Privacy Policy
Last updated: July 24, 2026 · Effective: July 24, 2026
Plain English summary: Court Crew collects the minimum data required to provide the service. We do not sell your data. We do not share it with advertisers. We use Google Analytics for anonymous usage statistics only. You can delete your account and all your data at any time.
1. Who We Are
Court Crew ("we", "us", "our") is a sports referee management application operated by Lovro Predovan, an individual developer based in the European Union. The application is accessible via courtcrew.co and the Court Crew iOS and Android mobile apps.
For the purposes of the General Data Protection Regulation (GDPR) and the UK GDPR, Lovro Predovan is the data controller.
Contact for privacy matters: [email protected]
2. What Data We Collect and Why
We collect only the data necessary to operate the service. The table below describes each category:
| Category | Data collected | Purpose | Legal basis (GDPR) |
|---|---|---|---|
| Account | Email address, first name, last name, profile photo (if Google Sign-In) | Authentication, display in app | Contract performance (Art. 6(1)(b)) |
| Match data | Match dates, times, team names, competition names, venues, age categories, remarks | Scheduling, career history, statistics | Contract performance (Art. 6(1)(b)) |
| Fee data | Match fees, travel fees, paid/unpaid status | Earnings tracking | Contract performance (Art. 6(1)(b)) |
| Crew data | Email addresses of crew members you invite, their names if they have an account | Crew coordination and invitations | Legitimate interest (Art. 6(1)(f)) |
| Photos | Photos you voluntarily attach to matches | Match archive | Consent (Art. 6(1)(a)) |
| Location names | Venue names and addresses you enter, Google Places autocomplete selections | Match scheduling | Contract performance (Art. 6(1)(b)) |
| Device & usage | Anonymous session data via Google Analytics (page views, feature usage — no personal identifiers) | Product improvement | Legitimate interest (Art. 6(1)(f)) with cookie consent |
| Authentication tokens | JWT access and refresh tokens stored on device | Session management | Contract performance (Art. 6(1)(b)) |
2.1 Data We Do NOT Collect
- We do not collect payment card details or banking information
- We do not collect GPS location or device location data
- We do not collect contacts from your phone address book
- We do not collect biometric data
- We do not collect data from children under 13
- We do not create advertising profiles or sell data to third parties
- We do not collect health or fitness data
3. Google Sign-In
If you choose to sign in with Google, we receive from Google: your email address, first name, last name, and profile photo URL. We use these solely to create and maintain your Court Crew account. We do not access your Google contacts, Gmail, Google Drive, or any other Google service beyond what is explicitly listed here.
Google's own privacy policy applies to the Google Sign-In flow: policies.google.com/privacy
4. Google Calendar Integration
If you use the Google Calendar export feature, we request permission to create calendar events in your Google Calendar. We use this permission exclusively to create match events you explicitly request to export. We do not read, modify, or delete existing calendar events. We do not access your calendar without your action.
You can revoke this permission at any time at myaccount.google.com/permissions.
5. Google Maps / Places
The location picker in the app uses Google Places API to autocomplete venue names. Search queries you type into the location field are transmitted to Google. We store only the final selected venue name and address — not the intermediate search queries. Google's API terms apply: cloud.google.com/maps-platform/terms
6. Analytics
We use Google Analytics to understand how the app is used in aggregate. Analytics data is anonymised — we do not associate it with your personal account. IP addresses are anonymised before processing. You can decline analytics via the cookie consent banner on our website.
The mobile app does not currently use any analytics SDK. If this changes, we will update this policy and notify users in advance.
7. Email Communications
We send transactional emails only: account-related notifications (e.g. password reset), and crew invitation emails on your behalf when you invite co-referees. We do not send marketing emails unless you have explicitly opted in. We use Brevo (formerly Sendinblue) to deliver email. Brevo privacy policy: brevo.com/legal/privacypolicy
8. Data Storage and Security
Your data is stored on servers operated by DigitalOcean (data center: Frankfurt, Germany — EU territory). Data in transit is encrypted via TLS (HTTPS). Passwords are hashed using bcrypt before storage and are never stored in plain text.
