Privacy

Responsibility and contact

The operator and contact for the operation of Squadaroa is:

Bernhard Krenn is responsible for the platform's own technical operation and for handling support requests. Your club decides how member data is processed for club activities. It also determines who within the club may access that data; I provide the technical operation and support.

If you have questions about the app or do not know whom to contact, support can help. Your club can provide information about club membership, the legal basis for club administration and its own retention obligations.

What data is used

Depending on your role and use of the service, the following data in particular is processed:

• Account access: name, sign-in email address, protected password verification value, permissions and notification settings.
• Club activities: personal and contact details, date of birth, family and caregiving relationships, team membership, roles and jersey number. This may also include emergency contacts, dietary preferences, allergy information, internal notes and sporting assessments recorded with the appropriate authorization. Allergy information is health data.
• Organization: games, practices, tournaments and events, including rosters, registrations, attendance responses and related details and comments.
• Files: uploaded photos and documents, including stored earlier versions.
• Operation and security: connection data such as IP address and browser information, sign-in and device identifiers, technical push addresses, and access and change timestamps.
• Support: sender details, the content of your request and any attachments.
• Agreements: user identifier, time, version and text checksum of explicit consent to the terms of use; for separate permission to use club content, the club identifier and the identifier of the user making the declaration are also recorded. No additional IP addresses or browser identifiers are collected for this purpose.

Data may come from you, an authorized caregiver or the club administration. Which details are required for club activities depends on the specific function. You need an account to use the signed-in application. Push notifications and uploading a profile photo are optional.

Stored contacts include, for example, emergency contacts and family relationships entered in Squadaroa by authorized people. The app does not read your device's address book for this purpose. To upload a photo, you select an image or take one yourself; your entire photo library is not uploaded.

What the data is needed for

Records relating to the terms of use serve the performance of the agreement and the legitimate interest in being able to demonstrate permissions granted and resolve disputes (Article 6(1)(b) and (f) GDPR). Personal consents are removed when the user account is deleted; for a club declaration, the user association is removed while the substantive record remains with the club. Related logs and backups are also reviewed when handling deletion.

Squadaroa uses the data for sign-in and access protection, shared club organization, requested notifications, support and the traceability of important changes. Access depends on the respective club and the permissions assigned.

When joining through an invitation link, your details and those of any children you enter are initially stored as separate applications. The club reviews access, caregiving authorization and team requests separately. Responsible coaches and managers see only the application details needed for their teams; club administrators review applications across the club. Other families cannot search these applications or existing children. Registering does not publish personal details or images.

The basis for the security and availability of the platform's own operation and for handling general support requests is Article 6(1)(f) GDPR. The legitimate interests are a reliably accessible service, protection against unauthorized access and resolving errors. Where a request serves the performance or initiation of a contract with you, Article 6(1)(b) GDPR applies.

Voluntarily enabling push notifications is based on your consent under Article 6(1)(a) GDPR. You can withdraw it for the future through the notification settings. You can continue using the rest of the application without push notifications.

Your club is responsible for the purposes and legal bases of processing its member data. This also includes special information in emergency details, free text, documents and the publication of public team pages. Providing the technical platform does not replace this decision by the club.

Squadaroa does not make decisions with legal or similarly significant effects solely by automated means. Sporting assessments are entered by authorized people in the club.

Who can see data

Club administrators, caregivers and members receive the views appropriate to their permissions. Authorized administrators may view data for administration, support and troubleshooting.

A club can explicitly make individual team pages public. These show club and team details, names, jersey numbers, birth years and photos specifically designated for team pages, grouped into players and staff. They also show the club logo, team photo, regular practice times and team links explicitly approved for public display. Private profile pictures are not automatically used for this purpose. Full dates of birth, contact, family, emergency, response and internal assessment data are not shown on these public team pages.

The club must clarify publication and image use with the people concerned or their authorized representatives. Content saved or copied from a public page cannot be recalled by subsequently disabling that page.

Sign-in and storage on your device

A technically necessary session cookie is used for sign-in. Without “Keep me signed in on this device for 30 days”, the session ends after eight hours of inactivity, or after 24 hours at the latest. With this option, it remains valid for no more than 30 days. Signing out, revocation or a password change may end it earlier.

Ending a session does not automatically delete all related security records. Under Security, you can review and end your sessions.

During a browser visit, session storage also holds table sorting settings and information for restoring navigation, scroll position and focus. These support use of the application. The service worker does not create an offline copy of signed-in pages or private API responses. Fonts and interface icons are loaded from the Squadaroa server.

The iPhone app also stores a random installation identifier in the protected keychain. This allows the push setting for that installation to be recognized. This identifier is not used as an advertising identifier.

Push notifications

Push notifications are enabled per device. On iPhone, the app first asks for your permission. You can disable push in Squadaroa or change the permission in system settings.

For iPhone and iPad, Apple's push service receives the technical device address and the notification, including its destination within the app; for Android, Google's Firebase Cloud Messaging receives them. Depending on your setting, the preview may include the type of activity, title, team and date. Children concerned, private comments and internal notes are not added to the preview.

Browser push uses the respective browser's push service; the message is encrypted for this transmission channel. Notifications already delivered may remain on the device after permission is withdrawn.

Technical operation and service providers

The application and its database are hosted by netcup on a server in Vienna, Austria. External backups are stored with Amazon Web Services (AWS) in the Ireland and Oregon, USA regions. The contents of these backups are encrypted before transmission.

The public connection to Squadaroa passes through Cloudflare, Inc., USA. This service processes connection data to route requests and make the application available and protect it.

