Privacy Policy

1. Who We Are

Turfmate is a small, independently operated product built and maintained by a two-person development team. We are not a large corporation — we are individual developers who built this platform for football coaches and academies. The platform is available on Android, iOS, and Web at turfmate.app.

Contact: support@turfmate.app — we read every email personally.

2. Information We Collect

3. How We Use Your Information

• Authenticate coaches and players and manage access
• Display player profiles, metrics, and attendance to authorised coaches
• Allow players to view their own profile, remarks, and session plans
• Generate AI-powered coaching reports and session plans
• Send tactical messages and session feedback from coaches to players
• Send optional monthly performance summary emails to players
• Track camp progress and attendance rates

4. Third-Party Services (Data Processors)

Your data may be processed by the following sub-processors under their own privacy policies. We have entered into data processing arrangements with each as required:

• Google Firebase (Auth, Firestore, Cloud Storage, Hosting, Cloud Functions) — core infrastructure
• Google Gemini API — AI coaching assistant, player assessment, and session planning features
• Razorpay — subscription billing and payment processing (PCI-DSS compliant)
• Resend — transactional email delivery (monthly reports)
• Google Tag Manager / Google Analytics — anonymous website usage analytics (landing site only; not in the mobile app)

We do not use any AI provider to train models on your personal data. Data sent to AI services is used solely to generate the requested output and is not retained by those services for training purposes under standard API terms.

5. Payments & Billing

Payments and subscription billing are securely processed through Razorpay. Turfmate does not store full card details, banking credentials, or UPI PIN information on its servers.

Subscription status, payment metadata, and transaction identifiers may be stored to manage premium access and billing history.

6. AI Features Disclaimer

AI-generated coaching insights, reports, or recommendations may contain inaccuracies and should not be treated as professional medical, fitness, legal, or health advice.

7. Who Can See Your Data

Turfmate administrators may access data for maintenance and support purposes only.

8. Data Storage & Security

• Data stored using Google Firebase and Google Cloud infrastructure
• Firebase Security Rules enforce role-based access control
• All communication encrypted using HTTPS/TLS
• No payment card information stored by Turfmate directly

Turfmate maintains a security programme that includes role-based access controls, encrypted data transmission, secure credential management, and periodic review of access logs and Firestore security rules. We will notify affected users and relevant authorities within 72 hours of becoming aware of a personal data breach that is likely to result in risk to individuals, in line with CERT-In and DPDP Act 2023 obligations.

9. International Data Transfers

Your information may be processed or stored on servers located outside your country of residence through providers such as Google, Razorpay, and Resend.

10. Data Retention

Player and academy data is retained for the duration of the active academy subscription. Following subscription cancellation, data is retained for 90 days to allow for reactivation or data export, after which it is permanently deleted from active systems.

Upon account deletion request: personal profile data, performance metrics, remarks, and attendance records are deleted from active systems within 14 days. Copies may persist in automated infrastructure backup systems for up to 90 days following deletion; such backup data is not accessible in normal use and is purged as part of routine backup rotation. Payment transaction identifiers and billing metadata are retained for 7 years as required under Indian tax and accounting laws (GST Act, Income Tax Act).

11. Breach Response

In the event of a data breach affecting user personal data, Turfmate will:

• Investigate the breach promptly upon discovery
• Notify affected users via the email address on record as soon as reasonably practicable
• Report to CERT-In and other relevant Indian authorities within the timeframe required by applicable law (currently 6 hours for critical incidents under CERT-In directions; as required under DPDP Act rules when notified)
• Provide details of the nature of the breach, data affected, and steps taken to contain it

Breach notifications will be sent to the email address registered to the affected head coach account. Players should ensure their coach's contact details are current.

12. Children's Privacy

Players under 18 cannot self-register. All player accounts are created and managed exclusively by authorised coaches via the Turfmate platform.

