CLUTCH

Privacy Policy

This publication updates the explanation of current processing. It does not record a new acknowledgement or consent on anyone's behalf. Previous published wording.

Who we are and how to contact us

Clutch is operated by a sole trader registered in Malta (VAT MT3132-0302). For privacy questions, corrections, access or deletion requests, contact support@useclutchapp.com. General enquiries can also be sent to hello@useclutchapp.com.

Who is responsible for each record

• Your account and personal use: Clutch determines how account administration, security, support and independent player features operate. We are the controller for those purposes, including personal profile and training features you use without a club and reviews you ask Clutch to carry out.
• Club records: the club decides why it keeps rosters, attendance, training plans, ratings and other club records. Clutch processes those records on its instructions.
• Federation records: the relevant federation decides the purposes and rules for registrations, eligibility, competitions and official sporting records. A club may collect and submit information to it. Each organisation must explain its own responsibilities and legal basis; joining a federation does not give it unrestricted access to club records.
• Physiotherapy: the practice or practitioner is responsible for their client and clinical records. Clutch supplies the system and processes those records on their instructions. Clients need not be basketball players.

These roles follow the actual processing, not simply a label in a contract. Contact us if you are unsure who handles a request. We will help route it to the appropriate organisation; an in-app visibility setting does not take away statutory access rights.

What information is used, and where it comes from

• Accounts and identity: email address, name, role, login and account-status records. Sporting-player setup requires first name, surname, nationality and date of birth. Optional profile fields include a photograph, playing position, height and weight.
• Personal development: workouts, goals, completed sessions, private journal entries, season highlights links, self-reported statistics, source links, supporting screenshots and verification requests or decisions.
• Club and competition records: team memberships, attendance, sessions, plans, plays, videos, ratings, tests, scouting reports, fixtures, lineups, jersey numbers, game events and statistics. These may be entered by authorised staff, generated from recorded games or imported from an external statistics file.
• Registrations: identity and contact details, photographs, eligibility and registration dates, identity-document copies, medical certificates where required, declarations, signatures and their timestamps. The registration form identifies the required documents. A club can create a record before its player has a Clutch login.
• Health and clinical information: injury and availability records, clinical notes, medical documents, prescribed exercise videos and feedback about symptoms or pain, where the relevant service is used. This information can come from the individual, their authorised guardian or the responsible staff or practitioner.
• Family links: guardian identity and contact details, invitations, linked children, permissions, approval and withdrawal records. Approval of an independent minor's account and access to a club's records are separate.
• Service records: support correspondence, subscriptions and billing records, notification preferences and push subscriptions, terms and notice records, action logs, crash reports and moderation decisions. Hosting, authentication and anti-abuse services process technical information such as IP addresses, request times, browser and device details. An exact IP address may be recorded for a temporary signup restriction.

Information comes from you, linked guardians, authorised clubs, federations and practitioners, and the service providers performing their functions. An organisation entering a person's details before inviting them remains responsible for providing the appropriate privacy information. Only provide information and files needed for the stated purpose.

Purposes and legal bases

• Providing the service you request: account administration and necessary personal profile, training and support functions are processed to perform our agreement with you, where that basis applies.
• Security and reliability: preventing abuse, investigating errors, enforcing reasonable restrictions and protecting service records rely on our legitimate interests in operating a safe service, balanced against individuals' rights, especially children's rights.
• Legal and accounting duties: we retain or disclose information where necessary to meet an applicable legal obligation, and may retain necessary evidence to establish or defend legal claims.
• Organisation-controlled records: the club, federation or practice must identify and explain the legal basis for each purpose. Clutch processes these records on documented instructions; a club's subscription is not blanket permission to collect or publish personal information.
• Optional analytics and other consent-based uses: these require the relevant choice or permission. Consent can be withdrawn without affecting processing that was lawful before withdrawal.

Health information requires an additional lawful condition under Article 9 GDPR, as well as an Article 6 basis. The responsible organisation must establish the applicable condition, such as valid explicit consent or an applicable healthcare condition with the required safeguards. Accepting Clutch's terms, uploading a document or ticking a general staff declaration does not by itself establish that condition. Ask the responsible club, federation or practitioner how this applies to your records, or contact us for help.

