This Privacy Policy describes how yallaGoal ("we", "us") collects, uses and shares information when you use the yallaGoal mobile app, website and admin portal (together, the "Service").
1. Information we collect
Information you provide
The only information required to create an account is your mobile phone number, which we use to send a one-time code for sign-in. After signing up you may optionally add:
- A display name;
- A date of birth;
- A profile photo;
- For venue managers: venue name, address, location, pitch details, opening hours, amenities and photos.
We do not collect government identification numbers, payment-card numbers or bank account details.
Gameplay information
When you take part in a group's games we record the groups you join, the games you register for, attendance, goals and assists, player ratings, award votes, and the teams you are placed on. This is the point of the app: it is visible to the members of that group.
Booking information
When you request a booking we process the venue, pitch, date and time you selected, together with your name and phone number, so the venue can confirm it.
Content you submit
You may submit venue reviews and upload match photos or videos. Content you submit publicly may be shown to other users alongside your display name.
You can also report content you consider objectionable, and block another user — both create records, described under Reports and blocking below.
Device and technical information
If you enable notifications we store a push token for your device. We also process your chosen app language and the basic technical data needed to serve the app securely.
2. How we use information
We use the information above to:
- Sign you in and keep your account secure;
- Create and manage bookings with venues;
- Run your group's games, squads, statistics, leagues, tournaments and awards;
- Send the notifications you have turned on;
- Show venues near you when you ask for them;
- Detect abuse, enforce our Terms, and keep the Service working.
We do not build advertising profiles, and we do not operate third-party advertising or analytics SDKs inside the app.
3. How information is shared
With other users
Your display name and profile photo are visible to groups you join. Your attendance and statistics are visible within that group. Venue reviews you post are public alongside your display name.
With venues
When you request a booking, the venue receives your display name, phone number and the booking details so it can confirm, modify or decline the request.
With service providers
We rely on a small number of processors, which handle data only on our instructions:
| Provider | Purpose |
|---|---|
| Supabase | Database, authentication and file storage |
| SMS provider | Delivery of your one-time sign-in code |
| Expo | Delivery of push notifications |
| Apple / Google | Map tiles and app distribution |
| OpenStreetMap (Nominatim) | Converting addresses to map coordinates |
We do not sell your personal information, and we disclose it to anyone else only where the law requires it or to protect the rights and safety of users.
4. Location
Location is used only while you are viewing a map or asking for venues near you, and only if you grant permission. It is used to centre the map and to sort venues by distance.
We do not store a history of where you have been, and we never track your location in the background. You can refuse or later revoke the permission in your device settings and continue to use the Service by searching for venues by name or area.
Map tiles and address lookups are served by Apple Maps (iOS), Google Maps (Android) and OpenStreetMap, which necessarily receive the coordinates of the map area you are viewing.
5. Photos and media
The app requests access to your photo library only at the moment you choose to set a profile picture, add a venue image, or attach media to a match. Only the images you explicitly select are uploaded. We never scan, index or read the rest of your library.
6. Reports and blocking
The Service carries content created by other users — venue reviews, match photos and videos, and display names. Two controls exist to keep that content safe, and both create records.
When you report something
Reporting a review, photo or video records who filed the report, what was reported, the reason you chose, and any note you added. Our moderation team reviews reports, normally within 24 hours.
Reports are confidential. The person you report is never told who reported them.
When you block someone
Blocking records that you blocked that account, and their reviews and match media stop appearing to you. The person you block is not notified and cannot see that you blocked them. You can undo a block at any time in the app (Profile → Blocked people).
How long we keep it
We keep reports and their outcome for as long as we need them to enforce these Terms and to recognise repeated behaviour, and we keep a block for as long as it is in place. Our legal basis is our legitimate interest in keeping the Service safe.
7. Notifications
If you allow push notifications we store a device token so we can reach you about your games, bookings and invitations. You can turn individual categories off inside the app, or disable notifications entirely in your device settings. The token is deleted when you delete your account.
8. Payments
yallaGoal never handles money and never sees card or bank details. Where a group enables match fees, the app acts purely as a ledger: it records who owes what, and what an organiser has marked as paid. Payment itself happens off the app, directly between you and your organiser or the venue.
9. How long we keep information
We keep your information for as long as your account is active. When you delete your account we remove your profile, phone number, push tokens and personal content.
Match records that form part of a group's shared history may be retained in anonymised form, so that the group's past results and statistics remain intact. Residual copies in encrypted backups are removed within 30 days.
10. Your rights and choices
You can view and edit your profile at any time, and you can delete your account permanently from within the app (Profile → Delete account) without contacting us.
You may also ask us to provide a copy of your data, correct it, restrict or object to a particular use, by writing to the address in the Contact section.
If you are in the European Economic Area or the United Kingdom, you have the rights granted by the GDPR, including the right to lodge a complaint with your local supervisory authority. Our legal bases are performance of a contract (running your bookings and games), your consent (location, photos, notifications) and our legitimate interests (security and abuse prevention).
11. Children
yallaGoal is not directed at children under 13, and we do not knowingly collect information from them. If you believe a child has created an account, contact us and we will delete it.
12. Security
Data is encrypted in transit. Access to the database is constrained by row-level security rules, so an account can only read the records it is entitled to. Sign-in uses one-time codes rather than stored passwords.
No system is perfectly secure, but we work to protect your information and will notify you of a breach affecting you as required by law.
13. International transfers
Our providers may process data on servers outside your country. Where data leaves the European Economic Area or the United Kingdom, it is transferred under appropriate safeguards, such as the European Commission's Standard Contractual Clauses.
14. Changes to this policy
If we change what we collect or how we use it, we will update this page and the date above. Where a change is significant we will also tell you inside the app.
15. Contact us
Questions, requests or complaints about privacy: