Privacy Policy

SquadLock (“we”, “us”, “our”) operates the SquadLock website at squadlock.app and the SquadLock mobile application. This policy explains what personal data we collect, how we use it, and the rights you have over it.

For the purposes of UK data protection law (the UK GDPR and the Data Protection Act 2018), the data controller is RM Technologies Services Ltd, 101 Devonshire House, Aviary Court, RG24 8PE, Basingstoke, UK. You can reach us about any privacy matter at the contact details in section 11.

1. Information We Collect

On the website

• • Waitlist signups — the email address you submit to join the waitlist or receive product updates.
• • Attribution data — the marketing source you arrived from (UTM parameters and ad click identifiers such as gclid/fbclid), the referring page, your IP address and browser user-agent. We use this to understand which channels bring people to SquadLock.

In the app

• • Account information — name, email address and password (hashed) when you register.
• • Date of birth — required to register. We use it to work out an age band and then apply the protections in section 9. If you are 13–15 we also ask for a parent or guardian’s email address so we can request their consent.
• • Location data — only when you explicitly grant permission, used solely to find nearby ringers.
• • Match & team data — availability votes, roster confirmations, payment records and team memberships you create.
• • Device information — push notification tokens for delivering alerts.
• • Diagnostics — crash reports and basic performance data from the mobile app (via Sentry), used only to find and fix bugs.

2. How We Use Your Data & Our Lawful Bases

Under the UK GDPR we must have a lawful basis for each use of your data. Our bases are:

• • Waitlist & product updates — your consent, which you give by submitting your email. You can withdraw it at any time (see section 6).
• • Operating your account, matches, votes and rosters — performance of our contract with you (our terms of service).
• • Push notifications — your consent, given when you opt in on your device.
• • Showing your ringer profile to captains searching for substitutes — our legitimate interest in operating the substitute-finding feature you chose to join.
• • Advertising measurement (Meta & Google) — your consent, given via the cookie banner (see section 3).
• • Age checks and child safety — your date of birth is processed under our legal obligations and our legitimate interest in protecting children. A parent or guardian’s email address, where we ask for one, is processed to obtain their consent under UK GDPR Article 8.
• • Security, fraud prevention and meeting legal obligations — our legitimate interests and legal obligations.

3. Cookies, Analytics & Advertising

On your first visit we show a consent banner. No advertising or analytics cookies are set, and no data is sent to Meta or Google, unless and until you accept. If you decline, the site continues to work normally. Strictly-necessary cookies (and the cookie that records your consent choice) do not require consent.

The cookies and similar technologies we use are:

• • sl_consent — first-party, stores whether you accepted or declined advertising cookies so we do not ask again. Lasts 12 months. Set regardless of choice; strictly necessary.
• • _fbp, _fbc (Meta Pixel) — set only after you accept; used to measure whether an ad led to a signup. Typically last up to 90 days.
• • _ga and related Google tags — set only after you accept; used for advertising/analytics measurement. The _ga cookie typically lasts up to 2 years.

When you accept, we also send conversion measurement events from our server to Meta and Google. These can include a hashed (irreversible) version of your email, your IP address and browser user-agent, and the advertising identifiers above — solely to measure whether an ad led to a signup. We never sell your data and never share your email in plain text.

4. Data Sharing

We do not sell your personal data. We share data only with:

• • Meta & Google — advertising measurement, only with your consent (see section 3).
• • Hosting & email providers — our application hosting (Railway), database (Neon, hosted in the UK/EU) and email routing (Cloudflare) providers, to run the service and send you transactional and waitlist emails.
• • Expo / EAS — for push notification delivery.
• • Sentry — crash and performance diagnostics from the mobile app (hosted in the EU), used solely to find and fix bugs.
• • Your team members — your name, availability and ringer profile are visible to members of teams you join.

5. International Transfers

Our database and core infrastructure are located in the UK/EU. Some of our providers — notably Meta and Google (advertising measurement) and certain hosting and notification services — may process data in the United States or other countries outside the UK. Where data is transferred outside the UK, we rely on appropriate safeguards such as the UK extension to the EU–US Data Privacy Framework and/or the UK International Data Transfer Agreement (or Standard Contractual Clauses) with those providers.

6. Data Retention

We keep waitlist emails until you ask us to remove you or until we launch and migrate you to an account. We keep account data for as long as your account is active, and delete or anonymise it within a reasonable period after you delete your account, unless we must keep it to meet a legal obligation. Marketing attribution and advertising-measurement data is kept in a form tied to you for no longer than 24 months. You can request deletion at any time using the contact details below.

7. Your Rights

If you are in the UK or EU, you have the right to access, correct, or delete your personal data, to object to or restrict its processing, to data portability, and to withdraw consent at any time. Withdrawing consent is as easy as giving it: for advertising cookies you can decline (or later clear the sl_consentcookie in your browser to be asked again), and for any processing based on consent you can email us to withdraw. Withdrawing consent does not affect processing already carried out. You also have the right to lodge a complaint with your data protection authority — in the UK, the Information Commissioner's Office (ico.org.uk).

8. Security

Passwords are hashed with bcrypt. All network communication uses HTTPS. Authentication tokens are stored in encrypted device storage.

9. Children & Young People

You must be at least 13 to use SquadLock. Registration asks for a date of birth and refuses anyone under 13 — no account is created and no data about them is kept.

Between 13 and 18, an account exists but is deliberately limited:

• • 13–15 year olds need a parent or guardian’s consent before the account does anything. We email the address given at signup and the account stays inactive until they confirm (UK GDPR Article 8).
• • Under-18s never appear in player search or any public listing. This is not a setting they or anyone else can switch on.
• • Under-18s cannot be cold-contacted by strangers — an invitation can only come from a squad they already play for.
• • An account whose age we cannot confirm is treated as if it belongs to a minor, with all of the above restrictions, until an age is supplied.

Full detail of these controls, including how location is handled for younger players, is on our safeguarding page.

Parents and guardians: you do not need a SquadLock account to act. You can withdraw consent, ask what data we hold about your child, or ask us to delete it, by emailing [email protected]. To raise a safety concern, use the report a safety concern form — it goes straight to our safety inbox.

10. Changes

We may update this policy from time to time. The updated version will be indicated by a revised “Effective date” at the top of this page.

11. Map Data

Player search is restricted to the country you are in. To work out which country a location falls in, we use national boundary data from Eurostat GISCO — © EuroGeographics for the administrative boundaries. The comparison happens on our own servers: your coordinates are never sent to a mapping or geocoding service. Boundary data is used for search filtering only and implies no position on any territorial question.

12. Contact

Questions about this policy, or want to exercise your rights? Contact us at [email protected].