Last updated: 20 October 2026
Moataz Abu Karat (“we”) runs the WYFA app for the families and staff of the academy. This policy explains what the app stores, why, who can see it, and what you can do about it.
The app is used by children. Most of what it holds is about them, and we treat it accordingly.
Who can use the app
Access is by invitation only. You cannot create an account without an invite code issued by the academy, and an account grants no access until a head coach approves it. This is deliberate: the app holds children’s records.
What we collect
Your account — email address, display name, and a password (stored hashed by our authentication provider; we never see it). Your chosen language.
Players — full name, nickname, date of birth, nationality, school, playing position, preferred foot, shirt number, height, weight, the date they joined, and a profile photograph if one is uploaded.
Welfare and medical — injuries, medical notes, emergency contacts, and recorded consents. This is health information and is treated as the most sensitive data in the app.
Guardians — full name, phone number, email address, and which children you are linked to.
Coaching records — attendance registers, skill assessments, improvement plans, match appearances, goals, assists, ratings and awarded points.
Financial — fees owed, payments recorded, and payment claims. We do not collect or store card numbers or bank details; the app records that a payment happened, not how it was made.
The feed — posts, comments, reactions, @mentions, and any content you report.
Your device — a push notification token and the device name and platform, so notifications reach the right phone.
Notifications — a copy of each notification sent to you, kept in your in-app inbox so you can read it again, and the notices the head coach writes to members. For each notification we also record whether it reached your phone (as reported by Apple or Google) and when you opened it in the inbox. The head coach and their deputy can see this, so the academy knows its notices are getting through.
What we do not collect
No advertising identifiers. No third-party analytics. No location tracking. No behavioural profiling. Nothing is sold, and nothing is shared for advertising.
Who can see what
Access is decided by the server, not by the app on your phone.
- Families see their own children’s records and their own fees.
- Coaches see the squads they are assigned, and only the functions the head coach has granted them.
- The head coach sees the academy.
- Medical notes and guardian contact details require an explicit delegation beyond ordinary squad access.
Other members of the academy can see your display name and photograph, because that is what makes attribution and @mentions work.
Third parties
- Supabase — hosts the database, authentication and photograph storage.
- Expo — delivers push notifications and app updates.
- Apple — distributes the app.
- Google — distributes the app on Android and delivers its notifications.
- flagcdn.com — receives a two-letter country code when a nationality flag is displayed. No personal data is sent, but the request is made.
- Giphy — contacted only when you open the GIF picker while writing a post.
Where your data is kept
The database, sign-in and photographs are hosted by Supabase in Frankfurt, Germany, in the European Union. Push notifications pass through Expo (a US company) and then Apple’s or Google’s notification service on their way to your phone. They carry only the notification’s title and text, never your full records, but that text can include details such as a child’s name, a session time or, in notices about fees and payments, the amount due or received. It appears on your lock screen unless your phone is set to hide notification previews.
How long we keep it
The academy keeps its records for as long as it needs them: a player’s attendance, fees and match history are the academy’s own record of its work.
Your notification inbox is kept for as long as your account exists. The record of whether each notification reached your phone is kept for 180 days.
When a player leaves the academy, the head coach marks them as having left. Their login stops working straight away; their record and history stay with the academy, marked as a former player, and the head coach can reinstate them if they return.
Deleting your account
You can delete your account in the app, at any time, without contacting anyone: Settings → Account → Delete my account.
When you do, your login is deleted and you cannot sign in again. Your name, email address and photograph are removed, and so are your notification inbox and notification settings.
What remains, and why: the academy keeps its record of you as a player, guardian or coach, and the attendance, fees and match history attached to it. A child does not leave the roster because a parent closes an account. Anything you posted stays, attributed to “Deleted member”. Records of who marked a register or recorded a payment keep a reference to a now-anonymous account, so the academy’s history remains verifiable.
If you want that record removed too, contact us and we will consider it against what we are required to keep.
Children
Children hold accounts, with a guardian’s involvement. A child can delete their own account; doing so removes their login, not their place at the academy. If you are a guardian and want your child’s records handled differently, contact us.
Your rights
Depending on where you live, you may have the right to ask for a copy of your data, to correct it, to have it deleted, or to object to how it is used. Write to us at the address below.
Security
Every rule about who can see what is enforced on the server. Sign-in tokens are held in the device keychain. Photographs are private and served through short-lived signed links.
Contact
Moataz Abu Karat · We aim to reply within a few days.