Privacy Policy

Vector Football ("we", "us", "our") is a strength & conditioning app for footballers. This Privacy Policy explains what personal data we collect, how we use it, who we share it with, and your rights — wherever in the world you are using the app.

By using Vector Football you acknowledge that you have read this policy. If you do not agree, please do not use the app.

1. Who we are & how to contact us

Vector Football is operated by Luke Craig Jarman, trading as "Vector Football" as a sole trader (not yet a registered company), and acting as the data controller for the personal data described in this policy. For all privacy-related enquiries — including exercising any right under applicable law — please contact:

Controller: Luke Craig Jarman, trading as Vector Football
Address: 17 Wrag View, Highworth, SN6 7QJ, United Kingdom
Email: vectorfootball.com@gmail.com
Website: vectorfootball.co.uk

We will acknowledge your request within 5 business days and respond fully within 30 days (extendable to 90 days for complex requests, with prior notice to you).

2. Data we collect

Data we do not collect: We do not collect racial or ethnic origin, political opinions, religious beliefs, trade union membership, biometric identity data, criminal record data, or GPS location. We do not read your contacts, messages, or photos beyond the profile photo you explicitly select.

3. Special category data (health & fitness)

You may withdraw consent for health data processing at any time by deleting your account (Profile → Delete Account & All Data). We will erase all such data from our servers within 30 days. Note that deleting health data means we can no longer provide personalised training features.

If you connect Apple Health, raw sleep, heart-rate variability, and resting-heart-rate values are processed on your device to calculate readiness and are not uploaded to our servers. Your saved readiness score and the manual ratings you enter may be included in cloud sync.

4. How we use your data & legal bases

5. Automated decisions & programme generation

Vector Football uses automated algorithms to generate personalised training programmes based on your profile, test results, playing position, and readiness data. Consistent with GDPR Article 22 and equivalent global transparency obligations, we disclose that:

• Programme generation is deterministic and rule-based — not opaque AI.
• You can override, ignore, or customise any recommended session at any time.
• No profiling data is used to make decisions with legal or similarly significant effects (employment, credit, insurance, housing).

You have the right to request human review of any automated recommendation by emailing vectorfootball.com@gmail.com.

6. Third-party processors

Each processor below is contractually bound to process your data only under our instructions.

6a. Coach and Club data sharing

If you join a Coach or Club account as a player, the coach(es) on that account can see data relevant to managing your training — including your readiness, injury and availability information, test results, training compliance, and load data — plus any notes they add about you. This sharing starts when you accept a link/invite to join their squad and stops when you leave or are removed from it, or when you delete your account. Coach notes about you are retained with the squad's data and are covered by the same deletion and access rights as your own data.

Peer leaderboards are separate: your data is only shown to other players in the same squad if you opt in, and you can opt out at any time.

For Coach/Club accounts, we may act as a data processor on the coach's or club's instructions for some of this player data, and as a controller for the underlying app service and our own analytics. Coaches and clubs are responsible for having a lawful basis to enrol and manage their players' data, including any safeguarding obligations for players under 18.

7. International data transfers

We are based in the United Kingdom. Your data may be processed in countries outside the UK and EU/EEA — including services operated by Supabase, RevenueCat, PostHog, Sentry, hCaptcha, Google, and Apple. Where transfers occur, we rely on:

• UK-recognised transfer safeguards (such as the UK International Data Transfer Addendum, an equivalent standard clause set, or an applicable adequacy arrangement) with our sub-processors, to the extent each transfer requires one.
• Technical measures — all data encrypted in transit (TLS 1.2+) and at rest (AES-256) as configured by our providers.

You may ask which safeguard applies to a specific supplier by emailing vectorfootball.com@gmail.com.

8. Data retention

To delete your account: Profile → Delete Account & All Data. This is permanent and, within 30 days, erases your personal data from our own application systems and local device backups. Some records may continue to exist for longer where a supplier (see Section 6) or a legal obligation requires it — for example billing records we must keep for 6 years, or a copy in a supplier's own backups that is not immediately purged. Deleting your account does not itself cancel an active Apple subscription — cancel that separately in your Apple ID account settings before deleting.

9. Your rights — global overview

See Section 15 for rights specific to your country.

10. Analytics opt-out

You can disable analytics at any time without affecting any other feature:

1. Open the app and tap Profile (bottom navigation).
2. Scroll to the Privacy section.
3. Toggle Usage Analytics off.

When opted out, no usage events are sent to PostHog. This preference is saved to your account, syncs across devices, and applies immediately.

11. Children's privacy

Vector Football is likely to be used by some users under 18, including 13–17 year olds, and we take extra care with their data as a result — see the age requirements in our Terms of Use. Minimum age requirements by region:

If you believe a child has provided us with personal data, email vectorfootball.com@gmail.com and we will delete it promptly.

12. Security

• Encryption in transit: All network communication uses TLS 1.2 or higher.
• Encryption at rest: Database data is encrypted at rest (AES-256 via Supabase/AWS).
• Authentication: Account passwords are managed by Supabase Auth (bcrypt). Passwords are never stored or transmitted in plaintext by Vector Football.
• Access control: Row-level security (RLS) restricts each account to its own data by default, with the specific, disclosed exception of authorised coach access under a Coach/Club account — see Section 6a.
• Payment security: Card data is handled exclusively by Apple — we never see or store card details.
• Least privilege: The app client uses Supabase's anonymous key only; privileged operations run in server-side functions.
• Regular audits: We conduct code security reviews and address vulnerabilities promptly.

To report a vulnerability responsibly: vectorfootball.com@gmail.com

13. Data breach notification

In the event of a data breach likely to affect your rights and freedoms, we will:

• Notify the relevant supervisory authority within 72 hours (GDPR / UK GDPR Article 33).
• Notify affected users without undue delay if the breach poses high risk to them.
• For US users: comply with applicable state notification laws, including California (notification generally required within 30 days, subject to statutory exceptions), New York, Texas, and others.
• For Australian users: comply with the Notifiable Data Breaches (NDB) scheme under the Privacy Act.
• For Brazilian users: notify the ANPD and affected data subjects as required by LGPD.

14. Do Not Sell or Share my personal information

We do not sell, rent, or share your personal information with third parties for their own marketing or advertising purposes — ever.

Under CCPA / CPRA (California):

• We do not "sell" personal information as defined by CCPA § 1798.140(ad).
• We do not "share" personal information for cross-context behavioural advertising.
• We do not use sensitive personal information beyond what is necessary to provide the service.

Because we do not sell or share data, no opt-out mechanism for sale/sharing is required. You may still opt out of analytics at any time (Section 10).

15. Region-specific supplements

16. Changes to this policy

When we update this policy:

• The "Last updated" date at the top of this page changes.
• For material changes (reduced rights, new data categories, new processors), we notify you in-app and by email at least 14 days before the change takes effect.
• Continued use after the effective date constitutes acceptance.
• Previous versions are available on request.

17. Contact & supervisory authorities

Luke Craig Jarman, trading as Vector Football (sole trader, not yet a registered company)
17 Wrag View, Highworth, SN6 7QJ, United Kingdom
vectorfootball.com@gmail.com
vectorfootball.co.uk