Privacy Policy

Zgraya · Last updated: 4 August 2026

This Privacy Policy explains what personal data the Zgraya mobile application ("Zgraya", "the app", "we", "us") collects, why we collect it, and the choices you have. Zgraya is a coordination tool for children's sports teams, used by coaches and by parents/guardians.

Zgraya is operated and published under the names Zgraya and Poklyk Apps. For any privacy question or request, contact us at privacy@zgraya.app.

1. Summary

• We collect the account and team data needed to run the coordination features (events, RSVPs, payment tracking, notifications).
• We use privacy-respecting product analytics that is not linked to your name, email, or phone number, and we do not use advertising trackers or session recording.
• Children do not use Zgraya directly. Player information is entered and managed by the adults responsible for the team (coaches and the child's parents/guardians).
• Zgraya does not process payments. Fees are tracked as a manual "paid / unpaid" ledger only.
• Your data is stored with EU-based service providers, and you can request access to or deletion of your data at any time.

2. Data We Collect

2.1 Account and profile data

• Your first and last name.
• Your email address and password (passwords are stored only in hashed form by our authentication provider).
• Optional: your phone number and a profile photo.
• If you sign in with Apple or Google, we receive the basic account identifier those services provide to create your account.

2.2 Team, player, and child data

To coordinate a team, coaches and parents/guardians enter information about players, who are typically children. This may include a player's first and last name, date of birth, playing position, shirt number, and a photo. This information is entered by the adults managing the team, not by the children themselves.

If you enter information about a child, you confirm that you are that child's parent or legal guardian, or the team coach acting with the guardians' knowledge, and that you are authorised to provide it. See Section 9 (Children's Privacy).

2.3 Team activity data

• Clubs, teams, rosters, and membership/role information.
• Events you create or are invited to (name, date, time, location, optional notes and fee amount).
• RSVP responses and optional free-text decline reasons.
• Payment status entries. Zgraya is a manual ledger only — it records whether a fee is marked "paid" or "unpaid". Zgraya does not process, transmit, or store card or bank payment credentials for transactions. A coach may type their own payment reference (for example a card or account number) into an event so parents know where to send money externally; this is display text, not a payment processed by us.

2.4 Device and notification data

• A push notification token for your device, so we can deliver event, RSVP, and payment reminders.
• Your device's platform (iOS/Android), app version, language, and a normalised device manufacturer label (for example apple, samsung, xiaomi) used to diagnose notification delivery problems on certain devices.

2.5 Product analytics

We use privacy-respecting analytics to understand how the app is used and where it needs improvement. This includes:

• Anonymous identifier. Analytics events are tagged with a random identifier generated on your device. It is not your account ID, email, or phone number, and it rotates when you log out or switch accounts.
• Usage events. Actions such as onboarding steps, RSVP and payment actions, screen views, feature usage, and app errors.
• Context. Your role (owner/coach/assistant/parent), platform, app version, language, whether the action happened offline, and device manufacturer.
• Notification delivery signals. We record when a notification is sent and acknowledged, keyed to an opaque per-device identifier, to measure delivery reliability.

We do not use session or screen recording, advertising or cross-app tracking, or third-party marketing SDKs. Analytics events are filtered so they do not carry names, emails, phone numbers, photos, or free text you typed. We do not maintain a mapping between the anonymous analytics identifier and your account.

For reporting on overall product health, we query aggregate, non-identifying summaries of the database rather than individual personal records.

3. How We Use Your Data

• To provide the core service: accounts, teams, events, RSVPs, payment tracking, and notifications.
• To send you relevant reminders and updates (event invitations, RSVP and payment reminders, changes and cancellations).
• To keep the service secure and to prevent abuse.
• To understand usage and fix problems so we can improve the app.

4. Legal Basis

Where the EU/UK General Data Protection Regulation (GDPR) applies, we rely on: performance of a contract (to provide the service you signed up for), our legitimate interests (to secure and improve the service using analytics that is not linked to your identity), and your consent where required. You accept this Privacy Policy when you create an account.

5. Who We Share Data With

We do not sell your personal data. We share it only with service providers ("processors") that operate the app on our behalf, under contract, and only as needed to run the service:

Provider	Purpose	Region
Supabase	Database, authentication, and backend hosting	EU
PostHog	Product analytics and delivery metrics	EU
Google Firebase Cloud Messaging	Android push notification delivery	Google infrastructure
Apple Push Notification service	iOS push notification delivery	Apple infrastructure

We may also disclose data if required by law, or to protect the rights, safety, and security of our users and the service.

6. Where Your Data Is Stored

Your account and team data and analytics data are stored with providers in the European Union. Push notification tokens are processed by Apple and Google to deliver notifications to your device. Where data is transferred outside your country, it is protected by the safeguards those providers offer (such as GDPR-standard contractual protections).

7. Data Retention

We keep your personal data while your account is active and for as long as needed to provide the service. When you delete your account, we remove your account identity, profile, photos, device tokens, and memberships. Where a player's profile has other linked guardians, that profile remains available to them and only your link is removed; where it has no remaining guardians, it is anonymised while necessary team event and payment history is retained. If a coach or assistant deletes an account, necessary club-operational records may remain with non-identifying “former staff” attribution; their name, email, photo, and contact details are removed. Anonymous, non-identifying analytics may be retained for product analysis.

8. Your Rights

Subject to applicable law (including GDPR and Ukrainian data protection law), you may:

• Access the personal data we hold about you.
• Correct inaccurate data (you can edit most profile data directly in the app).
• Delete your account and personal data — available in the app under Settings, or by using our account-deletion page.
• Request a copy of your data, restrict or object to certain processing, and withdraw consent.

To exercise any of these rights, email privacy@zgraya.app. You also have the right to complain to your local data protection authority.

9. Children's Privacy

Zgraya is designed for adults — coaches and parents/guardians. It is not intended for use by children, and children do not create accounts or use the app directly.

The app does store information about children (players) so that the adults responsible for a team can coordinate. This data is entered and controlled by the child's parents/guardians and the team's coaches. If you are a parent or guardian and want a child's information reviewed, corrected, or removed, contact the team coach or email us at privacy@zgraya.app. We rely on the adults who enter a child's data to have the authority to do so.

10. Security

We use industry-standard measures to protect your data, including encrypted connections, hashed passwords, and access controls that limit data visibility to the appropriate roles (owner, coach, assistant, parent/guardian). No method of transmission or storage is completely secure, but we work to protect your information.

11. Changes to This Policy

We may update this Privacy Policy as the app evolves. We will change the "Last updated" date above and, for significant changes, provide notice in the app. Continued use of Zgraya after an update means you accept the revised policy.

12. Contact

Questions or requests: privacy@zgraya.app