Privacy Policy

Last updated: October 15, 2026

This Privacy Policy explains what personal data 4league collects, why, who we share it with, how long we keep it and what your rights are. It covers the 4league apps for iPhone, Android and the web (web.4league.app), the 4league smartwatch apps, the website 4league.app, and the 4league widgets and developer API.

The short version

• 4league is run by NATIVEUP LAB S.R.L., a company in Romania. You can reach us at 4league.app@gmail.com.
• We use your data to run tournaments, teams and clubs: fixtures, results, statistics, messages and payments.
• Results, rankings and player statistics of public tournaments are public, like in a newspaper. Any player can ask us to hide their public player page.
• You need to be at least 16 to create your own account. Younger players are added by their club, coach or parent.
• We only use app analytics if you agree. The free plan shows non-personalised ads.
• We do not sell your personal data.
• You can see, correct and delete your data, and complain to the data protection authority.

Who is responsible for your data

The controller of your personal data is NATIVEUP LAB S.R.L., tax ID (CUI) 43901354, registered office: Jud. Sibiu, Sat Mohu, Comuna Şelimbăr, Strada MOHU, Nr. 298C, Romania ("4league", "we", "us"). Contact for any privacy question or request: 4league.app@gmail.com. We have not appointed a data protection officer.

When a club, academy, organization or tournament organizer uses 4league to manage its own players, staff and members, it decides what it enters and why. For the data it enters (for example rosters, player details, medical certificates, ID documents and coaches' training ratings), the club or organizer is the controller and 4league processes that data on its behalf. Questions about that data should go to the club or organizer first; we will help. 4league remains the controller for what it decides itself, as described in this policy: for example public player pages and their indexing by search engines, analytics, crash reporting, hosting and security.

What data we collect

Data you give us

• Account: name, email address, optional phone number, language, time zone, country and city.
• Player profile (optional): photo, birth date, position, shirt number, height, weight and, where a federation requires it, licence or registration number and personal ID number.
• Content: tournaments, teams, fixtures, results, lineups, news, polls, messages and group chats, photos and videos you upload.
• Payments: the plan you buy and payment status. Card details are handled by Apple, Google or Stripe; we never see your full card number.
• Support: what you write to us.

Data other people give us about you

• Team managers, coaches, clubs and organizers can add you as a player (name, photo, number, position, birth date, licence number), record your match events (goals, cards, appearances, attendance) and, in clubs, store documents (ID document, medical certificate, parent consent, insurance, contract) and coach ratings of your training.
• Other users can vote for player of the match, rate players, write messages and upload photos.
• Facility managers can record the name, phone and email of people who book a pitch.
• For some leagues we do not run, we show public results from the league's official website. We do not publish personal data of those players unless they joined 4league themselves; their names are shown only as initials.

The person who enters data about someone else is responsible for having the right to do so and for its accuracy. If someone has added data about you that is wrong or that you did not agree to, you can ask them to correct or remove it, or report it to us at 4league.app@gmail.com and we will review it and remove it where appropriate.

Data collected automatically

• Device and app data: device model, operating system, app version, language, and a notification token if you allow notifications.
• Approximate location (accurate to about 10 km), only if you allow it, to show competitions near you.
• Usage analytics (screens viewed, features used), only if you agree. See "Cookies, analytics and ads".
• Crash reports to fix errors.
• Security logs for our developer API, including IP address.
• Android install referrer, to connect an invitation link to your new account.

