1. Information We Collect

1.1 Information You Provide

When you use Goalify, we collect the following information:

• Account Information: When you sign in with Google OAuth, we collect your email address, name, and profile picture from your Google account.
• Team Data: Team names, member information, and team settings you create within the service.
• Player Information: Player names, positions, statistics, and profile photos you choose to upload.
• Match Records: Game dates, locations, scores, attendance records, and game statistics.
• Financial Data: If you choose to integrate with Google Sheets, we may access financial records you explicitly authorize.
• Payment Details (team administrators): If an administrator sets up team dues collection, we store the payment destination they enter — for example a Venmo username, a Cash App cashtag, a PayPal.me link, a Kakao Pay link, or a Zelle email address or phone number — and any QR code image they upload. Because a Zelle destination is normally an email address or phone number, this may be personal contact information. We store it only to build a link to that payment app; we never store card numbers or bank account credentials, and we never process the payment itself.
• Help assistant questions: The question text you type into Goalify AI. It is stored with email addresses, phone numbers, links, amounts, long numbers and the names of your team members masked, and is used only to improve help quality and understand what people ask about. The answers, match records, fees and other team data are not stored alongside it.

1.2 Information Collected Automatically

• Usage Data: Information about how you interact with our service, including access times, pages viewed, and features used.
• Device Information: Browser type, operating system, IP address, and device identifiers.
• Cookies and Similar Technologies: We use cookies to maintain your session and enhance user experience.

1.3 Health & Fitness Data

Apple Watch and iPhone (Apple HealthKit)

When you opt in, we read the following data types from Apple HealthKit:

• Heart Rate: Heart rate recorded during the workout, used for the session average and heart rate zone chart
• Activity Data: Step count, walking/running distance, active energy and basal energy (calories burned)
• Workout Sessions and Route: Exercise type, duration, start/end time, and the GPS route of the workout
• VO₂ Max: Used only to display your cardio fitness level alongside the workout summary

We also write the workouts you record in Goalify back to Apple HealthKit (workout, route, active energy, and distance) so that they appear in the Apple Health app.

Wear OS Watch and Android Phone

On a Wear OS watch, workout metrics are measured live by the watch's own sensors through Wear OS Health Services, only while a workout you started is running:

• Heart Rate: Live heart rate from the watch's optical sensor, shown on the watch and averaged for the session. Available when the watch supports the sensor and you grant heart-rate permission
• Activity Data: Step count, distance, speed/pace, and calories burned
• Location: GPS route and distance, only in Outdoor mode and only with your location permission
• Motion Sensors: Accelerometer and gyroscope readings, used to detect cadence and sprints

Heart rate uses BODY_SENSORS through Wear OS 5.1 and android.permission.health.READ_HEART_RATE on Wear OS 6 (Android 16) and later. You can deny heart-rate access and record other supported workout metrics. Measurements run during a workout you start, with a foreground workout service, and stop when it ends. If all permissions needed to run that service are denied, the watch asks you to enable an appropriate permission before starting. We do not request continuous background health monitoring.

We do not collect resting heart rate, heart rate variability (HRV), blood oxygen saturation (SpO₂), respiratory rate, sleep, or body weight on any platform.

How We Use Health Data

Your health data is used solely for the following purposes:

• Displaying workout analysis and performance metrics linked to your match participation
• Generating heart rate zone distribution, sprint detection, and performance scores
• Allowing you to optionally share workout summaries with your teammates

How Health Data Is Stored

• Health data is stored in our secure database (Supabase) with Row Level Security (RLS) enforced — only you can access your own health records
• Data is encrypted in transit (HTTPS/TLS) and at rest
• Raw health snapshots are never exposed to other users; shared data contains only aggregated summaries (e.g., average heart rate, total distance)

Health Data Sharing

• Health data is private by default. You control whether to share workout summaries with your team
• When you enable sharing, only aggregated statistics (not raw biometric data) are visible to teammates
• You can revoke sharing at any time, and shared data will be removed from teammates' views

