Club OS

Your data

Club OS is run for your club as a pilot. This page says in plain words what it keeps, who sees it and how to delete it. No ads, no tracking, nothing is sold.

Updated: 2026-10-08

What Club OS keeps

  • Your account: email address and password (stored only as a secure hash).
  • Your name, your teams and your roles.
  • Your answers to sessions (in, out, late, with a reason if you give one) and absences.
  • For teams that track load: how hard a session was (RPE) and how long, and your own training plans.
  • Settings: notifications, quiet hours, the devices that get notifications, your calendar link.
  • If you connect Apple Calendar: your Apple ID and the app-specific password (encrypted), and appointments from calendars you chose to show.
  • Error reports when something breaks, so it can be fixed.

Who sees it

  • Your coaches see your answers and absences (the reasons only coaches allowed to), and, where load is tracked, your load and own training.
  • Other players see the team’s sessions, messages and coaches, but not you: not your name, answers, absences or load.
  • Club admins and department leads see who is in which team.
  • Appointments from your own Apple calendars: only you.
  • Nobody outside your club.

Where it lives

The demo stays on your device. The club server stores data with Supabase in Paris (EU); Vercel hosts the app. Optional push, calendars and maps use the providers listed below.

Under 16

Under 16, ask a parent to consent to health data. Until then you can use the calendar, RSVP without reasons, messages and carpools. From 16, health consent is your choice.

Your choices

  • Change your name, email or password in Settings.
  • Switch notifications, the calendar link or Apple Calendar off in Settings at any time.
  • Delete your account in Settings → Account → “Delete account”: your account and everything about you in the club is deleted at once. Messages you wrote to a team stay, without your name.
  • Download your data as JSON in Settings → Account.

Privacy policy

Updated: 2026-10-08

Legal text in English

Controller and scope

Ben Hebling, Gröbenbachstraße 42d, 82194 Gröbenzell, Germany, ben.hebling@gmx.de, privately operates Club OS for sports clubs in Germany. No data protection officer has been appointed because one is not required. This policy covers the pilot club server and the local demo.

Data and purposes

We process email and name; birth year for players and an age confirmation for staff; clubs, departments, teams, memberships and roles; sessions, venues and calendars; RSVP status, late minutes and optional reasons; absences and optional reasons; squads and attendance; messages, polls, votes and read markers; carpools; notification preferences and push subscriptions; calendar connections; and technical error reports. These data provide club coordination, communication and attendance planning. RPE, training minutes, derived load and ACWR, personal training plans and injury-related absence reasons can reveal health information and receive the consent protection described below. Avoid putting health information in ordinary messages or carpool notes.

Legal bases and optional health consent

Providing the service to club members is based on Art. 6(1)(b) GDPR. Security, reliable operation and error reports are based on our legitimate interests under Art. 6(1)(f); you may object on grounds relating to your situation. Health data are processed only with explicit consent under Art. 9(2)(a), together with Art. 6(1)(a). Consent is optional: without it, calendar access, RSVP without reasons, messages and carpools remain available. You may withdraw in Settings at any time for the future; coaches then lose access and new health entries and rating prompts stop. Prior lawful processing is unaffected. Existing entries remain available to you for export or deletion; withdrawal offers deletion of load entries.

Children and parental consent

Players of any age may use the app with parental consent. From 16, players consent themselves. For players under 16, Art. 8 GDPR requires consent from a parent or legal guardian for consent-based processing. A one-time link, valid for 30 days, shows the child’s first name, team and club and records the guardian’s name, email and explicit confirmation. The guardian’s email must differ from the child’s login emails. The confirmation screen shows a private withdrawal link once; keep it, or contact the controller to withdraw. A player awaiting consent can use the limited features described above. We store the birth year rather than a full birth date; please provide it accurately and contact us for corrections.

Who can see data

Access follows memberships and team permissions. Players see their own health data; coaches with load permissions see health consent status and the health data allowed by their role for their own teams. Coaches with roster permissions can see birth years. Club administration does not automatically grant access to athlete health data. Team members see shared sessions, messages and the relevant carpool details. Guardian contact details are not shown to coaches; they are available to the account concerned and the operator when necessary.

Service providers and international transfers

Supabase provides database, authentication and Edge Functions under a data processing agreement, with the database in EU region eu-west-3 (Paris). Vercel Inc. hosts the web app; requests can disclose IP address, browser information and server access logs. Vercel is in the USA; transfers rely on the EU–US Data Privacy Framework and standard contractual clauses where applicable. Push notifications use the browser’s push provider (Apple, Google or Mozilla), transmitting subscription routing data and encrypted notification content; these providers may process data outside the EU. When a coach searches an address, Geoapify receives the typed search text through our server, without the account’s personal data; do not enter personal health information there. Supabase authentication sends necessary account emails. There are no advertising, analytics or tracking cookies.

Optional calendars, maps and device storage

Connecting Apple Calendar sends your Apple ID and app-specific password to the Supabase function and to Apple iCloud via CalDAV. The password is encrypted in Supabase Vault, not returned to the app. Connection URLs, chosen calendar sources, sync state, event identifiers and imported private appointments are stored; team and personal appointments are written to your iCloud calendar, and selected private calendars are imported for your account. Disconnecting removes the stored password and connection; a calendar already written to iCloud can remain there. A calendar subscription link gives its holder access to your exported appointments; share it carefully. Adding it to Google Calendar or another calendar provider sends that link and calendar data to the provider you choose. Opening Apple Maps or Google Maps sends the chosen address to that provider; following external links contacts their websites. Sharing a consent link uses the sharing app you choose; QR codes are generated on the device. Necessary browser storage keeps sign-in state, language, demo data, offline copies and pending changes, device and installation settings. There is no cross-site tracking. Clear browser storage on shared devices; deleting a server account cannot remotely erase copies on disconnected devices.

Retention and deletion

Data remain while the account and club service are used, unless you delete entries sooner. Leaving a team removes its membership, not all historic data about you. Account deletion immediately removes the account, person records, memberships, RSVPs, absences, load, votes and reads, push subscriptions, settings and stored Apple password through database cascades. Shared messages you authored remain with no author reference; technical error reports remain with no account reference, and their text can still contain details you submitted. Error reports currently have no automatic time-based deletion and remain until the operator deletes them; resolved reports are retained too. Do not include unnecessary personal or health data in reports. Provider backups are overwritten no later than 30 days. Local demo data remain on your device until reset or browser storage is cleared. Consent records and parental links are deleted with the person/account. The only club administrator must appoint another administrator before deleting an account if other people remain in the club.

Your rights and contact

You have rights to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), portability (Art. 20), objection (Art. 21) and withdrawal of consent for the future (Art. 7(3)), subject to the GDPR’s conditions. Settings → Account → Download my data provides a JSON export of your own records across clubs, including consents and push subscription metadata without cryptographic keys. You can correct your name in Settings; contact ben.hebling@gmx.de for other requests, birth-year corrections and parental withdrawals. You may complain to Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), Promenade 18, 91522 Ansbach, Germany, www.lda.bayern.de. Load calculations support coaches; they are not medical diagnoses and do not make automated decisions with legal or similarly significant effects. Changes to these texts will be announced in the app.

Last changed 26 September 2026. Back to Club OS