DeutschEnglish

This is a translation for your convenience. Only the German version is legally binding.

SQUAD+

Privacy policy

This privacy policy explains which personal data SQUAD+ processes and what it is needed for.

1. Controller

Marcus Rettig
Grundbergweg 4a
35428 Langgöns
Germany

Email: admin@squadplus.de

2. Which data is processed

• Master data: first and last name, date of birth, team and email address of the players (siblings can use the same address); name, email address and role of coaches and administrators; name and email address of guardians (parents, legal guardians) and the link to their children. Voluntary: profile picture and phone number.
• Access data: passwords are only stored as an irreversible hash. The email address is used for logging in and resetting the password and is confirmed with a code (valid for 15 minutes) or – if a coach or administrator enters it – with a confirmation link (valid for 7 days), both sent by email; “Forgot password?” sends a link that is valid for one hour and works only once. After a change of password or email address, a security notice goes to the previous address. To protect mailboxes from mass emails, SQUAD+ stores for 30 days when which kind of email was sent – only as an irreversible hash of the address. SQUAD+ sends no other emails (advertising, newsletters).
• Player details (voluntary): positions, strong foot, height, weight and kit details (e.g. shirt and shoe size, shirt number). They are visible to the player and to coaches and administrators.
• Events and replies: the team’s events (kind, date, times, place, opponent, note), the players’ replies (yes, maybe, no) with time, for a no the chosen reason (ill, injured, school/work, holiday, private, other) and an optional note, confirmed attendance, the squad (nomination, shirt number, goalkeeper, captain, line-up), car pools (drivers – including freely entered names such as “Max’s mum” –, seats, place and time of departure, passengers, ride requests), tasks and who took them on, and polls with the votes cast (polls are not anonymous). Reasons and notes are only visible to coaches and administrators; the team sees the names per reply.
• Preparation (training plans with proofs, only if the club uses the module): the coaches’ training plans and sessions; submitted sessions with duration, for runs the distance, effort (comfortable, challenging, very hard) and an optional note; photos and videos as proof; the coaches’ feedback (confirmation, question, rejection) and the history of these steps; the optional rating of the exercises (“too easy / fits / too hard”), saved exercises, results of performance tests (entered by the coach, e.g. Cooper test before/after) and the streak (weeks in a row all done) with the record. After an absence with the reason “ill” or “injured” (or a break) of at least 7 days, SQUAD+ suggests a lighter re-entry week to the coach; their decision, from when it applies and who decided are stored. Photos are saved again in the browser before the upload, which drops metadata such as the location. Beforehand SQUAD+ reads only the time taken, device, editing software and a note on AI generation from the original file – never the location – and shows them to the coach for checking. To recognise proofs submitted twice, a fingerprint of every file is stored. For runs, text recognition on the SQUAD+ server (no outside service) reads distance, duration and date from the screenshot of the running app; the result is kept for one day and shown to the coach as a hint if it does not match the entry. From duration and effort SQUAD+ calculates a weekly load and points the coaches to strong increases – players do not see this hint. Players see their team’s figures only without names (weekly rate, ranking as bars, shared kilometres; for comparing the kilometres with destinations the postcode of the club address is used). Coaches can upload short own videos (at most 60 seconds) for sessions or add links to videos of other providers; SQUAD+ only opens links when tapped, then the provider’s terms apply. Coaches get notifications about new proofs, a daily overview and on Mondays a weekly report by e-mail with the status of their players; players get reminders of open sessions, the result of the check (without notifications questions and rejections by e-mail) and the message about a new plan.
• Season photo album: match photos from the chat for which the sender chose “end of season” stay until 30 June and appear under Team › Photo album – the same files, no copy. Players only send there if the coach allows it.
