Privacy policy
Last updated: November 1, 2026
This is a translation of the French policy, provided for convenience. Gameday is published in France and governed by French law: in case of any difference, the French version is the one that applies.
Gameday is a football club's app: the staff posts the playbook, the call-ins, the depth chart and the videos; each player sees what concerns them. This page explains, without jargon, what data we handle, why, who can see it and how you keep control of it.
1. Who is responsible
Gameday is published by Nexflow (Arthur Cissac, sole proprietorship, Île-de-France, France), the data controller under the GDPR. Contact: contact@nexflow.agency.
Your club (its coaches) decides what gets posted in the app (playbook, call-ins, depth charts, videos). Nexflow provides the tool and hosts the data.
2. What we collect
We only collect what you enter yourself or what the app needs to work. There is no advertising, no advertising tracker and no measurement cookie — only an anonymous audience measurement, described below the table.
| Data | Why | Who sees it |
|---|---|---|
| Email, password (hashed), or Google / Apple identifier | Create your account and sign you inLegal basis: performance of the contract | You; never shown to other members |
| Date of birth given at sign-up; for anyone under 15, a parent's email address, the date of the request and the date of their consent | Check age and collect a parent's consent (see « Minors »)Legal basis: legal obligation — obtaining, and being able to prove, the consent of a holder of parental authority for anyone under 15 (GDPR Articles 7 and 8, French Data Protection Act Article 45) | You; your date of birth also appears on your profile (next row). The parent's address is never shown to the club |
| First name, last name, date of birth, jersey number, positions, height, weight, experience, background, photo | Your profile in the team; showing your assignments based on your positionsLegal basis: performance of the contract | The members of your club (teammates and staff) |
| Phone, Instagram, Facebook (optional) | So your teammates can reach youLegal basis: your consent: you choose to fill them in, and you can erase them whenever you want | The members of your club; on a swap-meet listing, your phone number only appears if you check « Show my phone number » |
| Emergency contact (name, phone, relationship) and medical notes (optional) | React quickly if you get hurt at practice or in a gameLegal basis: emergency contact: legitimate interest (your safety); medical notes: your explicit consent (see below the table) | Your teams' staff only. Never your teammates. This is sensitive data: only fill in what you want the staff to know. |
| Medical certificate (a file you upload) and admin record (license, dues, gear on loan) | Let the club check you're cleared to play and track your registrationLegal basis: certificate: your explicit consent (see below the table); admin record: the club's legitimate interest in tracking its registrations | You and your team's staff. Never your teammates. |
| Game and practice videos you appear in, with the comments, corrections and drawings added to them | Review plays and improveLegal basis: the club's legitimate interest in analyzing its play | The staff; the whole team once the staff publishes the video. A private comment is seen only by its author, a staff note only by the staff. |
| Highlight reels you make | Keep and share your best playsLegal basis: performance of the contract | You only; and anyone with the link if you choose to share it. The link isn't indexed by search engines, and you can turn it off at any time. |
| Sports stats (games, yards, tackles, physical measurements…) | Track your progressLegal basis: performance of the contract | You and your staff; your teammates only if you choose « share with the team » |
| RSVPs and reasons for missing, carpooling | Organize practices and gamesLegal basis: performance of the contract | The staff; teammates see who's in or out, and the rides |
| Chat messages, photos and reactions, swap-meet listings | Communicate within the team; sell gear between membersLegal basis: performance of the contract | The members of the group (chat) or the club (swap meet); a direct message is seen only by its two participants |
| Plays you've opened | Help you learn the playbook; let the staff see who's readyLegal basis: performance of the contract | You and your staff |
| Notification subscription, preferences, theme, haptics | Notify you (new play, call-in, message) according to your choicesLegal basis: your consent, given by allowing notifications and withdrawn in the settings | Nobody; technical settings |
| Club subscription: billing email address, subscription references at Stripe | Bill the club's subscriptionLegal basis: performance of the contract; legal obligation to keep invoices | Nexflow. Card details are entered at Stripe and never reach us. |
| Session data (IP address, browser) | Secure the sign-in, detect unusual useLegal basis: legitimate interest (account security) | Nobody; kept for the length of the session |
Health data: medical notes and the medical certificate are never required. You decide to share them with the staff, by typing them in or uploading the file yourself: that is your explicit consent (Article 9(2)(a) GDPR). You can withdraw it at any time by erasing the notes or the file from « Me »: they disappear for the staff right away.
Audience measurement: to know which pages are useful and which ones nobody finds, we count visits and some clicks with Vercel Web Analytics. It sets no cookie and writes nothing to your device; a visitor is only recognized by a fingerprint computed from the request and erased after 24 hours, and no measurement is tied to your IP address or your account. What is sent: the page visited, the site you came from, the country, the device type, the browser and the operating system. Before anything is sent, the page address is cleaned: no parameters, no identifiers, no invitation or sharing links; admin pages are not counted. We only ever see totals. Legal basis: our legitimate interest in improving the app (Article 6(1)(f) GDPR); you can object at any time (see « Your rights »).
Anonymous tap counts: the app also counts on its own, on our servers, how many times some buttons are used each day (for example « Invite my players » or « Remind the players who are behind »), to know which features are used. Only the day, the button's name and a total are recorded: not your account, not your IP address, not the page, not your device. Nothing is counted from admin pages. These totals are kept for 13 months. Legal basis: our legitimate interest in improving the app (Article 6(1)(f) GDPR).
Emergency contact: by filling it in, you are giving us data about someone else. Make sure they're fine with it.
3. What we don't do
- No selling or sharing of your data for commercial purposes.
- No advertising, no profiling, no cross-app tracking (no advertising tracker, no pixel).
- No location tracking: an event's address is typed in by the coach; the « Directions » button opens Google Maps on your device, without us knowing where you are.
- No access to your contacts. The camera, microphone and photo library are only used for the photos and videos you choose to send.
4. Where the data is hosted
With providers acting on our behalf (processors). The database and the files are stored in the European Union:
- Neon (database) — Frankfurt region, Germany.
- Cloudflare R2 (photos, boards, logos, medical certificates) — European Union jurisdiction. The files are private: they are served only to authorized members, through the app.
- Bunny.net (BunnyWay d.o.o., Slovenia) — video storage and streaming. A video only plays through a signed link that expires after a few hours, issued to authorized members only. To speed up playback, temporary copies pass through its worldwide server network.
- Vercel (app hosting, anonymous audience measurement) — servers in Frankfurt, Germany.
- Resend (sending emails: address confirmation, new password, support, consent requests to a parent) — sent from Ireland. It receives your email address and the message content.
- Stripe (payment of the club's subscription) — Stripe Payments Europe, Ireland. Only the staff member who subscribes is involved.
- Apple and Google (notifications) — the notification service of your iPhone, your Android phone or your browser receives a device identifier and the text of the notification.
- Google or Apple, only if you choose to sign in with them: they send us your email and your name, nothing else. With Apple, you can hide your email.
- Base Adresse Nationale (a French public service, api-adresse.data.gouv.fr): to suggest an address when a coach types in a location. The call comes from our server; no data about you is sent.
Some of these providers are US companies (Vercel, Resend, Stripe, Apple, Google). Any transfer outside the European Union is covered by the safeguards provided for by the GDPR (the European Commission's standard contractual clauses).
5. For how long
- As long as your account exists, you stay in control of everything.
- If you leave a team, your messages and RSVPs in that team stay visible in its history, but your profile is no longer reachable there. Your admin record and medical certificate are deleted. Your profile, stats and reels follow you: the staff of your next team sees your past stats.
- A medical certificate is deleted at the latest 18 months after it was uploaded.
- Videos stay as long as the club subscribes to the Video plan. If it ends, the staff has 30 days to download them, then they are deleted.
- If you delete your account (« Me » or « Settings », Account section), everything personal to you is erased immediately: profile, photos, stats, messages, comments, highlight reels (and their share links), listings, RSVPs, learning data, subscriptions. Content that belongs to the club (plays, events, depth chart, videos) stays, without your name.
- Anonymous tap totals (how many times a button was used per day) are kept for 13 months.
- Technical database backups are kept for at most 7 days, then overwritten.
6. Your rights
At any time you can see and change your data in the app (« Me », then Edit my profile), choose the visibility of your stats and your phone number, download all your data (« Me », then « My data ») and delete your account yourself, without asking us.
For any other right (objection, correction, a question), write to contact@nexflow.agency — we answer within 30 days. You can also file a complaint with the CNIL, the French data protection authority (cnil.fr).
7. Minors
In France, a minor can consent on their own to the processing of their data by an online service from age 15; below that, the consent of a holder of parental authority is also required, in addition to their own (GDPR Article 8, French Data Protection Act Article 45).
So every new account gives its date of birth. Under 15, the account stays on hold, with no access to the club, until a parent or legal guardian has given their consent: the young person enters a parent's email address, and the parent receives a link valid for 7 days. On that link's page, the parent sees what the app does and what data it uses, then accepts or refuses. Refusing deletes the account right away.
To be able to prove that consent, we keep, for as long as the account exists, the parent's address, the date of the request, the date of their consent and the version of this policy they accepted — never the link itself, which works only once. We check consent by reasonable means (a link sent to the address given): if you believe a minor signed up without a parent's consent, write to us and we will delete the account. This check applies to accounts created since late September 2026.
The parent or legal guardian exercises the rights above on the child's behalf, and can withdraw their consent at any time by writing to us.
8. Security
Encrypted connection (HTTPS), hashed passwords, verified email addresses, every piece of data served only to authorized members of your club (checked on the server on every request), files stored privately, videos playable only through signed, short-lived links. We may notify you in case of a security incident affecting you.
9. Changes
If this policy changes in a meaningful way, you'll be told in the app. The date at the top of the page marks the latest version.