Privacy Notice

Last updated: October 2026 (v2.10.89)

---

Who We Are

Atmos Football is a web app (with a companion Android app on Google Play) for tracking match results, player ratings, and generating balanced teams for casual football and other recreational sports groups. It is developed and operated by James Boucher — an individual, not a company.

For any data protection queries, contact Atmos.football@gmail.com.

---

What Data We Collect

Player Data

When you play in a group that uses Atmos Football, the following is recorded by your group organiser:

• Your name — first name and surname, as entered by the organiser when adding match results.

• Match results — which team you were on, the score, and the outcome.

• Game date and time — the date and kick-off time of each game, as entered or corrected by the organiser. This is used to display game history in the correct order and to match fitness data to the right session.

• Sign-up responses — if you use the weekly sign-up feature, your playing/not playing/maybe status for that week, along with the time you responded. They are stored in that week's event record and kept for as long as the event is, unless the organiser clears the sign-ups sooner.

• Team votes — if your group runs a team vote on the generated line-ups, the option number you voted for is stored against your name in that week's event record. Votes can be cast without signing in, so they are not proof of identity — anyone with the group's share code could vote under a given name.

• Team suggestions — if your organiser opens team submissions for the week, and you send in a line-up, that line-up is stored against your name and account. See Team Suggestions below.

• Match closeness votes — if your group uses the closeness vote on the last match, the 1–5 rating you give is stored against your name in a reactions record attached to that game. Only the rating is stored; there is no free-text comment.

• Payment status — if your group uses the Payment Ledger, the organiser records whether you have paid for each game event. This is stored as a yes/no flag against your name in the event record. If your group uses the payment reconciliation tool, the following additional data may be stored:

  • Bank name alias — the name that appears on bank transfers from your account (e.g. "SMITH J") may be mapped to your player name by the organiser, so that future bank statement imports can be matched automatically. No account numbers, sort codes, balances, or transaction details are stored — only the name.
  • Credit balance — if you have overpaid (e.g. paid for more games than you currently owe), the pound amount is stored against your name so it can be carried forward to future weeks.
  • Sign-up debt reminder — an organiser can switch on a reminder that appears on the in-app sign-up page when a player owes at least an amount they choose. Nothing new is stored about you to do this: the amount is worked out from the payment records above each time the page is opened, and shown with the date your organiser last processed payments. An organiser can set two separate amounts: at the first, only you (and your group's organisers) see your reminder; at the second, which is optional, everyone in the group who is signed in sees it — your name highlighted and the amount you owe. Organisers are warned about this when they set the second amount. The reminder never appears on the share-code sign-up page, so nobody who isn't signed in can see it. An organiser can also exempt individual players from the reminder; if you are exempted, your name is stored in a list on the group's record, which anyone who can see the group can read.

  Apart from the sign-up reminder described above, payment data is visible to group organisers and admins only — not to other players or share-code viewers. Bank statement files uploaded by the organiser are processed entirely in the browser and are never sent to the server.

• Cohort membership — an organiser can tag some players as a named group within the squad, called a cohort (for example "Work team"). The Leaderboard, Season table, Group Records and the Fantasy League views (Table, Ghost, Alpha and Graphs) can then be filtered to show just those players. The cohort's name and its list of player names are stored on the group's record. The app reads that record without a share code, so anyone who can see the group can see who is in a cohort and what it is called. Organisers are told this when they create one. A cohort name can say something about the people in it, such as where they work. There is currently no way to remove yourself from a cohort. Ask your organiser, who can remove you at any time.

If you add yourself as a guest via the "Not on the list?" link on a sign-up page, your name is stored for that game week only. By entering your name, you are voluntarily providing personal data.

Other Sports Sessions

Groups can also record sessions for sports other than football — for example badminton. For a badminton session, each round is stored as a separate record containing the player names on each side, the score, the winner, and the time it was recorded. This is the same kind of data as a football result and is treated the same way throughout this notice.

New Group Requests (Optional)

If you ask for a new group to be set up from within the app, we store your account identifier, your email address, your display name, the group name and organiser name you propose, an optional description, and the request status (pending, approved, or rejected). It is visible to site administrators and to you, and is used solely to review and create the group. The request record is deleted if you delete your account.

Organiser Invitations

When an admin or organiser invites someone to organise a group, an invitation record is created containing the invited email address, the group, and the role being granted. It exists so the invitation can be matched to the right account at sign-in. Invitation records can be read only by site administrators and by the signed-in holder of the invited email address, once that address has been verified. An invitation is only accepted for an account whose email address is verified. If you register with an email and password, we send you a verification link for this reason. Google sign-in addresses are already verified.

Using the App Without an Account (Anonymous Identity)

You do not need an account to sign up for games. When you open a group's sign-up link, or enter its share code, without being signed in, the app creates an anonymous identifier for your device using Google Firebase Authentication. It is a random code. It contains no name, email address or phone number, and it is never linked to Google Analytics.

The identifier is used to record which groups you belong to, as a group membership record: the anonymous identifier, the group, your role in it (member), how you joined (for example by share code), and when. Simply browsing the public example group does not create one.

• Who can see it: only you and the organisers and admins of that group.
• How long it is kept: an anonymous identifier, with all its membership records, is deleted automatically after 90 days without use. If it is deleted, you can rejoin from the group's link at any time. Your sign-up history is unaffected, because sign-ups are recorded against your player name.
• If you later create an account or sign in: your memberships move to your account and the anonymous identifier is deleted.
• On another device or browser, or after clearing your browser data, the app cannot recognise the anonymous identifier. Open the group's link again to rejoin.

Player Accounts (Optional)

Creating a player account is entirely optional — the app works without one. If you choose to register, we store:

• Email address — for authentication and account recovery.
• Display name — as you enter it on registration or update it later.
• Subscribed groups — the groups you have joined using a share code.
• Group membership records — one per group you belong to: your account identifier, your role in that group (member or organiser), how you joined (share code, invitation, join request or assignment by an admin), when you joined, and — if you have linked your account to a player name — that name. Only you and that group's organisers and admins can see them.
• Player identity link — if you link your account to a player name in a group, we store a mapping between your account identifier and that player name. This lets the app confirm your identity when you update your sign-up response.
• Link requests — when you ask to link your account to a player name, a request record is created in that group holding your account identifier, your email address, your display name, the player name you chose, your optional message, and the request status. The group's organisers and admins can read it: the approval panel shows your display name, or your email address if you have not set a display name. The record is kept after the request is approved or rejected, and it is not currently removed automatically when you delete your account — email Atmos.football@gmail.com and we will delete it.
• Name correction requests — if you request a correction to your linked player name (e.g. to fix a typo), we store the request — your account identifier, the current and corrected name, and its status — so the group's organisers can review and apply it. The request is visible to the group's organisers and admins only.
• Notification preferences — which types of push notifications you have enabled or disabled, stored per group.
• Push notification tokens (FCM tokens) — one per device, stored together with the device platform (web or Android) and a last-seen date. These are device identifiers issued by Google Firebase Cloud Messaging and are used solely to deliver notifications to your device. Only your most recently used devices are kept — registrations not seen for around two months are removed automatically — and all tokens are removed when you sign out or delete your account.
• Subscription tier — if you have a paid subscription, your tier level (Free, Fitness, or Pro) and its expiry date are stored in your account record. This determines which features are available to you. Your tier can only be changed by the system after payment confirmation or by an administrator — you cannot change it yourself.
• Achievements — if you have a linked account in a group, season podium finishes (1st/2nd/3rd) and teammate commendations awarded to you are stored in an achievements subcollection on your account. Each entry records the type (season_podium or commendation), the source group, and — for commendations — the player name of the teammate who commended you. These appear on your My Stats tab and on the rating card shown to organisers when you send a join request.

