Draft for legal review. Text in [square brackets] must be completed before launch.

Privacy Policy

Last updated: 25 October 2026

Who we are

My Academy is software that sports academies use to manage their athletes, sessions, staff and money. It is provided by [company legal name], [registered address], Egypt ("we"). Write to us about privacy, legal questions or anything in this policy at my.academy.998@gmail.com.

Two roles: the academy and us

Each academy decides what it records about its athletes, guardians and staff, and why. For that information the academy is responsible (the controller), and we process it on the academy's behalf and only to run the service. If you are a parent, guardian or athlete and want to see, correct or delete information an academy holds about you, contact the academy first; we will help it answer you.

For the account details of the people who sign in (owners, admins, coaches and staff), and for how they use the app, we are responsible.

What we collect

Your account. Name, email address, phone number if you give it, and your password, which Supabase Auth stores only as a secure hash. If you sign in with Google, we receive your name and email address from Google.

What an academy records. Depending on the academy and its bundle, this can include:

• athletes: name, date of birth, gender, nationality, national ID, school, address, photo, group, attendance, technical tests and fees;
• guardians: name, relationship, phone, email and a photo of their ID;
• health: medical records and injuries;
• staff: contact details, responsibilities, working hours, pay and reviews;
• money: income, expenses, invoices, bills and payroll;
• documents the academy uploads, such as contracts and consent forms.

Payments for a plan. Payments are handled by Paymob. We never see or store card numbers; we keep the amount, plan, date, invoice number, Paymob's transaction reference and the last four digits of the card. When a plan renews automatically, Paymob keeps the card so it can charge it for each new period, until you turn auto-renew off.

Agreement to these terms. When you agree to the Terms of Service, Privacy Policy and Refund Policy, we record the date and the version you agreed to.

How the app is used. When you use the app, it records which screens are opened and actions such as "athlete added" or "attendance saved", with your account's ID, your academy's ID, its bundle and sport, your role, and whether you are on a phone or a computer. These records never include names, email addresses, athlete details or amounts. We use them to see which parts of the app help and which confuse people. You can switch this off in the app under Your profile, Privacy, "Share how I use the app".

Error reports. When the app crashes or hits an error, it sends a report: the error, the part of the code where it happened, the screen it was on (such as "an athlete's page", never which athlete), the app version, and your browser and device type. Before a report leaves your device, the app removes any email address, phone or ID number, record ID and database value from it. Reports carry no account, name or IP address.

Technical records. Our providers keep standard server logs (such as IP address, time and the address requested) to run and secure the service.

Children's information

Many athletes are under 18. Before an academy records athletes, its owner confirms in the app that every athlete's guardian has agreed to it. Academies must only record what they need to run the academy. Health records and guardian ID photos are visible only to the people the academy allows: medical information to staff with medical access, and ID photos to people who manage athletes. No information about athletes or guardians goes into usage records or error reports.

How we use it

• to provide the service the academy has chosen: storing records, showing them to the right people, and producing reports and PDFs;
• to take payment for a plan, renew it when auto-renew is on, and email the invoice;
• to keep the service secure, prevent abuse, and find and fix errors;
• to understand how the app is used so we can improve it, unless you switch this off;
• to email account holders about signing in, resetting a password, their account, their plan, payments and invoices, or changes to these terms.

We do not sell personal data, show advertising, or use academy records to train AI models.

Every service that handles data for us

• Supabase hosts the database, sign-in and file storage in London, United Kingdom (region eu-west-2). It also sends the emails for confirming an account and resetting a password, through our Gmail address. It holds everything described above, apart from what goes to Paymob.
• Cloudflare serves the website and the app's files, and sees your IP address and browser details as any web host does.
• Paymob (Egypt) takes plan payments on its own page. It receives what you enter there, and from us the academy's plan, the amount, and the owner's name, email and phone number if they gave one. For plans that renew automatically it keeps the card and charges it each period.
• Google provides optional sign-in, which shares your name and email with us, and serves the app's fonts and display engine, so your browser contacts Google's servers when the app loads. Our emails (password resets, invoices and plan notices) are sent from our Gmail address, my.academy.998@gmail.com, so Google handles each email's recipient and contents.
• Sentry (Functional Software, Inc.) receives the error reports described above and stores them in the European Union (Germany).
• Mixpanel (Mixpanel, Inc.) may receive the usage records described above, stored in the European Union, if we turn it on. It receives nothing while it is off or when you have switched sharing off.

Each processes data only as needed to provide its part of the service. The app has no advertising, no session recording and no other tracking. [Describe the legal basis for transfers outside Egypt, as required by Law No. 151 of 2020.]

How it is protected

Every request is checked by the database itself, so each person sees only their own academy, and within it only what their role and branches allow. Data travels encrypted (HTTPS). Photos, ID photos and documents are kept in private storage and opened through links that expire. Medical, pay and legal records are never saved on your device. The keys that unlock payments and the database's admin access stay on our servers and are never sent to your browser.

Cookies and what is stored on your device

My Academy sets no cookies. In your browser's local storage, the app keeps your sign-in session, your preferences (such as light or dark mode and whether you share usage), and copies of recently viewed lists, so it opens quickly and works on a weak connection. Signing out removes the saved lists. Nothing is stored for advertising or for tracking you across sites, so there is no cookie banner.

How long we keep it

• Academy records and accounts: while the account is open. An owner can delete their account in the app (Your profile, Delete account), which deletes the academies they own and everything in them straight away. Anyone else who signs in can delete their own account the same way. Copies in our providers' backups are removed as those backups expire, within [backup retention period].
• Usage records: 13 months, then deleted automatically.
• Error reports: up to 90 days in Sentry.
• Payment records and invoices: as long as tax law requires.

Your rights

Under Egypt's Personal Data Protection Law (Law No. 151 of 2020), and the EU or UK GDPR where they apply, you can ask to see, correct, delete or receive a copy of your personal data, object to some uses, and complain to the Personal Data Protection Center in Egypt or your local regulator. Write to my.academy.998@gmail.com; we answer within 30 days.

Changes

If we change this policy in a way that matters, we will tell account holders by email or in the app before the change takes effect.