• Player of the match: after a game the vote of every player and coach (for whom, when). Nobody sees in the app who voted for whom; after the end only the player with the most votes and how many are shown.
• Coach absences: period, an optional note, the requested cover (another coach of the club) and their reply. In the events of the period the team only sees “Coach away” and the accepted cover.
• Birthdays: Only with consent (under 16 by the guardians, from 16 by the player; can be withdrawn at any time) “First name has a birthday today” appears on the birthday on the start page and as a message in the team chat – never year of birth or age. We store the consent and who gave it when.
• Absences: period (from–until), reason from the list of reasons for declining (e.g. holiday, ill), an optional note and who entered it. Players enter them for themselves, guardians for their child, coaches for players of their team; events in the period count as declined. Only the coaches see reason and note, the team only sees “No”. The team’s coaches are notified. Absences are part of a data access request and are deleted with the player.
• Chat: messages, pictures and PDF documents in the teams’ chats, reactions, pinned messages, up to which message someone has read (for “read by”) and muted chats. Messages are visible to the team, its coaches and – depending on the setting – guardians.
• Team cash: fees, fines and other charges per player with amount and “paid”, the cash book with income and expenses, and who is treasurer. Players and their guardians only see their own balance; payment happens outside SQUAD+.
• Internal coach details: coaches can mark a player as paused (e.g. when injured, optionally with an end date), set a responsible coach and add a short internal note. These details are only visible to coaches and administrators; they are part of a data access request. For paused players, SQUAD+ automatically enters a no for events.
• Club pictures: club logo and team photos.
• Competition (fussball.de): if a coach connects their team with fussball.de, the SQUAD+ server retrieves and stores publicly available information from there: tables, fixtures with results and venues, names and crests of the clubs and teams. The games of the own team become events. No data of the users is transmitted to fussball.de – only the server makes the requests, the app loads nothing from fussball.de. Names of referees are not stored.
• Calendar subscription: for the calendar subscription every account gets a secret, renewable link. The phone’s calendar app regularly fetches the events (title, times, place) with it.
• Change log: which coaches or administrators changed teams, accounts, players and settings and when.
• Notifications: if you turn on notifications, the receiving address issued by the browser and its key are stored for your device, as well as the app’s language, so that notifications and emails arrive in that language. There are notifications e.g. about new, changed or cancelled events, reminders of open replies, published squads, assigned tasks, polls and new chat messages; notifications to players also go to their guardians. Which of them are sent is decided by the club. For the “Sending” overview, SQUAD+ only counts per day how many notifications and emails were sent – without recipients.
• Emails: SQUAD+ only sends emails that are needed for using it: confirmation codes and links, “Forgot password?” links, security notices, invitations for coaches, administrators and guardians and – only if no notifications are turned on on the phone – important notifications such as new or cancelled events and reminders.
• Technical data: session data for logging in, limited counts of failed login and registration attempts to prevent abuse (per account or name and per internet connection, the latter only as an irreversible hash; deleted after seven days at most), an error log with technical error messages (time, place in the program, function called – without IP address) and technical error messages of the web server, which can contain the IP address. The server does not store access logs (who calls which page when); the error messages are overwritten automatically after a short time.
• Photos and documents: photos (profile picture, chat, team photo) are saved again in the browser before uploading and shrunk if needed; embedded metadata such as the location is removed. PDF documents in the chat are stored unchanged and can contain their own metadata (e.g. author).

