Privacy Policy

Last updated: November 2025

We take the protection of your personal data very seriously. This privacy policy explains what data we collect, how we use it, and your rights regarding your personal information when using Club Steer.

1. Responsible Party

2. Overview of Data Processing

Club Steer is a web application for managing club memberships, member data, and club administration. We process personal data only to the extent necessary to provide our services and in compliance with applicable data protection laws, including the General Data Protection Regulation (GDPR).

2.1 Types of Data Processed

• Account Data: Email address, display name, Firebase authentication ID
• Club Member Data: Names, contact information, membership details (encrypted)
• Usage Data: Access logs, IP addresses, browser information
• Technical Data: Encryption keys (derived locally, never transmitted)

2.2 Legal Basis for Processing

3. Data Collection and Use

3.1 Account Registration

When you create an account, we collect:

• Email address (for authentication and communication)
• Display name (for identification within clubs)
• Firebase User ID (anonymous identifier)

This data is processed to provide you access to the service and enable club membership management.

3.2 Club Member Data (Zero-Knowledge Architecture)

Club administrators may store member information including:

• Names and contact details
• Membership status and history
• Training group assignments
• Payment and bank information (if applicable)

Important - Zero-Knowledge Encryption: All personally identifiable information (PII) of club members is encrypted on your device using encryption keys that are derived locally from passwords that only authorized club users know. The encrypted data is then stored on our servers. We never have access to these encryption keys and cannot decrypt, read, or access any personal member information. This zero-knowledge architecture ensures that your members' personal data remains private and secure, even from us as the service provider.

3.3 Automatic Data Collection

When you access our service, we automatically collect:

• IP address
• Date and time of access
• Browser type and version
• Operating system
• Referrer URL

This data is used for security purposes, service optimization, and troubleshooting.

4. Data Storage and Security

4.1 Storage Location

Your data is stored on servers provided by Google Cloud Platform (Firebase) located in the European Union.

4.2 Encryption

We employ multiple layers of encryption:

• Transport Encryption: All data transmitted via HTTPS/TLS
• At-Rest Encryption: Database encryption by cloud provider
• Client-Side Encryption (Zero-Knowledge): All club member PII is encrypted locally in your browser before being sent to our servers. Encryption keys are derived from club passwords using PBKDF2 and never leave your device. We store only encrypted data and have no ability to decrypt it.

What this means for you: Your members' personal information (names, addresses, bank details, etc.) is mathematically protected. Even in the unlikely event of a data breach, the encrypted data would be unreadable without the club-specific encryption keys that only you possess.

4.3 Data Retention

• Account Data: Retained until account deletion
• Club Data: Retained until club deletion or data export
• Access Logs: Retained for 90 days

5. Third-Party Services

We use the following third-party services:

5.1 Firebase (Google)

We use Firebase for authentication and data storage. Google's privacy policy applies: https://policies.google.com/privacy

5.2 No Data Sales

We do not sell, trade, or otherwise transfer your personal data to third parties for marketing purposes.

6. Cookies and Local Storage

We use cookies and local storage for:

• Authentication: Maintaining your login session
• Preferences: Language settings, UI preferences
• Security: Cached encryption keys (for performance)

These are essential for the service to function and cannot be disabled while using the application.

7. Your Rights

Under GDPR, you have the following rights:

7.1 Right of Access (Art. 15 GDPR)

You can request information about the personal data we hold about you.

7.2 Right to Rectification (Art. 16 GDPR)

You can request correction of inaccurate personal data.

7.3 Right to Erasure (Art. 17 GDPR)

You can request deletion of your personal data ("right to be forgotten").

7.4 Right to Restriction (Art. 18 GDPR)

You can request restriction of processing of your personal data.

7.5 Right to Data Portability (Art. 20 GDPR)

You can request your data in a structured, machine-readable format.

7.6 Right to Object (Art. 21 GDPR)

You can object to processing based on legitimate interests.

7.7 Right to Withdraw Consent

Where processing is based on consent, you can withdraw it at any time.

7.8 Right to Lodge a Complaint

You have the right to lodge a complaint with a supervisory authority if you believe your data protection rights have been violated.

8. Data Processing for Club Administrators

If you are a club administrator, you act as a data controller for the member data you enter into Club Steer. You are responsible for:

• Obtaining necessary consents from your club members
• Informing members about data processing
• Responding to data subject requests from your members
• Ensuring lawful basis for processing member data

We act as a data processor on your behalf and process member data only according to your instructions.

9. Children's Privacy

Our service is not directed to children under 16 years of age. We do not knowingly collect personal data from children under 16. If you become aware that a child has provided us with personal data, please contact us.

10. International Data Transfers

Your data is processed within the European Union. If data transfer outside the EU becomes necessary, we will ensure appropriate safeguards are in place (e.g., Standard Contractual Clauses).

11. Changes to This Policy

We may update this privacy policy from time to time. We will notify you of significant changes by posting the new policy on this page and updating the "Last updated" date. We encourage you to review this policy periodically.

12. Contact Us