PRIVACY POLICY

1. Who We Are

CoachSmart is a sports team management platform operated by CoachSmart (Ireland).

Data Controller: CoachSmart
Contact: privacy@coachsmart.app

If you have any questions about how we handle your personal data, please contact us at the address above.

2. What Data We Collect

We collect only the information necessary to provide CoachSmart's features to you and your club.

Account and Profile Information

• Full name
• Email address
• Month and year of birth (used for age-grade team grouping only)

Team and Club Data

• Club name and team membership
• Role within the club (coach, player, manager, etc.)
• Event attendance responses (attending, not attending, no response)
• Squad availability and selection history
• Match reports and scores

Payment Information

• Payment transactions for club events are processed by Stripe. CoachSmart does not store your full card details. We retain a record of payment status and amount for event management purposes.

Device and Usage Data

• Device type and operating system (for push notification delivery)
• Push notification tokens (FCM)
• App usage logs (for debugging and service improvement)

3. How We Use Your Data

We use your personal data for the following purposes:

• Providing the service: Managing your account, team membership, event scheduling, attendance tracking, squad selection, and car pools.
• Communications: Sending push notifications and emails about events, reminders, squad selections, and attendance changes relevant to you.
• Payments: Processing event payments through Stripe on behalf of your club.
• Security: Authenticating your identity and protecting your account.
• Service improvement: Analysing usage patterns to improve app performance and features.

Legal Basis (GDPR)

• Contract performance: Processing necessary to provide the CoachSmart service you have signed up for.
• Legitimate interests: Security monitoring, service improvement, and communicating relevant team updates.
• Consent: Push notifications (you can withdraw consent at any time via your device settings).

4. Who We Share Your Data With

We do not sell your personal data. We share it only with the service providers necessary to operate CoachSmart:

• Supabase (supabase.com) — Our database and authentication provider. Your account data and team data are stored on Supabase infrastructure hosted in the EU.
• Google Firebase (firebase.google.com) — Used for push notification delivery (FCM) and app hosting.
• Stripe (stripe.com) — Payment processing for club event fees. Stripe is a certified PCI DSS Level 1 provider.
• Google (google.com) — Squad export to Google Sheets (only when you explicitly trigger this feature as a coach).

Your data may also be shared with other members of your club team (e.g. your name and attendance status are visible to your coaches and fellow team members within CoachSmart).

We may disclose data if required by law or to protect the rights, property, or safety of CoachSmart, our users, or others.

5. Data Retention

We retain your personal data for as long as your account is active or as needed to provide the service. Specifically:

• Account data: Retained while your account is active. You may request deletion at any time.
• Event and attendance records: Retained for the duration of the club season and up to 12 months thereafter for historical reporting.
• Payment records: Retained for 7 years to comply with Irish financial record-keeping obligations.
• Push notification tokens: Removed when you log out or uninstall the app.

6. Your Rights Under GDPR

As a data subject under GDPR, you have the following rights:

• Right of access: You can request a copy of the personal data we hold about you.
• Right to rectification: You can correct inaccurate or incomplete data via the app or by contacting us.
• Right to erasure: You can request deletion of your account and associated personal data.
• Right to restriction: You can request that we restrict processing of your data in certain circumstances.
• Right to data portability: You can request your data in a structured, machine-readable format.
• Right to object: You can object to processing based on legitimate interests.
• Right to withdraw consent: Where processing is based on consent (e.g. push notifications), you can withdraw consent at any time via your device settings.

To exercise any of these rights, contact us at privacy@coachsmart.app. We will respond within 30 days. You also have the right to lodge a complaint with the Data Protection Commission (Ireland) at dataprotection.ie.

7. Data Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, or misuse. These include:

• Encrypted data transmission (TLS/HTTPS)
• Row-level security on our database — you can only access data belonging to your club and teams
• Secure authentication via Supabase Auth
• Payment processing handled entirely by Stripe (PCI DSS compliant)

8. Children's Privacy

CoachSmart manages GAA teams that may include under-18 players. Where a team member is under 18, their account is set up by a club administrator or coach. We do not knowingly allow children under 13 to create their own accounts. If you believe we hold data about a child without appropriate consent, please contact us immediately.

9. Cookies and Tracking

The CoachSmart website uses minimal cookies for functionality. The CoachSmart app does not use advertising cookies or cross-app tracking. Firebase may collect anonymised usage analytics to help us improve the app.

10. Changes to This Policy

We may update this Privacy Policy from time to time. When we make significant changes, we will notify you via the app or by email. The "Last updated" date at the top of this page will always reflect the current version.

11. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or your personal data, please get in touch: