Archived publication, replaced 25 September 2026. This is the previous published wording, dated 9 September. It is not proof of which version an individual accepted. Read the current page.

Privacy Policy

Who we are

Clutch ("we", "us") is a team management and player development application operated by a sole trader registered in Malta (VAT MT3132-0302). Contact us any time at hello@useclutchapp.com.

Who decides what

This matters more than it sounds, because it tells you who to ask when you want something changed or removed.

• Your club decides which players to enrol, what to record about them, why, which staff can see what, and how long to keep it. In data protection language the club is the "controller": the one who makes the decisions, and the one responsible for them.
• We store, display and protect that data on the club's instructions. In the same language we are the "processor". We do not decide what your club records about its players, and we do not use it for anything of our own.
• For a narrow set of data we decide ourselves: your login and account details, and the reliability records described under "How long we keep things". For those, we are the controller.

So: to correct or remove player data, ask the club. If the club does not deal with it, write to us and we will help.

What we collect

• Account data: your email address, name, and role (coach, player, or parent).
• Club and training data your club creates: team rosters, session plans, drills, plays, attendance, player ratings, test results, workouts, and scouting notes.
• Player profile data, where a coach or player adds it: position, date of birth, height and weight. These fields are optional, apart from date of birth where a club needs it to work out age groups.
• Health and availability information, where your club records it: whether a player is fit to train or play, an expected return date, and a short note describing an injury. This is written by club staff, not by us. It is optional, and it is the most sensitive information in Clutch, so it is the most tightly restricted. See "Who can see what".
• Technical data: a record of actions taken inside your club (who did what, and when), and crash reports needed to keep the service running. A crash report records the error, the address of the page where it happened and your browser type, and, if you are signed in, your account, so we can see which accounts a fault affected. We do not use advertising trackers.

How we use it

Only to provide the service: running your club inside the app, showing each person exactly the data they are allowed to see, and keeping the thing working. We do not sell personal data, we do not share it with advertisers, and we do not use it to train anything.

Our legal basis for using your data

• Running the service (accounts, teams, rosters, the day-to-day club record): performing the agreement to provide Clutch, together with our and your club's legitimate interest in running a sports club, balanced against your rights.
• Children's data: your club's responsibility to run its youth teams, together with parental or guardian consent captured before a child is given access. A parent can withdraw that consent at any time.
• Health and availability information: handled by the club for player welfare, under the additional protections that apply to this more sensitive data, and only by the roles that need it.
• Website analytics: only with your consent (the banner). Nothing loads until you say yes.

This is our working position. If you have a question about the basis for any specific use, write to us.

Who can see what

• Coaches and club staff see the data of players in their own club only, and only the parts their role allows.
• Health and availability information is narrower than the rest. Inside a club it is limited to the roles whose job needs it, and this is enforced by the database rather than by the screens, so it cannot be reached by going around the app. A player sees their own. A linked parent sees their own child’s. Nobody else in the club sees it, and nobody outside the club sees it at all.
• Players see their own data, and only the parts their coach has chosen to share with them, such as ratings, test results and scouting reports.
• Parents see the children linked to them, and only those children.
• Where your club uses federation registration, authorised federation staff can access the registration information and supporting documents their role permits, to review and manage registrations. This does not give them unrestricted access to all your club's records.
• Our staff can technically read data in the database in order to run and repair the service. We do so only when it is needed for that purpose.

Messages

Messaging has been removed from Clutch (August 2026). Nobody can send or read messages in the app today, in any role.

The feature was only ever available briefly and saw effectively no use before it was removed, so there is no message history: no stored messages exist in the app. If messaging returns in a future version, this page will describe how it works before it is switched on.

Cookies and analytics

This website sets no cookies unless you say yes. Our own visitor counting (Vercel Web Analytics) is cookie-free and never sees who you are.

If you press "Allow analytics" on the banner, we additionally load Google Analytics, which sets cookies to help us understand how people find Clutch: which pages are read and roughly where visitors come from, with IP addresses anonymised. If you press "No thanks", Google receives nothing, and we remember that choice the same way.

You can change your mind any time: reset your cookie choice and the banner will ask again.

The Clutch app itself contains no Google Analytics and no advertising trackers.

Children and minors

Clutch is built for youth sport, so this matters to us.

• A player under 16 cannot activate their own login until a parent or guardian has joined through their own invitation and given consent. The app refuses to create the child's login until that has happened.
• A parent chooses whether performance data and coach feedback are shared with them, and can change that at any time in the app.
• A parent can withdraw consent at any time. When consent is withdrawn the club must stop processing the child's data and remove it. Ask the club directly; if they do not deal with it, write to us at hello@useclutchapp.com and we will help you get an answer.
• Coaches confirm at signup that they have appropriate consent to record their players' data, including minors, with a parent or guardian's permission.

Where your data lives

Data is stored in the European Union (Supabase, on AWS in Stockholm). Our website and app are delivered by Vercel. Company email is provided by GoDaddy, and the app sends invitation emails to players and parents through Resend. GoDaddy and Resend are United States providers, so an email address and the contents of a message sent to or from us can be processed in the US; everything your club records about its players stays in the European Union. Each provider only receives what its function needs. For the United States email providers we rely on the standard European data-transfer safeguards (the European Commission's Standard Contractual Clauses, or the EU-US Data Privacy Framework where the provider is certified).

Security

All traffic is encrypted in transit (HTTPS). Access to data is enforced inside the database itself, per person and per role, rather than only in the app, so a person cannot reach data by going around the screens. The database is backed up nightly. Data is not encrypted in a way that would prevent our own operator reading it; that is what makes support and repair possible. No system is perfectly secure, but we treat your club's data as we would our own.

Your rights, and what deletion actually does

• Access and portability: download a copy of your data yourself from Settings ("Download my data"), or ask us at hello@useclutchapp.com. We respond to any request within one month.
• Correction: fix your details directly in the app, or ask your club.
• Erasure: request account deletion in Settings, or contact us at support@useclutchapp.com. The request and review process is explained below.
• Objection and restriction: ask us to stop or limit a particular use of your data and we will deal with it.
• Withdraw consent: where we rely on consent (analytics, or a parent's consent for a child), you can withdraw it at any time.
• Complaint: you may lodge a complaint with your local data protection authority. In Malta that is the Information and Data Protection Commissioner (IDPC), idpc.org.mt.

Requesting account deletion. In Settings, choose "Delete my account". The app asks "Are you sure?" before you confirm:

• Confirm opens a request and blocks your access. Your account and its data remain while our team reviews your request. Nothing is automatically deleted by submitting it.
• The app explains that you cannot access the account during review and that our team will contact you by email to confirm your choices. Choosing "Understood" signs you out. Signing in again shows the pending-request message rather than your account.
• To cancel your request, email support@useclutchapp.com. Our team can cancel it and restore your access after reviewing your message. Simply signing in does not cancel the request.
• The access block applies to your account. It does not delete your club, remove other people's accounts, or stop authorised club and federation staff accessing records they are already permitted to see.
• A request is not confirmation that erasure has been completed. We review which records it covers, coordinate with the relevant club or federation where needed, and explain the outcome and any records that must be retained.
• If the in-app request is unavailable for your account, or you need to request deletion of club data, contact support@useclutchapp.com.

How long we keep things

• Club and player records: your club or federation determines the applicable retention requirements. A 36-month leaver period has been recorded as the intended club policy, but Clutch does not currently delete or anonymise these records automatically at that deadline. Retention and deletion requests need review with the responsible organisation. An account-deletion request does not itself erase these records.
• Registration identity documents (a passport, ID card or birth-certificate scan used to confirm eligibility): where these are used, we aim to delete or lock the image once eligibility is confirmed, rather than keep it on file.
• Accounts with a pending deletion request: access is blocked, but the account and associated data remain during review. Submitting the request does not automatically erase records or backups.
• Messages: the messaging feature was removed in August 2026 and no message history is kept.
• Activity logs and crash reports: daily cleanup removes product activity events and crash reports older than 30 days; crash reports are also capped at 10,000 rows. A record can remain until the next scheduled cleanup. Separate administrative and deletion-request audit records do not have that timer.
• Backups: managed database backups currently provide a seven-day recovery window. Separate encrypted database backup artifacts on GitHub are configured to expire after 30 days. These database backups do not contain uploaded file contents. This does not promise that every downloaded or separately retained copy is erased on the same schedule.

Changes

If this policy changes meaningfully we will tell you in the app before the change takes effect. We are actively improving how much control parents have over a child's data, and this page will be updated to describe each change as it ships rather than before.

← Back to Clutch · Terms of Service