Privacy notice

Version of 7 September 2026.

Who we are

Athra Sports ("Athra", "we", "us") operates the Athra Sports app and this website. We hold two different roles at once, and which one applies depends on the data:

• Controller for account data. Your account itself: the email and password you sign in with, your date of birth, your device tokens, and your notification and app preferences. We decide why this is collected and how it is used.
• Processor for club data. Records your club or school creates about you in the app: fixtures, selection, availability, match records, photos and messages tied to club activity. Your club or school controls this data and instructs us on how to handle it.

If you are a parent, player or coach and have a question about a club record, the club or school holding it is the first point of contact. For questions about your account itself, contact us directly at privacy@athrasports.com.

What we collect

The tables below set out exactly what is collected. They are the same data set the app store listings describe, restated here for one plain-language reference.

• Identity and contact: name, email address, phone number.
• Health: safeguarding or medical records where a club records them (injuries, head injury assessments, return-to-play status).
• Fitness: workload, training load, minutes played and other performance data.
• Purchase history: what a club store order was for and its status. Card details are never collected by Athra; Stripe handles payment collection directly.
• Sensitive info: date of birth of minors, used to apply age-appropriate behaviour, including the under-13 and 13-17 rules below, and safeguarding records (which category overlaps with Health above where a club record is both).
• Photos and videos: profile pictures and images uploaded to club records.
• Audio: recordings made through the app's recording feature.
• User-generated content: messages sent through the app.
• Identifiers: your user ID and device identifiers, used to keep your account and notifications working correctly.
• Product interaction and crash data: basic usage and crash diagnostics, used to keep the app working. Crash reporting is switched on from public release.

We do not collect precise location, contacts, or browsing history, and we do not run advertising. The app does not track you across other companies' apps or websites, and it shows no tracking consent prompt because there is nothing here for one to cover.

Children's data

Athra Sports is a club and school management app, not a consumer product aimed at children. Accounts work like this:

• A child under 13 never holds their own login. Their account is created and managed by a guardian, and everything about them, availability, selection, minutes played, is actioned through that guardian.
• A 13 to 17 year old may hold their own sign-in, but self-sign-up requires a named parent or guardian on the account before it can be used.
• A child's record is reachable only by their linked guardians and by club staff with a genuine need to see it. This is enforced in the software, at the point of every request, not left to a policy.

User-generated content and child safety

The app supports messaging and other user-generated content between club members. Content that sexualises, exploits or endangers a child is prohibited absolutely, with zero tolerance, and is never permitted regardless of context or apparent consent.

Report a concern to safeguarding@athrasports.com. We aim to review and take down reported content that breaches this rule within 24 hours of receiving the report, and to refer confirmed child sexual abuse material to the relevant authorities as required by law. See our safeguarding page for the named contact and the full process.

Retention

Records are kept for defined periods rather than indefinitely:

• Finance records (subscription and store payment records): 6 years.
• Safeguarding and medical records: until the subject turns 25, or 7 years from the date of the record, whichever is later.
• Everything else is kept while your club or account is active, and is deleted as set out below once it is not.

International transfers

Athra's data resides in Google Cloud's us-central1 region. Where this involves a transfer of personal data out of the UK, UAE or another jurisdiction you are in, we rely on the standard contractual protections our infrastructure and sub-processors provide, and we hold data to the stricter of the applicable regimes rather than the more convenient one.

Sub-processors

We use a small number of service providers, each under contract and each limited to processing personal data only to provide their service to us:

• Google Firebase (Google Cloud): authentication, database, file storage, functions, analytics and push notifications.
• Stripe: payment processing. Card details are entered directly with Stripe and never reach Athra's systems.
• Resend: transactional email, such as invitations and password resets.
• Sentry: crash reporting, active from the app's public release.

We do not sell personal data and do not share it with advertisers.

Deletion

You can request deletion of your account in either of two ways:

• In the app: Profile > Delete account.
• On the web: athrasports.com/delete-account.

We commit to completing a deletion request within 30 days. On deletion, we delete your profile, date of birth, photos, messages, device tokens, notifications and preferences.

Two categories are retained rather than deleted outright, for the periods set out above: payment records, and safeguarding or medical records. In both cases, your identity is replaced with a non-reversible reference so the record can no longer be linked back to you, while the underlying record is kept for finance and safeguarding purposes. Names appearing in match records (results, team sheets, statistics) are retained on a league-archive basis, as a factual sporting record rather than a personal profile.

Contacts

Privacy questions and account data requests: privacy@athrasports.com. Safeguarding concerns and content reports: safeguarding@athrasports.com.

Your rights

Depending on where you are, you may have rights to access, correct, delete or object to the processing of your personal data, under UK GDPR, the UK Data Protection Act 2018, or the UAE Personal Data Protection Law. For account data, contact us directly. For club data, your club or school is the controller and is the first point of contact; we support it in answering your request.