Privacy policy

1Protecting your data matters to us

VolleyTeam helps volleyball teams organize training, matches and team life. To do that, we need to process personal data about coaches and players. We process it only as far as it is needed to run VolleyTeam, in line with the General Data Protection Regulation (GDPR), the German Federal Data Protection Act (BDSG) and the German Telecommunications Digital Services Data Protection Act (TDDDG).

This policy tells you what data we process, why, on what legal basis, who receives it, how long we keep it and what rights you have. It covers people who use VolleyTeam with an account, people a coach adds to a team, and visitors of our website.

We have taken technical and organizational measures to protect your data, for example encrypted connections (TLS) for all traffic, access only through signed and time limited links for files, hashed access tokens and strict permissions per team and role. Internet based data transmission can still have security gaps, so absolute protection cannot be guaranteed.

2Definitions

This policy uses the terms of the GDPR (Art. 4 GDPR). In particular:

• Personal data means any information relating to an identified or identifiable natural person ("data subject"). A person is identifiable if they can be identified directly or indirectly, for example by a name, an identification number, location data, an online identifier or one or more factors specific to their physical, physiological, genetic, mental, economic, cultural or social identity.
• Data subject means any identified or identifiable natural person whose personal data is processed by the controller.
• Processing means any operation performed on personal data, such as collection, recording, organization, storage, adaptation, retrieval, use, disclosure, combination, restriction, erasure or destruction.
• Restriction of processing means marking stored personal data with the aim of limiting its future processing.
• Profiling means any automated processing of personal data to evaluate personal aspects of a person, in particular to analyze or predict their performance at work, economic situation, health, preferences, interests, reliability, behavior, location or movements.
• Pseudonymization means processing personal data so that it can no longer be attributed to a specific person without additional information that is kept separately and protected by technical and organizational measures.
• Controller means the natural or legal person, public authority, agency or other body which alone or jointly with others determines the purposes and means of the processing of personal data.
• Processor means a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller.
• Recipient means a natural or legal person, public authority, agency or other body to which personal data is disclosed, whether a third party or not.
• Third party means any natural or legal person, public authority, agency or body other than the data subject, the controller, the processor and the persons who, under the direct authority of the controller or processor, are authorized to process personal data.
• Consent means any freely given, specific, informed and unambiguous indication of the data subject's wishes by which they, by a statement or by a clear affirmative action, signify agreement to the processing of personal data relating to them.

3Controller

The controller within the meaning of the GDPR and other data protection laws is:

EimerReis Enterprise, Moritz Frölich, Kolpingstraße 3, 72250 Freudenstadt, Germany. Email: office@eimerreis.de. Website: volleyteam.app. More details are in the imprint.

4Data protection officer

We are a small sole proprietorship and have not appointed a data protection officer, because the legal requirements for a mandatory appointment (Art. 37 GDPR, § 38 BDSG) are not met. For all questions about data protection, please contact us directly at office@eimerreis.de.

5Teams, clubs and data about other people

We are the controller for operating VolleyTeam: accounts and sign in, storage, security, notifications, error reports and the service providers listed in this policy.

Inside a team, coaches and club administrators decide whom they add and what they record, for example attendance, fines, notes, ratings, birth years or match videos. Coaches can add team members who do not have an account yet (unclaimed team members), with name, shirt number, position and optionally an email address and birth year. The club or coach who enters data about other people is responsible for being allowed to do so and for informing those people. If a coach added you, the data comes from your coach or club; you can claim your place in the team with your own account or contact your club or us.

Coaches can also bring data over from other team apps, for example SpielerPlus, through our import and public API. The data then comes from the system the coach imports from.

You can address requests about data in your team either to your club or to us. We will help you and, where necessary, involve the team's coach.

6Visiting our website

Our website volleyteam.app is a static website hosted by Netlify, Inc., 101 2nd Street, San Francisco, CA 94105, USA. When you open a page, your browser automatically sends data that Netlify records in server log files: IP address, date and time, requested page, referrer, browser type and version and operating system. This is needed to deliver the website and to protect it against attacks. The legal basis is Art. 6 (1) (f) GDPR; our legitimate interest is a secure and working website. We do not draw conclusions about you from this data.

Netlify is certified under the EU-US Data Privacy Framework, and we have agreed on standard contractual clauses with Netlify as part of its data processing agreement. More: Netlify privacy policy.

The website sets no cookies and uses no analytics, tracking or advertising. Fonts are served from our own website, not from Google or another third party. When you pick a language, your browser stores that choice (key vt-lang) in its local storage so the start page opens in your language next time. This storage is strictly necessary for the function you asked for (§ 25 (2) No. 2 TDDDG). You can delete it in your browser settings at any time.

