Trust & privacy
Plain facts about data and security.
Status as checked on 9 November 2026. We list what is in place, what is in preparation and what we do not have – nothing else.
| Area | Status | Details |
|---|---|---|
| Tenant separation | In place | Every request is authorized on the server and again by database row-level security. Automated tests check every endpoint against every role (rights matrix, run on every change). |
| Data minimization for planning | In place | Practice plans use the team size as a number. No player names are needed. |
| Hosting | In place | Application on Vercel, database on Supabase (Postgres 17) in the US East region (us-east-1). |
| Encryption in transit | In place | HTTPS only; the application connects to the database over TLS. |
| Sign-in | In place | One-time e-mail codes, no passwords. Sessions in http-only cookies. Sign-in codes are never shown in the apps. |
| Operator and support access | In place | The operator console sits behind an additional hosting login. Support access to a club needs a stated reason, is time-limited and logged; it shows aggregated setup data only. |
| Children’s privacy (COPPA) | Test phase | The family app is built with minimal data (first name or nickname, age band), parental consent for under 13 (in the app plus an e-mail link) and progress only on the device. Families can be invited only in our internal test club until release. |
| Payments | Built, not live | Card and invoice (ACH) via Stripe – we never see card or bank numbers. Online checkout opens soon; until then clubs start with us after a live demo. |
| Backups | In place | Daily database backups by the provider (Supabase); the latest backups were checked on 9 Nov 2026. Our own backup-and-restore procedure passed a documented restore test (test data, 79 tables, every row compared). A test restore of a provider backup into a separate database is still to be documented. |
| Privacy policy, terms, DPA | Draft | Published on this site and clearly marked as drafts. |
| Certifications (SOC 2, ISO 27001) | Not held | We do not claim certifications we do not have. |
Questions for your board? Contact us – we answer in writing.