What we collect and why

What we collect

• Identity: name, email, optional mobile number, and a password we store only as a hash. Or a sign-in from a social provider, from which we keep the provider's user id, your email and display name.
• Eligibility: your affirmation that you are an adult.
• Soccer profile: positions, experience, self-rating, preferred division, maximum travel distance, kickoff preferences.
• Geography and availability: the cities you selected and your weekday time windows. We do not collect your precise location.
• Payment: the amount, status, and our payment processor's reference. Card details never touch our servers.
• Activity: attendance answers, games played, substitute offers, captain assignments, messages, incident reports, and a reputation ledger derived from them.
• Technical: IP address and browser on sign-in, request logs with a correlation id, and an audit trail of decisions that affect you.

Why

To match you with players near you at times you can play, book fields, form balanced teams, fill absences fairly, run games safely, and resolve conduct reports. We use your email and phone only to tell you about your registration and games. We do not sell or share personal data for advertising.

Who sees what

• Other players see your first name and last initial, your position, and your attendance status for a shared game. Never your email or phone number.
• Contact details typed into messages are removed automatically.
• Administrators see your full record when reviewing payments, conduct reports or technical problems. Every such access is logged.
• Venues receive a headcount and a schedule. Never a list of names.
• Service providers — payment processing, email delivery, weather data — receive only what they need to do that job.

Your rights

From your profile you can download everything we hold about you as a file, and you can delete your account. Deletion removes your name, email, phone, password, availability, areas and profile text, and anonymises your messages. Game history is kept in anonymised form so other players' records stay consistent. Payment records are retained as required by law and our processor.

Retention

Sessions expire after 30 days of inactivity. Logs and background-job records are pruned within a few weeks. Conduct reports are retained while an account exists and for 6 months after so repeat patterns can be identified.

Security

Passwords are hashed, session tokens are stored hashed, transport is encrypted, webhooks from our payment processor are signature-verified, and administrative actions are audited.

Contact

Questions or requests about your data: privacy@localfc.club. — Weeknight FC