Version 2.6 — updated 22 October 2026.
This policy covers the SEV7N website, web app and mobile apps, operated by Next7 SRL in Belgium. Contact privacy@my.sev7n.app for privacy questions, including information about a player who does not hold an account.
Account and profile: email, authentication and account identifiers, display name, language and country. Sign-in uses email codes or a supported provider; we do not store plaintext passwords. Match content includes team and player names, photos, notes, lineups, scores, events and playing time. An optional injury marker records that a player got hurt during a match and may need substitution. A return-to-play marker clears that match indicator. We record the player and match time, not an injury description, diagnosis, treatment or medical recovery plan. These markers can concern health; playing time and participation statistics concern fitness. We do not read HealthKit or medical records.
When you choose location access, we use the approximate or precise position permitted by your device. Confirmed venue names and coordinates are saved with teams or matches and used for maps and weather; no background location is collected. Search text and coordinates are sent to the relevant venue or weather provider.
We also collect account-linked presence, session/activity timestamps, notification tokens and device/installation identifiers; purchase history, subscription status and account/store identifiers; referral associations when used; and messages you send support. Payment-card details are handled by the payment provider, not stored by SEV7N.
Crash, performance and other diagnostics include device/app information, error context and identifiers. App-supplied error context can contain player names or match identifiers, so diagnostics are not treated as anonymous. Website analytics and SDK technical telemetry are described below. We do not sell personal data or use it for behavioural advertising or cross-app advertising tracking.
We use account, content and subscription data to provide the requested service (GDPR Article 6(1)(b)); technical data and service/subscription analytics to secure, maintain and understand the service (Article 6(1)(f), subject to your rights); and legally required records to meet legal obligations (Article 6(1)(c)). Optional device access and website analytics rely on permission/consent where required (Article 6(1)(a)); you can withdraw it in device or cookie settings.
The person or organisation entering another player's data must have authority and an appropriate legal basis. Health information may require an additional Article 9 condition, such as valid explicit consent. Ordinary account acceptance or device permission does not itself establish that condition. Do not enter injury markers without the necessary authority, or add diagnoses, treatment details or medical documents.
Accounts are for people aged 13 or over. Under 18, a parent or legal guardian must review and agree to the terms on your behalf. This minimum age is not a claim that every child can independently consent under local law. Adults entering a child's name, photo or match information must have the necessary permission or other lawful basis.
Players retain rights over their personal data regardless of who entered it. A player or parent/guardian may contact us directly for access, correction or erasure; the account holder's permission is not required to make a request. Report an account belonging to a child under 13 to us.
Match notes are private to their author; team members and a new owner do not gain access to them.
Invitations and shared-team or match access can expose names, photos and match information to accepted recipients. Access depends on sign-in, role and membership. Revoking an invitation does not necessarily remove someone who already joined; manage their access separately. Exports, shared images and independent imports may remain with recipients. Do not publicly redistribute children's information without authority.
Supabase provides authentication, EU-region database/storage and realtime services for accounts and content. Cloudflare hosts the web app; Vercel hosts the public website; hosting providers process network/technical information. Resend delivers transactional email.
RevenueCat receives account, purchase and device identifiers for subscription management and revenue analytics. Stripe processes web payments; the relevant app store handles native purchases under its own terms. Firebase/Apple deliver notifications using tokens, installation identifiers and technical metadata. Firebase also processes SDK diagnostic/technical telemetry. Sentry receives crash, performance and diagnostic context.
Google Places receives venue searches and coordinates through our proxy; Nominatim/OpenStreetMap may receive fallback searches, coordinates and network information. OpenStreetMap map services receive map requests. Open-Meteo receives venue coordinates and forecast dates. Google Analytics measures the public website as described in section 8. These providers receive the information needed for the relevant feature; some act under their own privacy terms.
We may also disclose information when legally required, to professional advisers under confidentiality, or in a business transfer subject to applicable safeguards. We do not provide player content for advertising.
Account and match data are hosted in Supabase's EU region. Providers may process technical, support or other service data outside the EEA. Where required, recognised safeguards such as Standard Contractual Clauses apply. Contact us for information about the safeguards relevant to your data.
Account and content data are kept while needed to provide your account. Export anything you need before using Profile → Delete Account. Completed deletion removes the account and associated live-service data, including owned match history, uploaded media, notification tokens and referral records. There is no guaranteed post-deletion export window. Explicitly transferred teams and their shared match records remain under their new owner. Private notes never transfer and are erased when their author deletes their account. The departing user’s uploaded photos are removed even after team transfer. Other players retain their own access and erasure rights. Deletion does not cancel store subscriptions.
Restricted backup archives can retain copies after live deletion. Rotating visible backup files does not necessarily erase historical archive versions; we do not promise that all copies disappear within 366 days or that restoration automatically reapplies every deletion. Backup retention and recovery handling remain separate from live deletion; contact us for an erasure request concerning retained copies.
Providers may retain billing records where law requires. Technical logs, diagnostics and support records are retained according to their service settings and the needs of security, support or legal claims. We do not assert unverified fixed retention periods. You may request applicable retention information and erasure; legal retention exceptions will be explained.
The app uses session or secure device storage for authentication and local storage for preferences, cached data and pending writes. It does not use IDFA or advertising tracking. Service activity and purchase analytics are distinct from advertising.
On the public website, Google Analytics storage is denied until you accept cookies. Before a choice, Consent Mode may send limited cookieless measurement signals. The sev7n_cookie_consent cookie records your choice; use Cookie settings in the footer to change it. Advertising signals are disabled.
