Privacy Policy

Last updated: 12 Oct 2026

FootSkiller ("we", "us", "the app") is a football training platform for players, parents, coaches, club secretaries and clubs. This policy explains what personal data we process, why, who we share it with and what rights you have. The data controller is the operator of the FootSkiller app. Privacy contact: info@footskiller.eu.

What we process

• Player registration: first and last name, username (nick), date of birth (used to show lessons suitable for the player's age and to determine whether a guardian's consent is needed; it is not shown to any other user or on leaderboards in the app; only the platform administrator and the coaches and secretary of the player's club have access to it), email, password (stored only as a hash), app language and a record of agreeing to the terms (when and which version). A player registering with a club key does not have to give an email; a technical address is created.
• Parent, coach and secretary registration: name, email, phone, password (hash) and, for parents, the relationship to the child and the app language (used for the language of emails).
• Profile details a player can add: phone, shirt number, country, favourite club, social media links (Instagram, TikTok, Snapchat, Facebook, YouTube), profile photo and chosen theme. Coaches, secretaries and administrators can also add position, shirt number and team.
• Training data: lessons watched, XP, streaks, progress statistics, assigned trainings and answers to the onboarding questionnaire (age group, skill level, experience, whether the player trains at a club).
• Membership and payments: chosen plan and currency, membership period, payment outcome, Stripe customer and subscription identifiers and a record of the consent to immediate access. We never see or store card numbers.
• Goods orders: name, delivery address, phone (optional), ordered items, order status and tracking number.
• Invitations and activation keys: the invitee's email, the player's or parent's name and an invitation note.
• Notifications: the text of in-app and push notifications (system ones and ones written by a coach, secretary or administrator) and, in the mobile app, the device token used to deliver push notifications.
• Technical data: IP address (rate limiting and security), language, and page performance measurement without cookies. A country derived from the request header is only used to pick a language and is not stored.
• Content reports: when someone reports an inappropriate nick or photo of a player (the "⋯" menu next to a player on a leaderboard), we store the player, the reporter (if signed in), the reason and a short note. Only the administrator and the secretary of the player's club can see reports; they can hide the nick or delete the photo. The report is deleted together with the player's account.

Why we process it and on what basis

• Performing the contract: running your account, providing training content and progress tracking, managing membership and payments, delivering goods, and emails about these services (payment confirmations, membership expiry reminders, invitations).
• Legal obligation: keeping accounting and tax records.
• Legitimate interest: securing the app, preventing abuse (including of the referral programme) and measuring page performance.
• Consent: push notifications (after you allow them on your device; you can turn them off at any time in the phone settings) and processing the data of people under 15 (consent of a legal guardian).

Children and parents

The app may be used by players under 18, typically through a club. A person under 15 may create an account only with the consent of a legal guardian. A parent account lets a parent follow the child's progress and manage their membership. A legal guardian can at any time ask for access to, correction or deletion of the child's data at info@footskiller.eu.

Who can see your data in the app

• Other players: on leaderboards (team, club, global and by country) they see your nick (or only your first name if you have no nick or a moderator hid it; we never show other players your surname), profile photo, XP and number of lessons. A player profile that a logged-in user has a link to shows the nick or first name in the same way, photo, country, club, team, position, XP and any social media links the player added.
• Coach: players of their teams, including name, email, nick, shirt number, country and progress.
• Club secretary: players and parents of their club, including contact details (email, phone).
• Parent: their children's data and progress, and team leaderboards.
• Operator: all data, including orders and delivery addresses.

Who we share it with (processors)

• Stripe — payment processing and subscription management.
• Supabase — database, authentication and file storage (profile photos and generated player cards).
• Vercel — app hosting and page performance measurement.
• Resend — email delivery.
• Google (Firebase Cloud Messaging) — delivering push notifications to the mobile app (device token and notification text).
• Cloudflare Stream — training video hosting; videos load from Cloudflare when played, so it receives the viewer's IP address.
• Upstash — short-lived counters that limit request rates, storing an IP address for minutes to hours.
• Unsplash and flagcdn.com — on some pages your browser loads a background image and language flags from these services, which therefore receive your IP address.

Some processors are based or process data outside the EU (notably in the USA). Transfers rely on mechanisms under the GDPR, namely adequacy decisions or standard contractual clauses. We do not sell your data or use it for targeted advertising.

Cookies and on-device storage

We use only strictly necessary items, for which consent is not required: login cookies, a language cookie (1 year), a helper cookie with verified membership (24 hours), for coaches a selected-team cookie (24 hours), in the mobile app the last role stored for a faster start, and an offline page cached by a service worker. We do not use advertising or third-party analytics cookies. Stripe sets its own cookies on its payment page.

How long we keep data

We keep data for as long as your account exists. A player or parent can delete the account in the app (Profile → Password → My data and account deletion) or ask for it at info@footskiller.eu. The account is deactivated immediately and the recurring payment cancelled; after 14 days, during which the deletion can be cancelled using the link in the email, we permanently delete the account and related data (progress, notifications, photos, parent and team links). Before that you can download an export of your data. What we must keep by law: payment records (with the payment processor, for the period set by accounting and tax rules) and, for shipped orders, delivery details (name, address, phone) for 24 months after shipping to handle complaints, after which we wipe them. Rate-limit counters are kept for minutes to hours and push tokens until sign-out or until they become invalid.

Your rights

You have the right of access, rectification, erasure, restriction of processing, data portability, the right to object to processing based on legitimate interest and the right to withdraw consent. Send requests to info@footskiller.eu; we will reply within one month and may ask you to verify your identity. You also have the right to lodge a complaint with the Czech Office for Personal Data Protection (Pplk. Sochora 27, 170 00 Prague 7, www.uoou.gov.cz) or your local supervisory authority.

Security

Communication with the app is encrypted (HTTPS), passwords are stored only as hashes, access to data is limited by role, and payment data is handled exclusively by Stripe.

Changes to this policy

We may update this policy. We will notify you of material changes by email or an in-app notice.