Who can see what

• Personal information: access depends on the particular feature, membership and permissions. Private personal journals are not club reports. A profile photograph may appear alongside your name to people who are authorised to see that profile or roster; uploading it is not permission to use it in Clutch advertising.
• Club staff: see records within the clubs, teams and responsibilities their roles permit. Coach feedback, ratings and reports have their own sharing controls.
• Families: a linked parent or guardian sees the child's information that the applicable link and permissions allow, not every child's records. Independent account approval does not automatically grant access to club, medical or federation records.
• Federation registration: authorised club and federation staff can review the application and the supporting documents their roles permit, including a medical certificate supplied for registration. This is distinct from access to private treatment notes or all of a club's medical records.
• Health and physiotherapy: access is restricted by the clinical or club workflow and assigned role, with relevant access for the individual and authorised guardian. Not every coach, teammate, federation official or account approver can read clinical records.
• Official sporting results: permitted staff can view filed game statistics across their competition, not only their own team. Full-game and authorised federation reports can include player names, jersey numbers and statistics. This does not grant those readers access to the players' identity documents, private notes or medical records.
• Clutch operations: authorised operators and service providers process information necessary for support, security, delivery and maintenance. We may disclose information when legally required or necessary to protect legal rights, subject to applicable law.

Highlights, verification and downloadable copies

When you submit personal season statistics for review, Clutch reviewers can inspect the note, evidence and source link. A Clutch verification label records a Clutch review; a federation verification label records verification attributed to the federation following review. These labels are not identity checks, medical clearance or a guarantee that no error exists. They can be corrected or removed. Self-reported statistics remain distinct from official game records.

Opening an external highlights or evidence link takes you to another service, which applies its own privacy policy and may receive your IP address and browser information. Do not include unnecessary personal information about other people in screenshots or links.

Authorised users may download statistics and documents. Once downloaded or lawfully shared outside Clutch, those copies are not controlled by an in-app permission change or account block. The recipient is responsible for secure storage, lawful onward use and retention. A download is not permission to publish medical or identity documents, or to use a child's image for marketing.

Children and guardian approval

Clutch's sporting-account policy requires guardian approval for under-18s. This is a platform safeguard, not a statement that the same legal digital-consent age applies in every country. In the independent signup flow, an account may be created while access remains restricted pending guardian approval. Club-invited and practice clients follow their applicable guardian and permission workflows.

Use accurate dates of birth and genuine parent or guardian details. An adult must not impersonate a guardian, and a child must not approve their own account. Suspected false approval may lead to a review and access restriction; it does not automatically erase an organisation's sporting or clinical records.

Guardian account approval, club permissions, registration signatures and consent for a specific use of health information are different things. A guardian may request withdrawal through the available controls or by contacting us. We review the affected account, links and processing with the relevant organisation. Withdrawal stops future processing that depends on that consent; it does not automatically remove records that must lawfully be retained on another basis.

Cookies, local storage and analytics

Essential technologies support sign-in, security, app operation and remembering choices. The marketing website remembers an analytics decision in local storage and a preference cookie, including when you decline.

Optional Google Analytics and Vercel Web Analytics on the marketing site load only after analytics permission. They measure visits, pages, referral information, approximate location and device/browser information. They are not used for advertising in Clutch. Declining does not prevent use of the website. The product app does not run Google Analytics or advertising trackers; operational logs and security processing are separate.

You can reset your cookie choice. Withdrawing permission stops future optional loading after the page reloads; it does not itself erase information already received by a provider.

Service providers and international processing

The primary Supabase database is hosted in the EU, in Stockholm. This does not mean every part of the service, provider support or backup processing is confined to the EU.