We also use Vercel Web Analytics on the public website to measure aggregate visits, page views and referral sources independently of the cookie choice. It does not set analytics cookies or receive account, player or team identifiers from us. We remove query strings and fragments from the measured page URL and honour browser Do Not Track and Global Privacy Control signals. Vercel derives a visitor hash from request information and discards the visitor session after 24 hours. This measurement supports our legitimate interest in understanding website traffic (GDPR Article 6(1)(f)); you may object using the contact details below. With your Google Analytics cookie consent, we also measure clicks to the web app, App Store and Google Play; these clicks do not establish that an installation or registration occurred.
When the usage analytics feature is available, we use PostHog (EU Cloud) to count anonymous app opens before you choose whether to participate. These events contain basic platform and app-version information and a temporary identifier held in memory for that app launch. We do not link them to your account or use them to recognise you across launches. This limited measurement supports our legitimate interest in understanding app usage (GDPR Article 6(1)(f)). Choosing “No thanks” or enabling Do Not Track stops this measurement too. Network processing still exposes a connection IP address to the provider; we disable IP enrichment.
If you opt in, we also measure app activity, screen visits, team creation and match viewing, starting and completion to improve the service. These events are linked to your account ID. In the native apps, technical information can include device model and manufacturer, operating system and version, and app version/build. We do not send your name, email, player or match content, raw page links or hardware identifiers as usage properties. Opening a match is not proof of recording it; recorded match actions describe locally saved activity and may precede server confirmation.
The same optional choice allows masked recordings on Home, Welcome, Profile setup and Teams to help us understand setup problems. Recordings include page layout, clicks, scrolling and timestamps. Typed values and personal text are masked; images and media are blocked. Authentication, invitation, payment and match-recording screens are not recorded. We do not use these analytics or recordings for advertising.
Account-linked analytics and recordings rely on consent (GDPR Article 6(1)(a)). Refusal does not restrict the service. Your existing choice is preserved for this account on this device. In Profile → Troubleshooting, turn off “Help improve Sev7n” to stop future analytics and recordings; older app versions may call this “Setup recordings”. Withdrawing consent does not erase earlier events or recordings. Account deletion requests removal of the associated account-linked PostHog profile, events and recordings; provider processing is asynchronous. You can also request erasure through the privacy contact below. Recordings are retained for up to 30 days under the current project setting; events follow the analytics retention settings, available on request. Availability depends on the installed app version and rollout settings.
We also count clicks on the web app, App Store and Google Play buttons using our Supabase backend, independently of cookie consent. The counter stores only the UTC date, destination and daily total; it receives no account ID, cookie, campaign tag or referring page URL from us. We honour Do Not Track and Global Privacy Control. Ordinary network processing by the hosting provider still applies. These aggregate counts support our legitimate interest in understanding whether website visitors continue to the app (GDPR Article 6(1)(f)); they do not identify people or establish installs. Repeated clicks, automated requests, browser blockers and network failures can affect totals.
Players and parents or legal guardians can request access or erasure without an account or the team owner’s permission. Contact privacy@my.sev7n.app with the team, season and information concerned, without medical details. We may verify identity or authority first. Removing a player from a roster alone does not erase historical match records.
Under the GDPR you have the right to:
Write to privacy@my.sev7n.app. We respond within one month, extendable by two further months for complex requests, in which case we will tell you within the first month. Exercising your rights is free; we may charge a reasonable fee only for manifestly unfounded or excessive requests. We may need to verify your identity first.
A parent or guardian may exercise these rights on behalf of a child whose data appears in SEV7N.
Please raise concerns with us first — we would rather fix it. You also have the right to lodge a complaint with a supervisory authority, in the country where you live, where you work, or where the issue arose. Ours is:
Autorité de protection des données / Gegevensbeschermingsautoriteit
Rue de la Presse 35 / Drukpersstraat 35, 1000 Brussels, Belgium
contact@apd-gba.be — autoriteprotectiondonnees.be
We apply measures appropriate to the risk, including: encryption in transit (TLS) and at rest; passwords stored only as salted hashes; row-level access controls so accounts cannot read each other's data; centrally managed secrets; least-privilege access for the small number of people who can reach production; and regular patching of our dependencies.
No online service can be guaranteed completely secure, and we do not claim otherwise. What we do commit to: if a breach occurs that is likely to result in a risk to your rights, we will notify the Belgian Data Protection Authority within 72 hours as Article 33 requires, and we will tell you directly, without undue delay, where the risk to you is high.
If you find a vulnerability, please report it to security@my.sev7n.app. We will not pursue good-faith security research that respects users' privacy and does not degrade the Service.
We will update this policy as the Service changes. For significant changes we will notify you by email or in-app notice before they take effect, and where the change requires your consent we will ask for it. The version number and date at the top always reflect the current text, and previous versions are available on request.
Privacy questions and data rights requests: privacy@my.sev7n.app
Security: security@my.sev7n.app
We answer at these addresses. Our postal address is in section 14 below.
See also our Terms of Service.
The data controller for the processing described in this policy is Next7 SRL, trading as "SEV7N", a private limited liability company incorporated in Belgium.
Our registered office, company number and other identification details are set out in our Legal Notice, which is linked from every page of this site.
For anything concerning your personal data, write to privacy@my.sev7n.app. We have not appointed a Data Protection Officer, as we are not required to; messages to that address reach a person, not a queue.