Privacy notice

Who we are

Sideline is run by [Company name] Ltd, a company registered in England and Wales (company number [company number]), [registered office address]. We're responsible for your personal information as described here, under the UK GDPR and, where it applies to you, the EU GDPR or your own country's privacy law. We use the GDPR standard for everyone.

Questions? Email privacy@sidelineapp.com. This notice sits alongside our terms and safeguarding page.

The short version

• Accounts are for adults. Children don't have accounts and never give us their details.
• For players we keep as little as possible: usually a first name. Public pages show first names only by default.
• We don't sell personal information, show ads, or track you around the web.
• You can download or delete your account's data at any time.

What we collect

About you, if you have an account:

• your email address, which is how you sign in
• your first name, and last name if you add it
• how you know the team (parent, supporter, coach), if you say
• your country, which sets which terms apply and how dates read
• that you confirmed you're 18 or over, which versions of our terms and this notice you accepted, and when
• whether you want feature emails, and when you said yes
• the teams and clubs you help run, follow, or are linked to as family

About players, entered by a team's adults:

• first name, and surname or initial only if the team needs it (for example to tell two players apart)
• the team's records: goals, cards, appearances, line-ups and positions, player of the match
• optionally, gender (male or female), which only the team's admins see and is never shown publicly
• for school teams connected to the school's system through our partner Wonde: first name, surname, gender and the school system's id, for the pupils the school picks

We never ask for players' dates of birth, addresses, photos, contact details or medical information.

Other things:

• sponsors' names, websites and logos that a team adds
• concerns raised through our report form, and any email address given for a reply
• technical information: a sign-in cookie, the IP address and approximate country of a request (to choose your country, stop abuse and keep sign-in links safe), and basic server logs

Supporters can follow teams without an account. That list is kept only on their own phone or browser.

Children's information

The club, school or team decides what to record about its players and is responsible for having a lawful basis and telling families. Children don't use Sideline themselves, and the settings that protect them are on by default.

To keep children's information minimal and safe:

• children don't have accounts, and we don't collect anything from them directly
• public pages show first names only by default, adding a surname initial only when two players share a name
• any player can be hidden from public pages
• gender is never public, and we never collect dates of birth, photos or contact details
• team links aren't listed by search engines, and admins can reset them
• sponsors on youth teams can't be gambling, alcohol, vaping or tobacco, or junk food brands

For players' details, the club, school or team decides what to record and who can see it. For that information we act on their behalf (as a "processor" or "service provider"), and follow their instructions and this notice. Parents should ask the team's admin first; we'll help if they can't.

Why we use it, and our lawful basis

• To run your account and your team's pages (for example signing you in, showing scores to supporters). We need this to provide Sideline to you.
• To keep Sideline safe and working (rate limits, security, fixing faults, looking into concerns). This is in our and our users' legitimate interests in a safe, reliable service.
• To email you about new features, only if you tick the box. You can untick it on your account page at any time.
• To keep records the law requires, such as payment records and the versions of these documents you accepted.

We don't sell personal information, don't show advertising, and don't use it to build profiles of you or of children.

Who we share it with

Only with companies that help us run Sideline, under contracts that limit what they can do with it:

• Vercel (hosting, working out a visitor's country, and counting page visits)
• Neon (our database)
• Resend (sending sign-in and service emails)
• Wonde (only for schools that choose to connect their school system)
• a payment provider, when paid plans start, for billing details (we won't see full card numbers)

What a team shows on its public pages is visible to anyone with its link, under the team's settings. We'll also share information if the law requires it, or to protect a child or someone else from harm.

Overseas transfers

We're a UK company, and our providers store data in the United States, the United Kingdom and the European Union. Where your country's law limits overseas transfers, we use the safeguards it approves, such as standard contractual clauses.

How long we keep it

• Your account: until you delete it. We delete accounts that haven't been used for 3 years, after emailing you first.
• Teams, players and matches: while the team exists. When a team is deleted, its players and matches go with it.
• Sign-in links: 30 minutes. Sign-in sessions: 60 days.
• Demo teams made to try Sideline: up to a week.
• Concern reports: up to 6 years after we close them, in case they're needed to protect a child.
• Backups: overwritten within 35 days.

Cookies and storage

We use one cookie to keep you signed in, and a short-lived one to show messages like "Saved". Both are strictly necessary, so we don't ask for consent. Followed teams and scores waiting to sync are kept in your browser's storage. We don't use advertising or analytics cookies. We count page visits with Vercel Web Analytics, which uses no cookies and doesn't identify you; links and codes are stripped from page addresses before they're counted.

Keeping it safe

Data is encrypted in transit and at rest. Sign-in is by email link, so there are no passwords to steal, and only a scrambled (hashed) form of each link is stored. Only a small number of our staff can see personal information, when they need to.

Your rights

You can ask us to:

• give you a copy of your personal information (you can also download your account's data from your account page)
• correct it if it's wrong
• delete it (you can delete your account yourself)
• restrict or object to how we use it
• give it to you or another service in a machine-readable form

Where we rely on your consent (feature emails), you can withdraw it at any time. We'll reply within one month and it's free. Your own country's law may give you more rights, and we'll honor them.

Complaints

Please tell us first at privacy@sidelineapp.com. You can also complain to the data protection or privacy authority in your country, or to the UK's Information Commissioner's Office at ico.org.uk.

Changes to this notice

Each version has a number and date, and the changes are listed at the bottom of this page. If a change is important, we'll ask you to read and accept it the next time you sign in.