Privacy Policy

Usage analytics: limited product analytics events such as when a formation is started, saved, shared, or exported, plus aggregated Cloudflare Web Analytics.

Acquisition source: when you first visit, we record where the visit came from — a referring website hostname, a "ref" or "utm_source" query parameter on the URL, or "direct" — so we can understand which channels bring people to FTB.

Signed-in attribution and authentication analytics: if you are signed in, a pseudonymous account identifier (a random UUID, not your email) is attached to acquisition and authentication events so we can recognise the same account across sessions and devices for product measurement. Authentication events may record the sign-in method and whether a flow started, succeeded, failed, or was cancelled.

Account and authentication: if you create an account, we process your email address and a random account identifier through Supabase. If you set a password, Supabase Auth handles it and stores only a salted bcrypt hash.

Google sign-in: if you choose Continue with Google, Google provides Supabase Auth with your Google account identifier, email address, email-verification status, name, and profile picture URL. Supabase stores these in its authentication records. FTB uses only the email address in the product.

Linked sign-in methods: if you connect Google to an existing FTB account, Supabase stores that additional identity with the account.

Authentication emails: Supabase Auth creates account emails, such as sign-in links, account confirmations, and password resets. Zoho CPaaS, through ZeptoMail, delivers them using your email address and message and delivery data.

Cloud-saved data: if you sign in and cloud features are enabled for your plan, saved formations and custom player markers may be stored in our hosted database.

Shared content: when you create a share link, relevant shared data is stored temporarily so recipients can open it.

Feedback contact: when you submit feedback through the in-app feedback button, you may optionally provide an email address so we can reply about that specific report. Feedback submitted without an email is anonymous to us.

Feedback diagnostics: if you submit a bug report, you may choose to attach recent app errors and coarse app actions to help us understand that report. Diagnostics are not sent to product analytics or stored separately from the resulting feedback issue.

Local storage: if you use FTB without signing in, some data (including tactics and custom player marker designs) may be stored locally on your device using browser storage.

Payments and billing: where paid features are offered, Paddle may process purchase and payment-related information needed to handle orders, billing, taxes, refunds, fraud checks, and compliance.

Data accessed: if you choose Google sign-in, Google provides Supabase Auth with your Google account identifier, email address, email-verification status, name, and profile picture URL. FTB does not receive your Google password or request access to your contacts, Google Drive files, calendars, or other Google account content.

Purpose and use: FTB uses this data only for authentication and account linking, so you can sign in, connect Google to an existing FTB account, and recognise the account in the app. Only your email address is shown or otherwise used in the FTB product.

Storage and sharing: Supabase stores the Google identity data with your FTB authentication record and processes it on our behalf. We do not sell or rent this data, use it for advertising, or share it with other third parties except where required to operate the service or comply with law.

Protection: Google sign-in data is encrypted in transit using HTTPS, and access controls restrict production systems and account data to authorised services and people who need access to operate, secure, or support FTB. We minimise the Google data we request and rely on the security controls of Google and Supabase as our identity providers.

Retention and deletion: Google identity data is retained while Google remains linked to your active FTB account. You can disconnect Google from the Account page to delete the linked Google identity from FTB, or delete your FTB account to delete all linked sign-in methods and cloud data tied to it, except information we must retain for legal reasons. You can separately revoke FTB access in your Google account settings.

We do not sell or rent personal data.

We do not use third-party advertising trackers.

We do not store passwords in plain text or receive them on kindoapps servers. Passwords are handled by Supabase Auth, which stores salted bcrypt hashes.

We do not receive your Google password or request access to your contacts, files, calendars, or other Google account content.

We do not store full card numbers or full payment credentials ourselves.

We do not access locally stored guest data unless you actively share it with us for support.

We do not include your email address, name, or profile picture in product analytics events; only a random account identifier is used where an account is known.

We do not use email addresses submitted through the feedback button for marketing, newsletters, or any purpose other than replying to that specific report.

Cloudflare: hosting, temporary share storage, and cookieless web analytics (no persistent identifiers, no cross-site tracking) measured under our legitimate interest in service quality.

Supabase: authentication, storage of account identities and password hashes, creation of authentication emails, and cloud data storage.

Zoho CPaaS (ZeptoMail): delivery of transactional account emails, including sign-in links, account confirmations, and password resets.

Google: optional identity provider for Google sign-in. Google also processes the sign-in under its own privacy policy.

Paddle: checkout, billing, taxes, and refunds as merchant of record.

GitHub: stores feedback submitted through the in-app feedback button (including any optional email you provide) as GitHub Issues so we can triage and respond.

Access: request a copy of the personal data we hold about you.

Rectification: ask us to correct inaccurate or incomplete data.

Erasure: ask us to delete your account data. The in-app Delete account option removes your FTB account, linked sign-in methods, and cloud data tied to it; information may be retained where required by law.

Restriction: ask us to limit how we process your data.

Objection: object to processing based on legitimate interests.

Data portability: receive a portable copy of data you provided to us.

Account controls: where available, disconnect a linked Google sign-in method from your Account page. Revoke provider-side authorization separately in your Google account settings.

Lodging a complaint: file with the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl), or with your local EU supervisory authority.