Profile photos and match photos are stored on Amazon S3 (AWS). The data residency region for S3 is EU (Frankfurt). AWS privacy policy: aws.amazon.com/privacy
We apply reasonable technical and organisational measures to protect your data. No internet transmission is 100% secure and we cannot guarantee absolute security.
9. Data Retention
We retain your data for as long as your account is active. Specific retention periods:
- Account data: Retained until account deletion
- Match and fee data: Retained until account deletion
- Photos: Retained until you delete them or delete your account
- Chat messages: Retained until account deletion
- Analytics data: Aggregated, anonymised — retained per Google Analytics defaults (26 months)
- Server logs: Retained for up to 30 days for security and debugging
After account deletion, all personal data is permanently deleted within 30 days. Anonymised aggregate statistics may be retained.
10. Your Rights (GDPR)
If you are in the European Economic Area (EEA) or United Kingdom, you have the following rights:
- Right of access: Request a copy of all personal data we hold about you
- Right of rectification: Request correction of inaccurate data
- Right to erasure ("right to be forgotten"): Request deletion of your account and all associated data
- Right to data portability: Request your data in a machine-readable format
- Right to object: Object to processing based on legitimate interest
- Right to restrict processing: Request that we limit how we use your data
- Right to withdraw consent: Where processing is based on consent, withdraw it at any time
To exercise any of these rights, contact us at [email protected]. We will respond within 30 days. You also have the right to lodge a complaint with your local data protection authority.
11. Account and Data Deletion
You can delete your account directly within the Court Crew mobile app: go to Profile → Settings → Delete Account. This will permanently delete all your data including matches, fees, photos, crew connections, and chat history. Deletion is irreversible.
Alternatively, email [email protected] with the subject "Delete my account" and we will process the deletion within 5 business days.
12. Children's Privacy
Court Crew is not intended for users under 13 years of age. We do not knowingly collect personal data from children under 13. If you believe a child under 13 has provided us with personal data, contact us immediately and we will delete it.
Users aged 13–17 may use the app with parental consent. In some jurisdictions the age threshold may be higher (e.g. 16 in certain EU member states).
13. Third-Party Services Summary
| Service | Purpose | Data shared | Their privacy policy |
|---|---|---|---|
| Google Sign-In | Authentication | Email, name, photo | policies.google.com |
| Google Analytics | Anonymised usage stats | Anonymous session data | policies.google.com |
| Google Maps Platform | Venue autocomplete | Location search queries | cloud.google.com |
| DigitalOcean | Server infrastructure | All user data (encrypted, EU) | digitalocean.com |
| Amazon S3 (AWS) | Photo storage | Profile and match photos | aws.amazon.com |
| Brevo | Transactional email | Email address, invitation content | brevo.com |
14. Cookies
We use a small number of cookies. For the full list and management options, see our Cookie Policy. Essential cookies (authentication session) cannot be disabled without breaking the service. Analytics cookies can be declined via the consent banner.
15. International Transfers
Our primary infrastructure is located within the EU (DigitalOcean Frankfurt, AWS eu-central-1). When data is processed by Google or Brevo, it may be transferred outside the EEA. These transfers rely on Standard Contractual Clauses (SCCs) and/or adequacy decisions where applicable.
16. Changes to This Policy
We may update this Privacy Policy from time to time. When we make material changes we will notify users via email and/or an in-app notice at least 14 days before the changes take effect. The "Last updated" date at the top reflects the most recent revision. Continued use of the service after the effective date constitutes acceptance of the revised policy.
17. Contact
For any questions, concerns, or requests regarding this Privacy Policy or your personal data:
- Email: [email protected]
- Response time: within 5 business days for general inquiries, within 30 days for GDPR requests