Quadra privacy policy

1. Controller and contact details

Controller: Tiago Silva
Privacy email: geral.quadra.app@gmail.com

This policy explains data processing in Quadra, an app for managing futsal teams and matches, under Regulation (EU) 2016/679 (GDPR) and applicable national law, including Portuguese Law 58/2019. The club or person entering player data determines the purposes and means of that management and must inform players and others involved. The Quadra operator is responsible for the account, Premium access and service operations it determines.

2. Data and sources

Local data: team name, home venue, players (name, number and position), squads, matches, results, events, playing times, statistics, images, posters and audio notes. You enter this data or import it from files and backups. Audio notes are voice recordings; the app does not transcribe them or perform biometric identification.

Optional account: email, user identifier, authentication and session data and, when used, data provided by Apple or Google for sign-in. Password authentication is managed by Supabase.

Premium: product and transaction identifiers, purchase proofs, access status and expiry, invitations and manual grants. Data may come from Apple/Google stores or authorised administrators. Quadra does not receive full payment card details.

Optional Drive: selected Google account, email, authorisation and folder/file identifiers, dates, revision and backup status. Online services may also process IP addresses and technical logs of requests, authentication, security and errors. A deletion request generates a status record and a recovery receipt.

Support and rights requests: email address, message content and information strictly necessary to verify ownership and respond. Do not send passwords, access codes or team backups.

3. Purposes and legal bases

Account, authentication, recovery and Premium validation: performance of a contract or steps at your request (GDPR Article 6(1)(b)). These features require the necessary data; local features remain available without an account.

Security, fraud prevention and operation recovery: legitimate interests in protecting accounts, purchases and the service (Article 6(1)(f)), balanced against individuals’ rights. You may object on grounds relating to your particular situation.

Compliance with legal obligations, where applicable: Article 6(1)(c).

Connecting Drive and enabling automatic backups are separate, optional choices based on your authorisation and, where processing relies on consent, Article 6(1)(a). You may withdraw consent without affecting earlier processing or local use. System permission for microphone or files is a technical control and does not replace a legal basis for processing other people’s data.

The responsible club or user must establish an appropriate legal basis for player data; the Quadra contract with the user does not by itself authorise that processing.

4. Storage and recipients

Sports data and files stay on the device or in browser storage. Creating an account does not upload them to Supabase or synchronise them between devices. Supabase supports identity, account and Premium rights. Apple and Google process authentication and purchases when you choose those services; they may act as independent controllers for their own services. Authorised administrators may manage invitations and licences.

An archive is sent to your Google Drive only when you create a backup or enable automation. Connecting Drive alone does not upload your squad, matches or audio. The drive.file permission is requested for files authorised for this app. The selected folder and its permissions determine who can access backups. Exporting or sharing an archive/poster sends it to the destination you select. Backups may contain player data, images and audio.

This version integrates no advertising or behavioural analytics SDKs. Data is not sold and sports content is not used for advertising. Disclosures to authorities may occur when legally required.

In the web version, Cloudflare Pages serves app files and may process IP addresses and technical request metadata for delivery and security. Requests sent to the privacy contact are received in Gmail, a Google service.

5. Hosting and international transfers

PT: Base de dados e identidade Supabase na Irlanda, União Europeia. As Edge Functions usam execução regional distribuída por defeito. O Cloudflare Pages disponibiliza a versão web através da sua rede global. EN: Supabase database and identity in Ireland, European Union. Edge Functions use distributed regional execution by default. Cloudflare Pages serves the web version through its global network.

