Privacy policy

This policy explains what personal data Drillpin collects, why, and what rights you have under the EU General Data Protection Regulation (GDPR). The data controller is [Owner name / company, organisation number, address, contact e-mail].

What we collect

• Account: name, e-mail address, password (stored encrypted, never readable), or your Google account ID if you sign in with Google.
• Profile: username, profile picture, short bio, the clubs and teams you belong to, and whether your profile is public or private.
• Activity: drills you save, create or add to a team, practice plans, and your practice ratings.
• Consent: when you accepted these terms and which version.
• Technical: a login cookie so you stay logged in. We do not use advertising or tracking cookies.

Why we use it (legal basis)

• To provide the service you signed up for: your account, boards, teams and practice plans (performance of a contract).
• To keep the service safe and working, and prevent misuse (legitimate interest).
• To send e-mails you ask for, such as team invitations and password resets.

We never sell your data and never use it for advertising.

Who can see your data

• Public profile: anyone can see your name, picture, bio, clubs, teams and collected drills.
• Private profile (the default): only you and people on your teams.
• Coaches on your team can see your name and e-mail address. Club admins can see the club's member list.
• Practice ratings are anonymous: coaches only see the average and the number of answers, never who answered what.

Service providers

We use these providers to run Drillpin. They only process data on our behalf, under data processing agreements:

• [Vercel] — hosting of the website.
• [Neon] — database.
• [Resend] — sending e-mails.
• Google — only if you choose "Continue with Google".
• YouTube — only when you press play on a video, YouTube loads and may set its own cookies.

Some providers are based in the USA. Transfers are protected by the EU–US Data Privacy Framework or the EU Standard Contractual Clauses.

How long we keep it

We keep your data while you have an account. When you delete your account, your personal data is deleted immediately. Public drills you created stay in the library without your name. [Backups are deleted within 30 days.]

Children

Drillpin is used by youth teams. Users under 16 need permission from a parent or guardian. Profiles are private by default. Parents can contact us at [contact e-mail] to see or delete a child's data.

Your rights

• Access and portability: download all your data under Profile settings → Your data.
• Correction: change your details in Profile settings.
• Deletion: delete your account in Profile settings.
• Objection and restriction: contact us at [contact e-mail].
• Complaints: you can complain to your national data protection authority. In Sweden this is the Swedish Authority for Privacy Protection (IMY), imy.se.