Peer Attribute Ratings (Optional — Group Feature)

If a group organiser enables peer attribute ratings, linked players may rate each other on nine attributes: seven FIFA-style skills (Pace, Shooting, Passing, Dribbling, Defending, Physicality and Goalkeeping) and two sliding scales (Play Style — defensive to attacking — and Elo Accuracy — over-rated to under-rated). This feature is off by default and must be explicitly enabled by the group organiser.

When this feature is enabled:

• What is stored — for each rating you submit, one Firestore document is created under the group (path: groups/{groupId}/peerRatings/{raterUid}_{recipientName}). The document records your Firebase User ID, your player name, the recipient's player name, and the nine attribute scores (0–100 integers). A creation timestamp and a last-updated timestamp are also stored.
• Who can see ratings — aggregate averages (not individual submissions) are displayed to anyone with access to the group, including people viewing with the group's share code who do not have an account. This is the same trust model as the leaderboard and match results. No rater identity is ever shown to the recipient, to other players, or to organisers and administrators — the app displays averages only, and suppresses them entirely until enough people have rated someone. Ratings appear as a radar chart on the recipient's Player Stats profile, in the group's records, and as a team average when a match is analysed.
• Being precise about "who can see" — the app never displays who rated whom. That is a rule of the app, not of the database: the individual rating records are readable by anyone who has the group's link, in the same way that the group's games and Elo ratings already are. If your group needs rating authorship to be technically impossible to retrieve, rather than simply never shown, please contact us — it is a change we can make.
• Who can submit ratings — only players with a linked account in the active group. You cannot rate yourself. Re-rating a player overwrites your previous submission.
• Organiser moderation — the group organiser can clear all ratings received by a specific player (e.g. if abuse is suspected). This removes only the ratings received by that player; it does not affect ratings that player submitted.
• Account deletion — when you delete your account, all peer rating documents where you are the rater are deleted automatically. Rating documents where you were the recipient (rated by others) remain — they reference you by player name rather than by your account ID, and removing them would delete other players' data without their consent.
• No effect on Elo or team generation — peer ratings are strictly informational. They are never used as input to the Elo engine or the team generator.

Minimum Players / Conditional Sign-Up (Optional)

If you have a linked player account you can set a minimum number of players for yourself in My Account: "I'll play, but only if at least this many people are playing, including me." The setting is off unless you choose to use it.

When you use this feature:

• What is stored — your chosen number, held once per group (path: groups/{groupId}/memberPrefs/{yourUserID}). When you sign up with a condition attached, a second record is created against that specific event (path: groups/{groupId}/events/{eventId}/conditionalSignups/{yourUserID}) holding the number, your player name, whether the condition is still waiting or has been met, and the headcount at which it was met.
• Who can see your number — you, and the organisers and administrators of that group. No other player can see it, and it is not visible to someone holding the group's share code. This is enforced by the database rules, not only by what the app chooses to display. Your organiser can see it but cannot change or clear it.
• What other people see — your sign-up response is recorded as Maybe and is indistinguishable from any other Maybe. The sign-up page additionally shows everyone a count of how many people in that event are waiting on numbers — for example "3 pending higher number of participants". That count is visible to anyone who can view the sign-up page, including people who are not signed in. It never identifies anyone and never reveals any individual's number. Note that in a small group the count and the Maybe count together may make it obvious who is waiting; if you would rather avoid that, use the "play regardless" option on the sign-up page.
• Why an organiser can see it — an organiser needs to understand why a player is sitting on a Maybe in order to plan the week's game. This is the only purpose it is used for.
• Retention — the per-event record lives as long as the event it belongs to and is removed with it. Your standing number persists until you clear it, leave the group, or delete your account.
• Account deletion and erasure — both records are deleted when you delete your account or ask to be removed from a group.
• Notification — if you have push notifications enabled, you receive a "You're in" alert when your minimum is reached. It is sent only to you, uses the push token already stored in your account, and can be turned off under My Account → Notification Preferences.
• No effect on ratings — the number is never used as an input to the Elo engine, the team generator, or any statistic.

Team Suggestions (Optional — Group Feature)

If your organiser turns on team submissions, any player who has linked their account to their name can build a line-up in the Team Generator or Game Analysis and send it to the organiser as a suggestion for that week's vote.

• Nothing can be submitted until the organiser opens the window. It is closed by default, and that is enforced in the database's own security rules rather than only in the app, so a closed window cannot be worked around.
• What is stored — one document per player per event (path: groups/{groupId}/events/{eventId}/teamSubmissions/{submissionId}), holding the two team lists, any guest names on them, the team averages and rating gap, a snapshot of the ratings used at the time, whether it came from the Generator or Game Analysis, your player name, your account ID, and the status of the suggestion. If the organiser rejects it they may attach a short note.
• Only you and your organiser can read it. Unlike most group data, a suggestion is not visible to anyone holding the share code and not visible to other players. The database rules allow a read only by a group organiser or administrator, or by the account that submitted it.
• Voters never see who suggested what. When the vote opens, the options on the ballot are anonymous. Only the organiser can see which player each one came from. This is deliberate — it keeps the vote about the teams rather than about who proposed them.
• One suggestion each, and you can change your mind. Sending a new line-up replaces your previous one, and you can withdraw it entirely at any point before the organiser reviews it.
• Deletion — suggestions are deleted with the event they belong to. If your name is corrected the suggestion moves with you, and if you are removed from the group your suggestions are removed too.
• No effect on Elo or your rating. A suggestion is a proposal. Whether it wins the vote or is never used, it changes nothing about your rating or your match record.

Fantasy Premier League (Optional — Group Feature)

If we enable the Fantasy League feature for a group, the app displays that group's Fantasy Premier League classic mini-league table. This feature is off by default and can only be switched on by an Atmos Football administrator — group organisers cannot enable it themselves.

Atmos Football is not affiliated with, endorsed by, or associated with the Premier League or Fantasy Premier League. The data is read from the Premier League's own publicly accessible service, which anyone can view without signing in.