Transfer countries, recipients and safeguards: PT: O Supabase identifica a Supabase Pte. Ltd. (Singapura) e suporte/operações nos EUA, com cláusulas contratuais-tipo incorporadas no seu DPA e medidas complementares. O Cloudflare, fornecedor de alojamento web com entidade nos EUA e rede global, prevê no seu DPA cláusulas-tipo e o EU–US Data Privacy Framework quando aplicável. A Google trata os serviços escolhidos de autenticação, Drive e Play e recebe mensagens no Gmail; a sua documentação prevê tratamento internacional, incluindo nos EUA, decisões de adequação, DPF para entidades certificadas e cláusulas-tipo quando necessárias. A Apple trata autenticação e compras quando usadas e descreve transferências internacionais, incluindo para os EUA, com cláusulas-tipo para dados do EEE. Os destinatários e locais adicionais dependem do serviço utilizado e constam das listas/políticas dos fornecedores. Podes pedir cópia das garantias aplicáveis ao contacto de privacidade. EN: Supabase identifies Supabase Pte. Ltd. (Singapore) and US support/operations, with standard contractual clauses in its DPA and supplementary measures. Cloudflare, the web hosting provider with a US entity and global network, provides for SCCs and the EU–US Data Privacy Framework where applicable in its DPA. Google processes the chosen sign-in, Drive and Play services and receives messages in Gmail; its documentation describes international processing, including in the US, adequacy decisions, DPF for certified entities and SCCs where needed. Apple processes sign-in and purchases when used and describes international transfers, including to the US, with SCCs for EEA data. Additional recipients and locations depend on the service used and are listed in providers’ policies. You may request copies of applicable safeguards from the privacy contact. References: https://supabase.com/legal/customer-resources/data-processing-addendum ; https://supabase.com/legal/customer-resources/subprocessor-list ; https://www.cloudflare.com/cloudflare-customer-dpa/ ; https://policies.google.com/privacy/frameworks ; https://www.apple.com/legal/privacy/en-ww/

International providers’ services may involve access outside the European Economic Area. Transfers require a basis under GDPR Chapter V, such as an applicable adequacy decision or standard contractual clauses with assessment and supplementary measures where needed. Use the privacy contact to request information and a copy of applicable safeguards. This policy does not assume all data stays in the EU or that all providers are covered by an adequacy decision.

6. Retention

Local data: remains while you keep the profile or until you delete it. Signing out keeps the previous profile isolated; it does not erase it. Clearing data on this device affects the active profile. Removing the app or browser data may erase local information; operating-system backups and exported files may remain.

Account and licences: retained while the account and associated rights are needed. Account deletion removes identity and associated account/licence data, subject to applicable statutory retention duties. Purchase events may remain without an account link; this alone does not guarantee anonymisation of every identifier. Deletion records allow interrupted requests to be checked and recovered.

Drive: backups remain until removed. Retention is manual by default. If you enable keeping the last three, the app moves backups from the same origin to trash after confirming a new one; trash is emptied under Google Drive rules. Disconnecting does not erase existing backups.

Additional periods or criteria for technical, purchase and deletion records and server backups: PT: Plano Supabase Free: janela de consulta dos logs API/base de dados de 1 dia; a auditoria Auth guardada na base de dados é removida após 1 dia. Não estão contratados backups diários nem PITR, e o operador não mantém dumps da base de dados ou exportações dos logs. Não se presume que as cópias internas de segurança do fornecedor sejam apagadas instantaneamente. Eventos de compra em estado concluído são removidos 90 dias após o processamento (ou receção, se não tiverem data de processamento); estados pendentes são revistos até resolução. Comprovativos de eliminações concluídas: 90 dias desde a conclusão, sem expiração automática de pedidos pendentes/falhados. Convites e os respetivos eventos: 30 dias após utilização, expiração ou revogação, tomando o primeiro evento terminal. Auditoria de licenças: 180 dias, ou antes com a eliminação da conta associada. Os direitos Premium e referências de compra necessários à conta mantêm-se enquanto necessários e são removidos com a conta. A limpeza automática corre de hora a hora em lotes; há uma janela técnica até à execução seguinte e eventuais atrasos são corrigidos operacionalmente. Mensagens completas de suporte/direitos sob nosso controlo: 90 dias após fecho; comprovativo mínimo da resposta a direitos: 12 meses. Uma conservação excecional por obrigação legal ou litígio é limitada aos dados necessários, tem revisão própria e é explicada ao titular quando aplicável. Os fornecedores independentes aplicam também as suas próprias políticas de conservação. EN: Supabase Free: API/database logs have a one-day query window; Auth audit stored in the database is removed after one day. No daily backup or PITR service is contracted, and the operator keeps no database dumps or exported logs. Provider-internal security copies are not assumed to disappear immediately. Terminal purchase events are removed 90 days after processing (or receipt if no processing date); pending states are reviewed until resolved. Completed deletion receipts: 90 days after completion; pending/failed requests do not expire automatically. Invitations and their events: 30 days after use, expiry or revocation, using the first terminal event. Licence audit: 180 days, or earlier upon deletion of the linked account. Premium rights and purchase references needed for the account remain while needed and are removed with the account. Automated cleanup runs hourly in batches; there is a technical window until the next run and operational delays are corrected. Full support/rights messages under our control: 90 days after closure; minimum proof of a rights response: 12 months. Exceptional retention for legal obligations or litigation is limited to necessary data, reviewed separately and explained where applicable. Independent providers also apply their own retention policies.

