Can other families see my child's data?

No. Each family only sees their own children's information, and the rules are enforced in the database, not just on screen.

Is medical data stored?

There are no fields for diagnoses or medical results. Only the date of the last medical check and the date until which it is valid can be recorded, to keep track that it is up to date.

How long is data kept?

Each season's data is deleted two years after it ends, with 30 days' notice to the club. Billing data is kept for eight years as an accounting obligation.

Can the data be taken out of Spooru?

Yes. The club administrator can export the calendar, squad, attendance and statistics to Excel/CSV, and every export is logged.

What happens to players' photos?

They are not public: only authorised people see them through temporary links, and the club can remove them whenever it wants.

How we protect your club's and your players' data

A grassroots club works with children's data. This page explains, with no small print, what data Spooru stores, who can see it, how long it is kept and what each person can and cannot do. The legally binding texts are the privacy policy and the data processing agreement; here we summarise them.

Who is responsible for what

The club is the controller of its players', families' and coaches' data: it decides what data it needs and on what legal basis it processes it. Spooru provides the technology on the club's behalf as a processor, under a data processing agreement. For account and service-usage data, Spooru is the controller.

What player data is stored

First and last name, date of birth, team and age group, shirt number, position, call-ups, attendance and sports statistics.
A photo, only if the club uploads one.
The date of the last medical check and the date until which fitness to play is valid, only to keep track that it is up to date.
There are no fields for diagnoses, injuries or medical results. The only free text about a player is the short comment on the developmental review (280 characters), and clubs must avoid entering health information.
The staff's developmental review (a level from 1 to 4 in technical, tactical, physical and psychosocial areas and an optional short comment) is visible only to the team's staff and the club administrator; families and players cannot see it and it is not exported.

Each person sees only what concerns them

The club administrator sees every team; coaches and staff, only their own; families, only their own children; players from age 16 can have their own access.
These rules do not depend only on what is shown on screen: they are enforced in the database itself (row-level security), so a person cannot see other teams' data even if they know an address.

Photos are not public

Players' photos are not accessible on the internet: they are only shown to authorised people through time-limited links, and the club can remove them at any time. When a photo is uploaded, an automatic check makes sure the image is appropriate; nobody is identified, age is not estimated and no facial recognition is used.

Every change is logged

The club administrator can check a log of additions, edits and deletions (players, calendar, billing…) showing who did it and when.

Exporting data, with controls

The administrator can export the club's data to Excel/CSV. Coaches can only export the calendar and statistics of their own teams, with players shortened (“First name + initial”) and no notes.
Families' contact details, health data and payment data are never exported.
Every export is logged: who, when, what and how many rows.

Calendar on your phone, with a private link

The link used to view the calendar in Google, Apple or Outlook is private, can be changed or turned off whenever you like, and in our systems we only store its fingerprint, not the link itself.

Automatic deletion

A season's data (teams, calendar, call-ups, statistics, developmental reviews, messages, sessions, line-ups and tournaments) is deleted automatically two years after the season ends. Administrators get a warning at least 30 days beforehand.
Player profiles that no longer belong to any team are deleted together with the season, along with their photos.
SEPA direct-debit data is masked or deleted 14 months after the last collection; billing data is kept for eight years as an accounting obligation.

Payments

Card payments are processed by Stripe: Spooru does not store full card numbers.

Advertising and minors

Families who do not take the ad-free option see third-party ads (Google AdSense), after managing their consent. Minors with their own access only see non-personalised ads. The club panel has no ads.

Who we work with

Spooru does not sell personal data. These providers are involved in delivering the service: Supabase (database and files), Vercel (web hosting), Resend (email), Stripe (payments), Google (advertising and consent management), Anthropic (automatic photo check), OpenAI (translation and illustrations of the club's own exercises, with no personal data) and OpenStreetMap (maps and address search). The up-to-date list and the safeguards for transfers outside the European Economic Area are in the privacy policy.

What we do not promise

We apply reasonable technical and organisational measures: role-based access control, password authentication with passwords stored in protected form, an encrypted connection and a change log. No system connected to the Internet can guarantee absolute security.

Your rights and how to contact us

You can exercise your rights of access, rectification, erasure, restriction, objection and portability by writing to info@spooru.com; we reply within one month. If the data belongs to your club, you can also contact the club. For minor players, rights are exercised by those who are legally entitled to do so.

Frequently asked questions

Can other families see my child's data?: No. Each family only sees their own children's information, and the rules are enforced in the database, not just on screen.
Is medical data stored?: There are no fields for diagnoses or medical results. Only the date of the last medical check and the date until which it is valid can be recorded, to keep track that it is up to date.
How long is data kept?: Each season's data is deleted two years after it ends, with 30 days' notice to the club. Billing data is kept for eight years as an accounting obligation.
Can the data be taken out of Spooru?: Yes. The club administrator can export the calendar, squad, attendance and statistics to Excel/CSV, and every export is logged.
What happens to players' photos?: They are not public: only authorised people see them through temporary links, and the club can remove them whenever it wants.