When this feature is enabled:

• What is stored — a single Firestore document per mini-league (path: fplLeagues/{leagueId}), containing, for each manager in that league: their numeric FPL entry ID, their chosen FPL team name, and their rank, gameweek points and total points. A timestamp records when the data was last refreshed.
• A short history of each gameweek is kept alongside the table. So that the app can write summaries like "who won the week" and "how the league is doing this season", each settled gameweek is stored with one compact row per manager: their points, points left on the bench, what that bench actually cost them, any points deducted for extra transfers, how many transfers they made, and their overall rank among all Fantasy Premier League players worldwide. No squad, no footballer, and no name is in these rows — every figure in them is one the Premier League already publishes about that manager, and the mini-league table already stores their gameweek points. This history exists because the table itself only ever holds the current week.
• Real names are removed before storage, by default. The Premier League's service also returns each manager's real name. We strip that out before the table is saved, for every manager who has not been linked to a player in the group. Where a manager has been linked, their name is already recorded in the app by that group's own action, and the table can display it.
• We do not keep the other managers' names. There is a mode that stores every manager's real name rather than only the linked ones. Because the table can now be viewed by anyone holding the group's link, that mode would publish the names of people who are not app users, so it is refused unless a second, explicit confirmation is given at the same time, and it is not used for any group. What the table stores for an unlinked manager is their FPL team name and their points — nothing that identifies them. Whichever mode is used, the table shows FPL team names until a viewer ticks "Show real names".
• Setting up the links involves a brief, private exception. To connect FPL entries to player records, an administrator needs to see which manager is which. When the setup step is run, managers' real names are placed in a separate document (path: fplLinkCandidates/{leagueId}) that only an Atmos Football administrator can read — it is never public, never included in the shared table, and never shown to group members. It is deleted as soon as the links are saved, and can be deleted manually at any time.
• The app suggests matches; a person decides. Names are compared automatically to produce suggestions only — for example, matching a manager whose name is written in lower case to the corresponding player. No link is ever created automatically. An administrator confirms every single one by hand, and there is deliberately no "match everything" option, because a wrong link would attribute one person's fantasy team to somebody else. Where a name is close but not identical, the app makes no suggestion at all rather than guessing.
• Who can see the table — anyone with the group's link. The Fantasy League table is visible to anyone holding the group's share code, whether or not they have an account, on the same basis as the group's games, leaderboard and Elo ratings. It was previously restricted to signed-in members; that restriction was lifted at the group's request, and the safeguard that made it safe to lift is the one described above — the real names of managers who are not linked to a player in the group are not stored at all, so there is nothing about them to expose beyond the FPL team name and points they have already published on the Premier League's own service.
• How the data is refreshed — automatically, twice per gameweek: once after the transfer deadline and once when that gameweek's points are final. The refresh runs on our own hosting, never on your device, and reads only the Premier League's publicly accessible service. An administrator can also run it by hand.
• No effect on Elo or team generation — Fantasy League data is strictly informational. It is never used as input to the Elo engine, the leaderboard, or the team generator.
• Linked players get a Fantasy tab in Player Stats. For a player whose FPL entry has been linked, the app also stores and displays that manager's fantasy season: their overall rank, total and gameweek points, squad value, transfers and any points deducted for them, chips played, the footballers they picked each gameweek (including captain and vice-captain), and their finishing position in previous seasons. This is stored in one document per manager (path: fplEntries/{entryId}) and, like the table, is readable by anyone with the group's link.
  • Only linked entries are ever stored. Being in the mini-league is not enough: no unlinked manager's squad is ever written to our database, and the tab appears only for players who have been linked, all of whom are members of the group.
  • One narrow exception, and it keeps nothing. To work out facts like "the footballer nearly everyone in the league started this week", the refresh does briefly read the squads of mini-league members who are not linked. Those squads are held only in memory on our hosting for the few seconds the refresh takes, are reduced to the league-wide summaries described above, and are never written to the database and never shown as anybody's team. This is a deliberate boundary in the code rather than an incidental one.
  • No real name is stored in it. The document holds the FPL team name and the fantasy data; the person is identified by their Atmos player name, which the group already records.
  • The app also stores a list of Premier League footballers' names, clubs and positions (path: fplBootstrap/{groupId}), used to turn the squad's internal reference numbers into names. This is public reference information about professional footballers, not about app users, and contains no personal data belonging to anyone using Atmos Football.
• The "ghost" table stores a frozen copy of each linked squad. The Ghost view answers "what if nobody had touched their team all season?", which means keeping, for each linked manager only, the fifteen footballers they had at their first deadline of the season, the gameweek that squad was frozen at, and what that unchanged squad has scored each week since (path: fplGhost/{leagueId}). It holds no real name — the manager is identified by their FPL entry ID and FPL team name — and it is readable by anyone with the group's link, on the same basis as the table itself. No unlinked manager has a ghost row, because building one would require storing their squad.
• Season graphs store a per-gameweek line for each linked manager. The Graphs view plots how each linked manager's season has gone, so for each linked manager only the app keeps, per gameweek: their overall rank among all Fantasy Premier League players, their total points, and their team value (path: fplHistory/{leagueId}). Every figure is one the Premier League already publishes, and all three are already part of that manager's Fantasy tab. It holds no real name and no squad — the manager is identified by their FPL entry ID — and it is readable by anyone with the group's link, on the same basis as the table itself. The document is rewritten whole on every refresh, so a manager whose link is removed disappears from it at the next refresh, and no unlinked manager ever has a line.
• Removing a link — if a player's FPL link is removed, or the player is removed from the group, the connection between that FPL entry and the player record is deleted, and the stored fantasy squad data for that entry is deleted with it. It is not kept after the link that justified collecting it has gone. If a player's name is corrected, the link moves with them rather than being left behind under the old name.

Group Discovery (Optional — Organiser-Controlled)

If a group organiser chooses to make their group discoverable, the following information is published in a public listing visible to anyone using the Find a Group feature:

• Group name — as set by the organiser.
• Pitch or venue address — a human-readable location (e.g. street name or venue name) entered by the organiser. Not your home address.
• Pitch or venue GPS coordinates — latitude/longitude used for proximity search. These are stored as a geohash and used only for distance calculations. The exact coordinates are not displayed to searchers — only the resulting distance is shown.
• Typical day and time — the usual day of the week and kick-off time.
• Sport and format — e.g. football 5-a-side, basketball, netball, touch rugby. Atmos Football supports a range of casual sports beyond football.
• Cost per person per game — the typical fee a player pays per session, if the organiser sets it.
• Looking for players — whether the group is actively seeking new members, and optionally a slot count.
• Public description — a short free-text description written by the organiser.
• Active player count and average game size — derived from the last 10 games. No individual player names are included.

Organisers can remove or modify the listing at any time from Admin → Settings → Group Management → Discovery. Removing the listing removes the group from search results immediately.

Find a Group — Location Access (Optional)

When you use the Find a Group feature, you may be asked to share your device location. This is entirely optional — you can browse listings without granting location access, but distance labels ("1.2 km away") and proximity sorting will not be available.

