Privacy Policy

itsfootball.club is run from New South Wales, Australia (“we”, “us”). You can contact us about privacy at contact@itsfootball.club.

This policy explains how we handle personal information under the Australian Privacy Principles in the Privacy Act 1988 (Cth) and, for people in the United Kingdom, the UK GDPR and Data Protection Act 2018.

itsfootball.club is a platform that football clubs use to run their own websites and admin. That means two different organisations look after different parts of your information:

• Your club decides what it records about its members, players and supporters (your squad profile, membership, payments to the club, attendance, stats) and who in the club can see it. For those records the club is responsible for your information (in UK GDPR terms, the “controller”) and we store and process it on the club’s behalf.
• We are responsible for your itsfootball.club account (your email and sign-in), the platform’s own visit statistics, security logs and the emails we send about the platform.

For questions about what a club holds about you, contact the club first (every club page has a contact form). If you can’t reach them, email us and we’ll help.

Account details. Your email address and, if you set one, a password (stored only as a secure hash). Most people sign in with a one-time link sent by email.

Member and player profiles, entered by you or by your club: name, email, phone number, photo, date of birth, nationality, playing position and shirt number, height, weight, preferred foot, emergency contact, membership type and status, membership application notes and any committee role.

Club activity. Availability replies, lineups and matchday squads, match statistics, ClubScore points and the activity behind them, check-ins at matches and events (including the time of each scan of your member pass), event registrations and tickets, messages you send to your club and messages sent through a club’s contact form or sponsor application form.

Payments. When you pay a club, we record your name, email, what you paid for, the amount and the payment reference. Card details are entered directly with Stripe and never reach our servers. If a club accepts bank transfers, we store the receipt you upload.

Visit statistics. When you view a club’s pages we record the page, the referring site and a random visitor ID kept in your browser, so clubs can see how many people visit. When you click a sponsor’s link we also record your device type and country (worked out from your connection, not your precise location). We don’t use third-party analytics or advertising trackers.

Notifications and email. If you turn on notifications, your browser’s push subscription. For every email we send, a record of the recipient, type and subject, and any unsubscribe choices you make.

Technical information. Your IP address and browser details are processed by our hosting provider to deliver the site, keep it secure and limit abuse.

• To run the platform: sign you in, show club pages, run the match centre, passes, check-ins, tournaments, shop and payments.
• To let your club manage its membership, squad, events, finances and communication with you.
• To send the emails and notifications you or your club have asked for (sign-in links, receipts, membership renewals, match, event and news updates). Club update emails always include an unsubscribe link.
• To keep the service secure, prevent fraud and spam, and fix problems.
• To meet legal obligations, such as keeping payment records.

Club websites are public. A club can choose to show its squad (names, photos, positions, nationality and statistics), its committee, match lineups, events and news, and those pages may be found by search engines and AI assistants.

Your date of birth, email, phone number, emergency contact, payments and messages are never shown on public pages; only the people your club gives admin access can see them. If you don’t want to appear on a club’s public pages, ask the club to remove you.

We don’t sell personal information and we don’t show ads. We share it only with:

• Your club’s admins, for the club records described above.
• Supabase: our database and sign-in provider.
• Cloudflare: website hosting, security and storage of uploaded files such as photos and receipts.
• Stripe: card payments, paid into the club’s own Stripe account. Stripe handles your card under its own privacy policy.
• Resend: delivery of our emails.
• Browser push services (run by Apple, Google or Mozilla, depending on your browser) to deliver notifications you turned on.
• Google, when a club page shows its ground on an embedded Google Map, and YouTube, when a club article includes a video (we use YouTube’s privacy-enhanced mode). These load from Google’s servers, which receive your IP address.
• Authorities, where the law requires it.

Our database, which holds accounts and all club and member records, is hosted in Sydney, Australia.

Some providers handle information outside Australia as part of their service: Cloudflare delivers the site through its global network and stores uploaded files, and Stripe, Resend, browser push services and Google may process information in other countries, including the United States. Where information leaves the UK, we rely on our providers’ standard data protection terms. We choose providers that protect information to a standard comparable to Australian and UK law.

We use a small number of cookies and browser storage items, all needed for the site to work or to remember your choices:

• Your sign-in session, so you stay signed in.
• Your light or dark theme choice.
• The random visitor ID used for visit statistics (described above).
• Display preferences, such as how the squad list is shown.
• An offline copy of pages, if you install the site as an app on your phone.

We don’t use advertising or cross-site tracking cookies. You can clear these at any time in your browser settings.

• Your account: until you delete it.
• Club records: for as long as the club keeps them. When you delete your account, your club’s records about you (such as your squad entry, payments and attendance) stay with the club but are no longer linked to your account; ask the club if you want them removed.
• Payment records: as long as the law requires (in Australia, generally five years for financial records).
• Visit statistics and security logs: only as long as they’re useful for running the service.

You can ask to see the personal information held about you, to correct it, or to delete it. You can:

• Delete your itsfootball.club account at any time from My Clubs.
• Unsubscribe from club emails using the link in any of them, and turn off notifications in your browser.
• Ask your club to update, correct or remove your member details and the other records it keeps (club admins manage these).
• Email us at contact@itsfootball.club for anything else. We’ll reply within 30 days.

If you’re in the UK you also have the right to object to or restrict how your information is used and to receive a copy in a portable format.

If you’re unhappy with how we handled a privacy concern, tell us first so we can fix it. You can also complain to the Office of the Australian Information Commissioner or, in the UK, the Information Commissioner’s Office.

Many clubs have junior players. A club that records a child’s details, photo or statistics is responsible for having the consent of the child’s parent or guardian. Children under 13 shouldn’t create their own account; a parent, guardian or the club should manage their details. If you believe a child’s information is on the platform without that consent, contact the club or email us and we’ll act on it.

All traffic to the site is encrypted, each club’s records are only available to that club’s admins, and card payments are handled by Stripe. No system is perfectly secure, but if a data breach is likely to cause you serious harm we’ll notify you and the regulator as the law requires.

We’ll update this page when our practices change and show the date at the top. For significant changes we’ll also tell club owners by email.