Privacy & data

Last updated: 12 October 2026. Plain-English summary first, details below. This note is written for the UK GDPR and Data Protection Act 2018.

In short: Tactix Board is for adult coaches and volunteers. You decide what goes into a squad list. We ask you to keep it minimal (first name or initials, shirt number, position). Only you can see your sessions and squads, unless you share a squad with a club you joined. You can export everything, or delete your account and all your data, at any time from Account in the app.

Who is responsible

Tactix Board (tactixboard.app) is a trading name of Dawson Consulting (DC) Ltd, a company registered in England and Wales (company number 11206889), registered office: 71-75 Shelton Street, London, England, WC2H 9JQ. VAT number: GB518266383. Contact: privacy@tactixboard.app. For your account (email address and login) we are the controller. For player information you enter into squads, your club (or you as the coach) is the controller: you decide what to record and why. We act as your processor: we only store it so you can use it, and we never use it for anything else.

What we store

Data	Why	Who can see it
Your email address, a hashed password, sign-in times	To create your account and keep it secure	You; coaches in your clubs see your email/display name
Your tactics sessions (pitch, positions, drawings, notes)	So you can use them on all your devices	Only you
Squad lists: names, shirt numbers, positions, optional notes	To put players on the board	Only you, unless you share a squad with a club. Then the coaches in that club can see that squad
Club name, invite code, membership list	To let coaches share squads	Members of that club

We do not ask for or need children's dates of birth, photos, addresses, contact details, medical, ethnicity or safeguarding information. Please don't put these in notes. We use no advertising, analytics or tracking cookies. The app keeps data in your browser's storage (localStorage/IndexedDB) so it works offline. This is strictly necessary for the service, so no cookie banner is needed.

Guidance for coaches (data minimisation)

Use first names, nicknames or initials. Shirt numbers alone also work.
Keep notes about football (e.g. "left footed, likes to dribble"), not about health, behaviour or family.
Follow your club's data-protection and safeguarding policy, and tell parents/guardians that the club uses a tactics app (most club privacy notices already cover team-selection tools).
Only share a squad with your club when other coaches need it. Unshare or delete squads at the end of the season.

Lawful basis

Account data: contract (to provide the service you signed up for). Player data entered by coaches: the club's/coach's legitimate interests in organising youth football teams, balanced by keeping data minimal and visible only to the team's coaches. Clubs may instead rely on their own basis (e.g. membership terms or consent) as set out in their privacy notice.

Where it is stored and for how long

We use these service providers (processors), each under a data processing agreement:

Supabase: database and login. Your account, sessions and squads are stored in the EU (Ireland, eu-west-1).
Cloudflare: hosting and delivery of the web app (Cloudflare Pages/CDN). It handles normal web traffic such as IP addresses, but your sessions and squads do not pass through it.
Resend: sending account emails (sign-up confirmation and sign-in links), processed in the EU (Ireland). It receives only your email address and the email content.
Stripe: payments for paid plans (Stripe Payments Europe Ltd, Ireland). If you upgrade, Stripe collects your card and billing details directly; we never see or store card numbers. We keep only your Stripe customer ID and your subscription status, plan and renewal date so we know which features to switch on. Stripe keeps payment records as required by financial and tax law.

The EU is covered by UK adequacy regulations. Where a provider's group is based in the US, transfers are covered by the UK International Data Transfer Addendum / UK–US data bridge safeguards in their agreements. We keep your data for as long as you have an account. When you delete a session or squad, it is removed from your devices straight away and fully purged from the server within 30 days. When you delete your account, everything is deleted immediately (any copies in our provider's backups expire on its normal backup schedule).

Your rights, and how to use them yourself

Access / portability: Account → Export my data downloads everything we hold for you as JSON. Squads → Export gives CSV/Excel files.
Rectification: edit or rename anything in the app.
Erasure: delete individual squads or sessions, or Account → Delete account to erase your login, sessions and squads and leave all clubs.
Requests about a child's data: a parent/guardian should contact the club. The club's coaches can delete or correct the entry immediately. You can also email privacy@tactixboard.app and we will help the club respond within one month.
You can complain to the Information Commissioner's Office (ico.org.uk).

Security

Connections are encrypted (HTTPS). Passwords are hashed by the authentication service. Database row-level security makes sure each request can only read the rows that coach is allowed to see. Signing out offers to remove your data from the device, which is useful on a shared club tablet.

Children

The service is not intended for children to use and children cannot create accounts. Coaches must be 18 or over.