01Who we are

Matchday is operated by [Company legal name], [registered address], Ethiopia ("Matchday", "we"). We decide how the personal data described here is used, and we answer for it.

For anything in this policy, including a request about your data, write to us through the contact form.

02What we collect

Only what the parts of Matchday you use need:

• Your account: your name and phone number, and an email address if you give one or have a staff account. Your password is stored only as a one-way hash that nobody, us included, can read back.
• Teams and rosters: the team's details and, for each player a captain adds, their name, jersey number, position and date of birth. The date of birth is used to check a competition's age rules.
• Entries, bookings and orders: what you entered or booked, when, the amount, the payment method and reference, and the receipt image you upload as proof of payment.
• Shops and venues: for those who run one, the details and photos they publish, and the payout account details they add.
• Messages to us: what you send through the contact form, with the name and the email or phone you leave for a reply.
• Security records: each sign-in attempt and its outcome. The phone or email typed and the network address are stored only as keyed digests, not as readable values.
• Notifications: if you use the Matchday phone app and allow notifications, the device token needed to send them.
• Telegram: if you connect Telegram, or open Matchday inside Telegram, your Telegram user id and username, so you can be signed in there and your notices can be sent to you. If you choose Start with Telegram, also the phone number Telegram shares with your permission and your Telegram name, which become your account's phone and name. Nothing else from your Telegram account is read.
• Error reports: when something breaks on the website or in the API, a report of the fault: the page or feature, the error and where in our code it happened, and the browser and device type. A report from the API also carries the internal id of the signed-in account, never its name, phone or email. Reports leave out what you typed, passwords, the address you connect from and the parts of links that carry codes.
• Page visits: anonymous counts, described under Analytics.

Matchday never receives or holds your money, so it never sees your bank or wallet login, card details or balance.

03Why we use it

• To run your account and sign you in, and to keep it secure (including noticing repeated failed sign-ins).
• To carry out what you ask for: entering a competition, booking a pitch, listing a shop or venue, and passing your entry, booking or order to the organizer, venue or shop it is for.
• To check a roster against a competition's rules, such as squad size and age limits.
• To send the texts, emails and notifications those steps need, such as a sign-up code or a decision on an entry.
• To answer messages you send us.
• To find and fix faults, from the error reports the website and the API send when something breaks.
• To understand, in aggregate, how the site is used and how fast it is, so we can improve it.

04Who sees it

Matchday is one record that several sides read, so some of your data is seen by the side it concerns:

• The organizer of a competition you enter sees your entry, your roster and your payment proof.
• A venue you book sees your booking and its payment proof.
• A shop you order from sees your order and the details needed to fulfil it.
• Matchday's administrators can see records across the platform to run and protect it.

Some things are public by design: competition details, team names, fixtures, results, standings and disciplinary records within a competition, venue listings and shop products.

We do not sell personal data, and we do not share it with advertisers.

05Services that handle it for us

We use service providers who process data on our behalf, only to run Matchday:

• Supabase, for the database.
• Vercel and Render, which host the website and the API.
• Object storage, for uploaded images such as receipts and photos.
• Resend, for email; AfroMessage, for text messages.
• Cloudflare Turnstile, which checks that a form was sent by a person.
• Expo, which delivers notifications to the phone app.
• Telegram, which delivers your notices if you connect it.
• Sentry, which receives the error reports.

Some of these providers store or process data outside Ethiopia, including in the European Union. We use them only for the purposes above.

06How long we keep it

• Account, team and roster data: while your account exists.
• Entries, bookings, orders and their payment proofs: as long as the record they belong to is kept, because they are the evidence for it.
• Sign-in records: 90 days, then deleted automatically.
• Messages to us: until they are no longer needed to deal with what you asked.
• Error reports: up to 90 days, then deleted by Sentry.
• Telegram connection: until you disconnect it on your profile, send /stop to the bot, or block the bot.
• A phone number shared for Start with Telegram: until your account is made from it, and never more than 15 minutes.
• Page-visit counts: kept as totals; the anonymous code behind them changes every day.

07Your rights

Under Ethiopia's Personal Data Protection Proclamation No. 1321/2024 you can ask to see the personal data we hold about you, to have it corrected, and to have it deleted, and you can object to how we use it. You can change your name and email address yourself in your profile.

For anything else, write to us through the contact form and say what you are asking for. We may need to confirm the request comes from you. Some records cannot be deleted while they are still needed, for example a payment proof behind an entry that is still in a competition.

08Children

Some competitions are for players under 18. A captain who adds a player under 18 to a roster confirms they have the permission of the player's parent or guardian to do so. A parent or guardian can ask us to correct or remove a child's details through the contact form.

09Analytics and storage on your device

Matchday sets no advertising or tracking cookies. To see how the site is used, it counts page visits: the page, the site you came from, the kind of device and the country, with no name, no account and nothing stored on your device. Each visitor is reduced to an anonymous code that changes every day, so nobody can be followed from one day to the next. It also measures how fast pages load, through Vercel Speed Insights.

Both are on by default and you can switch them off at any time on the cookie preferences page, which also lists what Matchday keeps in your browser to work.

10Security

Passwords are hashed, payment receipts are private and reached only through links that expire within the hour, and staff accounts are signed out after a short time without use. No system is perfectly secure, and if a breach affects your data we will tell you as the law requires.

11Changes to this policy

When we change this policy we update the date at the top, and for a significant change we will tell signed-in users on Matchday before it applies.