly to support@playfoot.app.

9. Your Rights (GDPR)

If you are located in the European Economic Area, you have the following rights regarding your personal data:

• Right of access: request a copy of the personal data we hold about you.
• Right to rectification: correct inaccurate data (your display name and avatar can be changed directly in your profile settings).
• Right to erasure: delete your account and all associated personal data (available from profile settings).
• Right to portability: request your data in a structured, machine-readable format.
• Right to object: object to any processing of your data beyond what is strictly necessary to operate the service.

To exercise any of these rights, email us at support@playfoot.app. We will respond within 30 days.

10. Children's Privacy

PlayFoot is not directed at children under 16. If you believe a child under 16 has provided us with personal data, please contact us and we will delete it promptly.

11. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will update the "Last updated" date at the top of this page. We encourage you to review this page periodically. Continued use of PlayFoot after changes constitutes acceptance of the revised Policy.

12. Contact

For any privacy-related questions or requests, contact us at support@playfoot.app.