Privacy Policy

1. Who is responsible for your information

The Gravesend & District Indoor Games League is the data controller for league records and decides why and how that information is used. Martin Chamberlain, the League Secretary and System Owner, administers and secures Rack & Frame on the League's behalf. League officers may handle requests as part of their authorised duties.

Privacy enquiries may be sent to rackandframe.app@gmail.com.

2. Information we collect

• Account information, including email address, user ID, account status, acceptance records and authentication information managed by Supabase.
• Player information, including name, club, team, role, date of birth where required, profile image, nationality and player-profile links.
• League and competition records, including line-ups, fixtures, frame scores, breaks, results, submissions, approvals, reports, Elo ratings, handicaps and historical trends.
• Public paper-scorecard submissions, including the submitter's name and team, confirmation that both teams agreed the result, and an optional photograph of the signed scorecard.
• Contact information supplied for arranging matches or competitions, including telephone-sharing choices.
• Registration and competition-form information, including drafts, declarations, notes and information submitted by captains or club officers about other players.
• Administration and financial records, including competition entries, club invoice items, invoice recipients, payment status and audit history. Rack & Frame does not currently process payment-card details.
• Technical and security information, including audit events, pages used where analytics permission is given, browser/device information, notification status and web-push subscription credentials.

3. Where information comes from

Information may be supplied by you, a team captain or vice-captain, a club or league officer, an opponent recording a match by agreement, or generated from approved league and competition results. If you provide information about another person, you must ensure it is accurate and that the person knows it is being supplied to the League.

4. Why we use information and our lawful bases

• Requested service or contract: creating and operating an account, accepting requested entries and providing app functions under the Terms & Conditions.
• Legitimate interests: administering the League fairly, publishing sporting records, calculating tables and handicaps, resolving disputes, maintaining historical results, communicating operational information, protecting the service and producing club invoices. We balance these interests against players' privacy rights.
• Consent: optional telephone sharing, web-push notifications and identified usage analytics. Consent can be withdrawn for future use.
• Legal obligations: responding to data-protection requests and retaining records where accounting, tax or other law requires it.

5. Public information and restricted information

Published league pages may show player names, clubs, teams, fixtures, line-ups, results, frame scores, breaks, rankings, Elo ratings, handicaps and sporting statistics. They do not intentionally publish account email addresses, full dates of birth, private telephone numbers or push-subscription credentials.

League Secretary, Chairman and Treasurer accounts can access the information needed to run the League. The System Owner also has protected technical, security, backup and account-management access. Captains and vice-captains can access assigned team workflows and limited match-arranging information where sharing is authorised.

Draft fixture reviews, registration drafts, competition drafts and club invoices may use long, unlisted access links. Anyone who receives such a link may be able to view the information it protects, so it must not be posted publicly or forwarded unnecessarily.

6. Dates of birth and contact details

Dates of birth are used for identity checks and eligibility for age-restricted competitions such as Over 50s and Over 60s. A player may see or update their own date of birth, and the System Owner or authorised league officers may process it where necessary for validation or correction. Full dates of birth are not displayed on public league pages.

The league team-registration form does not collect private match-arranging telephone numbers. The separate competition-entry process may require a captain or team contact name and telephone number. Player telephone numbers are disclosed only where the player has agreed and the recipient needs them to arrange a relevant match.

7. Emails and push notifications

Transactional emails may be sent for account security, league administration or an optional registration receipt. A receipt email address is used for that requested copy and is not added to a player profile. Email delivery is provided through Resend and may create delivery and security logs.

Push notifications are optional. If enabled, the app stores a browser-generated endpoint, subscription keys and user-agent information so a compatible device service can deliver league alerts. Notifications can be disabled in Rack & Frame and in the device or browser settings.

8. Device storage and optional usage analytics

Rack & Frame uses browser storage and PWA caching for authentication, security, drafts, navigation, notification preferences and offline or installable-app functionality. These functions are necessary to provide features requested by the user. The app does not use advertising cookies.

With your permission, the app may record your signed-in account, role and pages visited to diagnose problems and improve the service. This choice is optional and does not affect league access. You can change it below at any time; withdrawing permission stops future usage events.

9. Service providers and international processing

The League uses service providers including Supabase for database and authentication services, Vercel for application hosting, Resend for email delivery and browser/device push services for notifications. They process information under their own security and contractual arrangements. Some processing may occur outside the United Kingdom; where a restricted transfer occurs, the League relies on an applicable adequacy regulation or approved contractual safeguards.

10. How long we keep information

• Approved fixtures, results, sporting statistics and handicap history may be retained as the League's permanent sporting archive.
• Account and current contact information is retained while the account or league relationship remains active and then reviewed for deletion, restriction or anonymisation.
• Drafts, unsuccessful requests, notification subscriptions and operational logs are retained only while needed for their purpose, troubleshooting, security or dispute resolution.
• An optional paper-scorecard photograph is held privately while the submission awaits review and is deleted after approval or rejection. Unreviewed photographs expire after 30 days; the result submission and evidence-deletion audit record may be retained.
• Invoice and payment records are normally retained for up to six years after the relevant financial year where needed for accounting and dispute records.

Records are reviewed periodically. Legal claims, safeguarding, security incidents or statutory obligations may require a longer period.

11. Automated calculations

Rack & Frame automatically calculates standings, Elo ratings and suggested handicaps from approved results. These are sporting calculations rather than decisions producing legal or similarly significant effects. Authorised league officers can review and correct the underlying records and apply League rules.

12. Security

The app uses authenticated access, role-based permissions, database row-level security, approval workflows, audit records, protected server credentials and backup controls. No internet service is completely risk-free, so users must protect their accounts and report suspected unauthorised access promptly.

13. Your rights and complaints

Depending on the circumstances, you may ask for access to your information, correction, deletion, restriction, portability, or object to processing based on legitimate interests. You may withdraw consent for future processing at any time. Some rights are not absolute, and limited sporting, audit, invoice or dispute records may be retained where there is a lawful reason.

We normally respond within one month. Please contact the League first so the matter can be investigated. You may also complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint.

14. Changes to this policy

This policy may be updated when the app, League procedures or law changes. The version and last-updated date will be shown above. Material changes may also be notified in the app and may require renewed acknowledgement.