Privacy policy

1. Who is responsible

• Controller: Voleibol Laredo, a non-profit initiative run by a private individual.
• Privacy contact: volleyplaya.dev@gmail.com

2. What data we process

• Account: when you sign in with Google, the sign-in system receives your email address, an identifier and basic profile data. Volley only uses the identifier: it does not show or use your Google name or photo.
• Nickname: the one you choose (2 to 20 characters). Only you can see it.
• Use of the service: the spots you sign up for, your attendance confirmed by QR, your faults and blocks, and any claims you send.
• Results and summary: if you organise a match, the points of each team that you enter. These points are stored with no user data at all; the app links them to your spot to work out your personal summary (matches played, wins, losses and draws).
• Acceptances: that you accepted the terms and this privacy policy and that you are 14 or older, with the date.
• Preferences: language and notifications.
• Mobile notifications: if you turn them on, for each device we store the address of your browser’s notification service (endpoint) and two technical keys (p256dh and auth) needed to send you the notification. Only its owner can see them.
• Technical data: your IP address reaches the services we use when you visit the website, sign in with Google or check the weather.

We do not ask for or store your location, name, photo or any password.

3. Why, and on what legal basis

• Creating your account and letting you sign up for matches: necessary to provide the service you ask for.
• Confirming attendance, faults and temporary blocks: so the system is fair to everyone. This is based on our legitimate interest in keeping the service working.
• Personal summary and season PDF: to provide a service you asked for; they only contain your own data.
• Mobile notifications: only if you turn them on. You can withdraw them at any time from your profile.
• Record of your acceptances: to comply with data protection law.

4. Who can see your data

• Other users: nobody. They only see free and taken spots. The organiser scans your QR but does not see your name.
• The administrator can access the information needed to resolve claims and keep the service running. Claims are shown with spots and numbers only, never names.

5. Third-party services

To work, we use these providers, who process data on Volley’s behalf or for their own function:

• Supabase: database and sign-in system. The project is hosted in the European Union. The public website, without signing in, only asks it for the administrator’s active notices; that request carries no data about you, although the server receives your IP address as in any connection.
• Google: sign-in. When you press “Sign in with Google” you go through their page and their privacy policy applies. We use the data Google provides only to sign you in and identify your account in Volley; we do not use it for advertising or share it. Our use of information received from Google APIs complies with the Google API Services User Data Policy, including its Limited Use requirements.
• Open-Meteo: weather forecast, in the app and on the public website (home and courts page, only when you scroll to that part). Your browser contacts their service directly, so it receives your IP address and the coordinates of the court (not yours). We send them no other personal data about you.
• Your browser’s notification services (Google, Microsoft, Mozilla or Apple, depending on the browser): if you turn notifications on, the message passes through your browser’s service. It is encrypted and only carries a time, a court and numbers, never names.
• Cloudflare Pages: website hosting.

When a provider processes data outside the European Economic Area, it must do so with the safeguards required by the GDPR.

6. Your season summary and PDF

• The summary in the app only shows your data.
• When the season ends you can download your season as a PDF for 15 days. The PDF is generated on your own device: it is not sent to or stored on any server.
• It contains your figures, your active faults and your matches (day, time, court, team, spot and score). It has nobody’s name on it.

7. How long we keep it

• Your account and data, for as long as you keep the account. If you delete it, it is removed immediately.
• Each fault expires after 30 days.
• Match records: 15 days after the season ends, match records (sign-ups, attendance, results and claims) are deleted and faults and blocks are reset. This is an automatic deletion that runs once per season.
• Notification subscriptions: until you turn notifications off, sign out on that device, delete your account or your browser’s service reports the subscription as expired.

8. What is kept on your device

To work, Volley keeps your session, your language and the app’s files in your browser and, in memory, the latest data you saw so that screens are not empty when you switch tabs. This data stays on your device and is cleared when you sign out. More details in the cookie policy.

9. Your rights

You can ask for access to your data, correct it, delete it, object to its processing, restrict it or request its portability. Write to volleyplaya.dev@gmail.com and we will reply free of charge. To delete your account you do not need to write: there is a button in your profile.

If you believe your rights have not been respected, you can complain to the Spanish Data Protection Agency (AEPD).

10. Minors

To use Volley you must be 14 or older. If we find an account belonging to someone under that age, we will delete it.

11. Security

Every table in the database has row-level access rules, so each person can only access their own data. We never ask for passwords: sign-in is handled by Google.

12. Changes

If this policy changes significantly, we will announce it on the website and update the date above.