Privacy policy

1. Who we are

Spytoo is owned and operated by Private Club App (Pty) Ltd (“Private Club App”, “we”, “us”), a private company incorporated in the Republic of South Africa. We operate the Spytoo mobile application for iOS and Android and the website at https://spytoo.com. We are the responsible partyfor the personal information described in this policy under the Protection of Personal Information Act, 2013 (POPIA). Our Information Officer can be reached at privacy@spytoo.com.

This policy forms part of our Terms & conditions. By using Spytoo you consent to the processing described here. Where processing depends on your consent, you may withdraw it at any time, although that may mean we can no longer provide part of the Service.

2. Information we collect

Information you give us

• Account details: your email address, password (stored only as a secure hash by our authentication provider) and display name.
• Sign in with Apple or Google (optional): if you sign in this way we receive from Apple or Google a signed identity token, your name and your email address (or, with Apple's Hide My Email, a relay address). We never receive your Apple or Google password. When you delete your account we also revoke Spytoo's Sign in with Apple authorisation.
• Age confirmations: your confirmation at sign-up that you are 13 or older and, before backing a player, that you are 18 or older. The 18+ confirmation is stored on your device only.
• Profile information (players and coaches): full name, date of birth, position or coaching role, football programme, city and province, bio, availability, highlights link, profile photo and season statistics.
• Contact details (players and coaches, optional): phone number and email address, shared with a club only when you accept that club's request.
• Club details (club administrators): club name, crest, story, website and social links, home ground, sponsors, technical staff names and the contact person's name, role, phone, WhatsApp and email.
• Club onboarding requests: the club and contact details you submit from the sign-up screen, whether or not you have an account.
• Payout details (clubs): bank name, account holder and the last four digits of the account number. Full bank account numbers are held by our payment processor, Paystack, not by Spytoo.
• User content: team sheets, results, scorers, trial events, registrations, votes, ratings, reports and messages you send us.

Information collected automatically

• Usage records needed to run the service, such as the time you voted, rated, registered for a trial or made a backing.
• Device and diagnostic data that your device sends with each request (for example device type, operating system version and IP address), used to keep the service secure and reliable.

Payment information

When you back a player, payment is processed by Paystack on Paystack's hosted checkout page. Spytoo never receives your full card number. If you choose to save a card for one-tap payments, Paystack gives us a token and the card's last four digits, brand and expiry so you can recognise it. We keep a record of each transaction (amount, service fee, status, reference, the player and club it was for).

Spytoo does not use advertising identifiers and does not track you across other companies' apps or websites.

3. How and why we use your information

We process personal information because it is necessary to provide the Service you asked for, to comply with law, to protect our legitimate interests (such as security, fraud prevention and enforcing our terms), or with your consent. We use it:

• To create and operate your account and, where you choose, your public profile.
• To show clubs, players, coaches, fixtures, standings, team sheets and results.
• To let clubs discover and contact free agents, and to let players and coaches control who receives their contact details.
• To run trials, Player of the Match voting and fan ratings.
• To process backings, pay clubs and keep the transaction ledger the law requires.
• To respond to support requests, reports and disputes.
• To keep the service secure, prevent abuse, investigate reports and enforce our Terms.
• To send you service messages (for example email confirmation, password reset, receipts and important changes). These are not marketing and you cannot opt out of them while you hold an account.
• To send you news about Spytoo, only where you have agreed and always with an easy way to unsubscribe.
• To produce aggregated, anonymised statistics that no longer identify you.

We do not use automated decision-making that has a legal or similarly significant effect on you.

4. What is visible to others

• Public: clubs, their squads and technical staff, signed players and coaches (name, photo, position, attributes, stats, bio, city and province), fixtures, results, standings, team sheets, substitutions, Player of the Match results and average fan ratings. This is visible to anyone using the app, including guests who have not signed in.
• Clubs only: players and coaches without a club (“free agents”) are visible only to club administrators and to Spytoo.
• Never public: your email address, phone number, date of birth, payment details, individual votes, individual ratings, backing history and reports. Your phone and email are shared with a specific club only after you accept that club's request, and you can revoke that at any time.

5. Who we share information with

We share personal information only with providers who help us run Spytoo:

• Supabase — hosting, database, authentication and file storage.
• Paystack — payment processing and club payouts.
• Apple and Google — app distribution, optional sign-in (Sign in with Apple, Google Sign-In) and, if you contact us through them, support. Their handling of your sign-in is governed by their own privacy policies.

Clubs. When you accept a club's request for your contact details, or register for its trial, the club receives that information as an independent responsible party. The club is responsible for how it uses it, and our Terms require clubs to use it only for genuine football recruiting. We are not responsible for a club's handling of information once it has left the Service.

We may also disclose information where the law requires it, in response to a lawful request from a court, regulator or law-enforcement agency, to protect the rights, property or safety of Private Club App, our users or the public, to enforce our terms, or as part of a merger, acquisition, financing or sale of assets (in which case this policy continues to apply). We do not sell personal information.

6. Data retention

We keep your information for as long as your account is active. When you delete your account, your profile, photos, contact details, votes, ratings, registrations and saved cards are removed. Records we must keep by law — in particular the backing transaction ledger — are retained in anonymised form with your identity removed. Club records survive the departure of their administrator so the club can be claimed by a new representative.

7. Your rights

Under POPIA and similar laws you may:

• access the personal information we hold about you;
• ask us to correct or update it (most profile fields can be edited in the app);
• delete your account and data yourself in the app, or ask us to — see Delete your account;
• object to processing or withdraw consent where processing is based on consent;
• lodge a complaint with the Information Regulator (South Africa) at inforegulator.org.za.

8. Children

Spytoo is intended for users aged 13 and over; the app will not create a player or coach profile with a date of birth younger than that, and only users who confirm they are 18 or over can back a player. Accounts and player or coach profiles for anyone under 18 must be created and managed with the consent of a parent or guardian, who is responsible for the account and for the information posted. By creating a profile for a minor you confirm you are that person's parent or legal guardian. If you believe a child has provided personal information without such consent, contact us and we will remove it.

9. Security

We take reasonable technical and organisational measures to protect personal information, as POPIA requires. Data is encrypted in transit and at rest. Access to personal information is controlled at the database level with row-level security, so users, clubs and administrators can only read what this policy says they can. Payment card details are handled by Paystack, which is PCI-DSS certified, and never touch our systems.

No system is perfectly secure and we cannot guarantee absolute security. You are responsible for keeping your password confidential and for anything done through your account. If we become aware of a security compromise affecting your personal information we will notify you and the Information Regulator as POPIA requires.

10. International transfers

Our providers may store data on servers outside South Africa. Where they do, we rely on their contractual commitments to protect personal information to a standard at least equivalent to POPIA.

11. Website cookies and analytics

The website at https://spytoo.com does not set tracking cookies and does not run third-party analytics or advertising scripts. Our hosting provider may keep standard server logs (IP address, browser and pages requested) for security and to keep the site running. The app does not use cookies.

12. Public content and other users

Information you choose to make public (for example a player profile, a club page, a team sheet or a result) can be seen, copied and shared by anyone, including guests who are not signed in, and may remain visible in screenshots, caches or search engines after you remove it. Think carefully before posting. We are not responsible for what other users or third parties do with information you have made public.

13. Changes

We may update this policy from time to time. We will post the new version on this page and update the date at the top, and we will announce material changes in the app or by email. Continuing to use Spytoo after a change means you accept the updated policy.

14. Contact

Private Club App (Pty) Ltd, the Republic of South Africa. Information Officer: privacy@spytoo.com. General support: support@spytoo.com.