If you grant location access, your coordinates are used in the browser only to calculate distances from group pitch locations. Your location is not sent to our servers and is not stored. Location access is requested only when you explicitly click "Use my location".

If you type an address in the location search box, it is sent to the Nominatim geocoding API (OpenStreetMap) to convert it to coordinates. Your IP address is shared with Nominatim for this request. See the Third-Party Services table for details.

Join Requests (Optional)

If you send a join request to a group via Find a Group, we store:

• Your Firebase User ID and display name — to identify you to the organiser.
• Your optional message — the text you type when submitting the request (up to 280 characters).
• Request status — pending, approved, or rejected. You can see this status on My Account.
• Group name — stored alongside your request so you can identify it on My Account.

Your email address is not shared with the organiser. Only your display name and optional message are visible to them.

When your request is approved, a server-side process automatically adds you to the group. No share code entry is required.

Join request documents are retained until they are superseded by a new request to the same group or your account is deleted.

Public Player Profile (Optional)

You may optionally create a public player profile from My Account → Public Profile. If you choose to do so, the following information may be stored and shared:

• Display name — as you enter it.
• Bio — a short free-text description (optional).
• Position — e.g. goalkeeper, midfielder (optional).
• Availability — typical days you are available (optional).
• Per-group rating visibility — for each group where you have a linked identity, you can choose to make your rank, percentile, and win rate visible to organisers reviewing join requests.

None of this information is shared until you explicitly save it. The profile is stored in a public subcollection (users/{uid}/publicProfile) and can be read by anyone — it is not restricted to signed-in users.

You can delete your public profile at any time by clearing the fields and saving, or by deleting your account.

Fitness and Health Data (Optional)

If you enable the Match Fitness Sync feature and link your account to a player name, we collect fitness data for games you participate in. This data comes from three possible sources:

Android Health Connect: Summary workout data including distance covered (metres), average heart rate (bpm), peak heart rate (bpm), workout duration (seconds), and heart rate recovery (bpm drop at 1 minute post-exercise). We only collect this data when you explicitly initiate a "Sync" for a specific match.

The Android app requests exactly three Health Connect permissions, all read-only: Exercise (workout sessions), Distance, and Heart rate. It requests no other health data types, and it never writes anything back to Health Connect. In particular, it does not request access to your exercise routes, so no GPS or location data is read from Health Connect and Atmos Football has no access to your location history. You can review or revoke these permissions at any time in Android Settings → Health Connect → App permissions.

TCX file import (all platforms): You may import a Training Center XML (TCX) file exported from your fitness device or app (e.g. Fitbit, Garmin Connect). TCX files typically contain 1-second resolution data including timestamps, cumulative distance, heart rate, and GPS coordinates (latitude/longitude). The file is parsed entirely on your device — the file itself is never uploaded to our servers. See "Where Fitness Data Is Stored" below for details on what is retained.

Manual entry: You may manually enter distance, calories, duration, heart rate, and peak heart rate for any game.

We do not track your live location in the background. GPS data reaches the app only through a TCX file that you choose to import. If that file contains recorded location data (latitude/longitude), it is processed locally on your device to calculate sprint velocity, map your route, and verify distance accuracy. GPS coordinates from imported files are stored only on your device and are never sent to our servers.

High-Resolution Fitness Analysis

When you import a TCX file — the only source of second-by-second data, since Health Connect provides summary figures only — the app computes the following analytics locally on your device:

Sprint and intensity detection: Using 1-second velocity data, the app detects sprint and high-intensity running (HIR) events that are invisible in standard 60-second health data. Adaptive speed thresholds are computed relative to your session's average moving speed.

Post-event heart rate recovery: After each sprint or HIR effort, the app analyses your heart rate for up to 60 seconds to find the true peak (heart rate often continues rising 15–40 seconds after an effort ends) and measures your recovery rate. This delayed HR analysis is necessary because standard instantaneous readings underestimate cardiovascular strain.

Mechanical load: The app detects explosive accelerations (> 2.5 m/s²) and hard decelerations (< −3.0 m/s²) from the velocity data. A 3-second smoothing filter is applied first to remove GPS sensor noise. This measures muscular fatigue from changes in speed that total distance alone does not capture.

Aerobic efficiency: The app compares your heart rate relative to your work rate (metres per minute) between the first and last 15 minutes of active play to assess aerobic decoupling — how much harder your heart works to maintain the same pace as you fatigue.

Speed distribution and percentiles: Time spent in each speed band (walk, jog, run, HIR, sprint) and percentile benchmarks (P50, P75, P90, P95, P99, peak) are computed from the full velocity series.

All of these analyses are performed entirely on your device. The raw 1-second data (velocities, GPS coordinates, heart rate timeline, stride data, acceleration series) is stored only in your browser's local database — it is never sent to our servers. Only summary metrics are stored in the cloud (see below).

Where Fitness Data Is Stored

Fitness data is split between two storage locations:

Data	Storage	Who can access
Summary metrics — distance, heart rate averages, peak work rate, HIR count, zone breakdown, sprint seconds, peak speed, aerobic efficiency index, mechanical load count, decoupling percentage	Cloud (Firebase Firestore, EU region)	Only you (authenticated, private subcollection)
Raw high-resolution data — 1-second velocity series, GPS coordinates, heart rate timeline, stride length estimates, acceleration series, individual sprint/HIR event details, recovery curve data	Local device only (IndexedDB in your browser)	Only you, on the device where you imported the data

This separation is by design. Raw high-resolution data stays on your device because it is large (200–400 KB per game) and contains detailed location and biometric information. Summary metrics are stored in the cloud so your averages and trend charts work across devices.

If you clear your browser data or switch devices, the raw high-resolution data is lost — you would need to re-import the TCX file to restore it. Summary metrics in the cloud are unaffected.

Organiser and Admin Data

If you sign in as an organiser or admin, we also store:

• Email address — for authentication and account recovery.
• Google Account ID — if you choose to sign in via Google.
• Firebase User ID — a technical identifier used to track which organiser added or edited a game.
• Assigned groups — the groups you manage, stored in your account record.

Organisers may also create a player account and link themselves to a player name, in which case the Player Accounts section above also applies.

Analytics Data

If you accept the cookie consent banner, we collect usage data through Google Analytics 4 (GA4). This includes which pages you visit, which features you use (including the Blog tab), and whether you installed the app. For signed-in organisers, your Firebase User ID is sent to GA4 to link your sessions together — this only happens when you have accepted analytics cookies.

If you decline cookies, no analytics data is collected.

Error Reporting (Optional — Consent Required)

If you accept the cookie consent banner, the app automatically sends anonymous error reports when it encounters an unexpected crash or problem. This helps identify and fix issues that would otherwise go unnoticed. Error reporting uses the same consent flag as analytics — accepting cookies enables both; declining disables both.