7Cookies and local storage in the web app and the apps

The web app at team.eimerreis.de uses cookies only to keep you signed in: a session cookie with your sign in tokens and a short lived cookie that secures the sign in step. Without them, sign in does not work. In addition, the training planner stores your undo history for a training plan in the browser's local storage. These are strictly necessary (§ 25 (2) No. 2 TDDDG; Art. 6 (1) (b) GDPR).

Our error reporting tool LaunchDarkly (see error reports) stores a random identifier that is not linked to your account, together with technical settings, in the browser's local storage, so that error reports from the same browser can be grouped. The legal basis is Art. 6 (1) (f) GDPR; our legitimate interest is finding and fixing errors. You can delete this data in your browser settings at any time.

The apps for iPhone, iPad and Mac store your sign in tokens in the device's keychain, settings such as appearance in the app's settings, and offline copies such as Match Plans, scouting drafts, planner drafts and videos in the app's own storage on your device. This data stays on your device unless this policy says otherwise and is removed when you delete the app.

8Collection of general data and server logs

The web app, its database and its file storage run on a server that we operate ourselves in Germany. Connections from the internet reach the server through Cloudflare Tunnel by Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA. Cloudflare encrypts the connection and protects the server against attacks; it processes your IP address and the transmitted data as our processor. Cloudflare is certified under the EU-US Data Privacy Framework; we also rely on the standard contractual clauses in Cloudflare's data processing agreement. More: Cloudflare privacy policy.

With every request to the web app or the API, our server and our sign in service record general data in log files: IP address, date and time, requested address, status, browser or app version (user agent) and, for sign ins, the email address and the type of sign in event. We need this data to deliver the service, to keep the systems secure, to detect misuse and attacks and, after an attack, to give law enforcement the information they need. The legal basis is Art. 6 (1) (f) GDPR.

Server log files are deleted after 14 days. Sign in events (email address, IP address, time, type of event) are deleted after 90 days. Data needed to clarify a specific security incident is kept until it is resolved.

9Registration and sign in

To use VolleyTeam you need an account. We process your email address and your name, and optionally a profile picture. You sign in without a password: we email you a one time code or sign in link. Signed in devices receive session tokens; you can see your devices under "Signed in devices" and sign them out. If a coach invites you with a QR code in person, the app first creates an anonymous sign in that is linked to your place in the team; you confirm your email address afterwards.

We use a sign in service (Supabase Auth) that we host ourselves. We send the sign in emails through Resend, a service of Plus Five Five, Inc., USA, as our processor. Resend receives your email address and the content of the email. Resend is certified under the EU-US Data Privacy Framework. More: Resend privacy policy.

The legal basis is Art. 6 (1) (b) GDPR, because the account is needed to provide VolleyTeam under our terms of use. We keep the account data until you delete your account.

10Using VolleyTeam

Depending on how your team uses VolleyTeam, we process the following data. Other members of your team see it according to their role, for example coaches see more than players. People outside your team do not see it. The legal basis is Art. 6 (1) (b) GDPR for your own use of VolleyTeam. For data that coaches record about team members, it is also Art. 6 (1) (f) GDPR; the legitimate interest is the joint organization of the team's training and match operations.

11Match videos (Mux)

Coaches can upload match videos so the team can watch scenes and tag touches. Videos usually show players. The app first creates a review copy on the device; the original stays on the device.

We store and stream new match videos with Mux, Inc., 88 Stevenson Street, San Francisco, CA 94105, USA, as our processor. Mux receives the video and an internal video number, but no names or team data. Videos are only playable through signed links that expire after a few hours. Older videos are stored on our own server. Mux is certified under the EU-US Data Privacy Framework. More: Mux privacy policy.

The legal basis is Art. 6 (1) (b) GDPR for the uploading coach and Art. 6 (1) (f) GDPR for the people shown; the legitimate interest is the team's analysis of its own matches. Videos stay until the team deletes them or the team is deleted. If you object to a video showing you, contact your coach or us.

Training videos you record in the app for yourself stay on your device and are not uploaded.

12Rally Calls (voice scouting)

With voice scouting in the Mac app, you speak each rally as a rally call. Speech recognition runs entirely on your Mac. No audio recording leaves your Mac.

To recognize the speech, the app downloads speech recognition models once from Hugging Face (Hugging Face, Inc., USA; in the EU: Hugging Face SAS, 9 rue des Colonnes, 75002 Paris, France). Hugging Face receives your IP address and technical data of the download; no content. Legal basis: Art. 6 (1) (f) GDPR, our legitimate interest is speech recognition on your device. More: Hugging Face privacy policy.

