Privacy Notice

Early version. Sunday Gaffer is in development and not yet open to the public. This notice describes what the service does with personal data today. A fuller policy - with retention periods, a self-service way to download or delete your data, and a review against the ICO’s Children’s Code - will replace it before public launch. Where something is still to come, this notice says so rather than claiming it exists.

1. Who is responsible

The service is operated by Jason Wrangles, a sole trader in England, trading as Sunday Gaffer. For your own account details we are the data controller. For the information you record about the players you coach, you are the controller and we are your processor, acting on your instructions - see section 5 of the Terms of Service. Questions about this notice: hello@sundaygaffer.co.uk.

2. What we store

Everything below is entered by you, the coach. We do not collect anything from children.

• Your account: your email address and a securely hashed password, managed by our authentication provider. Sign-up and password-reset emails carry an 8-digit code and no personal data beyond your address.
• Your team profile: team name, age group, gender, typical squad size, and the free-text notes you write about how the team plays.
• Your players: a name (a first name or nickname is enough), age group, position, whether they are active, any notes you add, and the development plan generated for them. There are no fields for a child’s date of birth, address or contact details, on purpose.
• Match reports and observations: opponent, date, scores, goalscorers, player of the match, and the coaching notes and individual development observations you write. These are the most sensitive data the service holds and are treated as such.
• Sessions and drills: the training plans generated for you and any drills you create.
• AI usage records: for each generation, the model used, token counts, timing, cost estimate and an outcome code - not the text of what was sent or returned.

3. What we do with it

We use your data only to provide the service to you: to show you your squad and matches, to generate plans, and to keep your account working. We do not sell personal data, we do not use it for advertising, and we do not use it to train AI models.

AI generation. When you generate a session, your team settings, the focus areas you choose and your match observations are sent to an AI provider. Player names are removed before anything is sent: the prompt refers to “a squad player”, and the model is instructed never to name a child in what it produces.

4. Where it is stored and who helps us run the service

The database and authentication run in Stockholm, Sweden (EU). The application runs on hosting in London, with a global content network in front of it. The providers below process data on our behalf under their data-processing terms:

• Supabase - database and authentication (EU, Stockholm).
• Netlify - hosting and server functions (functions in London; content network worldwide).
• Anthropic - the AI model that generates plans (player names removed first).
• Sentry - error monitoring (EU data region; personal data suppressed by configuration).
• Resend - sends the account emails (sign-up and password-reset codes). Resend is a US company: the email address and the code pass through it under standard contractual clauses and the UK addendum.
• GitHub - holds the source code only; no coach or player data.

Still to come: confirmation of each provider’s data-processing agreement is being recorded and will be linked here.

5. Cookies and local storage

The service sets the cookies needed to keep you signed in, and nothing else - there are no advertising or analytics cookies and no third-party tracking scripts. Your browser also keeps a small local copy of recently viewed sessions and unsent form drafts so the app works better on a poor pitchside signal; that data never leaves your device.

6. How long we keep it

Today, your data is kept for as long as your account exists. A retention schedule - what is kept for how long, and what is archived at the end of a season - is still to be defined and will be published here. When an account is deleted, the AI usage records are kept without the link to the account, so that cost history survives; everything else is deleted.

7. Your rights

You can ask us for a copy of the personal data we hold about you, ask us to correct it, or ask us to delete your account and everything in it. Email hello@sundaygaffer.co.uk and we will respond within a month. Self-service download and deletion from inside the app are planned. Parents and carers asking about a player’s data should contact the coach or club, who is the controller for it; we will help the coach respond. You also have the right to complain to the Information Commissioner’s Office (ico.org.uk).

8. Changes

We will update this notice as the service develops, and the date at the top will change when we do. Significant changes will be announced in the app.