YOUR DATA. YOURS.

1. What we collect.

When you use The Fourth Official, we collect three categories of data:

• Profile data. Name, email, phone (optional), position, foot, club history, photo.
• Match data. Fixtures you play, goals, assists, roll-call entries, ratings, sign-offs, disputes.
• Operational data. Device type, browser, IP address, anonymised analytics events, error logs.

2. Why we collect it.

Profile data lets your captain pick you for matches and lets your Scout Card render correctly. Match data is the platform's whole job - verified records of the football you play. Operational data lets us keep the platform working, detect fraud, and ship updates without breaking anything.

3. Legal basis.

We process your data under contract (you signed up to use the platform), legitimate interest (security, fraud prevention, analytics), or consent where required (push notifications, marketing emails). You can withdraw consent at any time in your settings or by emailing us.

4. Who we share it with.

We use a small set of named processors. Each one handles a specific job:

• Clerk - authentication and session management.
• Supabase - database, storage, and realtime sync.
• OneSignal - push notifications.
• WAM (wam.money) - payment processing for match fees. A payment platform built in Trinidad and Tobago and regulated by the Central Bank of Trinidad and Tobago.
• Sentry - error monitoring.
• PostHog - product analytics, anonymised.
• Algolia - search indexing.
• Cloudflare - hosting, CDN, and DDoS protection.

We don't sell your data. We don't share it with advertisers. We don't pass it to third parties outside the list above.

5. How long we keep it.

Active account: indefinitely, so your Scout Card stays current.

Deletion request: we purge your personal data within 30 days. Anonymised match records stay (they appear on other players' Scout Cards), but your name is replaced with a generic placeholder.

Payment records: retained for 7 years to comply with TT financial reporting requirements.

6. Your rights.

• Access. Request a full copy of your data.
• Correction. Fix anything that's wrong.
• Deletion. Purge everything we hold on you.
• Portability. Export your Scout Card and match history in JSON or CSV.
• Objection. Tell us to stop processing your data for a specific purpose (e.g. analytics).

To exercise any of these rights, email privacy@thefourthofficial.app. We respond within 30 days.

7. Security.

All data is encrypted in transit (TLS) and at rest. Access to production systems is limited to the founders and requires two-factor authentication. We have no third-party support staff with blanket data access.

8. Cookies.

We use cookies for authentication, anonymised analytics, and to remember your preferences. No advertising cookies. No third-party tracking cookies. You can clear them in your browser at any time; the platform will still work, you'll just have to log in again.

9. Children.

The platform is for users 16 and over. We do not knowingly collect data from anyone under 16. If you believe a child is using the platform, contact us and we'll close the account and purge the data.

10. International transfers.

Our infrastructure is hosted globally (Cloudflare, Supabase). Your data may be processed in the US, the EU, or Asia depending on nearest-region routing. All processors are bound by standard contractual clauses for cross-border transfers.

11. Changes to this policy.

Material changes get 30 days' notice via email and an in-app banner. Minor wording changes happen without notice but always with a fresh "Last updated" date at the top.

12. Contact.

Privacy questions: privacy@thefourthofficial.app.