What is sent in an error report:

• The error type and a short description (e.g. "TypeError: Cannot read property")
• A technical stack trace (the sequence of code that led to the error), truncated to 4 KB
• A short breadcrumb trail of recent activity (e.g. tabs visited, whether a game was loaded), with no content data
• App version, platform (web or Android), browser type, and whether the device was online
• The group ID of the active group, if you were in one (not the group name or any player names)
• Your Firebase User ID, if you are signed in (not your email address or display name). If you are not signed in but your device already has an anonymous identifier (see Using the App Without an Account above), that identifier is attached instead. No identifier is ever created just to send an error report.

What is never sent:

• Email addresses, player names, display names, or any personal identifiers
• Any content from your data — no game results, scores, ratings, sign-up responses, or fitness data
• GPS coordinates or location data

Retention: Error reports are retained until an administrator removes them. There is no automatic deletion.

Opt-out: Decline cookies via the cookie banner or click "Reset preferences" on the Privacy page. Clearing your stored cookie preference also stops error reporting until you make a new choice.

User Feedback (Signed-in — No Analytics Consent Required)

Signed-in users may send feedback — bug reports and feature requests — using the "Send feedback" link at the bottom of every page. This feature does not require analytics cookie consent. Submitting feedback counts as implied consent to store the data described below.

What is stored when you submit feedback:

• Your typed message (up to 2,000 characters) and an optional short title
• Your account email address, so the team can follow up
• Your Firebase User ID
• Basic technical context: app version, device type (web or Android), current screen, and group ID

What is never stored:

• The content of your games, ratings, sign-up responses, or any group data
• GPS coordinates or fitness data

Optional technical attachment: On bug reports, you may optionally check "Attach technical details from the last error." This only sends if you have accepted analytics cookies, and attaches the most recent error's stack trace and fingerprint as a separate automated report (same format as the automatic error reporting above).

Who can see feedback: Only site administrators. Feedback is never visible to group organisers, other players, or share-code viewers.

Retention: Feedback is retained until an administrator removes it. You may request deletion by contacting Atmos.football@gmail.com.

Lawful basis: The act of deliberately submitting feedback constitutes implied consent (Article 6(1)(a) UK/EU GDPR). Your email and message are stored solely to investigate the report and respond to you. Text is run through automated PII redaction before storage to remove any incidentally included email addresses or account identifiers.

We do not collect your address, phone number, date of birth, bank account numbers, sort codes, or payment card details.

---

How We Use Your Data

Your data is used to:

• Calculate player ratings (Elo) and display leaderboard standings.
• Generate balanced teams for upcoming games.
• Track match history, group records, and performance statistics.
• Display chemistry and head-to-head comparisons between players.
• Manage weekly sign-ups, team votes, and game scheduling.
• Record results for other recreational sports your group plays (e.g. badminton).
• Confirm your identity when you update your sign-up response (if you have linked your account to a player name).
• Deliver push notifications about game events you have opted into (account holders only).
• Understand how the app is used and guide development decisions (analytics only, with your consent).
• Provide personal fitness insights and workrate metrics (e.g. metres per minute, sprint detection, heart rate recovery, aerobic efficiency) linked to your match history.
• Track personal fitness trends and performance correlations across games.
• Determine which features and ad experience to provide based on your subscription tier.
• Enable groups to be discovered by prospective new players (if the organiser has opted in to the discovery listing).
• Allow prospective players to send join requests and organisers to review and approve them.
• Share your optional public profile (rank, win rate, position, availability) with organisers reviewing your join request.

All processing serves the purpose of running your football group's stats, team generation, weekly organisation, personal fitness tracking, and (where opted into) group discovery.

---

Who Can See Your Data

Your name and match data are visible to anyone who has your group's share code — a private 8-character code distributed by the group organiser. Share codes are not published or searchable. No group data is visible on the internet without the code. This includes your sign-up responses, team votes, match closeness votes, any other-sport session results, your peer attribute rating averages, and your group's Fantasy League table and linked fantasy squads — all visible on the same basis as match results. Team suggestions are the exception — a line-up you send in is readable only by you and your group's organisers, not by other players and not by someone holding the share code.

Group discovery listings — if an organiser opts their group into discovery, the listing (group name, pitch address, typical day/time, format, description, and active player count) is publicly visible to anyone using the Find a Group feature. The listing does not include individual player names, email addresses, or any personal data about group members.

Public player profiles — if you create a public profile, your display name, bio, position, availability, and any per-group rating data you have enabled are visible to anyone — no login required. You control exactly what is shared and can remove or change it at any time.

World Cup sweepstake share page — if your organiser runs a sweepstake and shares its public link, your display name and the team you drew are visible to anyone who has that link — no login required. Nothing else from the group (match data, ratings, contact details) is included on that page. If you would rather not appear, ask your organiser not to enter you in the sweepstake.

Cohorts — if your organiser puts you in a cohort, its name and the names of everyone in it are stored on the group's record. That record can be read without a share code. Treat membership as visible to anyone, and its name as public, even though the app only shows the filter to people viewing the group. Only organisers and admins can change who is in a cohort.

Minimum players (conditional sign-up) — the number you set is visible only to you and to your group's organisers and admins; no other player and no share-code viewer can see it. A count of how many people are waiting on numbers is shown on the sign-up page to anyone who can view it, including visitors who are not signed in — that count never names anyone and never reveals any individual's number.

Group membership records — whether you have an account or an anonymous identifier, your membership record in a group (your role, how you joined, and any linked player name) can be read only by you and that group's organisers and admins. Other players and share-code viewers cannot see who is a member.

Join requests — when you submit a join request to a group, your display name and optional message are visible to the organisers and admins of that group. Your email address is not shared. Your request status is visible only to you and the group's organisers/admins.

Organiser email addresses are visible only to other organisers and admins within the same group.

Payment data — including payment status per game, credit balances, and bank name aliases — is visible only to group organisers and admins. Other players and share-code viewers cannot see payment information, with one exception: if your organiser has set a sign-up debt reminder amount for everyone to see and you owe at least that much, other signed-in members of your group can see on the sign-up page that you owe money and how much. Share-code viewers never see it.

Player account email addresses are not visible to other players. They are visible to site admins, and to a group's organisers and admins in one place only: the link request you send when you ask to link your account to a player name in that group (see Link requests above).

Push notification tokens are stored in your account record and are not visible to organisers or other players.

Fitness Data Privacy: Unlike match results and Elo ratings, your fitness data (distance, heart rate, sprint analysis, recovery metrics, GPS coordinates) is strictly private. Summary metrics are stored in a secured area of the database that only you can access. Raw high-resolution data is stored only on your device and never leaves it. No fitness data — whether summary or raw — is visible to group organisers, admins, other players, or anyone using a group share code.

We do not sell or share your personal data with third parties for marketing purposes.

