Privacy Policy

Effective date: 19 March 2026 · Last updated: 12 April 2026

MyFootball ("the App", "we", "us", "our") is operated by LouayLabs. This Privacy Policy explains what personal data we collect, why we collect it, how we use it, and your rights regarding that data.

By creating an account, you acknowledge that you have read and understood this policy.

1. Data We Collect

1.1 Account & Profile Data

When you create an account and complete your profile, we collect:

Data	Purpose	Required
Email address	Account login & verification	Yes
Password	Account authentication (stored securely hashed — we never see your plaintext password)	Yes
Username	Unique public identifier	Yes
First & last name	Account identity	Yes
Display name	How other users see you in the app	Yes
Date of birth	Age verification (must be 13+)	Yes
Profile photo	Optional avatar displayed to other users	No
Sex	Optional profile field	No
Bio	Optional profile description	No

1.2 Match & Activity Data

When you use the App, we collect data about your activity:

• Match details — date, time, duration, location, team assignments, player positions, and match status
• Post-match reports — match results (win/draw/loss), player ratings, and player labels (e.g. "Striker", "Defender")
• Statistics — aggregated from your match history (matches played, win rate, average rating, awards)
• Friend connections — friend requests sent, received, and accepted
• Notifications — match invites, friend requests, and match activity notifications
• Chat messages — messages you send in match and squad group chats are stored so other participants can view them
• Squad data — squads you create or join, squad membership, invite codes, and squad-level statistics
• Dummy profiles — if you are a match admin, you may create placeholder player profiles (display name only) to represent players who do not have an account. These are linked to your account.
• Block data — if you block another user, we record the block relationship so the App can enforce it across all features
• Reports — if you report a user or content, we store the report details (reason, category, and associated content) for moderation purposes

1.3 Push Notification Data

If you grant notification permissions, we collect your Apple Push Notification service (APNs) device token. This token is used solely to deliver push notifications about match activity, friend requests, chat messages, and other in-app events. You can disable push notifications at any time in your device's Settings. We do not use your device token for advertising or tracking.

1.4 Location Data

When you search for match venues, the App uses Apple MapKit to search for places. Search queries are sent to Apple's mapping servers. We do not request access to your device's GPS location. The venue addresses you save are stored in our database so you can reuse them for future matches.

1.5 Data We Do NOT Collect

2. How We Use Your Data

We use your data solely to provide the App's functionality:

• Account management — creating and authenticating your account
• Core features — organising matches, managing teams, inviting friends, generating post-match statistics, squad management, and group chat
• Communication — sending verification emails, in-app notifications, and push notifications about match activity, chat messages, friend requests, and squad events
• Age verification — ensuring users meet the minimum age requirement of 13 years
• Safety & moderation — processing block and report actions to protect users from abuse, harassment, or inappropriate content

We do not use your data for advertising, profiling, automated decision-making, or selling to third parties.

3. What Other Users Can See

Other authenticated users of the App can see:

• Your display name, username, profile photo, and bio
• Your friendship status relative to them
• Within shared matches: your team assignment, position, ratings, and awards
• Within shared matches and squads: your chat messages sent to group chats
• Within shared squads: your squad membership and squad statistics

Other users cannot see your email address, password, date of birth, sex, first/last name, or saved locations.

3.1 Blocked Users

When you block a user (or they block you), visibility is reduced across the App:

• Blocked users will not appear in your friends list, search results, or friend suggestions
• Blocked users cannot send you friend requests, match invites, or chat messages
• In shared matches and squads, blocked users' profile photos are hidden (replaced with a generic placeholder) and interaction with their profiles is disabled
• Your ratings and post-match reports will not affect blocked users' statistics, and vice versa

4. Data Storage & Security

Your data is stored on Supabase, a cloud database platform built on PostgreSQL. Supabase provides:

• Encrypted data transmission (HTTPS/TLS)
• Row-Level Security (RLS) ensuring users can only access data they are authorised to see
• Secure password hashing (bcrypt) — we never store or have access to plaintext passwords
• SOC 2 Type II certified infrastructure

5. Third-Party Services

Service	Purpose	Data Shared
Supabase	Authentication, database, backend	All app data (encrypted in transit and at rest)
Apple Push Notification service (APNs)	Delivering push notifications to your device	Device token (not linked to your Apple ID)
Apple Sign in with Apple	Optional account authentication	User identifier and, if consented, name and email (Apple may provide a private relay email)
Apple MapKit	Venue search when setting match locations	Search queries only (no personal data)

We do not use any analytics, advertising, or tracking services.

6. Data Retention

• Active account — your data is retained for as long as your account exists
• Account deletion — when you delete your account, all your data is permanently removed, including: your profile, profile photo, match participation records, friendships, blocks, saved locations, match history, statistics, notifications, chat messages, squad memberships, dummy profiles you created, and push notification tokens. This is irreversible.
• Reports — reports you have submitted may be retained after account deletion for safety and moderation purposes, but will be anonymised (no longer linked to your profile).

7. Your Rights

Depending on your jurisdiction (including under GDPR, UK GDPR, and other privacy laws), you have the right to:

• Access your personal data
• Correct inaccurate data (via the profile editing features in the App)
• Delete your account and all associated data (via Settings → Delete Account in the App)
• Withdraw consent by deleting your account
• Data portability — request a copy of your data
• Lodge a complaint with your local data protection authority

To exercise any of these rights, contact us at the email address below.

8. Children's Privacy

The App is not intended for children under 13 years of age. We enforce a minimum age of 13 during profile creation. If we become aware that we have collected data from a child under 13, we will promptly delete their account and all associated data.

9. International Data Transfers

Your data may be processed and stored in countries outside your country of residence, including countries where Supabase operates its infrastructure. Where applicable, appropriate safeguards are in place in accordance with data protection laws.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will update the "Last updated" date at the top when we do. Continued use of the App after changes constitutes acceptance of the updated policy.

11. Contact Us

If you have questions about this Privacy Policy or want to exercise your data rights, contact us at: