Beta draft · version 0.6 · 27 Oct 2026

Privacy

Version 0.6, published 27 October 2026 · applies to the MatchTempo beta for Apple Watch, iPhone and matchtempo.app

Who we are

MatchTempo is made by an independent developer in the United Kingdom, who is responsible for your data under UK data protection law. We are the controller of the data described here. Contact us at support at matchtempo dot app.

Two ways to use MatchTempo

Only recording on your Watch

You don't have to sign in to record your own games. Recording doesn't send your recordings or health readings to our servers. If you signed in before, signing out doesn't delete your account or your groups' history, and if you email us we keep your message as explained below.

Signed in, for groups and games

To start or join a group you sign in with Apple or Google. We then keep your account and your groups' games on our servers, so everyone in the group sees the same replies, teams and results. Your recordings and health readings stay separate from this.

What stays on your devices

These are kept on your Apple Watch and iPhone, and not sent to our servers:

• heart rate, distance, calories, your route and location during a game, motion, recovery, effort and enjoyment;
• your max heart rate, how it was set, and your heart rate zones;
• your date of birth, if you add it or MatchTempo reads it from Apple Health, and your gender, if you add it;
• your recordings;
• a group photo you take or choose, which stays on the iPhone you added it on.

Recordings move from your Watch to your iPhone, and your heart rate zones from your iPhone to your Watch, using Apple's own connection between the two devices. Apple Health and your backups may also hold copies, as explained below. If you send us a screenshot or feedback yourself, it contains whatever you put in it, so please leave out health details unless we need them to help you.

Apple Health

With your permission, MatchTempo reads from Apple Health:

• on your Watch, your heart rate and active energy during a game, to show them live and in your summary;
• on your iPhone, your date of birth, your workouts from the last 12 months (including ones recorded by other apps) and the heart rate saved with them. It uses these only to estimate your max heart rate and work out your heart rate zones. If there are not enough workouts with heart rate, it estimates your max heart rate from your age. You can set it yourself instead.

When Save to Health is on in MatchTempo, and you have allowed it, MatchTempo writes the workout, with its route, active energy and distance, to Apple Health.

Using Apple Health is your choice, and you can change it at any time in the Health app or in Settings. Turning it off stops MatchTempo reading or writing from then on; it doesn't remove what is already saved. Health data is never sent to our servers, never used for advertising, never sold and never shown to your groups.

Location, motion, Bluetooth and camera

Location is used only while you're recording, to measure distance and save your route. Motion data helps describe your movement during a recording. Bluetooth is used only to connect a heart-rate strap you choose. The camera is used only when you choose Take photo for a group picture, and the photo stays on your iPhone.

When a manager searches for a venue, the search goes to Apple Maps. The venue they pick (name, address and map location) is kept with the group on our servers.

What we keep when you sign in

Your account

• Your first and last name from Apple or Google, a nickname if you add one, and which name your groups see.
• Your sign-in details: our sign-in service keeps the email address Apple or Google gives us (with Apple, this can be a private relay address), an identifier for your Apple or Google account, any name they send, and records of when you sign in, including your IP address. We never ask you to type an email address. You can see it in Personal details in the app, but not change it there. We don't show it to your groups, managers included.
• That you ticked the box to confirm you are 18 or over. We don't store your age or date of birth. You sign in with Apple or Google before you tick it, so our sign-in service already has your sign-in details by then. If your iPhone shares an age range from Apple, we only record that Apple confirmed you are 18 or over.
• Your agreement to the Terms and this policy: which versions, the date and time, whether you agreed in the app or a browser, and the app or site version. A new record is added each time you agree.
• Whether you have chosen to be left out of stats and tables.
• If you add a child as a player you look after: that you confirmed you are their parent or guardian, and when. What we keep about the child is explained in Children.
• If you link two sign-ins or merge two accounts: the old and new account identifiers and when it happened, so we can tell what moved.

Your groups and games

• Groups: name, manager, assistant managers, members and settings, such as how many players a game takes, the minimum age, even sides, reply and drop-out times, how places are given out, seasons and how goals are checked.
• Players: first name, last name, nickname, squad number, usual position, stronger foot and preferred side. The manager may add players who don't use the app, and a parent or guardian may add a child they look after (see Children).
• Games: dates, kick-off times, venues (name, address and map location), kits, team names, teams, results, scorers, own goals and Player of the Match.
• Replies: I'm in, Maybe or I'm out, whether you're bringing someone, and when you replied. The manager or an assistant manager can also record a reply for you.
• Guests: the name of a guest added to one game, and who brought them.
• Places and the waiting list: who has a place and who is waiting is worked out from the replies by the group's rule: who replied first, games played this season, how many of the group's last 10 games each player played, the players the manager marks as regulars, or the manager's own choice. The manager or an assistant manager can always move someone in or onto the waiting list.
• After a game: whether you played, the goals you say you scored (you can bring these in from your Watch), teammates you say scored, and own goals. These carry the goal and the score, never your health data.
• Player of the Match votes: who you voted for, until 30 days after the game.
• Seasons and awards: when each season starts and ends, which games count, and the season awards and badges worked out from the results.
• Reasons and notes: the reason given when a result is corrected or a game is made void, the reason a game is cancelled (up to 60 characters), a short note on a game, such as "Pitch 3, round the back" (up to 200 characters), and short notes the manager or an assistant manager adds when recording a reply or moving someone in or out.
• Late drop-outs and no-shows: the manager or an assistant manager can record that a player dropped out after the game's drop-out deadline, or did not turn up. We keep which player, which game, which of the two it was and when it was recorded. Nothing is recorded automatically, and a record does not change a player's place, teams, rating or payments. Guests are never recorded.
• A history of changes, so a corrected result keeps the earlier one and the reason.

Keep reasons and notes short and factual. Don't put health details, such as an injury, or anything private about someone else in them.

Payments for games

A manager can choose to take payment for games in the app. Card payments, including Apple Pay and Google Pay, go through Stripe straight to the manager's own Stripe account. The manager runs the game and receives the price. We never hold the money for games; we receive only our fee, which is shown before you pay.

When you pay, we keep: who paid, for which games and places, the price, our fee and the total, whether it succeeded, refunds, money carried over to later games, payments the manager marks as made outside the app, reminders sent, and Stripe's references for the payment. Stripe receives these references and the amounts, not players' names. Stripe handles your card details; we never see or keep them.

A manager who takes payments gives their own identity and bank details to Stripe, not to us, and becomes Stripe's customer. We keep their Stripe account identifier and whether it is ready to take payments and pay out.

Before setting up payments, a manager gives us their mobile number. We check it is theirs by sending a code by text message, and we keep the number and when it was checked. We pass it to Stripe for the manager's Stripe account, and we use it to contact the manager about payments, refunds, disputes or a problem with their group. We don't use it for marketing. We also give it to Stripe as the support phone number for the manager's payments, so Stripe may show it to players on card receipts, statements or Stripe's payment pages. The manager can change it by checking a new mobile number in the app. MatchTempo itself never shows it to players or assistant managers.

A manager can also take a payment from you in person. They can show you a QR code, or take a card payment on their own iPhone (Tap to Pay on iPhone). The payment goes to the manager's Stripe account in the same way, and Apple and Stripe handle the card details: we never see or keep them. For each payment we also keep how it was taken (in the app, on the website, by QR code or by tapping a card) and, for a payment the manager took in person, which manager took it.

A QR code opens a one-off payment page on matchtempo.app, which then passes you to Stripe's payment page. The link holds a random code and works for 30 minutes. We keep only a scrambled (hashed) copy of the code, so we cannot read it back. To stop people trying links over and over, each time the page is opened we keep a scrambled (hashed) form of the visitor's IP address for at most 2 days and use it to count recent tries. We cannot read the IP address back from it. The page sets no cookies. Our hosting service and Stripe also keep their own technical logs, as described under Logs and security.

If a manager takes a payment from one player but it should have been another player's, the manager can move it to the right player in the same game. No money moves: only our record of who paid changes. We keep a record of each move: which payment, who it moved to, which manager moved it, when, and a short reason if the manager types one. The manager sees this record. The first player sees that the manager moved the payment, but not the manager's name or the reason.

A parent or guardian pays for the children they look after. Those payments are kept under the parent's account, as their own payments, and the manager sees who paid.

The manager and assistant managers see who has paid for each game, how, what is still owed and any money carried over. Only the manager sees how a payment was taken and which manager took it. You see your own payments. Other players don't see what you paid, and game links never show payments.

Kick-off weather

If a venue has a map location, our server asks Apple Weather for the forecast at kick-off. Only the location, rounded to about 1 km, is sent to Apple, with no names or other details. We use a forecast for at most 12 hours and remove old ones every hour. We never store forecasts with results.

Logs and security

When the app or a browser talks to our servers, our hosting and sign-in services record technical logs, such as IP address, time, the request made and any error. We also keep a record of important changes in each group, and short-lived records that stop an action happening twice if your connection drops. These use account and group identifiers rather than names, but can still relate to you. We use them to keep the service running and secure. How long each is kept is below.

How you found us, and counting groups

When a manager creates a group, the app can ask them once how they found MatchTempo, from a short list of answers. It is optional and can be skipped. We keep the answer with the group and use it only to see which routes bring in groups. We read it only as counts, never as a list, and it is not shown to anyone in the group. We also count groups in our own database, by the week each group was created and whether it still has games after 8 weeks. These counts hold no names, players or votes.

Who sees what

• Your groups: members see players' shown names, squad numbers and playing preferences, an "U18" marker next to a child's name, who has a place in each game (and who is waiting for one more), how many have said Maybe or are out, teams, goals, results, Player of the Match, the table, seasons and awards, and the reason a result was corrected or a game was made void. You also see your own reply, your place and the status of goals you sent.
• Game notes and cancel reasons: a note on a game is shown to the group's members and, until the game is played, on its game link. A cancel reason is sent to the group's members when a game is cancelled.
• Late drop-out and no-show records are seen only by the manager and assistant managers, who can add them. Only the manager can remove one. Players do not see them in the app, including records about themselves, and they never appear on game links or in anything you share. You can email us for a copy of the records about you, and ask the manager to remove one.
• Managers and assistant managers also see each player's reply and when they replied, the waiting list in order, guests and who brought them, regulars, the notes any of them added to replies and moves, who said who scored, how many people have voted, payments as described above, and the past results Fair teams uses to balance the sides. Members can see who the manager and assistant managers are.
• The manager also sees players' last names, the names they typed when adding players, players left out of stats and tables, and requests to join or rejoin the group. Assistant managers don't see these: they see the same names as other members.
• Children: the manager and assistant managers also see a child's last name, if the parent added one, and which parent looks after them. Only the parent sees the child's year of birth.
• Player of the Match votes are hidden from other players, the manager and assistant managers. You can see your own vote. Only the winner is shown. Individual votes are stored on our servers, so we could see them if we needed to look into a problem, and they are deleted 30 days after the game.
• Anyone with a group's join link: the manager can share a link that lets people join the group. Someone who signs in and opens it sees the group's name and its current players' shown names, and can pick which one is them straight away, without waiting for the manager. A link stops working 30 days after it was made. The manager can turn it off sooner or make a new one, which replaces the old one.
• Anyone with a game link: the manager or an assistant manager can share a link to a game. Anyone holding it can see, without signing in, the group's name, the date and kick-off time, the venue and pitch names, the team names and kits, the players' shown names in each team (a child is shown only as "Under-18 player"), the score, the scorers, own goals, Player of the Match, the kick-off weather and whether the game was made void. Until the game ends, it also shows the venue's address and map location. It doesn't show replies, last names, payments or the reason a game was made void. A link stops working 30 days after kick-off (or 30 days after it was made, if that is later), and the manager or an assistant manager can turn it off sooner. Links can be forwarded, so share them only with the people who need them. To have a link removed, ask your manager or email us.
• Directions: if you tap Directions on a game, the venue's address or map location opens in the maps app you pick (Apple Maps, Google Maps or Waze), and that company's privacy policy applies. We don't send anything to them ourselves.
• Stats and tables: if you turn off "Show me in stats and tables", you are left out of the table, stats and awards for all your groups. You still appear in teams and as a scorer, and your games still count for your teammates. A manager can do the same for a player who doesn't use the app. This doesn't hide you from game links or remove past games.
• What you share yourself: when you share teams or results through the iPhone share sheet, they go to the app you pick, such as WhatsApp or Messages, and that app's privacy policy applies. Share images and share text show a child only as "Under-18 player".

Players who don't use the app

A manager can add players and guests who don't use MatchTempo. If you do this, tell them first what the group and anyone with a game link can see, point them to this page, and add only what the game needs, such as a first name. They can ask the manager to leave them out of stats or remove them, or email us directly, without needing an account. Removing a player doesn't change games they have already played.

Email updates

You can sign up on matchtempo.app/updates for an email when the beta opens and, now and then, news about MatchTempo. This is separate from your MatchTempo account, and you don't need an account to sign up.

We ask only for your email address. Brevo, our email service, sends you an email to confirm it, and keeps a record of when you signed up and confirmed, and the IP address you used, as proof that you asked. Every email has an unsubscribe link. Brevo may count how many emails are opened and how many links are clicked, but we have set this so the counts are not linked to you. The sign-up form loads nothing from Brevo, so it sets no cookies.

Why we use your data

• To run MatchTempo for you (your account, groups, replies, places, games, goals, votes, tables and payments you make): because it is needed for our agreement with you.
• Late drop-out and no-show records: because the group and we have a legitimate interest in managers being able to plan games fairly and keep track of late drop-outs. We keep them private and for 12 months, and a record changes nothing automatically. Anyone can object by asking the manager or emailing us.
• Players and guests added by a manager, notes, join links, game links and letting assistant managers help: because we and the group have a legitimate interest in running the group's games. We keep what is shared to what the game needs, and anyone can object by asking the manager or emailing us.
• Logs, security, agreement records, account merges and preventing mistakes or fraud: because we have a legitimate interest in keeping MatchTempo working, safe and fair.
• Apple Health and heart rate: because you choose to turn them on. You can turn them off at any time, as above.
• Email updates: because you asked for them. You can stop them at any time with the unsubscribe link in any email.
• Support and complaints: to answer you and put things right.
• Payment records, QR payment links and the limit on repeated tries: to take and refund payments, sort out mistakes and disputes, and keep the accounting records the law requires.
• Children added by a parent or guardian: because the parent, the group and we have a legitimate interest in letting the child play in the group's games, at the parent's request. A child's data needs extra care, so we keep only what the games need, show no name outside the group and keep no contact or health details.
• A manager's mobile number: because it is needed to set up and run payments for their group, and because we have a legitimate interest in being able to reach a manager directly about payments, disputes and problems in their group.

We don't use your data for advertising, we don't sell it, and we don't send marketing, apart from the email updates you sign up for. We don't make decisions about you that have legal or similarly serious effects. Places in a game are given out by the group's own rule, and the manager or an assistant manager can always change them.

Who helps us

• Supabase hosts our database and sign-in service, for us and under contract. Your data is stored in London. Supabase's support staff may be able to access it from outside the UK, under contract terms that UK data protection law approves for this. Email us if you'd like to know more.
• Apple and Google run Sign in with Apple and Google sign-in under their own privacy policies. Apple also provides Apple Health, venue search in Apple Maps, the weather forecasts and TestFlight.
• Stripe takes card payments for managers and checks managers' identity. Stripe is responsible for how it uses payment and identity data, under its own privacy policy, and may handle it outside the UK.
• Twilio sends the text message that checks a manager's mobile number, for us and under contract. It receives the number and the code, and may handle them outside the UK, under contract terms that UK data protection law approves for this.
• Apple iCloud Mail handles email sent to our support address.
• Brevo (Sendinblue SAS, France) keeps the list of people who signed up for email updates and sends those emails, for us and under contract. It stores the data in the EU, which UK data protection law treats as giving adequate protection.

Testing through TestFlight

During the beta, Apple's TestFlight may share crash reports, basic device information (such as model and software version) and any feedback or screenshots you choose to send with us. A screenshot can show personal or health details, so check it before you send it. Apple's privacy policy covers how Apple handles this.

Backups

Your recordings are left out of your iPhone's iCloud or computer backups unless you turn on "Include recordings in iPhone backups" in Settings. Your heart rate history is always left out. Backups are handled by Apple under your own Apple account, not by us. Turning the setting off doesn't remove recordings from backups made before, and Apple Health keeps its own copies under your Health settings.

