The data controller responsible for processing personal data through VolleyInsights is the individual operator identified on the legal notice page. For privacy inquiries, please use the contact details provided there.

This policy covers the website at volleyinsights.com, the native mobile applications for Android and iOS, all authentication flows (including Google Sign-In and Sign in with Apple), the product itself, support interactions, and any related communications.

VolleyInsights is the sole application requesting access to your Google user data. No other entity, application, or service accesses Google user data on our behalf or through our credentials.

• Account and contact data — such as name, email address, login identifiers, profile details, language and theme settings, notification preferences, and onboarding or in-app configuration settings.
• Authentication data — such as Supabase account identifiers and, if you choose Google Sign-In, your Google account email address, display name, profile picture URL, and the OAuth tokens Supabase uses to verify and maintain your authenticated session.
• Sign in with Apple data — if you choose Sign in with Apple, the name and email address you allow Apple to share with us (which may be a private relay address if you use Hide My Email), and the Apple-issued identity token Supabase uses to verify your account. Apple does not share a profile picture.
• Team and performance data — such as player names, numbers, positions, lineups, match events, and analytics generated from those records.
• Technical and usage data — such as IP address, browser, operating system, device type, log records, security events, and product-performance metrics collected through Vercel Analytics and Vercel Speed Insights.
• Feedback and support data — such as emails, messages, feedback requests, and the page URL, browser, operating system, and device type sent with an in-app feedback submission.

When you choose to sign in with Google, VolleyInsights requests access to a limited set of data from your Google account through the OAuth 2.0 protocol. The authentication flow works identically whether you sign in from the web application or from one of the native mobile apps (Android or iOS).

We request only the minimum scopes strictly necessary for authentication. The specific scopes and their purposes are:

openid — required to verify your identity using a Google-issued ID token. Without this scope we cannot confirm you are who you claim to be.

email — required to obtain your primary Google account email address, which serves as your login identifier and the address to which we send service-related notifications.

profile — required to obtain your Google display name and profile picture URL, which are used to pre-fill your VolleyInsights profile when your account is first created so that you do not have to enter them manually.

We do not request and have never requested any scope beyond openid, email, and profile. We do not request access to your Google contacts, calendar, Gmail messages, Google Drive files, Google Photos, YouTube data, Google Fit data, location history, or any other Google service. We will not "future-proof" our access by requesting scopes for features that do not yet exist. If we ever need to request an additional scope, we will update this policy and prompt you for consent before accessing any new data.

The specific data items we receive from Google under these scopes are: (a) your primary Google account email address, (b) your Google account display name, (c) your Google profile picture URL, and (d) OAuth tokens (access token and, on native mobile apps, an ID token) used exclusively for authentication.

Transparency about exactly how your Google data moves through our systems is fundamental. Here is the complete data flow:

Step 1 — Authentication: When you tap "Sign in with Google", you are redirected to Google's consent screen (on the web) or presented with Google's native sign-in dialog (on mobile). You authenticate directly with Google. VolleyInsights never sees or handles your Google password.

Step 2 — Token exchange: After you grant consent, Google issues an authorization code (web) or an ID token plus access token (mobile). On the web, our server-side callback exchanges the authorization code with Supabase, which in turn exchanges it with Google for tokens. On mobile, the native app validates the Google ID token locally on your device — verifying the audience claim matches our registered Google client IDs and validating a cryptographic nonce to prevent replay attacks — before sending it to Supabase.

Step 3 — Session creation: Supabase verifies the tokens with Google, creates or updates your user record in its managed authentication database (auth.users), and stores your Google email, display name, and profile picture URL in the user metadata field of that record. Supabase then issues a session token to your browser or mobile app.

Step 4 — Profile creation: The first time you sign in, a database trigger automatically copies your Google display name and profile picture URL from the Supabase authentication record into your VolleyInsights profile record (the profiles table). This is a one-time copy at account creation. After this point, you can edit your display name and avatar independently — changes you make in your VolleyInsights profile do not propagate back to Google, and changes you make in your Google account do not automatically update your VolleyInsights profile.