• Supabase: database, authentication and file storage.
• Vercel: website and app delivery, server functions and related hosting/security logs; optional marketing-site analytics after permission.
• Resend: account, password-reset, invitation and other transactional email delivery. Messages contain the recipient address and content needed for their purpose.
• Cloudflare Turnstile: anti-bot checks in authentication flows.
• GitHub: code hosting and the encrypted database-backup workflow and artifacts described below.
• Business email and browser push services: process correspondence or deliver notifications when those channels are used. Our business email services include the configured GoDaddy/Titan mail service; linking an address to a Google identity does not itself move its mailbox to Google.
• Google Analytics: optional marketing-site measurement after permission. External video and source websites are separate services when you follow their links.

Some providers or their support operations process information outside the EEA, including in the United States. Transfers require an applicable adequacy decision or appropriate safeguards, such as Standard Contractual Clauses with any necessary supplementary measures. We do not treat a provider's US presence as proof of Data Privacy Framework certification. Contact us for the safeguards and provider information applicable to your processing. This notice does not claim that encrypted backups or an EU database region eliminate international-transfer obligations.

Security and recovery

Clutch uses HTTPS, database-enforced access controls and restricted file access. Separate database backup artifacts are encrypted before upload. These controls reduce risk; no service can guarantee that an incident will never happen. Clutch is not end-to-end encrypted: authorised operation and support may require access to information.

Database backups and uploaded-file recovery are different. A database backup contains records and file references, not the uploaded file contents. It must not be treated as a promise to recover every deleted photo, certificate or video. Ask us about the recovery arrangements applicable to your organisation before relying on them as its only archive.

Your rights and account deletion

Subject to the applicable conditions, you can request access, correction, erasure, restriction and portability, object to processing based on legitimate interests, and withdraw consent for consent-based processing. Use Settings or contact support@useclutchapp.com. We may need proportionate identity checks. We respond without undue delay, normally within one month; if the law permits an extension, we explain it within that first month. You can complain to Malta's Information and Data Protection Commissioner or your relevant supervisory authority.

Requesting deletion is not instant erasure. Confirming "Delete my account" in Settings opens a review request and blocks account access. The account and data remain during review. Signing in again does not cancel the request. To cancel it, contact support; our team can restore access after review. You can still contact us about your rights while access is blocked.

We review which records the request covers with the relevant club, federation or practice and explain the outcome, including any lawful retention. The request does not delete other people's accounts or revoke their existing authorised access to organisation records. A club's internal sharing preference does not override a person's legal right to request their information.

Retention

• Accounts and personal features: records remain while the account or feature is used and while an applicable deletion request, dispute or legal retention requirement is addressed. Ending a club membership does not itself delete an independent account or playing history.
• Club, federation and clinical records: the responsible organisation determines and must justify the applicable retention period. A 36-month club-leaver period was recorded as an intended policy, but Clutch does not automatically erase or anonymise all records at that deadline. Do not assume identity-document images disappear when registration is approved.
• Verification: submissions, evidence and decisions remain with the relevant review or season record until deleted through the applicable process, subject to necessary dispute or legal retention. Removing a verification label does not itself erase all review evidence.
• Operational logs: daily cleanup removes product activity events and crash reports older than 30 days; crash reports are also capped at 10,000 rows. Cleanup can run after a record reaches the limit. Administrative, legal-acknowledgement, moderation and deletion-request records do not share that automatic timer.
• Restrictions: an account restriction can have an expiry or remain until reviewed and lifted. A temporary signup-IP restriction expiring does not itself erase the moderation history. Contact support to challenge a restriction or request a review of retained information.
• Backups: managed database backups currently have a seven-day recovery window. Separate encrypted database artifacts on GitHub are configured to expire after 30 days. Uploaded file contents are not included in those database artifacts. Deletion does not instantly remove existing backups or copies retained by an authorised recipient; retained backup copies must be protected and handled under the applicable retention and restoration process.

Changes and future features

This revision explains existing account, guardian, registration, clinical, statistics and operational workflows. It does not authorise a new audience for private records. Material changes will be explained through an appropriate notice and, where required, a separate choice before the new processing starts. Accepting terms or continuing to use Clutch does not replace any specific consent required by law.

This notice does not announce a public player marketplace, networking directory or rewards scheme. Those features need their own review and appropriate notices before launch.

← Back to Clutch · Terms of Service