---

Data Accuracy Disclaimer

The fitness analysis features in Atmos Football depend on the accuracy of data from your tracking device (e.g. Fitbit, Garmin, Apple Watch). Consumer fitness trackers have inherent limitations:

• GPS noise: Position data sampled at 1-second intervals typically has ±0.3–0.5 m/s jitter in velocity readings. The app applies smoothing filters to reduce this, but very short sprints (under 2–3 seconds) may be missed or underestimated.
• Heart rate sensor lag: Optical wrist-based heart rate sensors typically lag 5–15 seconds behind actual exertion. The app's post-event recovery analysis accounts for this by searching for the true heart rate peak up to 60 seconds after an effort ends, but the measured lag reflects both physiological delay and sensor delay combined.
• Indoor and poor-signal environments: GPS accuracy degrades indoors, near tall buildings, and in dense tree cover. Distance and speed readings in these conditions may be unreliable.
• Device variation: Different fitness devices produce different data quality. Chest-strap heart rate monitors are more accurate than wrist sensors. GPS watches are more accurate than phone GPS.

All metrics should be treated as relative indicators across your own games over time, not as absolute physiological measurements. Trends over 5 or more games are significantly more reliable than single-game numbers.

---

Cookies, Analytics, and Advertising

Google Analytics 4

We use GA4 to understand how the app is used — which pages are popular, how many people install the app, and how features are adopted. GA4 is only activated if you accept cookies via the consent banner shown on your first visit.

You can change your cookie preference at any time using the Reset preferences link on the Privacy page.

Google AdSense (Blog Pages Only)

We use Google AdSense to display advertisements on the public blog pages at /blog/. Since September 2026 (v2.10.38) AdSense is no longer loaded anywhere inside the app itself — there are no ads on the leaderboard, the sign-up flow, the stats tabs or any other signed-in screen, and the ad script is not requested on those pages at all. Ad-related cookies are gated behind the consent banner on the blog pages — they are only set if you accept. AdSense is not used on the Android app.

Google AdMob (Android App Only)

The Android app uses Google AdMob to display ads. AdMob is Google's mobile advertising platform and is separate from AdSense. The type and frequency of ads you see depends on your subscription tier:

• Free tier (Tier 1): Banner ads (a small strip at the bottom of the screen), interstitial ads (brief full-screen ads at natural transition points, limited to once per hour), and optional rewarded ads (watch a short video to remove ads temporarily).
• Fitness tier (Tier 2): Banner ads only. No interstitial or rewarded ads.
• Pro tier (Tier 3): No ads of any kind.

AdMob uses a device advertising identifier (Google Advertising ID) and may use it for ad personalisation if you have accepted cookies. If you decline cookies, only non-personalised ads are shown. You can reset or opt out of ad personalisation in your device settings under Google → Ads.

Google's own consent form, and how to change your answer

If you are in the UK, the EEA or Switzerland, Google shows its own consent message when you first open the Android app — before any ad is requested. This is separate from our cookie banner: ours covers analytics, error reporting and ad personalisation within the app; Google's covers what Google and its advertising partners may do.

You can reopen Google's form and change that answer at any time using the "Ad privacy settings" control, which appears in two places in the Android app:

• About → Privacy, next to your cookie preferences (also on the standalone privacy page), and
• Account → Account & sign-in, with your other personal settings.

The control appears only where Google requires it, so you will not see it on the web version or on devices outside the regions where it applies.

Choosing Reset preferences on the About page clears both records together — our cookie choice and Google's stored consent — so the app's banner and Google's form both appear again next time you open the app.

The AdMob SDK is provided by Google LLC. Their privacy policy applies: policies.google.com/privacy.

What Happens When You Decline

If you decline cookies, the app works identically. No analytics are collected, no error reports are sent, only non-personalised ads are shown (web and Android), and no usage data is sent to Google beyond what is strictly necessary.

Declining does not stop the app storing a small amount of information in your browser's own storage, because that never leaves your device. This covers your cookie choice itself and your own display preferences — for example which tab opens by default, which leaderboard columns you have chosen to show, your team-generator and prediction settings for a group, your maximum heart rate if you have entered one, whether you have dismissed a setup prompt, and when a rewarded ad-free period expires. None of this is transmitted to us, and you can clear all of it by clearing your browser data (or the app's storage on Android).

---

Data Storage and Security

All cloud data is stored in Google Firebase (Firestore), located in the EU region (europe-west2, London). Firebase is operated by Google LLC under standard data protection terms, including appropriate safeguards for international data transfers.

Google acts as a data processor on our behalf. Their Data Processing Agreement is part of the Firebase Terms of Service.

High-resolution fitness data (1-second velocity, GPS coordinates, heart rate timeline, acceleration series) is stored locally on your device using IndexedDB — a browser-based database. This data does not leave your device and is not accessible by us or any third party. It persists until you clear your browser data or uninstall the app.

The app uses HTTPS for all connections, and access to group data is controlled by share codes (for viewers) and Firebase Authentication (for organisers). Firestore Security Rules restrict who can read and write data at the database level. Subscription tier fields on your account can only be modified by the system after payment confirmation — they cannot be changed by any client-side code.

---

How Long We Keep Your Data

• Match results are retained indefinitely as part of the group's historical record. This is necessary for accurate ratings and statistics. Deleting your account does not remove them — you can instead ask us to replace your name with an anonymous placeholder (see "How Erasure Works — Match Records").
• Weekly sign-up responses are kept with the event they belong to (see the next line), unless the organiser clears them sooner.
• Link requests (including your email address) are kept after the request is resolved. They are not yet removed automatically when you delete your account; email us and we will delete them.
• Event sign-ups, team votes, and payment records are tied to individual game events and are retained for the life of that event.
• Team suggestions are tied to the event they were sent for and are deleted with it. You can withdraw or replace your own at any point before the organiser reviews it.
• Match closeness votes are attached to the game they relate to and are retained for as long as that game record exists.
• Other-sport session results (e.g. badminton rounds) are retained indefinitely as part of the group's historical record, the same as football results.
• Season archives (sealed final standings, including podium names) are retained indefinitely as part of the group's historical record.
• New group requests are retained until the request is resolved and reviewed, or until the requesting user's account is deleted, whichever comes first.
• Organiser invitations are retained until an administrator removes them.
• Organiser accounts are retained for as long as the account is active.
• Player accounts (email, display name, subscribed groups, group membership records, notification preferences, push notification tokens, subscription tier, and player identity links) are retained for as long as the account is active. When you delete your account, all of this data is permanently deleted immediately.
• Anonymous identifiers and their group membership records are deleted automatically after 90 days without use, or straight away when the identifier is merged into an account you sign in to.
• Group discovery listings are retained for as long as the organiser keeps the group opted into discovery. Organisers can remove the listing at any time.
• Join requests are retained until superseded by a new request to the same group or until the requesting user's account is deleted.
• Public player profiles are retained until the user clears and saves the profile, or deletes their account.
• Achievements (season podiums and teammate commendations) are retained for as long as the recipient's player account is active. They are deleted permanently and immediately when the account is deleted.
• Peer attribute ratings you have submitted are retained for as long as your player account is active. They are deleted permanently and immediately when you delete your account. Peer ratings submitted by others about you (where you are the recipient) are retained as part of the group's data and are not removed by your account deletion.
• Fantasy Premier League tables are a short-lived cache of information that is already public on the Premier League's own service. Each refresh replaces the previous copy. The data is never merged into player records or match history, and is readable by anyone holding the group's share code. Real names are removed before storage for anyone not linked to a player in the group. The cached table is deleted if the feature is switched off for that group.
• Fantasy squad data is stored only for managers an administrator has explicitly linked to a player, is readable by anyone holding that group's share code, and is deleted as soon as the link is removed or the player leaves the group. This includes the frozen "ghost" copy of a linked squad, which is deleted with it.
• Fantasy gameweek history (the per-manager points, bench, transfer and overall-rank rows behind the gameweek and season summaries) is retained for the season it describes and is deleted with the mini-league cache if the feature is switched off for that group. It contains no squad and no name.
• Fantasy season graph data (each linked manager's per-gameweek overall rank, total points and team value) is replaced whole on every refresh, so it holds only managers who are linked at that moment. It contains no squad and no name.
• Analytics data is subject to Google Analytics' own retention settings (currently 14 months).
• Fitness summary data (cloud): Fitness records stored in Firebase are retained for as long as your player account is active. Because this data is personal and private, it is deleted permanently and immediately if you delete your account or choose "Delete all fitness data" in app settings. It is not anonymised or retained as part of the group's historical record.
• Fitness raw data (local): High-resolution data stored in your browser's IndexedDB is retained until you clear your browser data, uninstall the app, or delete it from within the app. We have no ability to access or delete this data remotely — it exists only on your device.

