Privacy

Who is responsible

Valentin Schuh
Forsthausgasse 16-20
1200 Wien
Österreich
valentinn.schuh@gmail.com

Boot Stats is a private, non-commercial project. Nothing is sold and nothing is shown for advertising.

Without an account

Anyone can read games, standings and statistics without signing in. To deliver pages and keep the service running, the servers (Amazon Web Services, Frankfurt) process technical request data such as IP address, time and the address requested. These server logs are kept for one month.

The website counts page views with Cloudflare Web Analytics, which sets no cookies; the Impressum describes it. The app contains no analytics, no advertising and no tracking.

The app keeps a few things on your device only: your sign-in (in the iOS Keychain or the Android Keystore), your chosen colours and theme, and games you are scoring until they are sent. The app downloads its updates from Expo (650 Industries, Inc., USA), which sees the device's IP address and app version when it does. The win-probability chart in a box score loads its drawing library from cdn.plot.ly.

If you follow a game, team, club, person or competition in the app, Boot Stats keeps for that device: a random number the app makes for itself, the address your phone gives for notifications, the platform, app version and time zone, what you follow and which alerts you chose. If you are signed in, the device is linked to your account. Alerts go out through Expo (650 Industries, Inc., USA) to Apple's or Google's notification service, which see that address and the alert's text. A record of each alert sent is kept for 30 days. Unfollowing deletes the follow at once. A device is deleted, with everything it follows, 30 days after Apple or Google report that the app is gone from it, or after a year in which the app was not opened. This is needed to send the alerts you asked for (Art. 6(1)(b) GDPR).

Your account

An account holds a username, an email address and a password. The password is stored only as a one-way hash, so nobody can read it. The account also keeps when it was made and last signed in, and the roles it has been given (for example scorer, club admin or observer of a federation).

The email address is used to confirm it is yours, to send a link when you forget your password, and to tell you about requests that wait for your decision. Mail goes out through Amazon SES (Frankfurt). Nothing else is sent to it.

Everything an account and a linked profile hold is used to run Boot Stats for you; this is needed to provide the service you signed up for (Art. 6(1)(b) GDPR). You must be 14 or older to create an account.

Player profiles

A player, coach, umpire or scorer who appears in a game has a public profile with their name, their teams and the statistics from the games. These come from the game records of the federations and leagues that use Boot Stats, and from public game reports.

If you link your account to your profile, you can add a birth date, height, hometown, links and a photo. The birth date and height are hidden unless you choose to show them. A new photo or new links are shown only after an administrator has approved them.

For the Austrian competitions that Boot Stats records itself, names, teams and statistics are published on the basis of a legitimate interest in reporting sports results (Art. 6(1)(f) GDPR). You can object at any time by writing to valentinn.schuh@gmail.com; your statistics then stay under an alias. A federation that runs its own competitions on Boot Stats decides what it publishes there and is responsible for it; Boot Stats processes that data on its behalf.

Tracked games

Every pitch and play scored in the app is stored with the game and with the account that scored it, and is published on the game page as soon as it is sent. Changes to a player profile or a club are kept in a change log with the account that made them.

Pictures and articles

Profile pictures, club logos and pictures in articles are stored on Amazon S3 (Frankfurt) or in the database, together with the account that uploaded them. A comment on an article is shown with the name of your player profile; likes are shown only as a count.

Deleting your account

In the app, open Profile and choose Delete account: the login is deleted at once, with its username, email address, password, roles, comments and likes. On the website, the account page lets you ask for deletion, which the administrator carries out within 30 days.

Games you scored, and the statistics of people who played in them, stay: they are part of the season's record. You can remove your photo from your player profile yourself at any time. If you want your name removed as well, write to valentinn.schuh@gmail.com. Your statistics then stay under an alias such as "Player #13".

Your devices are unlinked from the account; what they follow stays on the device until you unfollow.

The database is backed up daily, and each backup is kept for one day, so deleted data is gone from the backups within about two days.

Who else processes data

Amazon Web Services EMEA SARL (servers, database, files and email, all in Frankfurt), Cloudflare, Inc. (website page counts), 650 Industries, Inc. / Expo (app updates and notifications) and Apple and Google (delivering notifications). Each processes the data under its own data processing terms. Cloudflare and Expo are in the USA; both state that they take part in the EU-U.S. Data Privacy Framework, which covers transfers of personal data from the EU to the USA.

Your rights

You can ask what is stored about you, have it corrected or deleted, restrict or object to its use, and receive your data in a portable form. Write to valentinn.schuh@gmail.com. You can also complain to the Austrian data protection authority (Datenschutzbehörde, dsb.gv.at).