Privacy policy | Match Ready: Football

The short version

Your account and training data are stored with our database provider, Supabase, in London.
Health data (wellness, mood, sleep, pain, illness and head injury reports) is special category data. We only process it with your explicit consent, only to run your training plan, and you can withdraw consent at any time.
Apple Health and Health Connect are optional and off by default. Data from them is never used for advertising, never sold and never shared with anyone for marketing.
Players aged 13 to 15 need a parent’s consent before their plan starts. Under-18s get high-privacy settings by default.
We don’t show ads, sell data, or share it with clubs, coaches, employers or insurers.
You can export or delete your data at any time.

1. Who we are

Match Ready: Football (“the app”) and this website are provided by ARX Algorithms Ltd, a company registered in England and Wales (company number 17511371), registered office Office 21751, 182-184 High Street North, East Ham, London, E6 2JA (“we”, “us”).

We are the data controller for the personal data described here. Contact us at [email protected] or by post at the address above, marked “Data protection”. We are a small company and have not appointed a data protection officer; requests are handled by the company’s director. ARX Algorithms Ltd is registered with the Information Commissioner’s Office (ICO), registration number ZC284158.

2. Who this policy applies to

This policy covers the app and matchreadyfootball.app. The app is for people aged 13 and over. Under-13s can’t create an account; if we learn we hold data about someone under 13, we delete it. Section 13 explains how we handle players aged 13 to 17. A plain-English version for young players is shown in the app.

3. The data we collect

Data you give us

Account details: your email address and a user ID. For players aged 13 to 15, the linked parent’s email and their consent record.
Profile and training details: date of birth, sex, bodyweight, positions, kicking foot, years of lifting, lift numbers and test results, equipment, session length, club training days, match days and season dates.
Training logs: sets, weights, reps and reps in reserve, session ratings, club training and match logs (including minutes played), warm-ups completed and jump heights.
Health and wellness data (special category data): daily wellness scores, weekly mood and sleep answers, illness answers, pain reports, injury reports and physio stages, head injury reports, daily symptom checks and return stage, concussion history, health screening answers (PAR-Q+), optional monthly height for under-18s, and the optional cycle log.

Data from Apple Health or Health Connect (optional)

If you choose to connect, the app reads only: resting heart rate, heart rate variability (HRV), sleep, and workouts with distance and speed (for example from a watch-recorded match). Each type is asked for separately and the connection is off by default. The readings stay on your phone and are never uploaded: only the training adjustment the app makes from them (for example, one amber signal in your daily check-in) is saved with your plan, and a match distance only if you choose to add it to a match log. We never write to Apple Health or Health Connect and never read anything else.

Shared club fixture lists

Club and team names and fixtures (date, opponent, home or away, cancelled) are shared information other users of that team’s list can see. If you join a team or add or change a game, we store your user ID with that record so we can check changes and stop misuse. Other players never see your name, email or user ID. Under-18s can follow a list but are never shown to other members. Club lists contain no health data.

Subscription data

Purchases are made through Apple’s App Store or Google Play. We never see your card details. Through our subscription provider, RevenueCat, we receive an anonymous app user ID, the product bought, purchase and renewal dates, trial status, store region and whether the subscription is active.

Support and website

If you email us, we receive your email address and whatever you include. This website uses no cookies, no analytics and no advertising or tracking scripts. Our host, Cloudflare, processes technical data such as IP addresses to deliver and protect the site.

What we don’t collect

We don’t collect your location, contacts, photos, microphone or camera data, and we don’t use advertising identifiers.

4. How we use your data and our lawful bases

Purpose	Data	Lawful basis (UK GDPR)
Building and adjusting your plan and sessions	Profile, training logs	Contract (Article 6(1)(b))
Adjusting sessions for readiness, pain, illness and head injury; showing safety guidance	Health and wellness data, Apple Health or Health Connect data	Contract (Article 6(1)(b)) and explicit consent (Article 9(2)(a))
Storing your data so the app works across devices	Account and app data	Contract; explicit consent for health data
Parental consent for players aged 13 to 15	Parent email, consent record	Legal obligation and legitimate interests in protecting children (Articles 6(1)(c) and 6(1)(f))
Shared club fixture lists	Team membership, games and changes you add	Legitimate interests in accurate team fixture lists (Article 6(1)(f))
Managing subscriptions and trials	Subscription data	Contract (Article 6(1)(b))
Tax and accounting records	Transaction records	Legal obligation (Article 6(1)(c))
Support, security and fixing faults	Support emails, technical logs	Legitimate interests (Article 6(1)(f))
Reviewing the coaching rules after the first season	De-identified training data only	Legitimate interests; health data only with explicit consent. Never for under-18s’ data without consent.

We don’t use your data for advertising or profiling for marketing, and we never sell or rent it.