Health Data Deletion

• You can delete your health data for any match at any time through the app
• You can revoke health data consent entirely, which will prevent further data collection
• Deleting your account will permanently delete all associated health data within 30 days

Apple HealthKit Disclosure

We integrate with Apple HealthKit to read health and fitness data. In accordance with Apple's requirements:

• Data obtained from HealthKit is not used for advertising, marketing, or sale to data brokers
• HealthKit data is not shared with third parties without your explicit consent
• We do not use HealthKit data to build user profiles for purposes unrelated to health and fitness
• We do not disclose HealthKit data to third parties for their own marketing or advertising purposes

Android and Wear OS Disclosure

On Android, Goalify does not read or write the Google Health Connect record store. Workout metrics come only from the sensors on your own Wear OS watch, measured through Wear OS Health Services:

• Sensors are read only while a workout you started is in progress, and stop the moment it ends
• We request only the minimum permissions necessary for the workout analysis feature
• Live heart rate requires your permission: BODY_SENSORS through Wear OS 5.1, or android.permission.health.READ_HEART_RATE on Wear OS 6 and later
• Sensor data is used solely to provide the app's health and fitness features, never for advertising or non-health-related purposes

2. How We Use Your Information

We use the information we collect for the following purposes:

• Provide and Maintain Services: To operate and maintain Goalify's features including team management, match recording, draft systems, and statistics tracking.
• Authentication and Security: To verify your identity, prevent unauthorized access, and detect fraudulent activity.
• Communication: To send you service-related notifications, updates, and respond to your inquiries.
• Improve Our Service: To analyze usage patterns, develop new features, and enhance user experience.
• Comply with Legal Obligations: To comply with applicable laws, regulations, and legal processes.

3. How We Share Your Information

We do not sell, trade, or rent your personal information to third parties. We may share your information in the following circumstances:

3.1 Service Providers

We work with third-party service providers who perform services on our behalf:

• Supabase: Database hosting and authentication services
• Google: OAuth authentication and Sheets API integration (when authorized by you)
• Vercel: Web hosting and content delivery network
• Microsoft (Azure AI Translator) / DeepL: Chat message translation. A message's text is sent to the configured translation provider only when you tap See translation on that message. If you never use the translation feature, no chat content is sent.
• Google (Gemini): The in-app help assistant, when your team switches it on and you agree to the notice shown before your first question. Your typed question and relevant text conversation may be sent for usage guidance or to interpret a record query. Recognizable email addresses, phone numbers, links and long numbers are masked; names are not reliably detected, so do not type personal information. Player lists, match records, performance and fee data used to calculate answers are not sent to the external AI. Local quick answers are computed on your device and send nothing to external AI. On Google's free plan, Google uses submitted content and generated responses to provide, improve and develop Google products, and human reviewers may read, annotate and process it. Goalify also keeps a masked copy of your question text in its own logs for 90 days to improve help quality. That copy is visible only to Goalify operators, never to your team administrators. You can withdraw your agreement at any time in My account.
• Cloudflare (R2): Storage and delivery of images you upload — player photos, team logos and chat images.
• Google (Firebase Cloud Messaging) / Apple (APNs): Delivery of push notifications. We store a device push token per device.
• Sentry: Crash and error monitoring. Email addresses and IP addresses are stripped before events are sent, and session replays are recorded with all text masked and all media blocked.
• Open-Meteo: Weather forecast for a match. Only the venue's coordinates and the match date are sent — never your personal location or identity.

Our providers operate infrastructure in multiple regions, including the United States and the European Union. Where data is transferred internationally, we rely on the providers' standard contractual clauses and equivalent safeguards. See section 10.

These providers are bound by contractual obligations to keep your information confidential and use it only for the purposes for which we disclose it to them.

3.2 Legal Requirements

We may disclose your information if required to do so by law or in response to valid requests by public authorities (e.g., a court or government agency).

3.3 Business Transfers

In the event of a merger, acquisition, or sale of assets, your information may be transferred. We will provide notice before your information is transferred and becomes subject to a different privacy policy.

