1. Who holds your information

Angus McGregor operates MatchHub as a New Zealand sole trader. For privacy questions, requests or complaints, email angus@matchhub.nz.

We hold your account information. Your club or association decides what competition information it records and what it publishes. We store those records for it. Ask your organisation for its own contact details.

2. What we collect

We hold only what running a competition needs.

• Account details — your name, email address and password (stored hashed), and optionally your phone number, gender and date of birth. Also the organisations you belong to and your role in each, your notification settings, and when you accepted the terms.
• Player details — the name your club records you under, the teams you play for, and your gender or date of birth where a competition needs them. A club can add you before you have an account. It must still tell you, or a parent or guardian for a junior, what it records and who can see it.
• Competition records — draws, who played in each fixture, scorecards, results, who entered and approved them, and when.
• Messages — the reminders and broadcasts a club sends through MatchHub, and whether they were delivered. For app notifications we also hold a device token, the device platform and the app version.
• Technical data — IP address, browser, sign-in times, pages visited, features used and errors, so we can keep the service secure and working. See "Analytics and error reports" below.

3. Why we collect it

The Privacy Act 2020 asks us to collect personal information only for a lawful purpose connected with what we do. Ours are:

• to run the competitions your club or association has set up — draws, rosters, scoring, ladders;
• to let the right people in: a manager sees their own team's scorecard, an administrator their own organisation;
• to send the reminders and notices a club has asked for, and the sign-in and verification emails an account needs;
• to build your own playing record from verified results;
• to keep the service secure and find faults.

We do not sell personal information, and we do not use it for advertising.

You do not have to give us information. Without a name, email address and password you cannot create an account, but you can still read public pages. A competition may need your age or gender, and a manager may need to give a phone number.

4. What is public

Each organisation has a public page at its own address. What appears there is what the organisation has chosen to publish: its name and logo, its competitions, published draws, verified results and ladders, team names, and the names of the players in each verified scorecard. Anyone in the world can see, copy and search for public information. If you have a safety concern about being named, tell your organisation or us.

Player contact email addresses, dates of birth, unpublished draws, draft results and the contents of a scorecard under query are never public.

5. Who can see what

Access follows your role in an organisation, not your account as a whole.

• Administrators of an organisation can see every person, team and result in that organisation, including email addresses and phone numbers, so they can run it.
• Team managers see their own team's roster and contact details, and the scorecards their team is party to. If a manager gives a phone number, the opposing team's manager and assistant managers see it from a week before each fixture until two days after it. A club may ask its managers to give one.
• Players see their own record, their team, and the draws their organisation has published.

Each organisation sees only its own private records. The organisations you join see your account profile. Our support staff can see account details when they help you. Belonging to two clubs does not let either see the other's data.

6. Who we share it with

We use a small number of providers to run the service. Each processes data on our instructions and only for the purpose named.

• Cloudflare hosts the application, the database and uploaded logos, and delivers the service to your browser.
• Cloudflare Email Service sends sign-in codes, invitations and the reminders a club has asked for. It receives the recipient address and the message.
• Expo, Apple and Google deliver app notifications. They receive the device token and the notification.
• PostHog receives analytics, error reports and any feedback you send, described in the next section.

Beyond that, we share personal information only where the law requires it or to protect the safety of a person.

7. Analytics and error reports

We record which pages are visited and which features are used, tied to your account when you are signed in, so we can see what clubs actually use and where they get stuck. When the app hits an error, we collect an error report. We do not record your screen.

We do not use advertising cookies. Our cookies keep you signed in and remember your settings. PostHog stores an analytics ID in your browser or device. We send PostHog a coded form of your account ID that cannot be turned back into it, never your name or email. Each record also says which organisation's pages you were on and whether you are a member or an administrator there. What your browser and our app send reaches PostHog through an address on our own domain; our servers also send PostHog a record of the actions you take, such as submitting a scorecard. We respect the browser's Do Not Track setting, for both.

8. Where it is stored

Our providers may store information outside New Zealand, including in the United States. They store and process it for us, and we remain responsible for it under the Privacy Act 2020.

9. How long we keep it

Competition records are the point of the service: a club's ladders, results and records stay for as long as the organisation keeps its workspace, so a player's history from past seasons survives.

• When you delete your account, we remove your email address, password, phone number, sessions and devices. The club's record keeps your name, your results, and your gender and date of birth if you gave them.
• An organisation closes its workspace by email. We agree the export and deletion dates with it, then confirm when we are done.
• We clear records of delivered emails and app notifications after about 180 days. We keep other message records while they are needed for support.
• PostHog keeps analytics and error reports for a limited time. Ask us if you want yours removed.

10. Your rights

Under the Privacy Act 2020 you can ask to see the personal information we hold about you and ask us to correct it. Most of it is on your account page and your record, where you can change it yourself. For anything else, email angus@matchhub.nz and we will respond within 20 working days. You do not need an account to ask. We may check who you are first. If we do not make a correction, you can ask us to attach your statement to the record.

If you are unhappy with how we have handled your information, you can complain to us first, and to the Office of the Privacy Commissioner at privacy.org.nz.

11. Children

Junior competitions are common in club sport, so some of the people recorded on MatchHub are under 16. A club adds a junior player's name and, where its rules require it, date of birth. The club must tell the junior and a parent or guardian first. A junior's contact details are visible only to their club's administrators and their own team manager, and we do not send marketing to anyone.

12. Security

Data travels over encrypted connections and is stored encrypted at rest. Passwords are stored as salted hashes. Access within our own team is limited to the people who operate the service. If we learn of a breach that is likely to cause serious harm, we will notify the people affected and the Privacy Commissioner, as the Act requires.

13. Changes to this policy

When this policy changes, the date at the top changes with it, and we email the administrators of every organisation about any change that affects what we collect or who we share it with. Questions go to angus@matchhub.nz.