Privacy notice
Draft, not yet in force. Last updated 17 October 2026. Items marked [TO CONFIRM] are settled before any pilot team signs up.
MatchSheet keeps a private record of your team's matches: who played, for how long, in which position, and who scored. This notice explains what we hold, why, for how long, and what you can do about it.
Who we are
MatchSheet is run by [TO CONFIRM: legal name of the person or company]. We decide how your information is used, which makes us the "controller" under UK data protection law.
Contact: [TO CONFIRM: privacy contact email]. We aim to reply within a week and always within a month.
Children are records, never users
Only adults have accounts. Children never sign in, never receive messages from us and are never asked for anything. A child appears only as a first name and a shirt number that their coach adds to the squad.
We never collect a child's surname, date of birth, address, school, photo or video.
What we hold
About adults (coaches, parents, carers):
- your email address, which you use to sign in
- which teams you belong to and your role in each (owner, assistant, recorder, viewer or club admin)
- which children you are a guardian of, once the coach approves your link
- the consent choices you make for your child
- if you turn on alerts, a device token so we can send them, and the level you chose
- a log of the alerts and emails we have sent you
- the match events you record, with your account as the recorder
About children:
- first name and shirt number
- whether they are shown by first name or by initials
- what happened in their matches: minutes played, positions played, goals and assists, and cards (at U12 and above)
We do not use your information for advertising, we do not sell it, and there are no third-party trackers or analytics in the app.
Why we hold it, and our lawful basis
| What | Why | Lawful basis |
|---|---|---|
| Your email, teams and role | To sign you in and show you your teams | Contract: it is the service you asked for |
| Match events, minutes, positions and goals | To give the team a fair, accurate record of who played, and help coaches meet FA guidance on playing time and match records | Legitimate interests, with the extra safeguards described below |
| Showing a child's first name rather than initials | Some families are happy for other parents in the team to see the first name; others are not | Consent from the child's guardian |
| Including a child on an exported or copied summary | Summaries can be shared beyond the team | Consent from the child's guardian |
| Alerts to your phone or browser | You asked for them | Consent, which you can withdraw in settings at any time |
We have weighed our legitimate interests against children's rights in a data protection impact assessment, which is available on request.
Who can see it
- Your team only. Everything about a team, including its children, is visible only to adults who belong to that team. This is enforced by the database itself, not just by the app.
- The other team never sees your record. When two teams on MatchSheet play each other, each keeps its own record of the match, and neither can see the other's players, events or recorders. The other team can see your team's name and age group so the fixture makes sense.
- Under 12s stay private. For U7 to U11 teams, results, scorers and any tables are never published outside the team, in line with FA rules.
- Guardian links. Who is a guardian of which child is visible only to that guardian and to the team's coaches.
- Club admins can see the names of a club's teams, not their players or matches.
Who helps us run it
We use a small number of providers, under contracts that require them to protect your information:
- Supabase, for the database, sign-in and server functions. Data is stored in [TO CONFIRM: region; we intend London, UK].
- [TO CONFIRM: email provider, e.g. Resend], to send sign-in links and the emails you ask for.
- Push services run by your device's maker (for example Apple, Google or Mozilla), to deliver alerts you turn on. They see the alert, not your team's record.
- [TO CONFIRM: web host], to serve the app.
If any provider stores data outside the UK, we make sure UK-approved safeguards are in place.
How long we keep it
- Children's records: deleted at the end of each season, on the retention date the coach sets for that season, unless the coach deletes them sooner. We suggest no later than three months after the last match. Match records that remain after that no longer identify the child.
- A whole team: the owner can delete the team at any time, which deletes its players, seasons and matches.
- Your account: kept while you use MatchSheet. Ask us to delete it and we will within a month.
- Alert tokens: deleted when you turn alerts off, or automatically when your device stops accepting them.
- The log of alerts and emails sent to you: 90 days.
- Backups: kept for 7 days, then overwritten.
Your rights
You can ask us to:
- give you a copy of the information we hold about you or your child
- correct something that is wrong
- delete your information or your child's
- stop or limit how we use it, or object to our legitimate interests
- give you your information in a portable format
You can withdraw any consent at any time. This does not affect anything we did before you withdrew it.
To use any of these rights, email [TO CONFIRM: privacy contact email]. If you are unhappy with how we handle your information, you can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113. We would like the chance to put it right first.
Changes
If we change this notice in a way that matters, we will tell you in the app before the change takes effect.