5. Health data and explicit consent

Information about your health is special category data under UK GDPR and the Data Protection Act 2018. The app asks for your explicit consent separately, with a plain explanation, before you first record health information. You can withdraw it at any time in the app or by emailing us. Without health data the app can’t personalise sessions to your readiness, pain or recovery; the safety tools still work. We never share health data with your club, coach, school, employer or insurer.

6. Apple Health and Health Connect

Used only to run your training plan and readiness check-in, and to describe your match and training running.
Never used for advertising or marketing, never sold, and never shared with data brokers or any third party except our processors listed in section 8, who store it for us.
Never used for injury predictions or risk labels.
You can turn it off in the app, or remove Match Ready: Football in your phone’s Health or Health Connect settings. Deleting your account deletes everything we read from them.

Our use of data from Health Connect follows Google’s Health Connect permissions policy, and our use of HealthKit data follows Apple’s App Store Review Guidelines.

7. Automated adjustments

The app adjusts your sessions automatically, for example fewer sets on an amber day or a training lock after a head injury report. These adjustments don’t have legal or similarly significant effects within the meaning of Article 22 UK GDPR: each shows its reason and, apart from safety locks, you can override it. The app gives training guidance only; it doesn’t diagnose anything or decide whether you’re fit to play.

8. Where your data is stored and who processes it

Your account and app data are stored with Supabase in its London region (AWS eu-west-2, United Kingdom). Row-level security means each user can only reach their own data. Some data is also kept on your phone so the app works offline.

Our processors, who act only on our instructions under written contracts:

Supabase Inc.: database, sign-in and the account deletion function. Data hosted in London.
RevenueCat Inc.: subscription management. Receives the anonymous app user ID and purchase information only, never health data.
Cloudflare Inc.: website hosting and security, and forwarding emails sent to our support address.
Our email provider: to receive and answer support emails.

Apple and Google process payments as independent controllers under their own policies. Some processors are based in the United States or may access data from outside the UK for support. Where data is transferred outside the UK, we rely on UK adequacy regulations (including the UK-US Data Bridge) or the UK International Data Transfer Agreement or Addendum.

Apart from our processors, we only share personal data if you ask us to, if the law or a court requires it, to protect someone’s vital interests in an emergency, or as part of a sale or restructuring of our business (in which case this policy still protects it). We never sell personal data.

10. How long we keep it

Account and app data: while you have an account. When you delete it, data is removed from our live database straight away and from backups within 30 days.
Inactive accounts: if you don’t open the app for 2 years, we may delete your account after emailing you first.
Parental consent records: while the child’s account exists, then deleted with it.
Club lists: fixtures you add stay for your team; your user ID is removed when you delete your account.
Subscription records: 6 years after the transaction, for tax.
Support emails: up to 2 years after our last reply.

11. Your rights

You have the right to access your data, correct it, have it erased, restrict or object to some processing, receive it in a reusable format, and withdraw consent at any time. Most of this you can do in the app (Profile: export or delete). Otherwise email [email protected]. We may need to confirm your identity and will reply within one month. There’s normally no charge. A parent can use these rights for a child aged 13 to 15.

12. Security

Data is encrypted in transit (TLS) and at rest by our database provider. Access is limited by row-level security, sign-in tokens are kept in your phone’s secure storage, and only the company’s director can access production systems, only when needed. If a breach is likely to put you at high risk, we will tell you and the ICO as the law requires.

13. Players aged 13 to 17 and the Children’s Code

We follow the ICO’s Age Appropriate Design Code (the Children’s Code). We complete a data protection impact assessment before under-18 sign-ups open.

Aged 13 to 15: a linked parent account must give consent before the plan starts. Until then, no plan, check-ins or health data are stored.
Aged 16 and 17: the player has their own account; a parent is invited and told the account exists.
High privacy by default: no public profile, no sharing, no messaging, no location, no advertising, no profiling, and no nudges to share more. Apple Health and Health Connect stay off unless the player opts in.
Health data is explicit opt-in, viewable and deletable by the player, and the parent can see what their child agreed to share.
Head injury reports alert the linked parent straight away, because safety comes first.
No leaderboards, body-composition numbers, diet plans or supplement content for under-18s.

14. Complaints

If you’re unhappy with how we’ve handled your data, please contact us first. You can also complain to the Information Commissioner’s Office: ico.org.uk/make-a-complaint, helpline 0303 123 1113.

15. Not medical advice

The app and this website give general training guidance, not medical advice, diagnosis or treatment. See our terms of use.

16. Changes to this policy

If we update this policy we’ll change the date at the top, and for significant changes we’ll tell you in the app or by email first.

17. Contact

ARX Algorithms Ltd, Office 21751, 182-184 High Street North, East Ham, London, E6 2JA. Email: [email protected].