Privacy policy

1. Introduction

This privacy policy describes how Volley DATS ("the App") processes the data entered by users, in line with the principles of Regulation (EU) 2016/679 ("GDPR"). The App is a scouting, statistical analysis and organization tool for volleyball teams, designed according to the "offline-first" principle: it works entirely on the device without needing any account. Those who wish to can activate an OPTIONAL account to sync their data across multiple devices and share a team with other people: this policy explains what changes in that case (points 5 and 6).

2. Who is the data controller

The data controller for the players' data is the user who uses the App (for example the coach, the manager or the sports club): they decide which data to enter, for what purposes and for how long to keep it, and they are the point of reference for players who wish to exercise their rights.

If the account is not used, the App does not transmit data outside and the developer (NB DEV) neither processes nor can access the data entered. If the account is activated, the synced data passes through the cloud service described in point 5: the developer, as technical manager of that service, can access it for the purposes and within the limits described in point 6.

3. Which categories of data the App handles

Depending on the features used, the App may store:

• Team data — team name
• Players' personal data — first name, surname, jersey number, date of birth (with calculated age)
• Contact data — email address and phone number
• Physical data — weight, height, jump and calculated BMI
• Health data — medical certificate in PDF and its expiry date; "Injury" and "Illness" attendance statuses in training sessions. These are data belonging to special categories (art. 9 GDPR), which require particular care
• Sports data — scouting actions, ratings, statistics, call-ups and attendance
• Organizational data — calendar events with dates, times, places (gyms, addresses), referee assignments and notes
• Video references — YouTube links or the path of local video files
• Account data (only if activated) — email, password (never in clear: handled by Supabase Auth), or Google identifier in case of sign-in with Google; role (coach/athlete/guest) with role details (staff role, club, dominant hand, previous teams, relationship to the team, reference team), first name, surname, date of birth, height, city, phone, profile photo — all optional, entered in the profile
• Team chat messages (only if the chat is used) — the text of the messages written, with the author's first and last name, date and time
• Change proposals (only if used) — the data concerned, the current and proposed values, any note and the status, with the author's first and last name and date
• Trash (only if items are deleted) — a copy of the deleted items (matches, calendar events, sheets, exercises, teams) with the deletion date, kept for the chosen period

4. Where the data is stored

Without an account, all data remains exclusively local, on the device in use:

• matches in an SQLite database (or localStorage in the web version)
• calendar, team profile and medical certificates in the application preferences
• local video files stay where they are on the device: the App saves only the path

If the account is activated (point 5), a copy of these same data is also saved on the cloud server, so that it can be found on other devices. The server is located in the European Union (Ireland). Without an account, the App performs no cloud synchronization and sends no data to the developer's or third parties' systems.

With an account, the service also keeps the synced data in structured form (lists of teams, roster, matches, actions, events, sheets, catalog and settings), so it can be consulted for support: they are the same data as the backup copy, not other data. Images (medical certificate PDFs, exercise photos and GIFs) stay only in the backup copy.

5. Optional account and cloud sync

The account is NOT mandatory: without an account the App works exactly as described in the previous points, data included.

Whoever creates an account (email/password or Google sign-in) can:

• sync their data (teams, matches, calendar, sheets) across multiple devices, through the Supabase service (hosting in the EU, which acts as data processor on behalf of the developer)
• share one of their teams online by generating a code, so that other people can follow it (point 6)

The synced data is protected by authentication and by server-side access rules (only the account owner, whoever received the team code, and the service administrator can read it — see point 6). The account and all the cloud data linked to it can be deleted at any time from Account → Delete account: the operation is immediate and permanent. Data left only on the device is not affected by this deletion and remains manageable as per point 11.

Trash: deleted items (matches, events, sheets, exercises, teams) go to the Trash (Settings → Trash) and can be restored, always as new copies, for 7, 15 or 30 days of your choice; then they are deleted automatically. With an account, a copy of the Trash is also saved on the server, so you can find it from another device.

Profile photo: if you sign in with Google, your Google profile photo is copied once into your space on the service (only if you don't already have your own) and used as your profile photo; you can change or remove it at any time and it is not downloaded again.

Action log: for security and support, the server records the main actions on accounts and teams (who, when, what and on which team: for example sign-in, team created, member joined, suggestion accepted). It never records message text or data values, and entries are deleted automatically after 18 months. Only the administrator can read it.

6. Sharing the team with other users

A coach who shares a team online generates a code: whoever uses it to "follow" the team, even without having an account (in that case they join as a guest, identified only by a random technical code, with no email or other personal data), becomes a follower. A new follower sees nothing until the owner allows it: the owner chooses, follower by follower, whether they can see the team data, all the sheets, comment, write in the chat or propose changes, and can block or remove them at any time. Whoever is allowed to see the data sees, read-only, ALL the data of that team as entered by the coach — including contacts, physical data and medical certificates of teammates. There is no selective masking of sensitive data: it is a choice of total transparency within the team group, which the owner must consider before granting the permission and about which they must inform the team. A follower cannot modify anything: only the owner writes the team data. With the relevant permission, a follower can write in the team chat (messages are visible to all members of the team, with the author's first and last name) and propose changes to the data (scores, match details, players' name, number, role and height, calendar events; never health or contact data): the proposal, with the first and last name of whoever makes it, is visible to all members of the team and the data changes only if the owner accepts it.

