Privacy Policy for Capo

Capo ("we", "our", "us") provides football statistics, score tracking and related services through our mobile and web apps (together, the "Service"). This Privacy Policy explains how we collect, use, and protect your personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

By using Capo, you agree to the practices described here.

1. Who We Are (Data Controller)

Capo

United Kingdom

Email: hello@caposport.com

If we later register a company, these controller details may be updated without further notice.

2. Data We Collect

a. Information you provide

• Phone number (required for account creation and login)
• Email address (optional)
• Name or display name
• Favourite teams or preferences
• Admin data: for admin accounts only, we collect signup source/referrer

We do not collect passwords — access is phone-number–based.

b. Information collected automatically

• Device type, operating system, browser
• IP address
• App usage statistics
• Server logs for security and diagnostics
• Authentication events (Supabase)

c. Analytics data

We use Plausible Analytics, a privacy-focused, cookie-free analytics provider.

No cookies or cross-site tracking are used.

d. Payments

Payments are handled by Stripe.

We receive information such as:

• transaction amount
• transaction status
• payer ID (from Stripe)

We do not store or process card details.

e. Public profile & leaderboard data

We store stats, match results, team/league participation and similar gameplay data.

This data may be shown publicly as part of the Service (see section 7).

3. How We Use Your Data

We process data to:

• Provide and operate the Service
• Authenticate your account
• Track player scores, stats and match history
• Run leaderboards, rankings, leagues and competitions
• Facilitate payments between users and admins
• Send important service notifications
• Provide customer support
• Prevent fraud or abuse
• Improve and develop the platform

Legal bases under UK GDPR

Contract: to provide the Service

Legitimate interests:

• analytics
• scorekeeping, leaderboards, and public display of player stats
• preventing abuse
• app performance

Consent:

• optional email updates
• push notifications (required by PECR)

4. Public Profiles, League Tables & Stats

Although Capo currently displays profiles privately, the app is designed to support public player stats, public profiles, rankings, match histories and social sharing.

We may display user stats publicly as part of the Service.

This is based on Legitimate Interests, because:

• competitive ranking is core to the platform
• user stats have value in a sporting context
• public display is expected in apps of this nature

When public profiles are enabled:

• users will be able to choose a display name instead of their real name
• users may be able to toggle visibility of some elements
• sensitive or personal-contact information will not be shown publicly

We will not require new consent to enable public profiles, as this policy provides notice in advance.

5. Push Notifications

We may send push notifications for:

• match results
• score updates
• invitations
• feature or service messages

Push notifications require opt-in consent on your device.

You can turn them off at any time.

6. Payments via Stripe

If you pay for matches or services, your payment is handled by Stripe, who acts as an independent data controller for payment information.

We receive no card details.

We may receive:

• anonymised payer token
• payment success/failure
• the amount paid
• the associated admin account

7. Third-Party Providers

We use the following services to run Capo:

• Vercel – hosting and deployment
• Supabase – authentication, database, storage
• Render – backend hosting
• Resend – transactional email (passwordless login emails, support emails)
• Plausible – privacy-friendly analytics
• Stripe – payments

These providers may process data in the UK, EU, or US.

Where data is transferred outside the UK, we rely on approved safeguards such as SCCs or the UK IDTA.

8. Data Retention

We retain data only as long as necessary for the purposes described.

• Account data: kept while your account is active
• Match history and gameplay data: kept indefinitely (see below)
• Analytics logs: typically 12–36 months
• Payment records: 6 years (required by law)

Gameplay Data & Right to Erasure

Because deleting a player's data would break league tables, historical stats and competitive integrity:

• We may anonymise your profile instead of deleting match results entirely
• Your contributions to matches, scores and rankings may be retained in anonymised form

This is permitted under UK GDPR where erasure would "seriously impair" the service or conflict with legitimate interests.

9. Your Rights

You have the right to:

• Access your personal data
• Correct inaccurate data
• Request deletion (with the anonymisation exception above)
• Object to processing based on legitimate interests
• Port your data
• Withdraw consent (e.g. email or push notifications)
• Lodge a complaint with the ICO (ico.org.uk)

To exercise your rights, email: hello@caposport.com

10. Children

Capo is intended for adults.

We do not knowingly collect data from users under 18.

11. Cookies

Capo uses no cookies for analytics or tracking.

Plausible Analytics is fully cookie-free.

If additional features later require cookies, we will update this policy and (if required) provide a consent banner.

12. Security

We take reasonable technical and organisational measures to protect your data, including:

• encrypted connections
• secure hosting environments
• access controls
• audit logs
• isolation between databases

However, no system is 100% secure.

13. Changes to This Policy

We may update this Privacy Policy from time to time.

The "Last updated" date at the top will be changed accordingly.

Significant changes may be announced via the app or email.

14. Contact

For any questions, please contact:

Capo

United Kingdom

Email: hello@caposport.com