3.4 Payment Details Shown to Your Team

When a team administrator saves a payment destination, it is shown to the members of that team so they can pay their dues. It is not shared with other teams, sold, or used for advertising. If the team has enabled the Public App feature described below, treat any payment detail as potentially visible to anyone — do not enter information you are not comfortable making public. An administrator can remove or change the payment destination at any time in team settings.

Goalify does not send your payment details to the payment provider. When you tap a payment link, your device opens that provider's app or website directly, and any amount or memo included in the link is passed to them at that moment. What happens afterwards is governed by that provider's own privacy policy.

3.5 Public App Feature (Team Choice)

4. Data Retention

We retain your personal information only for as long as necessary to fulfill the purposes outlined in this Privacy Policy, unless a longer retention period is required or permitted by law.

• Active Accounts: We retain your data while your account is active.
• Deleted Accounts: When you delete your account, we will delete or anonymize your personal information within 30 days, except where we are required to retain it by law.
• Legal Obligations: We may retain certain information for legal compliance, dispute resolution, and enforcing our agreements.
• Chat images: Images sent in team chat are automatically removed from storage 30 days after they are sent.
• Health and workout data: Heart-rate samples, GPS routes and workout sessions are kept while your account is active and you have not withdrawn consent. Withdrawing consent in My Account deletes them immediately.
• Audit and usage logs: Records of significant actions such as account deletion and permission changes, together with app launches, screen visits and feature usage (including questions typed into the help assistant), are retained for 90 days for security, dispute resolution and service improvement, then deleted automatically. These records may contain the identifier of a deleted account — the minimum needed to evidence that the deletion actually took place.

5. Data Security

We implement appropriate technical and organizational measures to protect your personal information:

• Encryption: All data transmission is encrypted using HTTPS/TLS protocols.
• Access Controls: We implement Row Level Security (RLS) policies to restrict data access.
• Authentication: Secure OAuth 2.0 authentication through Google.
• Regular Updates: We regularly update our security measures and conduct security assessments.
• Data Backups: Regular automated backups to prevent data loss.
• Health Data Protection: Health and fitness data is subject to additional protections including consent-gated access, per-user row isolation via RLS, and stripping of sensitive metadata (device names, GPS routes) from shared views.

However, no method of transmission over the Internet or electronic storage is 100% secure. While we strive to use commercially acceptable means to protect your information, we cannot guarantee absolute security.

6. Your Rights and Choices

Depending on your location, you may have the following rights regarding your personal information:

• Access: Request access to the personal information we hold about you.
• Rectification: Request correction of inaccurate or incomplete information.
• Deletion: Request deletion of your personal information.
• Objection: Object to our processing of your personal information.
• Data Portability: Request a copy of your data in a structured, machine-readable format.
• Withdraw Consent: Withdraw your consent at any time where we rely on consent to process your information.

To exercise these rights, please contact us at goalify.support@gmail.com. After verifying your identity we fulfil access and copy requests within 30 days (within 10 days for residents of Korea). If you want your workout records (heart rate and GPS routes) included, say so in your request and we will send them in a machine-readable JSON format.

What you can do directly in the app:

• Delete your account and data: My Account → Delete account
• Withdraw health data consent and delete it: My Account → My data → Health data
• Correct your profile: edit it on your player profile

7. Cookies and Tracking Technologies

What Are Cookies?

Cookies are small text files stored on your device that help us provide and improve our services. We use cookies for:

• Essential Cookies: Required for authentication and basic service functionality.
• Preference Cookies: Remember your settings and preferences.
• Analytics: Understand how users interact with our service to improve it.

Managing Cookies

You can control and manage cookies through your browser settings. Please note that disabling cookies may affect the functionality of our service.

8. Third-Party Links

Our service may contain links to third-party websites or services, including payment apps such as Venmo, Cash App, PayPal, Zelle and Kakao Pay that open when you pay team dues. We are not responsible for the privacy practices of these third parties. We encourage you to read their privacy policies before providing any information to them.

9. Children's Privacy

Goalify is not intended for children under the age of 13. We do not knowingly collect personal information from children under 13. If you are a parent or guardian and believe your child has provided us with personal information, please contact us, and we will delete such information.

