Privacy
Draft — not yet legally reviewed.
This is a draft. It was written from the project’s own record of processing
(docs/compliance/data-map.md) so that it describes what the software actually does. It has not
been reviewed by a lawyer, and every place where a lawyer has to decide something is marked
[LEGAL: …] in this text. Do not rely on it until those marks are gone.
Who is responsible
SlongeHoops is operated by Slonge Solutions Tobler, Switzerland. You can reach us at hello@slongehoops.com.
[LEGAL: the controller has to be named with its legal form and full registered address, and a decision is needed on whether an EU representative under GDPR Art. 27 is required for a Swiss controller offering a service to people in the EU, and likewise a Swiss representative under revFADP Art. 14 if the controller is ever established elsewhere.]
[LEGAL: when a club uses SlongeHoops for its teams, the club is in practice the point of contact with parents. Whether that makes the club a joint controller, and whether a joint-controller arrangement under GDPR Art. 26 is needed, is unresolved.]
The short version
- If you do not make an account, nothing you draw leaves your browser.
- We run no third-party trackers and no advertising pixels. There is no cookie banner because there is nothing to consent to.
- A player’s entire record is a display name. No birth date, no address, no phone number, and no e-mail is required.
- Names on your roster never leave your team. They are structurally excluded from every share link.
- You can export everything we hold about you, and you can delete your account yourself.
Using SlongeHoops without an account
The editor, the library, playback and video export run in your browser. Plays you draw are stored in your own browser’s storage on your own device. We do not receive them. If you clear your browser’s data, they are gone, which is why export exists.
A share link carries the play inside the link itself. Anyone who has the link can open the play. The link is not a secret; treat it as public.
[LEGAL: confirm whether browser-local storage of this kind requires consent under the ePrivacy Directive. Our reading is that it is strictly necessary for a service the user has asked for, and therefore exempt, but the reading needs to be confirmed.]
Using SlongeHoops with an account
An account exists so your plays sync, so a team can share a playbook, and so a coach can see whether players have learned a play.
What we store, and why:
| What | Whose | Why | How long |
|---|---|---|---|
| Display name | Yours | So teammates know who is who | While the account exists |
| E-mail address, if you signed in with one | Yours | Signing in, and getting back in | While the account exists |
| Avatar image, if you upload one | Yours | Optional | While the account exists |
| Your plays and playbooks | Yours | The product | 30 days after you delete them, then permanently gone |
| Roster entries: a player’s name, squad number and position, entered by a coach | The player’s, entered by the coach | The coach’s squad list, and names on the court tokens | Until the coach deletes it, or 30 days after a soft delete |
| Quiz results: score, mode, timings, the answers | The player’s | So a player can track themselves and a coach can see who has learned a play | 3 years after the quiz was finished |
| Team and club memberships and roles | Yours | Deciding what you may see and do | While the membership exists |
| Invite codes and share links you created | Yours | Letting people join or view | 30 days after they expire or are revoked |
| Security log: who did what, when | Yours | Investigating abuse and security incidents | 2 years, with your identity removed if you delete your account |
| Monthly usage counters for the AI features | Yours | Abuse and cost control | Indefinitely; a number, not a record of content |
| Subscription: which plan, the status, the provider’s ids | Yours | Knowing what you paid for | While the subscription exists |
[LEGAL: the legal basis for each row above is not stated, on purpose. Contract, legitimate interest and consent each apply to different rows, and the hardest one is the roster entry — a name entered by a coach about a person, usually a minor, who did not enter it themselves. This needs a determination, not a guess.]
[LEGAL: the retention periods of 3 years for quiz results and 2 years for the security log are engineering defaults chosen by the developer. They need to be either justified or changed.]
We never store: a card number, a billing address, an invoice, a date of birth, a phone number, a postal address, a health record, or a photograph you did not choose to upload as an avatar.
Children
Most players using SlongeHoops are minors, and the design answers that by collecting almost nothing. A player can join a team with an invite code and a display name, with no e-mail address at all. There are no public profiles, no direct messaging, no advertising and no profiling.
[LEGAL: this is the largest open question in this document. The age below which a parent must consent differs by country — 13 to 16 under GDPR Art. 8, 13 under COPPA in the United States, 16 under the revised Swiss data protection act’s reading for certain processing. SlongeHoops currently has no parental-consent flow and asks for no age. Whether one is required, at what age, in which countries, and whether a coach or a club can give consent on a parent’s behalf, all have to be settled before this service is offered publicly.]
Who processes data for us
| Who | What they process | Where |
|---|---|---|
| Supabase | The database, sign-in, file storage and server functions — everything an account touches | An EU region. [LEGAL: confirm and state the exact region; the project must be created in Frankfurt (eu-central-1) or Zurich (eu-central-2) and the region cannot be changed afterwards.] |
| Stripe | Payment, as the seller on record | Stripe is a US company with a European entity. [LEGAL: confirm which Stripe entity contracts with a Swiss seller under Managed Payments, and record the transfer mechanism.] |
| Cloudflare | Turnstile, the check that you are not a bot, which sees your IP address and some request metadata when a sign-in sheet or a join link opens | Global |
| DeepSeek, or Anthropic if configured instead | Only the AI quiz writer, and only if you use it. See below. | [LEGAL: DeepSeek processes data in the People’s Republic of China. The transfer mechanism for that, and for Anthropic in the United States, has to be recorded and is not yet.] |
| An e-mail sender | E-mail addresses and sign-in links | [LEGAL: not yet chosen. It must be named here before the first e-mail is sent.] |
| A hosting provider for the website | Your IP address and the usual web-server request metadata | [LEGAL: not yet confirmed in writing.] |
We do not sell data, and we do not share it with anybody not on this list.
Payment
Payments are handled by Stripe Managed Payments. Stripe is the seller on record — the merchant of record — not merely our payment processor. In practice that means:
- Your card statement will read
LINK.COM*followed by our product marker, because Link is the brand Stripe uses with customers. - We never see your card. We never see your billing address. We never see the invoice.
- When you press a plan, we hand Stripe your user id, the id of the account, team or club the plan is for, our product marker, the price id, and the e-mail address on your account so their form is filled in. Nothing else — no play, no roster, no team name, no player’s name.
- If you change the e-mail address at Stripe’s checkout, the address Stripe then holds is theirs and not ours.
- Stripe may refund a customer within 60 days at its own discretion.
- If you ask Stripe to delete your data, Stripe cancels your subscriptions and deletes its own records, including records held in our account. Our copy of a subscription is a mirror of theirs, never the record. To ask Stripe to delete what Stripe holds, you have to ask Stripe.
[LEGAL: whether Stripe is our processor, an independent controller for the sale, or both at once, decides what paperwork is needed and what this section has to say. It is not settled.]
The AI quiz writer
If you use the AI quiz writer, one request is sent to a model vendor containing the play as text a coach could read: its name, description, tags, situation and formation; each phase with its coaching note; each action in order with its timing; where each player stands, named as a court spot; and your simulated-defense settings if you have switched them on. Players appear as the numbers 1 to 5.
Not sent: roster names, squad numbers, lineups, team or club names, user ids, e-mail addresses, or any image.
There is one thing you should know before you use it. Your coaching notes are free text, and nothing removes names from them. If you type “Mika waits here” into a phase note, that sentence goes to the vendor. The same sentence already travels inside a share link, so it is not a new kind of risk, but it is a new recipient.
[LEGAL: the developer has recorded three options — send the notes as today, strip anything that looks like a name, or warn at the moment of generation. One has to be chosen, and this paragraph has to match it. The vendor’s retention period, processing region and data-processing agreement also have to be confirmed before the first real use.]
The feature is inactive unless the operator has configured a vendor key. Until then no request leaves the service at all.
Cookies and analytics
The website sets no advertising cookie, runs no third-party tracker and carries no social pixel. There is no cookie banner because there is nothing that would need one.
If analytics are switched on, they are cookieless — no identifier that follows you between visits, no cross-site tracking — and they count page views and clicks, not people.
The app itself stores things in your browser that it needs to work: your plays, your settings, your sign-in session and, if you arrived through a referral link, the referral code. These are first party, on your own device.
[LEGAL: confirm that a cookieless analytics tool as configured needs no consent in Switzerland, the EU, Germany (TTDSG §25) and the UK, and name the tool here once chosen.]
What you can do
- See everything we hold about you. The app exports it as a file, and it contains only what is keyed to you and nothing about anybody else.
- Delete your account. The app does it. Your personal plays are deleted. Your quiz results are deleted everywhere. If you were the only coach of a team and there is no club administrator, the team, its playbooks, plays and roster are deleted too and everyone loses access at once. If there is another coach, your team content passes to them. Roster entries linked to you are unlinked and the name replaced. Links and invites you created are revoked. The security log keeps what happened but not who you were.
- Correct anything. You edit your own profile; a coach edits their roster.
- A coach can delete a roster entry and a player’s quiz results at any time.
A live subscription cannot be left billing quietly: on deletion we try to cancel it at Stripe and record whether that worked. If it could not be reached, we cancel it by hand.
[LEGAL: restriction of processing and objection (GDPR Arts. 18 and 21) are not built as features and would be handled by hand today. Confirm whether that is sufficient, and state the response time.]
[LEGAL: the right to lodge a complaint with a supervisory authority has to be stated, naming the Swiss FDPIC and explaining that people in the EU may complain to their own national authority.]
Security
Access to every row is decided by the database, not by the app: default deny, with a policy per table. Codes for invites and share links are high-entropy, expire, can be revoked and are rate limited. Administrators of a club must use a second factor for sensitive operations. Data is encrypted in transit and at rest by our hosting provider. Avatars sit in a private bucket with one folder per user.
None of this makes a share link private. A share link is a capability: whoever holds it can open what it points at.
[LEGAL: a data-breach notification commitment has to be stated, with the 72-hour deadline under GDPR Art. 33 and the Swiss equivalent, and a decision on when users are told directly.]
Changes
If this policy changes in a way that matters, we will say so in the app and update the date at the top.
[LEGAL: decide whether material changes require notice by e-mail and how much notice, and whether continued use counts as acceptance.]