Step 5 — Ongoing usage: During normal use of the application, your display name and avatar (originally sourced from Google at account creation) are displayed in the application header, your profile page, and — for administrators only — internal administrative views. Your email address is used solely for login identification and service communications.

There are no hidden features, services, or background processes that access your Google data beyond what is described above. No data from Google is collected, stored, processed, or transmitted other than through the steps listed here.

Google user data is used exclusively to provide or improve user-facing features that are prominent in the VolleyInsights user interface. Specifically:

Authentication — to verify your identity, create your VolleyInsights account, and maintain your authenticated session within the application, on both the web and native mobile platforms.

Account setup — to pre-populate your display name and avatar at the time your account is first created, so you do not have to enter them manually. You may change these details at any time from your profile settings.

Communication — your Google email address may be used to send you service-related notifications, important product or legal notices, and responses to support inquiries you have submitted.

All use of Google user data is limited to these three purposes. If we ever plan to use Google user data for a new or different purpose, we will update this privacy policy and prompt you for consent before making any such use.

Google user data is never used for advertising, ad targeting, remarketing, retargeting, personalized advertising, or interest-based advertising. It is never used for behavioural profiling, user segmentation for marketing, or any form of tracking unrelated to the operation of the VolleyInsights application. It is never used to determine credit-worthiness or for lending purposes. It is never sold, rented, licensed, or otherwise distributed to third parties, including advertising platforms, data brokers, or any information resellers. It is never aggregated, analysed, or shared with any third party conducting surveillance.

No VolleyInsights employee, agent, or contractor reads individual users' Google-derived data (email address, display name, or profile picture URL) unless: (a) you have given your affirmative agreement for us to view specific data (for example, by submitting a support request that includes your account details); (b) it is necessary for security purposes such as investigating a bug or abuse; (c) it is necessary to comply with applicable law; or (d) the data has been aggregated and anonymized and is used for internal operations in accordance with applicable privacy and legal requirements. Any such access is limited to the minimum data necessary and is logged.

VolleyInsights' use and transfer to any other app of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements, available at https://developers.google.com/terms/api-services-user-data-policy.

In compliance with the Limited Use requirements, VolleyInsights applies the following restrictions to all Google user data, including raw data obtained from the authorized scopes and any data aggregated, anonymized, or derived from it:

Use limitation — We limit our use of Google user data to providing or improving user-facing features that are prominent in the VolleyInsights user interface, namely: authentication, profile setup, and service communications as described in section 5.

Transfer restrictions — We do not transfer Google user data to any third party except: (a) to provide or improve user-facing features that are visible and prominent in the VolleyInsights user interface, and only with your consent (for example, Supabase processes your data to provide the authentication service); (b) for security purposes such as investigating abuse; (c) to comply with applicable laws or regulations; or (d) as part of a merger, acquisition, or sale of assets, and only after obtaining your explicit prior consent.

No human reading — We do not allow humans to read your Google user data unless: (a) you have given your affirmative agreement to view specific data; (b) it is necessary for security purposes such as investigating a bug or abuse; (c) it is necessary to comply with applicable law; or (d) the data (including derivations) has been aggregated and anonymized and is used for internal operations in accordance with applicable privacy and other jurisdictional legal requirements.

Prohibited uses — We never transfer, sell, or use Google user data for: serving advertisements (including retargeting, personalized, or interest-based advertising); transferring or selling to advertising platforms, data brokers, or information resellers; determining credit-worthiness or for lending purposes; or any other purpose not explicitly disclosed in this policy.

Employee and contractor compliance — We ensure that all employees, agents, contractors, and successors comply with this Google API Services User Data Policy.

• To create and manage accounts and authenticate users via email/password Google OAuth Sign-In, or Sign in with Apple.
• To provide team management, live stats recording, analytics, exports, and related product features.
• To store your profile, language, theme, notification, and stats-recording preferences.
• To secure the service, prevent fraud, troubleshoot incidents, and enforce our terms.
• To review and respond to feedback reports together with the page, browser, operating system, and device context included with that report.
• To respond to requests, provide support, and send important product or legal notices.
• To measure traffic, feature usage, usability, performance, and reliability using Vercel Analytics and Vercel Speed Insights (this does not involve Google user data).

