Privacy Policy

1. Controller

Boris Sobieski, Friedrich-Inhauser-Straße 21, 5026 Salzburg, Austria

Email: boris@bobo23.dev

No data protection officer has been appointed.

2. Why we process data

MVC supports football teams in organizing their training: training plans, calendar, RSVPs, polls, roster and notifications. The app can only be used with an invitation.

3. Which data we process and on what basis

3.1 Account and sign-in

First and last name, email address, password (stored as a hash only), language, sign-in times and technical session data (session token, session device identifier).

Purpose: provide the account, sign-in and password reset. Basis: performance of a contract (Art. 6(1)(b) GDPR).

3.2 Club, team and role

Membership of club and team, your role (for example player, coach, head coach, club admin) and join requests with the decision.

Purpose: control access and visibility. Basis: performance of a contract (Art. 6(1)(b) GDPR).

3.3 Player profile

Positions, jersey number, start year and status (for example active, injured, inactive). This information is visible to the coaches of your team and can be changed by head coaches and club admins.

Purpose: maintain the roster, plan training. Basis: performance of a contract (Art. 6(1)(b) GDPR).

The status "injured" may allow conclusions about your health. We process it only as a simple status without medical details. You can ask your coach to enter "inactive" instead.

3.4 Trainings, RSVPs, polls

Your acceptance or decline of trainings, your poll answers and the time of each. Coaches of your team can see who accepted, declined or voted. Players do not see the results of others in polls.

Purpose: training planning and voting. Basis: performance of a contract (Art. 6(1)(b) GDPR).

3.5 Notifications

• Push notifications: we store a device token and use it to send messages, for example when the RSVP window for a training opens, for polls, reminders from coaches and join requests. Delivery is handled by Firebase Cloud Messaging (Google) and the Apple Push Notification Service.
• Local alerts (coaches only): alerts before and during a training are scheduled on your device. No data is sent to us for this. The settings are stored in the app on your device.
• Emails: we send invitations, password resets and notices through Resend.

Basis: performance of a contract (Art. 6(1)(b) GDPR). You can turn off push notifications at any time in your device settings.

3.6 Local storage

The app stores your session token, your language and alert settings and cached profile data on your device. The web app uses a cookie for sign-in. It is required for operation, and we do not use tracking or advertising cookies.

Basis: performance of a contract (Art. 6(1)(b) GDPR) and Section 165(3) TKG 2021 (technically necessary storage).

3.7 Server logs

When you open the web app and whenever the app accesses our servers, technical data is generated (IP address, time, requested address, status code, browser or device type). It serves secure operation and troubleshooting.

Basis: legitimate interest in stable and secure operation (Art. 6(1)(f) GDPR).

4. No analytics and no advertising

We do not use analytics or tracking services and do not pass on data for advertising.

5. Recipients and processors

We use the following service providers and conclude the agreements required under Art. 28 GDPR with them:

• Google Cloud (hosting of web app, backend and search service), region Belgium (europe-west1)
• MongoDB Atlas (database), data center in the EU
• Resend (email delivery)
• Google Firebase Cloud Messaging and Apple (push notifications)
• Apple TestFlight and the App Store (distribution of the iOS app)

Within your team, other members see data according to their role (see section 3). We do not pass data on to other third parties unless we are legally obliged to.

6. Transfers to third countries

Some providers (for example Google, Apple, Resend, MongoDB) may process data in the USA. This is based on the EU-US Data Privacy Framework or the standard contractual clauses of the European Commission.

7. Retention

We store your data as long as your account exists. When you delete your account, we delete or anonymize your personal data unless legal retention obligations apply. Server logs are usually deleted after 30 days. Database backups are overwritten after the retention period of the database provider.

8. Your rights

You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21 GDPR). You can withdraw any consent at any time with effect for the future.

You can delete your account yourself in the app under Profile. For anything else, write to boris@bobo23.dev.

You also have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for us is the Austrian Data Protection Authority, Barichgasse 40-42, 1030 Vienna, www.dsb.gv.at, dsb@dsb.gv.at. You can also contact the supervisory authority at your place of residence.

9. Obligation to provide data

Without an account, email address and name we cannot provide the app. All other information (for example positions or jersey number) is voluntary.

10. Minors

The app is aimed at people aged 14 and over. If you are under 18, use it only with the consent of your parents or legal guardians. Parents and guardians can request access to or deletion of their child’s data at any time (contact see section 8).

11. Changes

We update this policy when the app or the legal requirements change. The current version is always available at https://mvc.coach/datenschutz.