To turn the recognized text into individual touches, our server sends the text of the rally call, the first names and shirt numbers of the roster, whether a player is on court, and the names of the teams to OpenRouter, Inc., USA, which forwards the request to the provider of the language model, currently Anthropic PBC, USA. We use only OpenRouter's zero data retention routing: OpenRouter and the model provider do not store the requests and do not use them for training. We do not store the request either; only the touches you confirm are saved in the scouting. OpenRouter acts as our processor; the transfer is based on the EU standard contractual clauses. More: OpenRouter privacy policy, Anthropic privacy policy.

The legal basis is Art. 6 (1) (b) GDPR for the coach who uses voice scouting and Art. 6 (1) (f) GDPR for the players named in the roster; the legitimate interest is efficient scouting of the team's own matches.

13Push notifications

If you allow notifications in the iPhone or iPad app, we store the device token and send notifications, such as cancelled events, shared Match Plans and response reminders, through the Apple Push Notification service of Apple Inc., USA. Apple receives the device token and the text of the notification, for example event title, date and team name. Apple is certified under the EU-US Data Privacy Framework.

The legal basis is Art. 6 (1) (b) GDPR. You can turn off notifications in the iOS settings or turn off single types in the app. We delete the device token when you sign out, delete your account or Apple reports the token as invalid.

14Error reports (LaunchDarkly)

To find and fix errors, the web app, our server and the apps send error reports to LaunchDarkly (Catamorphic Co. dba LaunchDarkly, Oakland, California, USA) as our processor. A report contains the type of error, a technical description, the place in the code (stack trace), crash and hang reports of the device, app version and environment. We remove email addresses, links, tokens and similar details from error messages before sending. Reports contain no user or session identifiers; LaunchDarkly receives the IP address of the reporting device for technical reasons. We do not use LaunchDarkly for analytics, session recordings or tracking.

The legal basis is Art. 6 (1) (f) GDPR; our legitimate interest is stable and secure software. LaunchDarkly is certified under the EU-US Data Privacy Framework. More: LaunchDarkly privacy policy.

15App permissions

The apps ask for access only when you use a feature that needs it. You can withdraw access in the system settings at any time.

• Camera: scan the code of the Scouting Remote on the Mac and record training attempts that stay on your device.
• Microphone (Mac): voice scouting; speech is recognized on your Mac (see Rally Calls).
• Photos: pick a player photo or a match video, and save videos or Player Card images to your library. The app only adds to your library and does not read it.
• Local network: connect iPhone and Mac directly for the Scouting Remote. This traffic stays in your local network.
• Notifications: see push notifications.

The apps do not use advertising identifiers, do not track you across apps and websites of other companies and do not determine your location.

16App Store and app updates

If you download the app from the App Store, Apple processes data for the download, purchases and, if you allow it, crash reports shared with developers, under its own responsibility. More: Apple privacy policy.

If you install the Mac app directly from our website, it checks our website (Netlify) for updates. It sends its version and your IP address, but no system profile.

17Contact form and email

If you contact us by email or through the contact form on our support page, we process your email address, your name if you give it, your message and the time, to answer your request. The contact form is provided by Netlify (see website), which stores the message and forwards it to us by email.

The legal basis is Art. 6 (1) (b) GDPR if your request is about using VolleyTeam, otherwise Art. 6 (1) (f) GDPR; our legitimate interest is answering requests. We delete your request when it is resolved, at the latest after six months, unless statutory retention periods apply.

18Recipients and transfers to third countries

We pass personal data to the following recipients only as described in this policy. Some of them are located in the USA. For the USA, the European Commission has adopted an adequacy decision for companies certified under the EU-US Data Privacy Framework (Art. 45 GDPR); otherwise we use the EU standard contractual clauses (Art. 46 (2) (c) GDPR). You can request a copy of these safeguards from us.

• Cloudflare, Inc., USA: secure access to our server (Data Privacy Framework, standard contractual clauses)
• Plus Five Five, Inc. (Resend), USA: sign in emails (Data Privacy Framework)
• Mux, Inc., USA: match videos (Data Privacy Framework)
• OpenRouter, Inc., USA, and Anthropic PBC, USA: Rally Calls (standard contractual clauses, zero data retention)
• Catamorphic Co. (LaunchDarkly), USA: error reports (Data Privacy Framework)
• Apple Inc., USA: push notifications (Data Privacy Framework)
• Netlify, Inc., USA: website, contact form, Mac app updates (Data Privacy Framework, standard contractual clauses)
• Hugging Face, Inc., USA: download of speech models (IP address only)
• PayPal (Europe) S.à r.l. et Cie, S.C.A., Luxembourg: payment of fines, as an independent controller

Within your team, data is visible to other team members according to their role. We do not sell personal data and do not pass it on for advertising. We disclose data to authorities only where we are legally obliged to.

