Privacy Policy | Capo Football App

Capo ("we", "our", "us") provides football statistics, score tracking and related services through our mobile and web apps (together, the "Service"). This Privacy Policy explains how we collect, use, and protect your personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

By using Capo, you agree to the practices described here.

1. Who We Are (Data Controller)

CAPO SPORT LTD (company number 17030048) is the data controller responsible for your personal data.

Registered office: 52 Swing Gate Lane, Berkhamsted, Hertfordshire, HP4 2LL, United Kingdom

Email: hello@caposport.com

2. Data We Collect

a. Information you provide

Phone number (required for account creation and login)
Email address (optional)
Name or display name
Favourite teams or preferences
Admin data: for admin accounts only, we collect signup source/referrer

We do not collect passwords — access is phone-number–based.

b. Information collected automatically

Device type, operating system, browser
IP address
App usage statistics
Server logs for security and diagnostics
Authentication events (Supabase)

c. Analytics data

We use Plausible Analytics, a privacy-focused, cookie-free analytics provider.

No cookies or cross-site tracking are used.

d. Payments

Payments are handled by Stripe.

We receive information such as:

transaction amount
transaction status
payer ID (from Stripe)

We do not store or process card details.

e. Public profile & leaderboard data

We store stats, match results, team/league participation and similar gameplay data.

This data may be shown publicly as part of the Service (see section 7).

3. How We Use Your Data

We process data to:

Provide and operate the Service
Authenticate your account
Track player scores, stats and match history
Run leaderboards, rankings, leagues and competitions
Facilitate payments between users and admins
Send important service notifications
Provide customer support
Prevent fraud or abuse
Improve and develop the platform

Legal bases under UK GDPR

Contract: to provide the Service

Legitimate interests:

analytics
scorekeeping, leaderboards, and the display of player stats within leagues/competitions (where users reasonably expect performance data to be recorded and shown in that context)
preventing abuse
app performance

Legal obligation: compliance with accounting and tax requirements (e.g. payment records).

Consent:

optional email updates
push notifications (required by PECR)

4. Public Profiles, League Tables & Stats

Although Capo currently displays profiles privately, the app is designed to support public player stats, public profiles, rankings, match histories and social sharing.

We may display user stats publicly as part of the Service.

This is based on Legitimate Interests, because:

competitive ranking is core to the platform
user stats have value in a sporting context
public display is expected in apps of this nature

When public profiles are enabled:

users will be able to choose a display name instead of their real name
users may be able to toggle visibility of some elements
sensitive or personal-contact information will not be shown publicly

If public profiles are introduced, users will be notified in advance and given appropriate control options.

5. Push Notifications

We may send push notifications for:

match results
score updates
invitations
feature or service messages

Push notifications require opt-in consent on your device.

You can turn them off at any time.

6. Payments via Stripe

If you pay for matches or services, your payment is handled by Stripe, who acts as an independent data controller for payment information.

We receive no card details.

We may receive:

pseudonymised payer identifier
payment success/failure
the amount paid
the associated admin account

7. Third-Party Providers

We use the following services to run Capo:

Vercel – hosting and deployment
Supabase – authentication, database, storage
Render – backend hosting
Resend – transactional email (passwordless login emails, support emails)
Plausible – privacy-friendly analytics
Stripe – payments

These providers may process data in the UK, EU, or US.

Where data is transferred outside the UK, we rely on appropriate safeguards such as the UK International Data Transfer Agreement (IDTA), Standard Contractual Clauses (SCCs), and/or adequacy decisions where applicable.

8. Data Retention

We retain data only as long as necessary for the purposes described.

Account data: kept while your account is active
Match history and gameplay data: retained for as long as the Service operates and as necessary to preserve league integrity and historical records (see below)
Analytics logs: typically 12–36 months
Payment records: 6 years (required by law)

Gameplay Data & Right to Erasure

Because deleting a player's data would break league tables, historical stats and competitive integrity:

We may anonymise your profile instead of deleting match results entirely
Your contributions to matches, scores and rankings may be retained in anonymised form

This is permitted under UK GDPR where erasure would "seriously impair" the service or conflict with legitimate interests.

9. Account Deletion

You may request deletion of your Capo account at any time.

How to delete your account

To request account deletion, email hello@caposport.com from the email address or phone number associated with your account.

You may request deletion even if you have uninstalled the app.

What happens when your account is deleted

When your account is deleted:

Your user profile, authentication data (phone number, email), and personal settings are permanently deleted.
Access to your account is removed and cannot be restored.

Gameplay data and anonymisation

Because Capo is a competitive sports platform, deleting gameplay data would impair league tables, rankings, and historical results.

For this reason:

Match results, scores, and rankings may be retained in anonymised form
Any retained data will no longer be linked to you as an identifiable individual

Retention of limited data

We may retain certain records where required by law (for example, payment or tax records).

Such data is retained only for the legally required period and is not used for other purposes.

10. Your Rights

You have the right to:

Access your personal data
Correct inaccurate data
Request deletion (with the anonymisation exception above)
Object to processing based on legitimate interests
Port your data
Withdraw consent (e.g. email or push notifications)
Lodge a complaint with the Information Commissioner's Office (ICO) at https://ico.org.uk

To exercise your rights, email: hello@caposport.com

11. Children

Capo is intended for adults. However, teams may include under-18 players.

Where an administrator adds or manages information about a player under 18, the administrator confirms they have the authority to provide that data (for example as a parent/guardian or authorised club/league official).

We do not knowingly collect personal data directly from children without appropriate authority.

12. Cookies

Capo uses no cookies for analytics or tracking.

Plausible Analytics is fully cookie-free.

If additional features later require cookies, we will update this policy and (if required) provide a consent banner.

13. Security

We take reasonable technical and organisational measures to protect your data, including:

encrypted connections
secure hosting environments
access controls
audit logs
isolation between databases

However, no system is 100% secure.

Where required by law, we will notify affected users and the ICO of relevant personal data breaches.

14. Changes to This Policy

We may update this Privacy Policy from time to time.

The "Last updated" date at the top will be changed accordingly.

Significant changes may be announced via the app or email.

15. Contact

For any questions, please contact:

CAPO SPORT LTD

52 Swing Gate Lane, Berkhamsted, Hertfordshire, HP4 2LL, United Kingdom