Flux Developments → SideOut → Privacy

Privacy Policy

Last updated: 3 August 2026

SideOut ("we", "us", "our") is operated by Flux Developments Ltd, a company registered in England and Wales. This policy explains what the SideOut mobile application (the "App") collects, why, who it is shared with, and what rights you have. It applies to the App on both iPhone and Android. It is written to match what the App actually does. Where something is commonly collected by apps but is not collected by SideOut, we say so explicitly in section 3.

1. What we collect

1.1 Account information

• An anonymous account. The first time you open the App it creates an anonymous account for you automatically. It has no name, no email address and nothing identifying attached to it. It exists so that your matches can sync between screens and so you can join a session without signing up.
• Email address, if you choose to create a full account. You can do this with an email address and a password, or by requesting a one-time sign-in code sent to your email.
• Sign in with Apple. If you use it, we receive the identifier Apple gives us and whatever name and email address you choose to share. If you use Apple's "Hide My Email" option we only ever receive the private relay address, not your real one.

1.2 Profile information

• Display name.
• Your court positions, in your order of preference.
• An avatar colour.
• An optional Instagram handle.
• An optional short personal motto.
• An optional profile photo, chosen from your device's photo library.
• Your SideOut level and the rating derived from your match results.

1.3 Match, session and tournament data

• Team names and player names as you enter them, shirt numbers and court positions.
• Scores, point-by-point records, timeouts and the score they were taken at, substitutions, rotations, set results and match results.
• Tournament structures, fixtures, seedings and results.
• A session code, and a random identifier the App generates for your device so that a session can tell one participant's phone from another. This identifier is created by the App itself. It is not your device's hardware identifier and it is not an advertising identifier.

Note that you can enter other people's names into a match or a session. Please only enter names you are comfortable sharing with the other people in that session.

1.4 Scoresheet information

• League, competition, venue and match official details you type onto a scoresheet.
• Signatures drawn on screen by referees and captains.

Scoresheet details and signatures are held on your own device and rendered into the PDF. They are not uploaded to our servers. If you email a completed scoresheet, it is sent through your device's own mail app using your own email account, and we do not see the message or its recipients.

1.5 SideOut Clubs

If you use the Clubs part of the App, we additionally process:

• Club and team names, region and an optional club logo.
• Your membership of a club and of specific teams, your role (club admin, team manager, coach or player), your shirt number, your court position, your display name and your avatar.
• Your email address and phone number, if you ask to join a club using a join code. These are collected so the club can confirm who you are before approving you. They are readable only by that club's admins and the relevant team manager, and are deliberately stored separately from the roster so that ordinary club members cannot see them.
• Training sessions and fixtures: title, date and time, location, notes, opponent, the named host, and which teams and individual members are invited.
• Your reply to a session ("going", "maybe", "can't make it") and any note you attach to it.
• Comments you post on a session.
• Lineups a coach saves against a session, and any accompanying note.
• Coaching notes. Free text written by a coach or manager about a named player, optionally linked to a particular session. These are private by default: they are readable only by that team's coaching staff and by the person who wrote the note, unless the author deliberately shares an individual note with the player it is about. No other player can ever see them.

1.6 Subscription information

SideOut Pro is a paid subscription. Payment itself is taken by Apple or by Google, never by us. We do not receive, see or store your card number, bank details or billing address at any point.

What we do process in connection with a subscription:

• Purchase and subscription status - which product you bought, whether your subscription is active, when it renews or expires, whether you are in the free trial, and whether a purchase was refunded or cancelled.
• A store transaction receipt, issued by Apple or Google, used to verify that the purchase is genuine.
• An app user identifier, which is your SideOut account ID. This is passed to our subscription provider so that a subscription follows you to a new phone when you sign in.
• The country of your store account and your platform (iOS or Android), which the store supplies as part of the transaction.
• The date you installed the App, held on your device, which is what the 14-day free trial counts from.

We use RevenueCat (RevenueCat, Inc.) to verify receipts and keep track of subscription status across both app stores. See section 4.

