CLUTCH

Privacy Policy

Who we are

Clutch ("we", "us") is a team management and player development application operated by a sole trader registered in Malta (VAT MT3132-0302). Contact us any time at hello@useclutchapp.com.

Who decides what

This matters more than it sounds, because it tells you who to ask when you want something changed or removed.

• Your club decides which players to enrol, what to record about them, why, which staff can see what, and how long to keep it. In data protection language the club is the "controller": the one who makes the decisions, and the one responsible for them.
• We store, display and protect that data on the club's instructions. In the same language we are the "processor". We do not decide what your club records about its players, and we do not use it for anything of our own.
• For a narrow set of data we decide ourselves: your login and account details, and the reliability records described under "How long we keep things". For those, we are the controller.

So: to correct or remove player data, ask the club. If the club does not deal with it, write to us and we will help.

What we collect

• Account data: your email address, name, and role (coach, player, or parent).
• Club and training data your club creates: team rosters, session plans, drills, plays, attendance, player ratings, test results, workouts, and scouting notes.
• Player profile data, where a coach or player adds it: position, date of birth, height and weight. These fields are optional, apart from date of birth where a club needs it to work out age groups.
• Health and availability information, where your club records it: whether a player is fit to train or play, an expected return date, and a short note describing an injury. This is written by club staff, not by us. It is optional, and it is the most sensitive information in Clutch, so it is the most tightly restricted. See "Who can see what".
• Technical data: a record of actions taken inside your club (who did what, and when), and crash reports needed to keep the service running. A crash report records the error, the address of the page where it happened and your browser type, and, if you are signed in, your account, so we can see which accounts a fault affected. We do not use advertising trackers.

How we use it

Only to provide the service: running your club inside the app, showing each person exactly the data they are allowed to see, and keeping the thing working. We do not sell personal data, we do not share it with advertisers, and we do not use it to train anything.

Our legal basis for using your data

• Running the service (accounts, teams, rosters, the day-to-day club record): performing the agreement to provide Clutch, together with our and your club's legitimate interest in running a sports club, balanced against your rights.
• Children's data: your club's responsibility to run its youth teams, together with parental or guardian consent captured before a child is given access. A parent can withdraw that consent at any time.
• Health and availability information: handled by the club for player welfare, under the additional protections that apply to this more sensitive data, and only by the roles that need it.
• Website analytics: only with your consent (the banner). Nothing loads until you say yes.

This is our working position. If you have a question about the basis for any specific use, write to us.

Who can see what

• Coaches and club staff see the data of players in their own club only, and only the parts their role allows.
• Health and availability information is narrower than the rest. Inside a club it is limited to the roles whose job needs it, and this is enforced by the database rather than by the screens, so it cannot be reached by going around the app. A player sees their own. A linked parent sees their own child’s. Nobody else in the club sees it, and nobody outside the club sees it at all.
• Players see their own data, and only the parts their coach has chosen to share with them, such as ratings, test results and scouting reports.
• Parents see the children linked to them, and only those children.
• Nobody outside your club sees anything.
• Our staff can technically read data in the database in order to run and repair the service. We do so only when it is needed for that purpose.

Messages

Messaging has been removed from Clutch (August 2026). Nobody can send or read messages in the app today, in any role.

The feature was only ever available briefly and saw effectively no use before it was removed, so there is no message history: no stored messages exist in the app. If messaging returns in a future version, this page will describe how it works before it is switched on.

Cookies and analytics

This website sets no cookies unless you say yes. Our own visitor counting (Vercel Web Analytics) is cookie-free and never sees who you are.

If you press "Allow analytics" on the banner, we additionally load Google Analytics, which sets cookies to help us understand how people find Clutch: which pages are read and roughly where visitors come from, with IP addresses anonymised. If you press "No thanks", Google receives nothing, and we remember that choice the same way.

You can change your mind any time: reset your cookie choice and the banner will ask again.

The Clutch app itself contains no Google Analytics and no advertising trackers.

Children and minors

Clutch is built for youth sport, so this matters to us.

• A player under 16 cannot activate their own login until a parent or guardian has joined through their own invitation and given consent. The app refuses to create the child's login until that has happened.
• A parent chooses whether performance data and coach feedback are shared with them, and can change that at any time in the app.
• A parent can withdraw consent at any time. When consent is withdrawn the club must stop processing the child's data and remove it. Ask the club directly; if they do not deal with it, write to us at hello@useclutchapp.com and we will help you get an answer.
• Coaches confirm at signup that they have appropriate consent to record their players' data, including minors, with a parent or guardian's permission.

Where your data lives

Data is stored in the European Union (Supabase, on AWS in Stockholm). Our website and app are delivered by Vercel. Company email is provided by GoDaddy, and the app sends invitation emails to players and parents through Resend. GoDaddy and Resend are United States providers, so an email address and the contents of a message sent to or from us can be processed in the US; everything your club records about its players stays in the European Union. Each provider only receives what its function needs. For the United States email providers we rely on the standard European data-transfer safeguards (the European Commission's Standard Contractual Clauses, or the EU-US Data Privacy Framework where the provider is certified).

Security

All traffic is encrypted in transit (HTTPS). Access to data is enforced inside the database itself, per person and per role, rather than only in the app, so a person cannot reach data by going around the screens. The database is backed up nightly. Data is not encrypted in a way that would prevent our own operator reading it; that is what makes support and repair possible. No system is perfectly secure, but we treat your club's data as we would our own.

Your rights, and what deletion actually does

• Access and portability: download a copy of your data yourself from Settings ("Download my data"), or ask us at hello@useclutchapp.com. We respond to any request within one month.
• Correction: fix your details directly in the app, or ask your club.
• Erasure: delete your account in Settings (see below for exactly what that removes), or ask us.
• Objection and restriction: ask us to stop or limit a particular use of your data and we will deal with it.
• Withdraw consent: where we rely on consent (analytics, or a parent's consent for a child), you can withdraw it at any time.
• Complaint: you may lodge a complaint with your local data protection authority. In Malta that is the Information and Data Protection Commissioner (IDPC), idpc.org.mt.

Deletion. You can delete your account in Settings. We want to be exact about what that does, because "everything is deleted" would not be true:

• Your login, your profile and the data attached to you are removed from the live database.
• Your name may remain inside free text somebody else wrote. A coach's note that mentions you by name is that coach's sentence, and we cannot find it automatically. Ask the club to remove it.
• If you own a club that still has other members, you cannot delete your account until you hand the club to someone else. Deleting it would destroy the club and everyone in it. The app will refuse and tell you what to do.
• A club can request full deletion of the club and everything in it at hello@useclutchapp.com.

How long we keep things

• Your club's data: kept while a player is active, and for up to 36 months after they leave a club or their registration lapses, after which it is deleted or anonymised. This aligns with the three-year registration cycle. Your club decides within that limit and can ask for deletion at any time.
• Registration identity documents (a passport, ID card or birth-certificate scan used to confirm eligibility): where these are used, we aim to delete or lock the image once eligibility is confirmed, rather than keep it on file.
• Deleted accounts: removed from the live database immediately.
• Messages: the messaging feature was removed in August 2026 and no message history is kept.
• Our reliability records, meaning the record of actions inside your club and crash reports, are deleted automatically after 30 days.
• Encrypted backups: age out within 30 days.

Changes

If this policy changes meaningfully we will tell you in the app before the change takes effect. We are actively improving how much control parents have over a child's data, and this page will be updated to describe each change as it ships rather than before.

← Back to Clutch · Terms of Service