---

Your Rights

Under UK data protection law (UK GDPR / Data Protection Act 2018) and EU GDPR, you have the right to:

• Access — request a copy of the personal data we hold about you.
• Rectification — ask us to correct inaccurate data, such as a misspelled name. Name corrections can also be handled directly in the app: organisers can correct a player's name from the Players tab, and linked players can request a correction from My Account — either route updates all records at once.
• Erasure — ask us to remove your personal data from the app. Account data can be deleted by you in the app; your name in a group's match history is anonymised by us on request (see below).
• Object — object to the processing of your data on legitimate interest grounds.
• Portability — request your data in a machine-readable format (e.g. JSON).

To exercise any of these rights, email Atmos.football@gmail.com with your name and the group you belong to. We will acknowledge your request within 72 hours and complete it within 30 days.

Erasure works along two separate tracks, and it is important to understand the difference:

• Your account data — deleted by you, instantly, from within the app. See "Player Accounts" below.
• Your name in the group's match records — handled by us on request by email. This is deliberately not part of the in-app delete button. See "Match Records" below.

How Erasure Works — Match Records

Match records cannot simply be deleted. Every result contains the line-ups for both teams, and the group's Elo ratings, chemistry figures, and head-to-head records for every other player are calculated from those line-ups. Removing a player's games outright would silently corrupt the statistics of everyone they ever played with or against.

So instead of deleting, we anonymise. If you want your personal information taken out of a group's records, email Atmos.football@gmail.com and we will replace your name with a numbered placeholder (e.g. "Removed Player #1", "Removed Player #2") everywhere it appears. Your results stay in the group's history, but nothing in them identifies you. If you would prefer a different placeholder, say so in your email and we can use one.

This is a manual process handled by the site administrator, because it rewrites shared group data rather than your own account and cannot be undone once done.

When a player is anonymised, their name is replaced with that identifier across all game records. This preserves the integrity of the group's statistics — win/loss records, Elo calculations, and chemistry data for the remaining players stay correct — without retaining any personal data about the removed player. The replacement is permanent and cannot be reversed.

The same replacement is applied to the other places your name appears in the group: sign-up responses, team votes, team suggestions, payment records, match closeness votes, peer attribute ratings, sealed season standings, and the stored ratings snapshot. Any associated data (tier assignments, active player list entries, cohort membership, sign-up debt reminder exemptions) is also cleared.

Records of sessions in other sports (e.g. badminton rounds) are not covered by the automated tool and are handled manually as part of the same request — tell us if your group has used that feature so we can include them.

How Erasure Works — Player Accounts

If you have a player account, you can delete it yourself at any time from My Account → Delete account. Deleting your account immediately and permanently:

• Deletes your account record (email, display name, subscribed groups, notification preferences, push notification tokens, subscription tier).
• Removes your player identity link from any groups, releasing the linked player name for others.
• Deletes your group membership records. If you are the owner of a group, that membership is kept until an administrator hands the group to someone else.
• Deregisters all push notification tokens so you stop receiving notifications.
• Permanently deletes all your synced fitness data from the cloud (if you have used Match Fitness Sync).
• Deletes your public player profile (if you created one).
• Deletes any outstanding join requests you have submitted.
• Deletes any outstanding request you have made for a new group to be created.
• Deletes any achievements (season podiums and teammate commendations) recorded against your account.
• Deletes all peer attribute rating documents you submitted as a rater across every group you belong to. Ratings submitted by others about you (where you were the recipient) are not deleted — they reference your player name, not your account ID, and removing them would delete other players' data without their consent.
• Deletes your Firebase Authentication account.

High-resolution fitness data stored locally on your device (IndexedDB) is not affected by account deletion — it exists only in your browser and can be removed by clearing your browser data.

What account deletion deliberately does not do: it does not touch your match history (results entered by your organiser). Those records stay in the group's statistics under your player name, because deleting them would break the ratings and chemistry figures of everyone you played with — see "Match Records" above for why.

Deleting your account is instant and self-service precisely because it only affects data that is yours alone. If you want your name removed from the match history as well, email Atmos.football@gmail.com. The two are independent — you can do either without the other, in any order.

Data Removal for Organisers

Group organisers can request removal of any player from their group's records by emailing Atmos.football@gmail.com. Organisers are responsible for ensuring they have a reasonable basis for adding a player's results to the app in the first place.

