We collect the following categories of personal information when you use GoClubPro:

• Identity & contact: Full name, email address, mobile phone number, username.
• Account security: Hashed password (never stored in plain text), multi-factor authentication secrets.
• Sign-in with Google or Apple: If you choose to sign in with Google or Apple instead of a password, that provider tells us your name, your email address, and whether the email is verified. We never receive your password for those accounts. Where a Google-verified email matches an existing GoClubPro account, the two are linked so you return to your own account rather than creating a second one.
• Club membership: Club association, team membership, role (e.g. Player, Coach, Club Admin).
• Activity data: Fixture availability responses, training attendance, event RSVPs, squad selections.
• Financial data: Payment status for fixtures, training, events, and season registration fees; fine records; wallet credit balances. Payments may be declared (e.g. bank transfer) and verified by your club treasurer, drawn from wallet credit, or paid by card through Stripe. We never receive or store your card details — card data is entered on Stripe’s own checkout page and stays with Stripe. We retain only a reference to the Stripe transaction so the payment can be reconciled against your club’s ledger.
• Health information: Injury status and estimated return-to-play date, if entered by authorised club staff.
• Family relationships: Guardian–dependent links when a family account is configured.
• Performance statistics: Match stats entered by coaches (e.g. goals, assists) for sports that support it.
• Carpool coordination: Pickup location text you enter when offering or joining a carpool for a fixture, visible to other members coordinating that ride.
• Files you upload: Receipt images or PDFs you attach to an expense claim, and any club logo or profile image you upload. These are stored in our hosting provider’s file storage and are visible to you and to the club staff who review claims. A receipt often shows more than the expense it evidences — an address, a card or account number, unrelated purchases — so please upload only what your treasurer needs in order to approve the claim.
• Push notification tokens: Device tokens for in-app alerts; not used for tracking.
• Usage data: Standard server logs (IP address, browser type, pages visited), retained for up to 90 days.
• Error diagnostics: If enabled for your environment, technical error reports (e.g. stack traces, the page you were on) sent to our error-tracking provider to help us fix bugs — not used for tracking or advertising.

• Managing your club membership, availability, and squad participation.
• Processing and tracking payments, fines, and registration fees.
• Sending transactional notifications (fixture alerts, payment reminders, push notifications).
• Enabling family account management for guardians and their dependants.
• Displaying performance records and career statistics to you and your coaching staff.
• Supporting injury management and return-to-play planning by authorised club staff.
• Maintaining security of your account (authentication, MFA, session management).

We do not sell your personal data to third parties, use it for advertising, or share it outside your club except as described in Section 4.

Where applicable under data protection law (including Australia’s Privacy Act 1988 and the GDPR for users in the EU/UK), we process your data on the following grounds:

• Contract performance: to deliver the club management services you or your club have signed up for.
• Legitimate interests: to maintain security, prevent fraud, and improve our services.
• Consent: for push notifications — you may withdraw consent at any time in your device settings. Injury status is sensitive information under the Privacy Act, and is only entered by authorised club staff with the player’s (or their guardian’s) consent, not collected automatically.
• Legal obligation: where we are required to retain records by applicable law.

Your data is shared only in the following circumstances:

• Within your club: Club Admins, Coaches, Selectors, and Treasurers can view member data relevant to their role.
• Sign-in providers (Google, Apple): If you sign in with Google or Apple, that provider confirms your identity to us and necessarily knows that you signed in to GoClubPro. We send them no other information about you, and we do not sign you in this way unless you choose it.
• Email delivery: We use Resend to send transactional emails. Resend acts as a data processor under a data processing agreement.
• Push notifications: We use Firebase Cloud Messaging (Google). Your device token is transmitted to Firebase solely to deliver notifications.
• Database hosting (Supabase): Your data is stored in a Supabase-managed PostgreSQL database hosted on AWS infrastructure. Supabase acts as a data processor under a data processing agreement.
• Application hosting (Vercel): The application is served via Vercel’s global edge network. Request metadata (IP address, headers) may pass through Vercel infrastructure. Vercel acts as a data processor under a data processing agreement.
• Card payments (Stripe): Where your club has connected Stripe, card payments are processed by Stripe as an independent controller of the card data and a processor for the transaction details we send (amount, your name and email, and what the payment is for). Card numbers are collected by Stripe directly and never pass through our systems. Your club is the merchant of record and provides its own bank details to Stripe, not to us.
• Error tracking (Sentry): Where enabled, technical error reports are sent to Sentry to help us diagnose and fix bugs. Sentry acts as a data processor under a data processing agreement.
• Legal requirements: We may disclose data if required by law or to protect the rights and safety of our users.

We retain your personal data for as long as your account is active or as needed to provide the service. When a member is removed at a club admin’s request, personal identifiers (name, email, mobile) are anonymised rather than deleted, preserving non-identifying activity history such as match statistics. Server logs are retained for 90 days.

Depending on your location, you may have the following rights:

• Access: Request a copy of the personal data we hold about you.
• Correction: Ask us to correct inaccurate or incomplete data.
• Erasure / Anonymisation: Request that your personal identifiers be removed from our records.
• Restriction: Ask us to limit processing in certain circumstances.
• Portability: Request an export of your data in a machine-readable format.
• Objection: Object to processing based on legitimate interests.
• Withdraw consent: Withdraw consent for push notifications via your device settings at any time.

To exercise any right, contact your club administrator or email us at the address in Section 8.

We implement industry-standard measures to protect your data, including:

• TLS encryption for all data in transit.
• Bcrypt hashing for stored passwords.
• Optional multi-factor authentication (TOTP) for your account.
• Role-based access controls limiting data visibility to authorised staff.
• Secure, httpOnly cookies for session management.

No method of transmission or storage is 100% secure. If you suspect a security issue, please contact us immediately.

For privacy enquiries, data access requests, or complaints, please contact:

GoClubPro Privacy Team
Email: support@goclubpro.com

If you are in Australia and are not satisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC).

We may update this policy from time to time. The “Last updated” date at the top will reflect any changes. Continued use of the app after changes constitutes acceptance of the updated policy.