Cloudflare assigns IP addresses to a country. This approximate origin is processed for traffic statistics and security functions; the application does not request your device's GPS location. Enabled network error reports help identify connection problems. Cloudflare states that no client IP addresses are logged in these reports and that personal details are removed after processing.

Cloudflare Web Analytics is also enabled for squadaroa.com, with automatic measurement of page views and loading performance. The configured EU exclusion prevents visitor data from the European Union from being included in this additional measurement. Outside the EU, data analyzed may include pages visited, browser and device type, country, loading times and rendering metrics. Cloudflare describes this service as operating without personal visitor profiles and without tracking individuals across other websites. Squadaroa does not send its own user identifier for this purpose. The analysis serves technical improvements to accessibility and usability, not advertising. Further information is available in the Cloudflare Web Analytics documentation.

Apple's push service is used for native iPhone notifications. For users in the European Economic Area, Apple identifies Apple Distribution International Limited in Ireland as the responsible entity. For Android notifications, we use Google Firebase Cloud Messaging. Google processes technical installation identifiers and the notification submitted for delivery. Google Analytics is not integrated into the app. For browser push, the delivery service involved depends on the browser, for example Apple, Google, Mozilla or Microsoft.

Messages to [email protected] are forwarded through Cloudflare Email Routing to an Apple iCloud Mail mailbox and handled there. Sender and recipient details, message contents, attachments and technical delivery information are processed in doing so.

We use Brevo to verify your sign-in email address and to send the one-time notification that your club access has been approved. The service receives your email address, the respective message text and technical delivery information. The verification message also contains a single-use verification link. The approval message directs you to sign in without sending children's names, team details or internal club content. Schedule changes and ongoing club notifications are not sent through this email delivery service.

Transfers outside the European Economic Area

Some encrypted backups are stored in the AWS Oregon region in the USA. The use of the other international services may also involve processing outside the European Economic Area (EEA), particularly in the USA. Having the application server in Austria and an additional backup in Ireland therefore does not mean that all processing takes place exclusively within the EEA.

Cloudflare describes its transfer bases and safeguards, including EU Standard Contractual Clauses, in its Data Processing Addendum. AWS provides its GDPR Data Processing Addendum, including Standard Contractual Clauses. Google describes data processing and international transfers in the Firebase privacy information and the contractual terms linked there. Apple explains international transfers and the option to request a copy of its Standard Contractual Clauses in its privacy policy.

For more information about the services and safeguards used for Squadaroa, use the contact above.

Retention and deletion

For parent registrations, cleanup is planned according to these product retention periods: unverified registration starts after 7 days from creation or the last verification email; drafts after 90 days without activity; withdrawn, rejected and fully decided applications after 90 days from the last change. Open reviews and requests for clarification are retained. Deleting copies of applications does not delete approved people, relationships or memberships. An administrative preview is currently available for this; an automatic deletion run is not yet active.

The required retention of club data depends on its purpose, the requirements of the responsible club and any legal obligations. The end of team membership therefore does not automatically mean that earlier participation or club records are deleted immediately.

Archived records and change records currently remain stored. Removing a picture from a profile or archiving a document also does not automatically delete its earlier file versions. Revoked push connections are disabled; their stored records are currently not automatically removed in full.

Local web server logs are configured to rotate daily; the configuration retains 14 older log files. Empty logs are skipped. Logs may contain accessed URLs, including query parameters, and information about the referring page.

The following retention schedule is configured for regular backups: all backup versions from the last two days, plus 14 daily, eight weekly and three monthly versions. Cleanup according to this schedule takes place weekly. Versioning of the backup storage may also retain older object versions until they are cleaned up separately.

Separate backups made before migrations or changes, and historical rollback copies, are not fully covered by this regular schedule. Their continued retention and deletion must be reviewed separately according to the respective recovery purpose. The generation schedule is therefore not a promise that all copies are deleted after three months. The shorter sign-in duration of a user account does not apply to backups.

Support requests are used to handle the matter and clarify related follow-up questions. Whether further retention is necessary depends on the open issue, required records and any applicable retention obligations; club-related content is subject to the requirements of the responsible club.

Verification links are valid for one hour. Local delivery queues store the recipient address and, for verification messages, the verification code in encrypted form and remove them after handover, cancellation or expiry. Other local delivery records are cleaned up after 30 days. The verification time and a verification value for your current address remain stored for account security; changing the address requires a new verification. Delivery logs held by the delivery provider are processed separately.

A deletion request is reviewed individually. The review considers the purpose, identity and authority to represent others, links to other records, third-party rights and retention obligations. Backups are kept separately from the running service and must also be considered when implementing a deletion decision.

Your rights

Under the conditions of the GDPR, you may request access, rectification, erasure, restriction of processing and, where applicable, data portability. Where processing is based on legitimate interests, you may object on grounds relating to your particular situation. You may withdraw consent you have given with effect for the future.

Delete your account

After signing in, you can directly request deletion of your entire account and the associated personal data under Security → Delete account. No additional email request is required. The request covers all clubs linked to your login, including parent registrations not yet approved and details of children you have entered.

Requests are processed manually, generally within one month. We will inform you within that period of any necessary questions or justified extension. Your access remains available until processing is completed. The completion confirmation is sent to the sign-in email address recorded with your request. If certain club data must be retained by law, we will identify the specific data, reasons and periods.

To handle the request, we store your contact address, internal club and person links, and the request status and timestamps. The contact address and associations are removed from the request after completion is documented. A protected deletion record may be necessary for existing backups so that restoring a backup does not bring deleted data back into the running service.

Write to [email protected] about your request. Include the club concerned and your issue. Your identity or authority to represent someone may need to be verified before the request can be handled.

You may also complain to a data protection supervisory authority, in particular the Austrian Data Protection Authority.

Further help is available under Help and contact.