Privacy Policy

Last updated: 14 August 2026

WeBall Club (“we”, “us”, the “app”) helps grassroots football groups organise games, balance teams, RSVP, and track results. This policy explains what we collect, why, and your rights. We are the data controller: WeBall Club Ltd, a company registered in England and Wales (company no. 17294178), registered office 232 Brick Lane, London, England, E2 7EB, United Kingdom, contact admin@weballclub.com.

What we collect

We only collect what's needed to run the app:

• Account — your email address (for sign-in via our auth provider). Your password is set by you and stored, hashed, by the auth provider; we never see it.
• Profile — your name, nickname, self-rated skill level, preferred positions, favourite club (optional), and (optionally) a profile photo you upload. Because a profile picture must show a single clear face, the app runs an automatic face check on your device before uploading; it only looks for the presence and position of a face, it does not identify or recognise you, and the picture is not sent anywhere for that check. If no face is found the photo is simply not uploaded.
• Phone number — required at sign-up so game organisers can contact you about matches. It is visible to the organisers and admins of games and groups you join, not on your public profile.
• Date of birth — required at sign-up to confirm you are 13 or over. We store it and use it to derive your age; it is not shown on your public profile.
• Communications — messages, polls, reactions, and any images or videos you send in your group's chat. Chat media is stored privately: it can only be opened by members of that chat, through short-lived links the app requests for you, and by our staff for moderation (below).
• Activity — the games you create, organise, or RSVP to; team and line-up assignments; payment/attendance tracking; and recorded results within your group(s).
• Group membership — which group(s) you belong to and your role in them.
• Payments — when you pay a match fee, team charge, or tournament entry, we store the amount, what it was for, and whether it succeeded. We never receive or store your card details — card entry happens inside Stripe's own secure payment sheet (see “Who can see your information” below). If you set yourself or your club up to receive money, Stripe collects your identity and bank details directly for its own verification and payout obligations; those never pass through us.
• Location — only if you allow it, and only while you are using the app. We use your approximate/precise position to centre the venue map when you pin a pitch, and to sort nearby games, clubs, and tournaments by distance. We do not store your location and we never track it in the background — it is used for the request at hand and then discarded. Distance filtering happens on your device. When you search for a venue, your approximate position is sent to Google Places to bias the results (see below). You can decline the permission and the app still works — venue entry falls back to typing an address.
• Technical — a session token to keep you signed in, and basic logs needed to operate and secure the service. If you submit a support report or report content, we attach your app version, platform, and OS version so we can reproduce the problem.

We do not use third-party advertising or analytics SDKs, we do not track you across other apps or websites, and we do not sell your data.

How we use it

• Provide the service: schedule games, send in-app notifications, balance teams from skill ratings, and compute your stats.
• Take and settle payments for match fees, team charges, and tournament entries, and handle refunds.
• Show you nearby games, clubs, and tournaments, and help you find a venue — only while you are using the app, and only if you granted location permission.
• Keep your account secure and the service working.
• With your explicit opt-in only, send occasional product emails (off by default; change it in Settings).

Legal bases (UK GDPR): performing our contract with you (running the app, and taking payment where you choose to pay through it), your consent (optional marketing, profile photo, and location — each of which you can refuse or withdraw), our legal obligation to keep financial records, and our legitimate interest in keeping the service secure. We do not use your data for any automated decision-making that produces legal or similarly significant effects — the Team Builder's auto-balance feature only sorts self-rated skill levels into sides and never affects your account, and you can always build teams manually instead.

Cookies & similar technologies

The WeBall Club app does not use cookies. This website sets no analytics, advertising, or tracking cookies either — it only loads the Saira and Plus Jakarta Sans typefaces from Google Fonts, which may receive your IP address as a normal part of that request. We do not use any other third-party scripts on this site.

Who can see your information

• Your group(s): other members of a group you join can see your profile (name, nickname, rating, positions, photo) and your game activity within that group. Anyone with a group's invite code can join it, so only share codes with people you trust.
• Service providers (processors): we host the app's database, authentication, file storage, and serverless functions with Supabase (our sub-processor), with data hosted in London, United Kingdom. Push notifications are relayed through Expo's push notification service and then Apple's (APNs) or Google's (FCM) own push services, which receive only a device push token — never your account content.
• Payments (Stripe): payments and payouts are processed by Stripe. When you pay, your card details go directly to Stripe and never reach our servers. When you or your club set up to receive money, you complete Stripe's own onboarding, providing your identity and bank details to Stripe directly; we only ever see whether your account is verified and able to accept charges and payouts. Stripe acts as an independent controller for that information — see stripe.com/privacy.
• Maps & venue search (Google): when you search for a venue or drop a pin on the map, the search text and (if you have granted the permission) your approximate position are sent to Google Maps Platform / Google Places to return matching places and address labels. Google processes this under its own privacy policy — see policies.google.com/privacy.
• Legal: we may disclose information if required by law, to enforce these terms, or to protect the rights, safety, and security of WeBall Club, our users, or the public.
• WeBall staff (moderation): uploaded photos and videos — profile pictures, club/group logos, and images or videos sent in group chats — can be reviewed by WeBall staff for safety and moderation, and removed if they breach our guidelines. Every removal is recorded in an internal audit log. Profile pictures must show a single clear photo of your face.

Storage, security & retention

Your data is encrypted in transit and hosted in the UK. We keep your data for as long as your account is active and as needed to provide the service. You can permanently delete your account at any time in Settings → Delete account, which removes your profile, stats, and personal data (some group game records, such as final scores, may be retained in anonymised or aggregated form so other members' history stays intact). Payment records are an exception: where you have paid or been paid through the app, we must keep the transaction record — amount, date, and what it was for — to meet UK tax and accounting obligations, normally for six years. Stripe keeps its own records under its own policy. If you can't access the app, see how to request deletion another way. We aim to complete deletion requests without undue delay and within one month, as required by UK GDPR.

Your rights (UK GDPR)

Under UK data protection law you have the right to request access to, correction of, export of, or erasure of your data, and to object to or restrict certain processing, and to withdraw consent at any time (this won't affect processing already carried out). Use Settings → Delete account, our account deletion page, or email admin@weballclub.com — we'll respond within one month. You also have the right to complain to the UK's data-protection regulator, the Information Commissioner's Office (ICO), at ico.org.uk or 0303 123 1113, though we'd welcome the chance to address your concerns first.

Children

WeBall Club is intended for users aged 13 and over; anyone younger must not create an account. If we learn that a child under 13 has provided us data without appropriate consent, we'll delete it promptly — contact us at admin@weballclub.com.

International transfers

Our primary hosting (Supabase) keeps your data in the UK. Where a service provider processes data outside the UK — our push-notification relay, Stripe for payments, and Google for maps and venue search — we rely on that provider's safeguards, such as the UK's International Data Transfer Addendum to the EU Standard Contractual Clauses, or an equivalent adequacy decision, to ensure your data stays protected.

Deleting your account

The quickest way is in-app: Settings → Delete account. If you no longer have access to the app or your device, visit our account deletion page for another way to request it.

Changes

We'll update this page and the “Last updated” date when this policy changes; significant changes will be highlighted in the app.

Contact

Questions or requests: admin@weballclub.com, or by post to WeBall Club Ltd, 232 Brick Lane, London, England, E2 7EB, United Kingdom.