7. Rights and complaints

Subject to GDPR conditions and limits, you may request access, rectification, erasure, restriction and portability, and object to processing based on legitimate interests. You may withdraw consent at any time without affecting earlier lawful processing. There are no solely automated decisions with legal or similarly significant effects or behavioural profiles; sports statistics are calculated locally from entered records.

Contact the email in section 1. Requests are answered without undue delay and normally within one month. Complex or numerous requests may require two additional months, with notice and reasons within the first month. Exercising rights is normally free; only proportionate identification information will be requested where necessary.

For local player data managed by a club or coach, also contact that organisation: the operator cannot remotely access or erase files held only on the user’s device or Drive. You may complain to the supervisory authority in the Member State of your habitual residence, workplace or alleged infringement. In Portugal: Comissão Nacional de Proteção de Dados (CNPD), https://www.cnpd.pt, with rights information at https://www.cnpd.pt/cidadaos/direitos/. You do not have to contact us before complaining.

8. Controls available in the app

In Settings you can export a backup, import data, manage backups and clear local data. Sports exports do not include all remote account/purchase data; request that through the privacy contact. In Account you can request account deletion with confirmation and recent authentication. You may also choose to erase that device’s local profile; other profiles are not erased. Export first if you need to keep your data.

You can also request deletion by emailing geral.quadra.app@gmail.com without reinstalling the app. Use the subject “Delete Quadra account” and include the email linked to your account. We verify ownership before deleting data; never send passwords or access codes.

Send a deletion request without the app

Deleting an account does not remove Drive backups, shared files or copies on other devices and does not cancel App Store/Google Play subscriptions. Manage those copies and subscriptions in the relevant services. You can disable automatic backups and revoke Google access in your Google account permissions. You can revoke microphone access in device settings; only recording becomes unavailable.

9. Security, permissions and local storage

The app isolates local profiles and the backend restricts access to account data. Security also depends on your device lock, accounts and sharing permissions. ZIP archives exported or sent to Drive have no password or archive-level encryption. Protect them and limit sharing. No system eliminates all risks.

The microphone is used when you start recording. The file picker imports images and backups you choose; location and contacts access is not requested. Preferences, session and local data are stored to provide features. In the web version, the browser keeps this data in local storage. This version uses no cookies or identifiers for advertising or cross-service tracking. External provider authorisation is also subject to that provider’s information.

10. Underage players and sensitive data

Managing teams with underage players requires special care. The person managing data must inform individuals and legal representatives in age-appropriate language, determine the legal basis and obtain required authorisations. Do not share children’s names, images or voices without an appropriate basis. Do not enter health data, other special categories or unnecessary information in notes and recordings. The app does not require this data. Device recording permission does not constitute consent from the people recorded.

11. Updates and references

This policy must reflect changes to features and providers. Material changes must be communicated before new processing and separate consent obtained where necessary. Reading this policy does not authorise optional processing.

Official GDPR text: https://eur-lex.europa.eu/eli/reg/2016/679/oj
Portuguese Law 58/2019: https://diariodarepublica.pt/dr/detalhe/lei/58-2019-123815982