10. International Data Transfers

Your information may be transferred to and processed in countries other than your country of residence. These countries may have data protection laws that are different from the laws of your country. We take appropriate safeguards to ensure that your personal information remains protected in accordance with this Privacy Policy.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or for other operational, legal, or regulatory reasons. We will notify you of any material changes by:

• Posting the new Privacy Policy on this page with a new effective date
• Sending you a notification through the service or via email

We encourage you to review this Privacy Policy periodically to stay informed about how we protect your information.

12. Contact Us

If you have any questions, concerns, or complaints about this Privacy Policy or our data practices, please contact us using the information above. We will respond to your inquiry within a reasonable timeframe.

13. United States Privacy Rights

13.1 California Residents (CCPA/CPRA)

If you are a California resident, the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA) provide you with specific rights regarding your personal information:

Your California Privacy Rights:

• Right to Know: You can request information about the personal information we collected, used, disclosed, and sold about you in the past 12 months.
• Right to Delete: You can request deletion of your personal information, subject to certain exceptions.
• Right to Opt-Out: You can opt-out of the "sale" or "sharing" of your personal information. Note: We do not sell your personal information.
• Right to Correct: You can request correction of inaccurate personal information.
• Right to Limit Use: You can limit the use and disclosure of sensitive personal information.
• Right to Non-Discrimination: We will not discriminate against you for exercising your CCPA rights.

Categories of Personal Information We Collect:

• Identifiers: Name, email address, Google account ID, IP address
• Internet Activity: Browsing history, search history, interaction with our service
• Geolocation Data: Approximate location based on IP address
• Professional Information: Team membership, player statistics, match records
• Sensitive Personal Information (Health Data): Heart rate, steps, distance, speed, calories, and VO₂ max (iOS only) — collected only with your explicit opt-in consent, via Apple HealthKit on iOS or your own watch's sensors on Wear OS
• Inferences: Preferences and characteristics derived from your activity

How to Exercise Your Rights:

To exercise your California privacy rights, email us at support@goalify.club with the subject line "California Privacy Rights Request." We will verify your identity before processing your request.

Authorized Agent:

You may designate an authorized agent to make requests on your behalf. The agent must provide written authorization or power of attorney.

Shine the Light Law:

California residents may request information about our disclosure of personal information to third parties for direct marketing purposes. We do not share personal information with third parties for their direct marketing purposes.

13.2 Virginia, Colorado, Connecticut, and Utah Residents

If you are a resident of Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), or Utah (UCPA), you have similar rights including:

• Right to access your personal data
• Right to correct inaccuracies in your personal data
• Right to delete your personal data
• Right to obtain a copy of your personal data (data portability)
• Right to opt-out of targeted advertising, sale of personal data, and profiling

To exercise these rights, contact us at support@goalify.club

13.3 Nevada Residents

Nevada residents have the right to opt-out of the sale of their personal information. We do not sell personal information as defined under Nevada law.

13.4 Do Not Track Signals

Our service does not currently respond to "Do Not Track" (DNT) browser signals. We treat all users consistently regardless of DNT settings.

14. Email Communications (CAN-SPAM Act)

We comply with the CAN-SPAM Act for commercial emails. You can opt-out of marketing emails by:

• Clicking the "unsubscribe" link in any marketing email
• Contacting us at goalify.support@gmail.com
• Updating your email preferences in account settings

Note: You cannot opt-out of transactional or service-related emails (e.g., account notifications, security alerts).

15. Legal Basis for Processing (GDPR - EEA Users)

If you are located in the European Economic Area (EEA), our legal basis for collecting and using your personal information depends on the specific context:

• Consent: You have given us explicit consent to process your information for specific purposes.
• Contract: Processing is necessary to provide you with our services.
• Legal Obligation: Processing is necessary to comply with legal obligations.
• Legitimate Interests: Processing is in our legitimate interests and not overridden by your data protection rights.

Note: US-based operations primarily fall under US privacy laws (CCPA, state laws) rather than GDPR. EEA users are subject to GDPR protections.

← Back to Home