Privacy Policy

    Last updated: June 23, 2026

    Overview

    This Privacy Policy explains how MB Ekipax ("SquadX", "we", "us"), based in Vilnius, Lithuania, collects, uses, and shares personal data across the SquadX platform: the coach-facing web app and the player-facing mobile app (together, the "Service"). It applies to everyone who uses the Service — coaches, club administrators, and players (and, where relevant, their parents or guardians).

    For any privacy-related questions or requests, contact us at hello@squadx.app.

    1. Who is responsible for your data

    SquadX provides the Service to sports clubs and their coaches. In data-protection terms:

    • Your club is the controller of the roster and training data it records about its players (names, team membership, attendance, evaluations, injuries, notes, and similar). SquadX acts as a processor for that data, on the club's instructions.
    • SquadX is the controller of your account data (your login and the way you use the Service) and of data submitted through our website forms.

    If you are a player and want a club's records about you changed or erased, contact your club/coach (the controller). You can also contact us at hello@squadx.app and we will help route the request.

    2. Data we collect

    Account & identity. Email address, name, password (stored hashed by our authentication provider), and — if you sign in with Google — your Google profile (name, email, profile picture).

    Players (mobile app)

    Your coach creates your player profile, which may include: name, email, phone, date of birth, height and weight, playing positions and jersey number, and guardian/parent contact details (name, email, phone). We also store training and match data linked to you: attendance and RSVPs, self-assessment and coach ratings (effort, focus, attitude), pre/post-match check-in answers, game participation, and injury records kept by your coach.

    Coaches & admins (web app)

    Profile details (name, phone, bio, coaching license, specialization, experience), the club and teams you manage, the content you create (drills, training plans, sessions, player notes, evaluations), and billing information for subscriptions (see §6).

    Device & technical. If you enable push notifications, a device push token and platform (iOS/Android). Session tokens are stored securely on your device (Keychain on iOS, encrypted storage on Android).

    Website forms. If you contact us, book a demo, or subscribe to our newsletter via our website, the details you submit (e.g. name, email, organization, subject, and message content).

    Sensitive data

    Injuries, fitness-test results, and physical attributes may constitute health-related data, and some data concerns minors. We process these only to provide the Service to your club, on the basis of the club's lawful grounds and any parental/guardian consent the club is required to obtain.

    3. How and why we use data

    • To provide the Service — accounts, team rosters, scheduling, check-ins, and evaluations.
    • To send the push notifications you've enabled (reminders, check-in windows).
    • To process club subscriptions and payments (coaches/clubs only).
    • To power AI assistance for coaches (drill descriptions and training-plan suggestions) — see §4.
    • To secure the Service, prevent abuse, provide support, and meet legal obligations.

    Where the GDPR applies, our legal bases are: performance of a contract, our and the club's legitimate interests, your consent (e.g. push notifications and, where required, health data), and compliance with legal obligations.

    4. Service providers we share data with

    We use a small set of sub-processors to run the Service:

    • Supabase — database, authentication, and file storage (the EU-hosted backend that holds your data).
    • Google — optional Google Sign-In, and push-notification delivery (Firebase Cloud Messaging).
    • Stripe — subscription payments and billing (coaches/clubs only; SquadX does not store full card details).
    • Resend — sending transactional emails (e.g. invitations and account notifications).
    • Anthropic (Claude) and OpenAI — AI features for coaches. We send drill/session/training-plan content and the coach's planning answers to generate suggestions and to power library search. We do not send player personal data, contact details, health/injury data, or individual player ratings to these AI providers.

    We do not sell your personal data, and we do not share team data with federations, other clubs, or other coaches. We share data with these providers only as needed to run the Service, and with authorities where legally required.

    5. International transfers

    Our core data is stored on EU-hosted servers. Some providers may process data outside the EU (e.g. in the United States). Where required, such transfers rely on appropriate safeguards, such as the European Commission's Standard Contractual Clauses.

    6. Payments

    Subscriptions are purchased by clubs/coaches on the web app via Stripe. Players do not pay and inherit access through their club. We store a Stripe customer reference for your club and your subscription status; card data is handled by Stripe under its own privacy policy.

    7. Data retention & account deletion

    We keep personal data for as long as your account is active or as needed to provide the Service, then delete or anonymize it (subject to any legal retention obligations).

    • Account & profile data: deleted within 30 days of account deletion.
    • Training & match data: deleted or anonymized alongside the account, except for the minimal roster record described below.
    • Website contact messages: retained for 12 months, then automatically deleted.

    Players (mobile app)

    When you delete your account in the app, your login and personal details (email, phone, guardian contact, date of birth, height/weight) are deleted. Your club retains a minimal roster record (your name and team membership, plus training history) as the team's own record, so a coach can recognize the slot if you rejoin. To have that record fully erased, contact your club or us at hello@squadx.app. See our account deletion page.

    8. Security

    • Access to data is enforced by row-level security, so users only see what their role permits.
    • Data is encrypted in transit (HTTPS/TLS) and at rest; mobile session tokens are kept in the device secure store.
    • Access to production data is restricted to authorized personnel only.

    No method of transmission or storage is 100% secure, but we follow industry-standard practices to protect your data.

    9. Children & minors

    Players may be minors. Clubs are responsible for obtaining any parental or guardian consent required to enroll a player and record their data under their local law. We collect guardian contact details to support this. Where required, guardians may exercise a minor's rights on their behalf by contacting the club or us at hello@squadx.app.

    10. Your rights (GDPR)

    Depending on your location, you have the following rights over your personal data:

    • Right to access: request a copy of the data we hold about you.
    • Right to rectification: request correction of inaccurate data.
    • Right to erasure: request deletion of your data ("right to be forgotten").
    • Right to data portability: request your data in a structured, machine-readable format.
    • Right to withdraw consent: withdraw consent at any time where processing is based on consent.
    • Right to lodge a complaint: file a complaint with your local data-protection supervisory authority.

    Exercise these rights in the app (e.g. account deletion), by contacting your club (for roster/training data), or by emailing us at hello@squadx.app.

    11. Cookies & analytics

    • Essential cookies: the coach web app and player mobile app use only the cookies and secure storage necessary for authentication and session management.
    • Marketing website: our public website (squadx.app) uses analytics and advertising cookies, including Google Analytics and the Meta Pixel, to measure campaigns and improve the site.
    • The coach web app and the player mobile app do not include third-party analytics or advertising SDKs.

    12. Changes & contact

    We may update this policy from time to time; we'll post the new version here with an updated revision date, and for significant changes we will notify registered users by email.

    Questions or requests: