App privacy policy

This policy explains how the Openside app for iPhone and Android (“the app”) handles your information. It covers the app only. Your club's website has its own privacy policy, and so does openside.club.

In short

• The app is a window onto your club's own website. What you add in it (your profile, the matches you record) goes to your club's site, and your club decides how it's used.
• The app has no advertising, no analytics and no tracking. It doesn't build a profile of you, and never asks to track you across other apps.
• You sign in on your club's own sign-in page. The app never sees your password.
• You can delete your account from the app, at any time: Me › Delete my account.
• The app is for adults, 18 and over.

Who we are

The app is made by Arkilon Ltd, a company registered in Scotland (company number SC730513), with its registered office at 48, 2/3 West George Street, Glasgow G2 1BP, United Kingdom. We're registered with the UK Information Commissioner's Office (registration ZB652074). In this policy “we” and “us” means Arkilon Ltd.

Contact us about anything in this policy at hello@openside.club. [Our representative in the European Union, for people there who'd rather contact someone in the EU: name and address.]

Your club and us

Each rugby club on Openside has its own website, which we host and run for the club. The app talks to the websites of the clubs you add to it, and to nothing else.

• Your club is responsible for your member information (in data protection terms, its controller): your account, your profile, the club's fixtures and team sheets, and the matches recorded for it. Its own privacy policy explains how it uses them; the app links to it from Me.
• We look after that information on your club's behalf (as its processor), under our data processing terms with the club. We only use it to run the club's site and the app for the club, never for our own purposes.
• We're responsible ourselves for the little the app's stores tell us (see Apple and Google) and for emails you send us.

So if your question is about your membership, your profile or a match, please ask your club first. We'll help too: write to us and we'll pass it on or answer it.

What the app handles

The clubs you add

When you add a club by its web address, the app reads the club's public details from its site (its name, crest, colours, languages and sign-in address) and keeps them on your phone.

Signing in

You sign in on your club's own sign-in page, opened in your phone's secure sign-in sheet (on iPhone) or a private browser tab (on Android), so the app never sees your password or the codes you're emailed. The club's site gives the app keys (“tokens”) that let it act for you. They're kept in the iPhone's Keychain, or encrypted with a key in the Android Keystore, one set for each club. Signing out of a club cancels its keys on the club's site and removes them from your phone.

Your account and profile

The app shows and lets you change what your club's site holds about you: your name, nickname, bio (in each of the club's languages), your preferred position, your photo, whether you're shown on the club's public site, and the language your club writes to you in. When you change something, the app sends only what you changed to your club's site. A photo you choose is made into a JPEG of at most 2000 pixels on your phone before it's sent. The app keeps a copy of your profile and settings so Me opens without signal.

Your signed-in devices

To show you where you're signed in, and let you sign a device out, your club's site keeps a record of each device you've signed in on: [the device's name or model, the app's version, and when it was last used]. The app also makes a random identifier for itself when it's installed, which goes with the match events it records, so the site can tell which phone recorded what.

Match records

If your club lets you record matches, the app downloads what the recorder needs: fixtures from a week ago to four weeks ahead, the teams, the squad (players' names and numbers) and the match formats. It keeps them on your phone so they work with no signal, and refreshes them when you open the app and about once a day in the background.

Everything you record (tries, kicks, cards, subs, the team, each with its time) is saved on your phone first, then sent to your club's site when there's a signal. These records are about the match and the players in it, and become part of your club's records. They show who recorded them.

The calendar

If your club's site has a calendar, the app downloads its fixtures, tournaments and training sessions, with places, team sheets and scorers as the club publishes them, and keeps them on your phone so they open without signal.

Notifications

The app doesn't send notifications yet. When it does, it'll ask your permission first, and this policy will say what it sends and to whom.

Permissions on your phone

• Photos: you choose a photo for your profile with the phone's own picker, which only gives the app the photo you pick. The app doesn't ask to see your library.
• Calendar: “Add to Calendar” uses your phone's own screen to add an event. The app can't read your calendar and doesn't ask to.
• Location: the app doesn't use your location. Directions to a ground open your maps app with the ground's address; your maps app's own privacy policy then applies.
• Network: the app watches for the network coming back, so it can send what's waiting. It doesn't record which networks you use.
• Background work and keeping the screen on: so recorded matches are sent even when the app is closed, and (on Android) so the screen stays on while the board's open.

What the app doesn't do

• No advertising, and no advertising identifiers.
• No analytics or tracking kits, ours or anyone else's, and no tracking across other apps or websites.
• No selling or sharing of your information, and no profiling of you.
• No access to your contacts, microphone, location or calendar.

Who else is involved

Your club

Holds your account, profile and the club's records, and decides how they're used. See its privacy policy.

Vultr

Runs the servers your club's site is on, for us. [Japan (Tokyo).]

Cloudflare

Carries the app's requests to your club's site and protects it from attacks, for us. Worldwide.

Apple and Google

Distribute the app through the App Store and Google Play under their own privacy policies. If you've agreed in your phone's settings to share analytics with app developers, they give us crash reports and statistics about the app (such as installs and the phone models used), which don't identify you to us. We use them only to find and fix problems.

We may also disclose information if the law requires it, and we'd tell your club unless we're not allowed to.

Where it's kept

Your club's site, and so what the app sends to it, is hosted in [Japan], which the UK and the European Union recognise as protecting personal information adequately. Cloudflare may carry requests through other countries, under the UK's and EU's standard contractual clauses. What the app keeps on your phone stays on your phone.

How long it's kept

• On your phone: a club's details, keys, profile, fixtures and calendar are kept until you sign out of that club or delete the app. Recorded match events stay on your phone after they're sent, as a backup, [until you sign out of that club or delete the app].
• On your club's site: for as long as your club keeps them, as its privacy policy says. If your club leaves Openside, its site is removed and its final backup deleted, as openside.club's privacy policy explains.
• Crash reports and statistics from Apple and Google: as long as their consoles keep them.
• Emails you send us: [two years] after our last reply.

Your rights

Wherever you live, you can ask to see, correct, download or delete your information, and object to how it's used. Under UK and EU data protection law (and similar laws, including Japan's Act on the Protection of Personal Information and Taiwan's Personal Data Protection Act) these are legal rights.

Most of what the app handles is your club's, so the quickest way is usually to change it in the app (Me) or ask your club. You can always write to us at hello@openside.club: we'll help, or pass your request to your club and tell you we have. It's free, and we'll reply within a month.

Deleting your account

In the app, go to Me › Delete my account. Your club's site deletes your account and profile, and the app forgets the club. Match events you recorded stay in your club's records, as part of the match, without your account. You can also ask your club to delete your account, or write to us.

Deleting the app from your phone removes everything it kept there, but it doesn't delete your account on your club's site. If you delete the app while recorded events are still waiting to be sent, they're lost: the app shows what's waiting in the Match tab.

Age

The app is for adults, 18 and over. It isn't meant for children, and we don't knowingly handle children's information through it. If you think a child is using it, please tell us or the club.

Security

The app only talks to club sites over encrypted connections (HTTPS). Its keys are kept in the phone's secure storage, are short-lived and are replaced as they're used, and signing out cancels them. Recorded events carry an identifier made on the phone, so sending one twice can't count it twice.

Changes to this policy

If the app starts doing something new with your information, such as notifications, we'll update this policy before it does, and say what's changed at the top of this page. Big changes will be shown in the app too.

Contact and complaints

Write to us at hello@openside.club, or Arkilon Ltd, 48, 2/3 West George Street, Glasgow G2 1BP, United Kingdom.

If you're unhappy with how your information has been handled, please tell us so we can put it right. You can also complain to the UK Information Commissioner's Office, or the data protection authority where you live, such as Japan's Personal Information Protection Commission.