Depending on the context, we process data because it is necessary to perform a contract (providing the VolleyInsights service), pursue legitimate interests (security, fraud prevention, service improvement), comply with legal obligations, or because consent has been obtained where required (for example, when you grant OAuth consent to Google Sign-In or Sign in with Apple).

If you input personal data about athletes, staff, or minors, you are responsible for identifying and documenting the appropriate legal basis for that processing.

We share personal data only with the limited set of providers strictly necessary to operate the service. We never sell, rent, or license personal data. The providers and their roles are:

Supabase (Supabase, Inc.) — provides authentication, database hosting, and file storage. Supabase handles the Google OAuth token exchange on our behalf, stores user authentication records, and hosts the application database. Google-derived profile data (email, display name, profile picture URL) is stored within Supabase infrastructure. Supabase processes Google user data solely to provide authentication and database services to VolleyInsights, consistent with the Google API Services User Data Policy.

Google (Google LLC) — involved only to the extent required by the OAuth sign-in flow that you initiate. When you sign in with Google, your browser or mobile app communicates directly with Google servers to authenticate. Google receives standard OAuth protocol data (client ID, redirect URI, scopes requested). Google's processing of your data during this flow is governed by Google's own Privacy Policy.

Apple (Apple Inc.) — involved only when you choose Sign in with Apple. Your device or browser authenticates directly with Apple, which returns an identity token and, if you allow it, your name and email address (or a private relay address). On iOS, the Sign in with Apple dialog is shown through the same Capgo plugin, which handles the tokens locally on your device. Apple's processing of your data during this flow is governed by Apple's own Privacy Policy.

Capgo (Capgo) — provides the native mobile Google sign-in plugin (@capgo/capacitor-social-login) used in the Android and iOS applications. This plugin facilitates the Google sign-in dialog on your device and passes the resulting tokens to our application code. Capgo does not receive, store, or transmit your Google user data to its own servers — all token handling occurs locally on your device.

Vercel (Vercel, Inc.) — provides web hosting, edge functions, and usage analytics (Vercel Analytics and Vercel Speed Insights). Vercel collects anonymized performance and usage metrics. Google-derived profile data (email address, display name, and profile picture URL) is not transmitted to Vercel's analytics or logging systems.

Google user data is not shared with, transferred to, or made accessible to any other third party, including advertising platforms, data brokers, information resellers, or any entity conducting surveillance. We do not aggregate or analyse Google user data for the purpose of distributing it to a third party.

We may disclose personal data where required by law, to protect the rights and safety of users or third parties, or in connection with a merger, acquisition, or asset transfer — and in that last case, only after obtaining your explicit prior consent and with the acquiring entity required to honour the commitments in this policy.

We maintain a secure operating environment and take reasonable and appropriate steps to protect all data — including Google user data and data derived from it — against unauthorized or unlawful access, use, destruction, loss, alteration, or disclosure.

Your data is stored in Supabase-managed infrastructure. Supabase applies encryption at rest and in transit (TLS) and enforces row-level security to ensure that users can only access their own data.

We apply the following security measures: HTTPS-only communication for all data in transit (both web and mobile); row-level security policies on all database tables ensuring users can only access their own records; session tokens stored in HTTP-only cookies (web) or secure client-side storage managed by Supabase Auth (mobile); access controls that restrict administrative access to the minimum necessary; and regular review of third-party dependencies for known vulnerabilities.

On native mobile apps, Google ID tokens are validated locally on your device before being transmitted to Supabase. This validation includes verifying the token audience (ensuring it matches our registered Google client IDs) and verifying a cryptographic nonce to prevent token replay attacks.

Google OAuth tokens (access tokens, refresh tokens, and ID tokens) are managed exclusively by Supabase Auth and are not stored in our application-level database tables or exposed to our application code beyond what is required to authenticate your session.

No security system is completely infallible. In the event of a data breach that is likely to result in a risk to your rights and freedoms, we will notify you and the relevant supervisory authorities as required by applicable law.

Your data may be processed in countries other than the one where you are located, as our infrastructure providers (Supabase, Vercel) operate globally.