1.7 Information held only on your device

The following is stored in the App's own storage on your phone and is not transmitted to us: your match history, the match currently in progress, any tournament in progress, your saved league details for scoresheets, the date you installed the App, and the randomly generated device identifier described above.

2. How we use it, and our lawful basis

• To provide the App - keeping score, producing scoresheets, running sessions and tournaments, showing your history and rating, and operating clubs, rosters, sessions and replies. Lawful basis: performance of a contract with you.
• To let a club organise itself - showing your name, role, shirt number and availability to the other people in your club, and letting coaching staff plan lineups and keep notes. Lawful basis: performance of a contract, and the legitimate interests of the club in running its teams.
• To keep the service secure and working - authentication, access control and preventing misuse. Lawful basis: legitimate interests.
• To sell and manage SideOut Pro - verifying that a purchase is genuine, unlocking Pro features on every device you sign in on, tracking the free trial, and handling renewals, cancellations and refunds. Lawful basis: performance of a contract with you.
• To meet our legal obligations, including UK tax and consumer law record-keeping for transactions. Lawful basis: legal obligation.
• To respond to you when you contact support. Lawful basis: legitimate interests.
• Optional features you switch on - your profile photo and the camera used for QR scanning. Lawful basis: your consent, given through the operating system's permission prompt. You can withdraw it at any time in your device settings.

We do not use your data for advertising, profiling or automated decision-making.

3. What we do not collect

This section is deliberately specific, because it forms part of our App Store and Google Play data declarations.

• No analytics or tracking. The App contains no analytics SDK, no crash-reporting SDK and no attribution SDK. We do not track you across other apps or websites, and the App does not ask for tracking permission because it does not track.
• No advertising. There are no adverts, no ad networks, no advertising identifiers and no affiliate or referral links of any kind.
• No location data. The App never requests or accesses your location. A venue name typed into a session is free text, not a location reading.
• No contacts. The App never reads your address book.
• No push notifications in the current version, and therefore no push notification token is generated or stored.
• No microphone or audio. Microphone access is explicitly disabled in the Android build.
• Camera: QR codes only. The camera is used solely to scan a session or club join code. No photograph or video is captured, saved or transmitted.
• Photo library: profile picture only. We only ever receive the single image you pick as your profile photo. The App does not browse, read or upload anything else from your library.
• No card or bank details. SideOut Pro is sold through the App Store and Google Play. Those stores take the payment and we never see or store your card number, bank details or billing address. What we do receive about a subscription is set out in section 1.6.
• No health, fitness or biometric data, and no date of birth.

4. Who your information is shared with

We do not sell your personal data, and we do not share it for advertising.

• Other people in your session or match. The player names, shirt numbers, positions and scores in a session are visible to everyone who has joined it with the session code.
• Other members of your club. Your display name, avatar, shirt number, role, availability replies and comments are visible to the other members of your club and team. Your email address and phone number are not: those are visible only to club admins and the relevant team manager. Coaching notes are visible only as described in section 1.5.
• Supabase. We use Supabase (Supabase, Inc.) to host our database, authentication and file storage. All information described in sections 1.1 to 1.5 that leaves your device is stored on infrastructure operated by Supabase. See the Supabase privacy policy.
• Apple. Apple distributes the iOS version of the App, operates Sign in with Apple, and takes payment for SideOut Pro on iPhone through the App Store. See the Apple privacy policy.
• Google. Google Play distributes the Android version of the App and operates Google Play Billing, which takes payment for SideOut Pro on Android and issues the purchase receipt. See the Google privacy policy.
• RevenueCat. We use RevenueCat (RevenueCat, Inc., a US company) to verify store receipts and keep a subscription valid across your devices and both platforms. RevenueCat receives your SideOut account ID, the store receipt, your subscription status, your platform and your store country. It does not receive your name, your email address, your match data or any club data. See the RevenueCat privacy policy.
• GitHub. The web page used for session join links is hosted on GitHub Pages (GitHub, Inc.), which processes standard web server request information such as IP address when that page is opened. See the GitHub privacy statement.
• Legal requirements. We may disclose information where we are required to do so by law.

