Privacy Policy for MatchOps

Data Controller

MatchOps is developed and operated by Ville Pajala, based in Finland. As the data controller, we are responsible for the processing of your personal data as described in this policy.

Overview

MatchOps ("we", "our", "the app") is a local-first soccer coaching application. This privacy policy explains how we handle your information.

Data Storage

Local Data (Default)

By default, all your data is stored locally on your device:

• Player rosters and information
• Game records and statistics
• Settings and preferences
• Season and tournament data
• Personnel information (names, roles, contact details if you choose to enter them)

We do not have access to this data. It never leaves your device unless you explicitly export it or enable cloud sync.

No Account Required (Local Mode)

MatchOps works entirely offline in local mode. No account creation, login, or personal information is required.

Cloud Sync (Optional)

If you enable Cloud Sync, your data is additionally stored on secure cloud servers:

• Copied to our secure EU-based servers (Supabase, hosted in EU)
• Encrypted in transit (HTTPS/TLS) and at rest
• Protected by row-level security (only you can access your data)
• Synced across your devices
• Retained under your full ownership

Cloud data is stored in secure EU-based data centers. You can delete your cloud data at any time from Settings.

Data Retention

Cloud data is retained while your account is active. When you delete your cloud data or your account, data is permanently removed within a reasonable period. If your account becomes inactive for an extended period, we may delete cloud data with prior notice. Local data remains on your device until you clear it. Consent records are retained even after account deletion for GDPR compliance.

Legal Basis for Data Processing (GDPR Art. 6)

We process personal data on the following legal bases:

• Contract (Art. 6(1)(b)): Processing necessary for cloud sync service delivery
• Consent (Art. 6(1)(a)): Acceptance of Terms of Service and Privacy Policy for cloud mode users. Consent records are stored to demonstrate compliance
• Legitimate interest (Art. 6(1)(f)): Error reporting via Sentry to maintain app quality and fix bugs. This processing involves minimal anonymized data and does not involve profiling or tracking

Data We May Collect

Error Reporting

When the app encounters an error, we may collect:

• Error type and stack trace
• Device type and OS version
• App version
• Anonymized session information

This helps us fix bugs and improve the app. Error reports do not contain your game data or player information. They are processed by Sentry.io (data may be processed in the US under Standard Contractual Clauses).

Play Store License Validation

If paid features are introduced, Google Play will handle all payment processing. We verify license status through Play Store API but do not receive your payment information.

Consent Records (Cloud Mode)

When you accept our Terms of Service and Privacy Policy in Cloud Mode, we record:

• Date and time of consent
• Which policy version you accepted
• Your IP address (for legal verification)
• Your browser/device information

This information is required for GDPR compliance to prove that valid consent was obtained (GDPR Art. 7(1)). Consent records are retained even after account deletion for legal purposes.

Personnel Data

When you add team personnel (coaches, assistants, medical staff), you may optionally enter:

• Name and role
• Email address (optional)
• Phone number (optional)
• Certifications (optional)

This data is stored locally on your device (local mode) or in our secure EU-based database accessible only to you (cloud mode). Personnel contact information (email, phone) is considered personally identifiable information (PII) under GDPR. You are responsible for ensuring you have appropriate grounds to store their contact details.

Data We Do NOT Collect

• Game content, scores, or statistics (stored locally only, or in your private cloud account)
• Location data
• Photos or media
• Device identifiers for tracking or advertising
• Player names or personal details (these are stored locally by you, or in your private cloud account)

Note: If you enter personnel contact information (email, phone), this is stored by your choice and under your control — see the Personnel Data section in our full Privacy Policy.

Third-Party Services (Sub-processors)

We use the following third-party services to operate MatchOps. Data processing agreements are in place with each provider where required.

Your Rights (GDPR)

Under GDPR and applicable data protection laws, you have the right to:

• Access (Art. 15): View and export all your data at any time
• Rectification (Art. 16): Correct any inaccurate data directly in the app
• Erasure (Art. 17): Delete your local data or cloud data at any time
• Portability (Art. 20): Export your data in standard JSON format
• Restriction (Art. 18): Switch to local-only mode to stop cloud processing
• Objection (Art. 21): Stop cloud processing by switching to local mode
• Withdraw consent: Delete your cloud account to withdraw consent to cloud processing

For local data: Use Settings → Data → Your Data Rights

For cloud data: Use Settings → Data → Your Data Rights

All data management options are available directly in the app under Settings → Data tab. No email request is needed — you can self-serve all GDPR rights through the app interface.

If you believe your data protection rights have been violated, you have the right to lodge a complaint with a supervisory authority. In Finland: Office of the Data Protection Ombudsman (Tietosuojavaltuutetun toimisto): tietosuoja.fi

Children's Privacy

MatchOps is a tool designed for adult coaches, not for use by children. The app does not knowingly collect personal information from children under 16. Player names and statistics are entered by the coach (the app user), not by the players themselves. This data is stored locally on the coach's device or in their private cloud account and is never transmitted to us or any third party (except when cloud sync is enabled, in which case it is stored securely in the coach's private account). No age verification is required because the app collects data from coaches about their players, not directly from children.

Data Security

In local mode, your data is stored in your browser's IndexedDB database:

• Protected by your device's access controls (screen lock, password, biometrics)
• Not additionally encrypted at rest beyond what your device/browser provides
• No network transmission unless you enable Cloud Sync

Your device's security is your primary protection for local data. We recommend using a strong screen lock.

In cloud mode, your data is protected by:

• Encrypted in transit (HTTPS/TLS)
• Encrypted at rest in secure EU-based servers (Supabase, Frankfurt)
• Row-level security ensuring you can only access your own data
• Backed by Supabase's security infrastructure and SOC 2 compliance

Backup File Security

When you export your data, the backup file contains all your data including any personnel contact information. Backup files are not encrypted and should be stored securely. We recommend storing backup files in a secure location and deleting them after import.

Changes to This Policy

We may update this policy when necessary. Material changes will update the "Last Updated" date and Policy Version, trigger a re-consent prompt for cloud mode users on their next sign-in, and be available for review before acceptance.

Contact

Most data requests can be handled directly in the app (Settings → Data tab) without contacting us. For other privacy questions or concerns:

Email: support@match-ops.com