Head coaches are responsible for obtaining written parental or guardian consent before entering a minor's personal data (name, photo, phone number, performance metrics, attendance) onto the platform. Coaches must retain evidence of such consent independently.

Turfmate does not verify the age of players entered by coaches. By adding a player, the coach warrants that appropriate consent has been obtained.

Parents or guardians of minor players may contact support@turfmate.app to request access to, correction of, or deletion of their child's data.

13. Your Rights (DPDP Act 2023)

Under the Indian Digital Personal Data Protection Act 2023, you have the following rights as a Data Principal:

• Access: Request a summary of personal data held about you and how it has been used
• Correction: Request correction of inaccurate or incomplete personal data
• Erasure: Request deletion of personal data (subject to legal retention obligations)
• Grievance Redress: Lodge a complaint with our Grievance Officer (see §18 below)
• Nomination: Nominate another person to exercise your rights on your behalf in the event of death or incapacity
• Consent Withdrawal: Withdraw previously given consent at any time by emailing support@turfmate.app with subject line "Consent Withdrawal — [Your Name]". We will process your request within 30 days. Withdrawal does not affect the lawfulness of processing prior to withdrawal, but will result in the relevant features or account being unavailable

To exercise any of these rights: use Settings → Delete Account in-app, or email support@turfmate.app with subject line "Data Rights Request — [Your Name]". As a small team we aim to respond within 30 days; for deletion requests we will confirm receipt promptly.

For parents or guardians of minor players: email support@turfmate.app with subject "Minor Data Rights Request" and provide the player's name and academy. We will coordinate with the head coach and process your request within 30 days.

14. DPDP Act 2023 Compliance

Turfmate acts as a Data Fiduciary under India's Digital Personal Data Protection Act 2023 in respect of user data it collects directly (coach accounts, subscription data).

For player data entered by a coach, the head coach / academy acts as the party responsible for obtaining lawful consent from players and parents/guardians. Turfmate provides the platform and storage infrastructure and processes that data on behalf of the academy. Both the academy and Turfmate have responsibilities regarding lawful data handling; neither party can fully disclaim the other's obligations through contract alone.

Turfmate does not use personal data for automated profiling or targeted advertising.

15. Device Permissions

• Camera — profile photos
• Photo Library / Storage — uploads
• Internet — required platform functionality
• Push Notifications — tactical messages and updates

16. Changes to This Policy

We may update this Privacy Policy periodically. The "Last updated" date at the top of this page reflects the most recent revision.

For material changes — including changes to the categories of data collected, new third-party data processors, or changes to how data is used — we will notify active users via in-app notification or email at least 7 days before the change takes effect. Continued use after the effective date constitutes acceptance of the revised policy. If you do not accept a material change, you may request account deletion before the effective date.

For minor, non-material changes (clarifications, formatting, broken links), we will update this page without separate notification.

17. Intermediary Status (IT Act 2000 §79)

Turfmate acts as an intermediary under Section 79 of the Information Technology Act 2000 in respect of content uploaded or entered by coaches and players (including remarks, notes, session content, and profile information). Turfmate does not initiate, select recipients for, or modify such user-generated content.

Turfmate is not liable for content posted by coaches or players on the Platform where such content violates these Terms or applicable law, provided Turfmate has not been notified of the violation or has expeditiously removed such content upon notification.

To report unlawful content, inaccurate data about a minor, or a data rights request, contact our Grievance Officer (§18 below). We will respond within 24 hours of receipt and resolve within 30 days.

18. Grievance Officer

In accordance with the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules 2021 and the Digital Personal Data Protection Act 2023, a Grievance Officer has been designated to address user complaints and data principal requests.

If you are not satisfied with the resolution, you may approach the Data Protection Board of India (once constituted under the DPDP Act 2023) or other competent authorities.

19. Contact Us

Turfmate — Football Coaching & Academy Management Platform

Website: turfmate.app

Email: support@turfmate.app