3. Purpose and legal basis

The data is processed to organise the team’s and club’s activities – events, replies, squad, car pools, tasks, team cash –, to manage player, guardian, coach and administrator accounts and for communication within the club (Art. 6(1)(b) GDPR, user relationship or club membership). The change log, protection against login abuse and error messages serve the security and traceability of operation (Art. 6(1)(f) GDPR). Notifications are only sent after your explicit consent in the browser (Art. 6(1)(a) GDPR). SQUAD+ processes voluntary details (profile picture, phone number, player details) based on your consent (Art. 6(1)(a) GDPR); you can change or delete them at any time.

The reasons “ill” and “injured” are health data; they are voluntary and are only processed with your explicit consent, which you give by sending the reply (Art. 9(2)(a) GDPR). You can choose another reason instead. For minors, the club ensures the necessary consent of the parents or guardians. Players under 16 may only use SQUAD+ with the consent of their parents or guardians (Art. 8 GDPR). They confirm this when registering or the next time they open the app; the time of the confirmation is stored. It is part of a data access request.

4. Storage period and deletion

• Events, replies, squads, car pools, tasks, polls, chat messages and cash data are stored as long as the club uses SQUAD+ and they aren’t deleted. You can delete your own chat messages at any time (and edit them for 15 minutes after sending); coaches can delete messages in their team. Deleted pictures and documents are removed from the server. Match photos (photo albums in the chat) are deleted automatically after the period chosen when sending – 30 days at most.
• Entries, proofs, feedback and history of a training plan (preparation) are deleted automatically three months after its end; the plan itself stays as a template without personal data. The club can delete proof files of finished plans earlier.
• The change log is deleted after twelve months, the daily counts for “Sending” after 13 months.
• Confirmation codes are valid for 15 minutes and deleted at the latest one day after expiry; confirmation links are valid for 7 days, “Forgot password?” links for one hour, invitations for 7 days and player links for 30 days. The key for “Stay logged in” is deleted after 30 days or when logging out. The list of sent emails (only as a hash of the address) is deleted after 30 days. The error log is limited to about 1 MB; older entries are overwritten.
• Backups: every night a copy of the database is created automatically on the server; the last seven are kept. Deleted data can therefore remain in these backups for up to seven days. In addition, the operator regularly and before every update downloads a complete backup and keeps it protected outside the server to be able to restore the data after a failure; older backups are continuously replaced by newer ones. Backups are only used for restoring.
• If a club stops using SQUAD+, all of the club’s data is deleted; it then stays in a protected recycle bin on the server for 14 days and is then removed for good.
• The device data for notifications is deleted as soon as you turn notifications off, log out, your account is archived or deactivated or the notification service reports the address as invalid or it repeatedly can’t be reached.
• Account and master data is stored as long as the account exists. Archived players can no longer log in; their replies are kept for the statistics. If a player is deleted, their account, replies, contact details and assignments are removed. Requests for deletion and correction can be sent to the contact address above.

5. Recipients and hosting

The application is run at the hosting provider IONOS SE (data centre in Frankfurt am Main, Germany). The provider processes data exclusively for the operation and technical security of the application. SQUAD+ does not pass on data for advertising or analysis purposes.

Notification services: notifications are delivered via the push service of the respective browser or device manufacturer, such as Google (Chrome, Android), Apple (Safari, iPhone, iPad), Mozilla (Firefox) or Microsoft (Edge). The content of the message is transmitted encrypted and cannot be read by these services; however, they process the receiving address and technical connection data. A transfer to third countries, in particular the USA, cannot be ruled out. Google, Apple and Microsoft are certified under the EU-US Data Privacy Framework. If you don’t turn on notifications, you are not affected.

Sending emails: all emails (see section 2) are sent via the mail server of the email provider Serverprofis GmbH and transmitted to the recipient’s mail provider. Notifications by email contain e.g. the name, date and place of an event; unlike notifications, emails are not transmitted end-to-end encrypted.

Maps and calendar: SQUAD+ only opens the place of an event in a map service (e.g. Google Maps or Apple Maps) when you tap it – then that service’s privacy policy applies. SQUAD+ doesn’t embed maps. If someone subscribes to the calendar, their calendar app or its provider fetches the events via the secret link.

6. Cookies and local storage

• Session cookie: technically required for logging in and protection against access by others; ends after two hours of inactivity at the latest.
• “Stay logged in”: only if this option is chosen when logging in, a cookie stores a random key for 30 days so that you don’t have to log in again. It is deleted when you log out.
• Language cookie: stores the language chosen in the app (German or English) so that pages, notifications and emails appear in that language.
• Browser storage: SQUAD+ stores settings and usage hints there (e.g. light/dark appearance and whether hints about installing or notifications were dismissed). SQUAD+ also registers a service worker that makes the app on the home screen and notifications possible.
• Offline mode: so that you can also view SQUAD+ without an internet connection, the app stores on your device the most recently loaded data you are allowed to see anyway (events with replies, squads, car pools and tasks, polls, team and contacts, cash balance, the most recently read chat messages as well as profile pictures and the team photo). Nothing can be changed without a connection. When you log out, SQUAD+ deletes all stored data from the device, as it does when someone else logs in there.
• Anonymous usage statistics: the operator counts on its own server, without cookies, which areas of the app are opened how often – with role (e.g. player/coach), device type, browser and whether SQUAD+ is installed as an app, never with names or contents. The IP address is not stored; visitors of a day are told apart by an identifier made from the IP address, browser details and a random key that is created anew every day and deleted afterwards; it can’t be traced back to a person. Individual visits are deleted after 30 days; only daily totals remain.

No tracking, advertising or third-party statistics services are used.

7. Your rights

Players can delete their account for good at any time themselves in the account under “Delete access”. The club can create a data access file with all stored details directly from SQUAD+. Within the legal requirements you have the right to access, correction, deletion, restriction of processing, data portability and objection. Consent given can be withdrawn at any time with effect for the future; you turn notifications off at any time in your account under “Notifications” or in your browser’s settings. You also have the right to lodge a complaint with a data protection supervisory authority.

8. Contact

For questions about data protection: admin@squadplus.de

As of November 2026