5. Who is responsible for club data

For your account and profile, Flux Developments Ltd is the data controller. Where a club uses SideOut Clubs to manage its own members, the club decides who is admitted, what roles people hold and what its coaches write in coaching notes. In respect of that information the club acts as a controller in its own right and we act on its behalf. If your question is about what your club holds about you, contact your club in the first instance. You can still contact us at any time and we will help.

6. Storage and security

• All connections between the App and our backend use HTTPS.
• Access to the database is enforced at the database itself using row-level security, so a request can only ever return the records that the signed-in account is entitled to see. The rules described in this policy are enforced by the database, not merely hidden in the App's interface.
• Your sign-in token is held in the App's own storage on your device.
• Passwords, where you set one, are handled and stored by Supabase's authentication service. We never see your password.
• Profile photos are stored in a publicly readable storage bucket. This means that anyone who knows or can guess the direct URL of a profile image can view that image without signing in. Photos are not listed or indexed anywhere by us, but please do not use a profile photo you would not be willing to have seen publicly.
• Supabase may process and store data on servers outside the United Kingdom. Where that happens, transfers are made under the safeguards permitted by UK data protection law, including the UK International Data Transfer Addendum to the European Commission's standard contractual clauses.
• Purchase verification happens against Apple's and Google's own servers via RevenueCat, so an unlocked subscription cannot be faked by editing anything on your device.
• No system is perfectly secure, and we cannot guarantee absolute security, but we take reasonable technical and organisational measures appropriate to the data involved.

7. How long we keep it

• Data held only on your device is kept until you delete it in the App or uninstall the App. Uninstalling removes it.
• Your account, profile and photo are kept for as long as your account exists. Deleting your account in the App deletes your profile record and your uploaded profile photo, and we will complete removal of the remaining associated personal data within 30 days.
• Club records, including memberships, sessions, replies, comments and coaching notes, are kept for as long as the club keeps them. Club admins can remove members and delete sessions and notes. If you leave a club, ask the club to remove your records, or contact us and we will assist.
• Session and match records that other participants also hold may remain visible to them.
• Subscription records are kept for as long as your subscription is active, and afterwards for six years from the end of the relevant financial year, because UK tax law requires us to keep records of transactions for that period. This is limited to the transaction record itself and does not require us to keep your match or club data.
• We keep support correspondence for up to two years.

8. Your rights under UK GDPR

If you are in the United Kingdom you have the right to:

• Ask what personal data we hold about you and get a copy of it.
• Have inaccurate data corrected.
• Have your data deleted.
• Restrict or object to how we process it, including where we rely on legitimate interests.
• Receive your data in a portable format.
• Withdraw consent at any time where we rely on it, without affecting processing already carried out.

You can delete your account directly in the App. Deleting your SideOut account does not cancel a subscription: an App Store or Google Play subscription can only be cancelled through your store account, and you should do that first. For anything else, email us at the address below and we will respond within one month. If you are unhappy with how we have handled your information, you can complain to the Information Commissioner's Office, the UK supervisory authority, at ico.org.uk or on 0303 123 1113.

9. Children's privacy

SideOut is not intended for children under 13, and we do not knowingly allow anyone under 13 to create an account.

Volleyball clubs run junior and youth squads, and a club using SideOut Clubs can add under-18 players to a team. Where that happens, the club is responsible for having an appropriate lawful basis and, where required, parental consent, before entering a young person's details or writing coaching notes about them. Clubs should treat coaching notes about a minor with the same care as any other safeguarding record.

If you are a parent or guardian and believe a child's information has been provided to us without appropriate consent, contact us and we will delete it.

10. Changes to this policy

We may update this policy, for example if we add push notifications. When we make a significant change we will update the date at the top of this page and, where the change affects how your data is used, notify you in the App. Continued use of the App after a change takes effect constitutes acceptance of the updated policy.

11. Contact us