Why we use your data and our legal basis

Under the EU General Data Protection Regulation (GDPR) we need a legal basis for each use:

• To provide 4league (accounts, tournaments, teams, fixtures, statistics, messages, notifications, emails such as login codes and invitations): necessary to perform our contract with you (Art. 6(1)(b) GDPR).
• To publish results, rankings and player statistics of public tournaments: our legitimate interest, and the interest of players, fans and organizers, in sharing sports results (Art. 6(1)(f)). You can object at any time; see "What is public".
• To take payments and keep accounting records: contract and legal obligation (Art. 6(1)(b) and (c)).
• App and website analytics (Google Analytics for Firebase, Google Analytics 4): your consent (Art. 6(1)(a)). Our server also sends a few key events (for example a subscription starting, a vote, an account being deleted) to Google Analytics with a pseudonymous ID, based on our legitimate interest in understanding how the service is used.
• Crash reporting and security (Sentry, API logs): legitimate interest in keeping 4league working and safe.
• Ads in the free plan (Google AdMob, non-personalised): legitimate interest in funding the free plan; where the law requires consent for the device storage ads use, we ask for it.
• Location: your consent, given through your phone's permission prompt.
• Club documents and training ratings: decided by the club as controller. Health data (medical certificates) is special-category data; the club must have a valid condition under Art. 9 GDPR, such as your explicit consent or your parent's.
• Marketing emails: only with your consent. You can unsubscribe at any time.
• Legal claims and compliance: legitimate interest and legal obligation.

What is public

4league is used to run real football competitions, so some data is visible to anyone, including people without an account and search engines:

• Public tournaments, teams and organizations: names, logos, fixtures, results, standings and statistics.
• Player pages and lineups in public tournaments: name, photo, team, position, shirt number, goals, assists, cards and other match statistics. Player pages can appear in search results.
• Posters and share images that users create and share.
• Widgets and the developer API that clubs use on their own websites. Player names and photos appear there only if the club switches this on.

Birth dates, ID and licence numbers, contact details, club documents and private messages are not shown on public pages.

Your right to object. Every player can ask us to hide their public player page and photo. Today this is done by email: write to 4league.app@gmail.com with a link to the page. We will hide it unless there is a compelling reason not to (for example an official result that must stay correct), and we will explain our decision.

Children and young players

• You must be at least 16 to create your own 4league account.
• Players under 16 can be added to a team or tournament by their club, coach or parent. The person who adds a child confirms that they have the parent's or guardian's permission and is responsible for having it. In the United States, we do not knowingly let children under 13 use 4league without verifiable parental consent.
• Our rule is that public pages of players under 16 should not be shown publicly. The app does not yet ask for a player's age automatically, so until this is built a parent, the club or the player can ask us at 4league.app@gmail.com to hide a young player's page, and we will do so.
• All ad requests from the app are marked as directed at children and under the age of consent, so Google serves only non-personalised ads suitable for young audiences.
• If you are a parent and think we hold data about your child that we should not, contact us and we will delete it.

Who we share data with

We do not sell your personal data. We share it only with:

• Other users, as the service requires: your teams, tournament organizers, clubs you belong to, and the public for public tournaments (see "What is public").
• Service providers who process data for us: DigitalOcean (servers and file storage, EU region), Amazon Web Services (email delivery, Ireland region), Google (Firebase Analytics, Google Analytics 4, AdMob ads, Google Maps and Places), Sentry (crash reports), RevenueCat (in-app subscription status), Stripe (web payments and club fee payments), Expo (push notifications and app updates), Apple and Google (push notification delivery), and Cloudflare (website delivery and security).
• Apple and Google, when you buy a subscription in their stores. They are independent controllers of that purchase.
• Clubs, when you pay a club fee through 4league: the club receives your payment details needed for its records.
• Authorities, when the law requires it.
• A buyer, if our business is sold or merged; we will tell you before your data falls under a different privacy policy.

Transfers outside Europe

Some of our providers are US companies (including DigitalOcean, Amazon, Google, Sentry, RevenueCat, Stripe, Expo and Cloudflare), so your data may be accessed from or stored in the United States. For these transfers we rely on the EU-US Data Privacy Framework where the provider is certified under it, and otherwise on the European Commission's Standard Contractual Clauses. You can ask us for more information about these safeguards.

