Security and child protection
How MisterFC handles the club's data and, above all, children's data.
Access and isolation
- You can only join a club by invitation. There is no open sign-up.
- A club cannot see another club's data: access control is enforced in the database itself, table by table, not just on screen.
- Every change passes more than 140 automated database security tests before it is released.
- Each person sees what corresponds to their role: management, coordinator, coach or family.
Children
- Whether a player is a minor is calculated every day from their date of birth. While the player is a minor, their sensitive data (health, consents, deletion and download) is managed by their guardian; at 18 it passes to the player.
- A minor cannot have their own account without a linked guardian, and the last guardian cannot unlink while the minor has one.
- Separate consents (internal images, images on social media, medical data), in a record that cannot be edited or deleted: withdrawing a consent adds a new entry.
- Without image consent, the player's photo is not shown. If consent is withdrawn, it stops being visible immediately, in file storage too.
Health
- Within the club, health data is only visible to club management, the coaching staff of the player's team (and of the team calling the player up, only until the end of the match day), the guardian, and the player themselves if they are an adult. Always with recorded consent.
- Every access to health data by staff is logged: who, when and from where.
Families' rights
- A guardian can download all of their child's data as a PDF and request its deletion, which the club approves.
- Any user can delete their account, from the app or from the web.
Accounts and passwords
- Password recovery has attempt limits, and so do invitations.
- On mobile, the session is stored in the system's secure storage (Keychain and Keystore).
Providers, privacy and data location
- Technical error reports do not include emails, IP addresses or cookies, and sessions are not recorded.
- We do not store card details: in-app payments are processed by Apple and Google.
- No third-party advertising or analytics in the app.
- Providers: Supabase (database and files), Vercel (hosting), Resend (email), Sentry (errors), Expo, Apple and Google (mobile notifications) and RevenueCat (in-app subscriptions).
- Data is hosted in the European Union (Ireland): the database and the files.
More details in the privacy policy.