Hattrick — Privacy Policy
Last updated: 4 October 2026 Applies to: the Hattrick mobile app (iOS and Android), the facility web app, the website playhattrick.com and the backend service behind them.
1. Who we are
Hattrick ("we", "us") is a football app run by its founders in Amman, Jordan. For any privacy question or request, contact hello@playhattrick.com.
2. What we collect
You give us directly
- Name, email address, and password (the password is handled by Google Firebase Authentication — we never see or store it).
- Your country and city, chosen from a list. We keep the centre point of that city as your default location; it is not your own position.
- Optional profile details: phone number, playing position, and your general area (e.g. "Abdoun").
- An optional profile photo, which you choose from your phone's photos or take with the camera. The app shrinks it to a small square picture before sending it.
- Content you create: team names, reviews and ratings you write, scores you submit for matches, and the messages, photos and videos you post in your club's chat.
- Reports: when you report a player, a profile photo, or a photo or video in a club chat, we keep your report (what you reported, the reason and any note you add). Only our team can see it, and the person you reported is never told that it was you.
Collected automatically when you use the app
- A push notification token for your phone, if you allow notifications, so we can tell you about your games and your club's chat. Turning notifications off in your phone's settings stops them.
- Your device's approximate location, only while the app is open and only if you grant permission, to show fields near you. We do not track your location in the background, and we do not store your coordinates on our servers — they are sent with a search request and used to compute distances, not retained. When location is off, we use the centre of the city you chose instead.
- Basic technical logs from our server (IP address, request time, endpoint) kept for security and debugging.
We do not collect payment card details (the app takes no payments), contacts, or advertising identifiers. The app only reads a photo or video you pick yourself; it never browses or uploads your photo library. We do not use tracking or advertising SDKs.
3. Why we use it
| Purpose | Data used | Basis |
|---|---|---|
| Create and secure your account | Name, email | Performing our contract with you |
| Confirm your email address with a one-time code | Performing our contract | |
| Send game and chat notifications | Push token | Your consent (revocable in device settings) |
| Show fields near you | Approximate location | Your consent (revocable in device settings) |
| Show games and fields near your city when location is off | Country and city | Performing our contract |
| Make and manage bookings | Account, booking details | Performing our contract |
| Let venue owners recognise their bookings | Your name and phone (shown only to the owner of the field you booked) | Performing our contract |
| Teams, pickup games and match results | Name, position, team membership, scores | Performing our contract |
| Show who you are to other players | Profile photo (optional) | Performing our contract |
| Club chat | Your messages, photos and videos | Performing our contract |
| Keep the community safe (reports of photos and players) | Your reports, and what was reported | Our legitimate interest in keeping the service safe |
| Keep ratings trustworthy | Your booking history at a venue | Our legitimate interest in preventing fake reviews |
| Keep the service working and secure | Technical logs | Our legitimate interest in security |
4. Who can see your information
- Other players see your name, profile photo, playing position, city, general area, teams, and any reviews you write. Only members of your club see what you post in its chat. They do not see your country or any coordinates.
- Venue owners see the name and phone number of players who booked their field, so they can recognise you and confirm payment.
- We share with service providers who run parts of the service for us:
| Provider | Role | Where data is processed |
|---|---|---|
| Google Firebase (Google LLC) | Login and account security | Google infrastructure |
| Neon | Database hosting | Frankfurt, Germany (EU) |
| Amazon Web Services (S3) | Stores profile photos and chat photos and videos, in a private bucket | Frankfurt, Germany (EU) |
| Resend (Resend, Inc.) | Sends our account emails, such as your sign-up code | Ireland (EU); the company is in the United States |
| Fly.io | Runs our backend | Frankfurt, Germany (EU) |
| Sentry (Functional Software, Inc.) | Error reports from the apps and our servers, so we can fix problems; they carry no name, email, messages or IP address | Frankfurt, Germany (EU); the company is in the United States |
| Expo (650 Industries) | Delivers push notifications to your phone | United States |
| Google Maps | Displays the map | Google infrastructure |
| Cloudflare | Hosts our website and the facility web app | Cloudflare's global network |
We do not sell your personal data, and we do not share it for advertising.
Because our database and hosting sit outside Jordan, your data is transferred internationally. We choose providers that offer standard contractual protections for such transfers.
5. Emails we send
We only send emails about your account: the one-time code that confirms your address when you sign up, and similar messages you ask for (such as a new code). We do not send marketing or newsletters, and we never buy or rent email lists.
If an email to you bounces permanently or you mark one of ours as spam, we stop emailing that address and keep a record of it (the address, the reason and the date) so we don't email it again. Password-reset emails come from Firebase.
6. How long we keep it
- Your account data: until you delete your account.
- Bookings and match results: retained after account deletion, but stripped of anything identifying you (see below).
- Reports: kept while we review them and afterwards as a record of what was decided; a photo we remove is deleted for good.
- Server logs: roughly 30 days.
- Accounts whose email was never confirmed: removed after 7 days.
7. Deleting your account
You can delete your account at any time in the app: Account → Profile → Delete my account. When you do:
- Your name, phone number, country, city, area, playing position, profile photo and review comments are permanently removed. Changing or removing your profile photo also deletes the old picture.
- Your login is deleted, so you can no longer sign in.
- Any upcoming bookings you made are cancelled and the slots released.
- Past bookings and match results remain, without your personal details. We keep these because they are also the venue's business records and the opposing team's match history — deleting them would rewrite other people's records. Numeric ratings you left stay as anonymous figures; the written comments are removed.
If you captain a team, you'll be asked to hand over the captaincy or remove the team first, so your teammates aren't left with an orphaned team.
8. Your rights
You can ask us to access, correct, or delete your personal data, or to object to how we use it. Most of this is available directly in the app (Profile screen); for anything else, email hello@playhattrick.com and we'll respond within 30 days.
9. Children
Hattrick is not intended for children under 13, and we don't knowingly collect their data. If you believe a child has given us personal data, contact us and we'll remove it.
10. Security
Passwords are handled by Firebase Authentication and never reach our servers. Traffic between the app and our servers is encrypted (HTTPS), and the database connection is encrypted. No system is perfectly secure, but we take reasonable measures to protect your information.
11. Changes
If we change this policy materially, we'll notify you in the app before the change takes effect.