How long we keep data

• Your account: until you delete it in the app, in You. This removes your account, your sign-in details and your agreement records. Signing out doesn't delete anything.
• Your groups' history: results, replies, goals, awards, corrected results, void games and their reasons stay with the group after you leave or delete your account, so the table and past games still add up. When you delete your account, your player entries are no longer linked to you, and your last name, the name the manager typed for you and any nickname you weren't showing are removed. Past games keep your first name or shown nickname, as they appeared then. If that worries you, email us.
• A child you look after: until you remove them, or until you delete your account. Then their first name, last name and year of birth are deleted, and past games show "Removed player". If they take over their place when they turn 18, their year of birth is deleted and the rest becomes part of their own account.
• Player of the Match votes: 30 days after the game. The winner stays.
• Notes on replies and moves: 30 days after kick-off.
• Archived groups are kept: archiving is not deleting. Deleted groups: their links stop at once; members can bring a group back for 60 days, and then it is deleted.
• Join links: 30 days after they are made. Game links: 30 days after kick-off, or after they are made if that is later.
• Records of changes in a group: 12 months. Records that stop an action happening twice: up to 90 days.
• Technical and sign-in logs kept by our hosting and sign-in services are deleted on their own schedule, and copies in their backups are replaced in time. Email us if you'd like the current periods.
• Payment records: 6 years after the end of the financial year they belong to, as UK accounting rules require. This includes how each payment was taken and the record of a payment moved from one player to another. A move record holds who moved it and when, and the manager's account identifier stays on it even if their account is deleted. This applies only to payment records, not to the rest of your group's data.
• The reason a manager types when moving a payment: deleted 30 days after the game.
• QR payment links: a link works for 30 minutes. The scrambled copy of its code is deleted 7 days after the link expires. The scrambled form of a visitor's IP address, used to limit repeated tries, is deleted within 2 days.
• Late drop-out and no-show records: 12 months after the game. They are also deleted if the player is removed from the group, if the game is cancelled, or if the group is deleted.
• Game notes and cancel reasons: a game note stays with the game and is deleted if the game is cancelled or made void. A cancel reason is deleted if the game is put back on. Both go when the group is deleted.
• How you found us: the answer is kept with the group until the group is deleted. The counts hold no personal data.
• A manager's mobile number: until they delete their account or change the number. Stripe keeps its own copy under its privacy policy, and Twilio keeps records of codes sent for a limited time.
• Email updates: until you unsubscribe. After that, Brevo keeps your address on a list of people not to email, so you aren't signed up again by mistake. Email us if you want it removed from that list too.
• Support emails: 12 months after we last heard from you, unless we need them longer to settle a complaint or dispute.
• Weather forecasts: at most 12 hours.
• On your devices: a recording you delete goes to Recently deleted on your iPhone for 30 days, and you can bring it back or choose Delete now. Deleting a recording doesn't remove the workout from Apple Health, a copy still on your Watch or older backups.

Children

You must be 18 or over to have an account. Children under 18 can't sign in, and we never ask them for anything. A parent or guardian can add their child as a player they look after, from You in the app. The child can then play in the parent's groups whose minimum age they meet, once the manager or an assistant manager says yes. Each group is for people aged 18 and over unless its manager chooses a lower minimum age.

About a child, we keep:

• their first name, and their last name if the parent adds it;
• their year of birth, which only the parent sees. We use it to work out whether the child is under 18 and whether they meet a group's minimum age. A child counts as under 18 until the end of the year they turn 18;
• which parent or guardian looks after them;
• their replies, places, teams, goals, Player of the Match and table entries, as for any player. The parent replies and claims goals for them. A child can be voted Player of the Match, but doesn't vote.

We don't keep a child's email address, phone number, photo, health or Watch data, or notes about them. The parent's Watch records only the parent. Messages about a child, such as a place or a team, go to the parent and use the child's first name only. Nothing is sent to the child.

Group members see the child's shown name with an "U18" marker. The manager and assistant managers also see their last name and their parent. Game links, share images and share text show the child only as "Under-18 player", never their name.

The parent can remove a child at any time. This deletes the child's first name, last name and year of birth, and past games show "Removed player". Deleting the parent's account does the same. A manager can take a child out of their own group only. Payments the parent made are kept under the parent's account for the time shown above.

From 1 January of the year a child turns 18, the parent can send them a one-time link, which works for 30 days. The young person signs in with their own Apple or Google account and confirms they are 18 or over, as any new account does. They then take over the same player, with their name, places, games, goals, awards and table points. Their year of birth is deleted. Payments the parent made stay in the parent's payment history, and any money carried over for the child's places is refunded to the parent. If the sign-up shows they are still under 18, nothing moves.

A parent can use the rights below for their child, and so can the child. If you think someone under 18 has an account, or has been added to a group other than by their parent, please email us and we'll remove them.

Cookies

We don't use analytics, advertising or tracking of you. The game page and matchtempo.app set no cookies. The app keeps what it needs to work, such as your sign-in, on your device. Apple and Google's sign-in pages have their own policies.

Your rights

You have rights under UK data protection law, including to get a copy of your data, to correct it, to have it deleted, to limit how we use it and to object to how we use it. These rights have some legal limits, and if we can't do what you ask, we'll tell you why. You can do much of this yourself in the app. For anything else, or for a copy of your data, email support at matchtempo dot app. If a manager added you or a guest to a group and you don't use the app, you can email us too.

If you're unhappy with how we've handled your data, email us. We'll confirm we have your complaint within 30 days, look into it, keep you updated and tell you the outcome as soon as we can. You can also complain to the Information Commission, the UK's data protection regulator (formerly the ICO), at ico.org.uk.

Changes to this policy

Each version of this policy has a number and a date, shown at the top of this page. For a big change, the app will tell you what has changed and ask you to agree again the next time you open Play. Small changes, such as clearer wording, only update the date and version.