How we protect your data

Where your data lives

Bestplay's database and user sign-ins run on Supabase; the database is PostgreSQL. The API server that the app and the panel talk to is believed to be hosted on Railway; the region will come from Can. The database region will be added here once confirmed.

Sign-in and sessions

Sign-in to the app and the panel goes through Supabase's authentication service; a successful sign-in gives the device a time-limited session key (a JWT: think of it as a digital ID card signed by the server that expires). On every request that returns personal data, the API checks this key with Supabase; a request with an invalid or expired key is rejected. Endpoints that need no session are marked one by one in the code; they are the registration and application forms, the parent and staff setup links, the external evaluator link, public information such as the club logo, and scheduled jobs called with a secret key. Endpoints that need no session, such as the registration form, limit how many requests can come from the same address. The limit on wrong password attempts depends on the settings of Supabase's authentication service, which have not been confirmed yet. In the app, the session is kept in the phone's secure storage. When a staff member changes their password, their older sessions stop working.

Who sees what

Club admins and managers see every athlete in the club; the accountant role can also read the whole club. Coaches and coordinators see only the athletes in the branches and groups assigned to them; an athlete they are not assigned to does not open for them. Staff who work at more than one club state on each request which club they are acting for; the request is rejected if they have no active membership there. A coach can see the daily check-in (energy, mood, sleep, muscle soreness), weekly tasks and goals of the athletes assigned to them. Once an athlete leaves the club, staff see that athlete's personal records only up to the date they left.

Parent access

Parents do not download an app; they open the parent page in their phone's browser from the setup link in the email the club sends. The setup link is valid for 7 days and works once: after the parent sets a password, the same link no longer works. The key in the link is a 32-byte random value; the database stores only its SHA-256 digest (a fingerprint that cannot be turned back), never the key itself. If the club sends the link again, the old link stops working; only one link is valid at a time. The parent sets a password of at least 8 characters and uses it for later sign-ins. The club can remove a parent's access at any time; a parent whose access was removed cannot open their child's page.

The parent page shows: attendance, upcoming events, measurements, the fee and instalment statement, coach evaluations that are open to parents, the title, description and completion of weekly tasks, the main goal with the current milestone, and photos the club has shared. The parent page does not show: the athlete's daily check-in, self-assessment or AI coach chats. In evaluations, sections marked "staff only" and the coach's note never reach the parent. If the athlete leaves the club, the parent can still see their child's past records, while the club's upcoming events are closed.

Privacy of the coach chat

The chat with the AI coach belongs to the athlete: the chat list and the messages are open only to the account that owns the chat. There is no screen or endpoint through which a coach or a parent could see the content of the chat or a summary of it. The coach can write what it learns in the chat into the athlete's own profile notes, and these notes are used when new weekly tasks are prepared. No screen shows these notes; coaches and parents see only the title and description of the resulting tasks.

AI processing

Coach chats, weekly task suggestions and the club assistant Buddy run on agents in Microsoft's Azure AI Foundry service. For this, the athlete's message and the profile information the coach needs are sent to Azure; each chat is also opened as a conversation record on the Azure side. The Azure region where this data is processed and how long conversation records are kept there will be added here once confirmed. Whether the data sent is kept out of model training and how abuse monitoring is set will be written after Can's approval. The log of AI calls does not keep message text; it keeps which agent was called, the duration, the cost and a fingerprint of the content sent.

Children's data and explicit consent

The club uploads its own privacy notice and explicit consent texts shown on the online registration form; these texts sit in storage that is not public. Registration cannot be completed without a consent marked as required. Every consent given is recorded with which text was accepted, when, and the name of the parent who accepted it, and this record is not deleted. A photo in which an athlete without photo-sharing permission is tagged is not shown to athletes or parents. The app shows no ads; it has no ad infrastructure. The data processing agreement with clubs and the VERBIS registration will be added to this section once settled.

Deleting your account and data

If you are an athlete, you can delete your account yourself from the app settings; only its owner can delete an account. Deletion removes coach chats and chat photos, daily check-ins, self-assessments, goals and tasks, health data and the sign-in account. How long the club's own records (attendance, measurements, payments) and consent records are kept after an account is deleted will be added here once decided.

Encryption in transit and at rest

The panel, the parent page and the app connect to the API and to Supabase only through https addresses; https means data is encrypted so it cannot be read on the way. The iOS app is set not to allow unencrypted connections. Disk encryption for the database and files is believed to be provided by Supabase's infrastructure; Can will confirm.

Photos and files

Gallery photos, photos added to the coach chat, athlete profile photos, registration documents and consent texts are kept in storage that is not public. These files open only through time-limited links: gallery links last 30 minutes, chat photo links last 1 hour. Photos added to the coach chat are deleted automatically after 90 days. Among the storage areas created in code, the only public ones are club logos and campaign images.

Logs and backups

The API does not write database queries to its logs; to measure request speed it keeps only timing figures. The log of announcement SMS messages keeps the recipient number and the message text; this record is for delivery and cost tracking. How long server logs are kept and whether any personal data stays in them will be added here once confirmed. How often the database is backed up and whether it can be restored to a specific moment (PITR) will be added here once confirmed.

Service providers

Announcement SMS messages to parents are sent through Posta Güvercini. Push notifications to athletes are delivered through Google Firebase Cloud Messaging. The app sends the user ID and email address to Sentry for error tracking and to PostHog's European server for usage analytics. Whether data sent to these providers is transferred abroad, and on what basis, will be added here once confirmed.

Admin tools

The background job queue screen requires a username and password. Billing admin endpoints can be called only with a secret key kept on the server; if the key is not set, these endpoints are fully closed. Endpoints that trigger scheduled jobs also require a secret key.

Reporting a security issue

The address you can write to if you spot a security issue or have a request about your data will be added here once decided. How and how quickly clubs and affected people will be told about a data breach will be written here once decided.