Where transfers outside the European Economic Area occur, we rely on appropriate safeguards such as Standard Contractual Clauses adopted by the European Commission, adequacy decisions, or other lawful transfer mechanisms recognized under applicable law.

We keep personal data for as long as reasonably necessary to provide the service, comply with legal obligations, resolve disputes, and enforce agreements.

Active account data — including any data sourced from Google Sign-In such as your email address, display name, and profile picture URL — is retained while your account remains open.

After you delete your account, all personal data associated with your account (including any Google-derived profile data) is removed from our active database immediately via cascading deletion. This includes your profile record, all teams, players, matches, and analytics you created. Residual copies in encrypted backups and system logs are purged within 90 days of account deletion, unless a longer retention period is required by applicable law.

To delete your data, you can use the account deletion function available in the profile settings of the application, or contact us directly using the details on the legal notice page. We will process your request within 30 days and confirm once deletion is complete.

Important: Deleting your VolleyInsights account does not automatically revoke the OAuth connection between your Google account and VolleyInsights. To fully revoke VolleyInsights' access to your Google account, you should also remove it from your Google account's third-party app permissions at https://myaccount.google.com/permissions. After revocation, VolleyInsights will no longer be able to request any information from Google on your behalf.

Conversely, revoking VolleyInsights' access via your Google account settings does not automatically delete your VolleyInsights account or the data already stored in it. The data already associated with your account (email address, display name, profile picture) will remain until you delete your account as described above, but will not be refreshed from Google.

If you use Sign in with Apple, you can stop using it with VolleyInsights at any time from your Apple Account settings (on iPhone: Settings → your name → Sign-In & Security → Sign in with Apple). This does not delete your VolleyInsights account or its data; to do that, delete your account from your Profile.

Depending on the laws that apply to you, you may have rights to access, correct, delete, restrict, object to, or port your personal data, and to withdraw consent where consent is the legal basis for processing.

You can manage profile preferences such as language, theme, and notification choices from within the product, and you can stop non-essential email communications by using the unsubscribe instructions included in those messages.

To manage or revoke the Google Sign-In connection, visit your Google account's third-party app permissions page at https://myaccount.google.com/permissions and remove VolleyInsights from the list of authorized applications.

Under the GDPR, you may also lodge a complaint with your local data protection supervisory authority. Under the California Consumer Privacy Act (CCPA/CPRA), California residents have the right to know what personal data is collected, to request deletion, and to opt out of the sale of personal data. We do not sell personal data. To exercise any right, contact us using the details on the legal notice page.

VolleyInsights is not directed primarily at children under the age of 13. It is a coaching and team management tool designed for use by adult coaches, parents, and sports administrators.

Because the service may be used in youth sports environments where some participants may be minors, VolleyInsights functions as a mixed-audience application. Google Sign-In is offered as an optional feature — users can also create accounts using email and password without any interaction with Google services.

Organizations and account holders who use VolleyInsights in youth sports settings must ensure lawful handling of minors' data, including obtaining any parental or guardian authorizations required by applicable law, such as the Children's Online Privacy Protection Act (COPPA) in the United States or equivalent legislation in other jurisdictions.

In accordance with the Google API Services User Data Policy, we confirm the following: VolleyInsights accurately represents its identity in all permission requests and communications with Google and Google users. We accurately describe the data we request (openid, email, and profile scopes only), the reasons we request it (authentication and profile setup), and how it is used (as described in sections 3 through 6 of this policy). We do not misrepresent what data is collected or what we do with Google user data. There are no hidden features, services, or actions inconsistent with the described purpose of our application. We do not use undocumented Google APIs. We do not make false or misleading statements about any entities that have authorized or manage our application.

VolleyInsights accurately represents its operating environment in all Google authentication flows — web authentication pages are rendered in standard browsers, and native mobile authentication uses the platform's native Google Sign-In dialogs.

We may update this policy from time to time. When we do, we will update the effective date shown at the top of the policy and, where required, notify you of material changes.

If we change the way our application uses Google user data, we will update this privacy policy and prompt you for consent before using Google user data in a new way or for a different purpose than originally disclosed.

Continued use of the service after an update constitutes acceptance of the revised policy.