How long we keep data

We keep data only as long as needed. This is what happens today:

• Your account: until you delete it. We do not yet delete inactive accounts automatically.
• Tournaments, teams, results and statistics: as long as the tournament or team exists, as part of its history. Inactive ones stay in our database.
• Player entries in teams and tournaments: as long as the team or tournament exists, even after the player's account is deleted, unless we are asked to remove them.
• Messages, votes, photos and videos: until they are deleted by the user or the organizer, or on request.
• Club documents: until the club deletes them. Expiry dates (for example of a medical certificate) are tracked, but documents are not deleted automatically.
• Old profile photos: earlier versions are removed after one year.
• Demo tournaments: available for 30 days, then fully removed after [[TODO: exact period]].
• Payment and subscription records: at least 5 years from 1 July of the year after the financial year, as required by Romanian accounting law.
• Developer API logs: 30 days; API audit logs: 90 days.
• Analytics data: [[TODO: Google Analytics / Firebase data retention setting]]. Crash reports: [[TODO: Sentry retention]].

Your rights

• Access: ask what data we hold about you and get a copy.
• Correction: edit your profile in the app, or ask us or your club to correct it.
• Deletion: delete your account in the app (Account → Your Profile → Delete Account) and ask us to delete other data. See Delete your account for exactly what is deleted today.
• Objection: object to uses based on legitimate interest, including your public player page.
• Restriction of use while a complaint is checked.
• Portability: receive the data you gave us in a common machine-readable format. Today this is done by email.
• Withdraw consent at any time, without affecting what was done before.

To use any of these rights, email 4league.app@gmail.com. We may ask you to confirm your identity. We reply within one month (this can be extended by two more months for complex requests; we will tell you). For data a club controls, we pass your request to the club.

You can complain to a data protection authority. In Romania this is the National Supervisory Authority for Personal Data Processing (ANSPDCP), www.dataprotection.ro. You can also complain in the EU country where you live or work. In the United Kingdom, you can contact the Information Commission (ico.org.uk); please contact us first so we can try to solve the problem.

Cookies, analytics and ads

On the website 4league.app

• 4league_consent: remembers your choice in the cookie banner for one year. Necessary.
• Google Analytics 4 cookies (_ga, _ga_<ID>): set only if you click "Accept all". They measure visits.

To change your choice, delete this site's cookies in your browser; the banner appears again. Some pages show video thumbnails loaded from YouTube (Google), which receives your IP address.

In the apps

• Google Analytics for Firebase: on Android and the web app we ask for your consent when you first open the app; analytics stays off if you refuse. On iPhone, analytics is switched on only if you allow tracking in Apple's "Allow to track" prompt; you can change this at any time in iPhone Settings → Privacy & Security → Tracking.
• Google AdMob (free plan): non-personalised ads. Google may use device identifiers and your IP address to deliver ads, limit how often you see them and prevent fraud. A PRO subscription removes ads.
• Sentry: crash reports, without your name or email.
• Notifications and location: only with your phone's permission, which you can turn off in your phone settings.

If you want to withdraw your analytics consent in the Android or web app, email 4league.app@gmail.com, or clear the app's data, after which the consent question appears again.

Automated decisions

Standings, rankings and statistics are calculated automatically from match results. We do not make decisions about you based solely on automated processing that have legal or similarly significant effects.

Security

We use encrypted connections, access controls and private storage for club documents, which can only be opened through short-lived links. No system is completely secure; if a data breach is likely to put you at risk, we will tell you and the authority as the law requires.

Information for users in the United States

We do not sell personal information and do not share it for cross-context behavioural advertising. The categories of data we collect, why, and who receives it are described above. You can ask to access, correct or delete your data by email; we will not treat you differently for doing so.

Changes to this policy

If we make important changes, we will tell you by email or in the app before they take effect. The date at the top shows the latest version.

Contact

NATIVEUP LAB S.R.L., Jud. Sibiu, Sat Mohu, Comuna Şelimbăr, Strada MOHU, Nr. 298C, Romania · 4league.app@gmail.com