19Account deletion and what your team keeps

You can delete your account in the app at any time (see Delete your account). Deletion is immediate. We delete your sign in, signed in devices, push registrations, access tokens, team memberships, responses to upcoming events, name, email address, photo, self ratings and notes, benchmark results, Squad Cards and rewards.

So that your team's history still adds up, past attendance and responses with their reason, points, fines, results, scouting data and videos stay with the team, shown as "Former player" without your name, email address or photo. The legal basis is Art. 6 (1) (f) GDPR; the legitimate interest of the team is complete records of its past operations. If you want these entries removed too, contact us and we will review your request together with the team.

Sign in events in the log and backups are not changed by the deletion; they are deleted on their regular schedule (see retention).

20Children and young people

VolleyTeam is also used by youth teams. If you are younger than 16, you may only use VolleyTeam with the consent of a parent or guardian (Art. 8 GDPR). Coaches of youth teams must make sure that the parents agree before they add a minor to a team or record data such as a birth year, photos or videos. Parents can contact us at any time to see, correct or delete their child's data.

21Routine erasure and blocking of personal data

We process and store personal data only for as long as needed for the purpose of storage or as required by laws to which we are subject. When the purpose no longer applies or a statutory retention period ends, we routinely block or delete the data in accordance with the law.

22Your rights

You have the following rights. To exercise them, contact us at office@eimerreis.de. Many things you can also do directly in the app, for example correct your profile or delete your account.

23Legal bases of processing

Art. 6 (1) (a) GDPR is the legal basis where we ask for your consent for a specific purpose, for example for your player photo.

Art. 6 (1) (b) GDPR is the legal basis where processing is necessary to perform the contract with you, that is, to provide VolleyTeam under our terms of use, or for steps prior to a contract at your request, for example answering questions about VolleyTeam.

Art. 6 (1) (c) GDPR is the legal basis where we are subject to a legal obligation, for example statutory retention duties or answering requests from authorities.

Art. 6 (1) (f) GDPR is the legal basis for processing that is necessary to safeguard our legitimate interests or those of a third party, such as the team or club, unless your interests or fundamental rights and freedoms override them.

Storing information on your device or accessing it is based on § 25 (2) No. 2 TDDDG where it is strictly necessary for the service you requested; otherwise we ask for your consent (§ 25 (1) TDDDG).

24Legitimate interests

Where processing is based on Art. 6 (1) (f) GDPR, our legitimate interests and those of third parties are in particular:

• operating VolleyTeam securely and reliably, preventing misuse and defending against attacks (server logs, sign in events, error reports, Cloudflare)
• the joint organization of a team's training and match operations, including data coaches record about team members
• the analysis of the team's own matches (videos, scouting, Rally Calls)
• complete records of a team's past operations after a member leaves (Former player)
• answering requests that are not about using VolleyTeam

25Retention periods

We keep personal data as long as needed for the purpose and then delete it, unless statutory retention periods apply. In particular:

• Account and profile data: until you delete your account.
• Team data: while you are a member of the team. When you leave a team or delete your account, past team activity stays with the team without your name (see account deletion). It is deleted when the team is deleted.
• Player photo: until you remove it, leave the team or delete your account.
• Match videos: until the team deletes them or the team is deleted.
• Rally Calls: not stored; only the touches you confirm are saved.
• Push device tokens: until you sign out, delete your account or the token becomes invalid.
• Access tokens: until they expire (at the latest after 90 days), are revoked or you delete your account.
• Server log files: 14 days. Sign in events: 90 days.
• Backups: overwritten after 30 days at the latest.
• Contact requests: until resolved, at the latest after six months.
• Invoices and business letters, if any: 6 or 10 years under § 147 AO and § 257 HGB.

26Legal or contractual requirement to provide data

Providing personal data is partly required by law (for example tax rules) or can result from contractual arrangements. You are not obliged to provide personal data. However, without an email address and a name you cannot create an account and use VolleyTeam, because we need them to sign you in and so your team can recognize you. All other information, such as a photo, birth year or reasons for responses, is voluntary; without it some features are not available. If you are unsure whether you have to provide certain data, ask us.

27Automated decision making

We do not use automated decision making or profiling within the meaning of Art. 22 GDPR. VolleyTeam calculates points, rankings, attendance figures and statistics automatically and suggests touches from rally calls, but these figures and suggestions only support the team. They have no legal effect on you, and coaches decide what happens in the team.

28Changes to this policy

We update this policy when VolleyTeam or the law changes. The current version is always available at volleyteam.app/en/privacy. We inform you about significant changes in the app or by email.