The coach can add whoever follows them to the roster, linking them to a player or a staff member, and can move them back to simple follower at any time. Only people with an account can be added to the roster: guests without an account can only follow.

A single administrator account, reserved for the developer for the technical management of the service (support, security, troubleshooting), can access in read mode and — only with explicit and repeated confirmations — correct the data of any team, with the same information available to the owning coach. This access is never automatic or continuous: it happens only when the administrator deliberately opens that team.

For the same purposes the administrator can also read, read-only, the team chat and the change suggestions of any team, and can post in the chat a service message signed "Administrator", clearly distinct from the others.

7. Responsibility of those who enter data

Whoever enters data of third parties (players, staff, referees) must be entitled to do so. In particular:

• inform the players that their data is managed through the App, and possibly synced or shared online with those who follow the team (points 5 and 6)
• for minor players, obtain the consent of whoever exercises parental responsibility, also for any online sharing
• for health data (medical certificates, injuries, illnesses), make sure to have a suitable legal basis, as these are special categories of data
• do not share the data with unauthorized parties

8. Sharing and manual export

Besides the online sharing described in point 6, no data leaves the App automatically. Data leaves only upon the user's explicit action, through:

• exports in JSON, Excel or PDF
• sharing of images (player statistics, calendar plans)
• full backup
• printing or sharing of the medical certificate

Once exported or shared, the data is no longer under the App's control: its protection depends on the channels chosen by the user (email, messaging, cloud storage, physical media, etc.).

9. Third-party services

Some features open or rely on external services:

• Supabase — if the account is used, it hosts authentication, synced data and the profile photo (EU hosting)
• Google Sign-In — if you choose to sign in with Google, for authentication
• YouTube videos — playback takes place through YouTube, subject to Google's terms and privacy policy
• Google Calendar — the "Add to calendar" button opens the Google Calendar site with the event data pre-filled
• Email and phone clients — tapping a contact's email or number opens the device's default app
• Firebase Cloud Messaging (Google) — if you turn on team alerts, delivers push notifications to the phone

In these cases the privacy policies of the respective providers apply. The App transmits to these services only the minimum data necessary to provide the requested feature.

10. Device permissions and notifications

The App accesses the device's files exclusively through the system picker, and only when the user starts an operation (import/export, choosing a photo, a PDF or a video). There is no background access to camera, microphone, location, contacts or storage.

Reminder notifications (events, birthdays, certificate expiries, attendance) are local: they are scheduled and shown entirely on the device.

Team alerts: with an account, the App can receive push notifications (a training sheet assigned to you, suggestions and their outcome, chat messages, new followers or requests, team updated). To deliver them the service stores an anonymous device identifier (token) and the notifications go through Google's Firebase Cloud Messaging; they only contain the alert text. They can be turned off by type and by team in Settings → Notifications. The token is deleted when you sign out or delete your account.

11. Retention and deletion

Local data stays on the device until the user deletes it. For deletion:

• single items — can be deleted individually (matches, events, players, certificates)
• all local data — "My Data → Data Management → Delete all data" deletes matches, calendar with attendance, team profile, roster, medical certificates, training sheets and exercise catalog
• cloud data and account — "Account → Delete account" permanently deletes the account and all data synced to the server (shared teams, data published for followers); messages and proposals written in the team chat remain, anonymously
• alternatively, by uninstalling the App (removes only local data, not what may already have been synced)

Backups and exports created by the user remain where they were saved and must be deleted separately.

• Trash — deleted items stay in the Trash for the chosen period (7, 15 or 30 days), then they are deleted; you can delete them earlier, one by one or by emptying the Trash
• safety copy — with an account, an item leaving the Trash (deleted, emptied or expired) stays in a safety copy on the service for 90 days, solely so it can be recovered at the user's request (by writing to the contacts in section 16), then it is deleted automatically; "Account → Delete account" also deletes these copies and the Trash on the service
• "Delete all data" also empties the Trash on the device; copies already on the service follow the same timing (Trash up to 31 days, then 90 days of safety copy)
• action log — the security log (point 5) deletes itself after 18 months; it also holds the account email, which stays in the log for that period even after "Delete account"

12. Security

Local data is protected by the device's security measures. It is recommended to protect the device with a PIN, biometrics or password and to keep its system up to date, especially if it contains players' health data. The App applies no additional encryption of its own to local data.

Cloud data (if the account is used) is protected by authentication and by server-side access rules that limit reading to those actually linked to the team and authorized by the owner (the owner, whoever follows it with the code and has permission to see the data, service administrator); writing the team data is reserved to the owner.

13. Minors

The App is intended for use by adults (coaches, managers, staff). The data of minor players may be entered only in compliance with point 7 (consent of parents or guardians), even when the team is shared online or followed by other users (point 6).

14. Rights of data subjects

Players whose data is managed in the App can exercise the rights provided by arts. 15-22 of the GDPR (access, rectification, erasure, restriction, objection) by contacting whoever manages the device or the account, that is the data controller indicated in point 2. Without an account, the developer cannot intervene on the data, as they have no access to it; for cloud data they can do so on request, within the technical limits of the service.

15. Changes to this policy

The policy may be updated along with the App, for example if new features that process data are introduced. The current version, with the date of last update, can always be consulted from this page and from the App (Settings → About).

16. Contact

For any question about this policy or about how the App works regarding data:

NB DEV — nbdevcode@gmail.com