---

Lawful Basis

Data	Lawful Basis
Player match data (name, results, sign-up responses, team votes, match closeness votes, other-sport session results)	Legitimate interest (Article 6(1)(f)) — operating a recreational leaderboard and team generator. Players in a casual group reasonably expect their results and their organising responses to be tracked as part of the group's activity.
Team suggestions (proposed line-ups, submitter name and account ID)	Legitimate interest (Article 6(1)(f)) — letting players take part in how the sides are picked. Submitted voluntarily, only while the organiser has the window open, readable only by the submitter and the group's organisers, and deleted with the event.
New group requests (account identifier, email, display name, proposed group and organiser name, description)	Consent (Article 6(1)(a)) — you submit the request voluntarily so that a group can be created for you. Deleted if you delete your account.
Organiser invitations (invited email address, group, role)	Legitimate interest (Article 6(1)(f)) — necessary to grant an agreed organiser the correct access to the group they will run.
Season archives (final standings and podium player names)	Legitimate interest (Article 6(1)(f)) — preserving the group's own competitive record, the same basis as match results.
Player accounts (email, display name, subscribed groups, notification preferences, push tokens, identity links, link requests)	Consent (Article 6(1)(a)) — creating an account is entirely voluntary. By registering, you consent to storage and use of this data to deliver account features. You may withdraw consent at any time by deleting your account.
Subscription tier and expiry	Consent (Article 6(1)(a)) — stored as part of your player account to deliver the features included in your subscription.
Organiser accounts (email, Firebase UID, assigned groups)	Legitimate interest (Article 6(1)(f)) — necessary to authenticate organisers and track who made changes to group data.
Analytics and advertising cookies (web)	Consent (Article 6(1)(a)) — managed by the cookie consent banner.
Automated error reports (crash type, stack trace, breadcrumbs, group ID, Firebase UID)	Consent (Article 6(1)(a)) — gated behind the same cookie consent banner as analytics. Only collected if you accept.
User feedback (message, title, email, Firebase UID, technical context)	Consent (Article 6(1)(a)) — implied by the deliberate act of submitting. Requires sign-in; no analytics cookie needed.
AdMob ads and advertising identifier (Android)	Consent (Article 6(1)(a)) — personalised ads require cookie consent. Non-personalised ads are shown without consent.
Payment data (payment status, bank name aliases, credit balances)	Legitimate interest (Article 6(1)(f)) — necessary for organisers to manage group finances. Payment tracking is a natural extension of organising a recurring sports group and replaces informal manual record-keeping.
Fitness summary metrics (distance, average and peak heart rate, peak work rate, HIR effort count, Zone 5 time, full zone breakdown, sprint seconds, HIR seconds, peak speed, aerobic efficiency index, mechanical load count, aerobic decoupling percentage, heart rate recovery drop, work:rest ratio, speed percentiles)	Explicit Consent (Article 9(2)(a)) — health data is special category data under GDPR. You must explicitly opt in to fitness tracking in account settings, separate from OS-level permissions. You can withdraw consent at any time by disabling the feature or deleting your data.
High-resolution velocity data (1-second speed, distance, heart rate)	Explicit Consent (Article 9(2)(a)) — processed locally on your device to detect sprints and high-intensity events that are invisible in standard 60-second health data. Stored on-device only (IndexedDB).
GPS coordinates (latitude/longitude, from an imported TCX file only)	Explicit Consent (Article 9(2)(a)) — processed locally on your device to calculate velocity, verify distance accuracy, and optionally map your route. Stored on-device only. Never sent to our servers. No location data is read from Health Connect.
Post-event heart rate recovery data	Explicit Consent (Article 9(2)(a)) — the app analyses heart rate for up to 60 seconds after each sprint or high-intensity effort to measure true peak HR and recovery rate. This delayed analysis is necessary because heart rate sensors lag behind actual exertion and standard instantaneous readings underestimate cardiovascular strain. Summary metrics (average recovery drop, average HR lag) are stored in the cloud; raw per-second HR data remains on-device only.
Group discovery listing (group name, pitch address, GPS coordinates, format, description)	Legitimate interest (Article 6(1)(f)) — organiser-controlled opt-in to make the group findable by prospective players. No personal data about individual players is published. Organisers can remove the listing at any time.
Join request data (display name, message, request status)	Legitimate interest (Article 6(1)(f)) — necessary to allow prospective players to contact a group organiser and for organisers to manage admission. The requesting player's email is not shared with the organiser.
Public player profile (display name, bio, position, availability, per-group rating visibility)	Consent (Article 6(1)(a)) — entirely optional. Nothing is published until you explicitly save your profile. You can remove it at any time.
Achievements (season podium finishes, teammate commendations)	Legitimate interest (Article 6(1)(f)) — recognising recreational sporting achievements within the player's own group context. Achievements only attach to accounts that have voluntarily linked themselves to a player name; recipients can remove all achievements by deleting their account.
Peer attribute ratings (rater UID, player names, attribute scores)	Legitimate interest (Article 6(1)(f)) — supplementary skill profiling within a closed football group, opted into by the organiser and by each individual rater. Off by default; only available to groups at tier 4 or above. Raters' submitted documents are deleted on account deletion.
Device location (Find a Group proximity search)	Consent (Article 6(1)(a)) — requested only when you explicitly click "Use my location". Used in the browser only to calculate distances; not sent to our servers or stored.

---

Third-Party Services

We use the following third-party services, each of which acts as a data processor:

Service	Provider	Purpose	Data Shared
Firebase / Firestore	Google LLC	App data storage and authentication	Player names, match data, organiser emails, player account data, fitness summary metrics
Firebase Cloud Messaging	Google LLC	Push notifications (account holders only)	Push notification device tokens (FCM tokens)
Google Analytics 4	Google LLC	Usage analytics (consent required)	Page views, feature usage, Firebase UID (organisers only)
Google AdSense	Google LLC	Advertising on the public blog pages only — not inside the app (consent required)	Ad interaction data via cookies
Google AdMob	Google LLC	Advertising on the Android app	Device advertising identifier (Google Advertising ID); personalisation requires consent
Android Health Connect	Google LLC	Reading fitness data (Android)	Read-only access to exactly three data types from the on-device health store: ExerciseSession (workout duration and type), Distance (metres covered), and HeartRate (average and peak bpm). No exercise route/GPS access is requested, and nothing is written back.
OpenStreetMap tile servers	OpenStreetMap Foundation	Map tile rendering for the GPS heat map (street view)	Your IP address is sent to OSM tile servers when you open the heat map. No personal account data is shared. Tiles are © OpenStreetMap contributors (ODbL).
Esri World Imagery tile servers	Esri	Map tile rendering for the GPS heat map (satellite view)	Your IP address is sent to Esri tile servers when you select satellite view. No personal account data is shared. Tiles © Esri, Maxar, Earthstar Geographics.
Open-Meteo API	open-meteo.com	Game-day weather forecast on the sign-up screen	Your IP address is used to fetch forecasts. No account data is shared. Weather data is provided under CC BY 4.0; see open-meteo.com.
football-data.org	football-data.org	Fetching public tournament fixtures and results for the World Cup sweepstake	Nothing. Requests are made by our server on a schedule, never by your device, and contain no user or group data.
Nominatim (OpenStreetMap)	OpenStreetMap Foundation	Address-to-GPS geocoding in Find a Group setup	When an organiser or user types an address and clicks "Set GPS from address", that address string and your IP address are sent to the public Nominatim API to convert the address to GPS coordinates. No account data is shared. Usage is subject to the Nominatim usage policy.

No data is shared with any other third parties.

---

Children's Data

Atmos Football is not directed at children under 13. We do not knowingly collect personal data from children. If you believe a child's data has been added to the app, contact us and we will remove it.

---

Changes to This Notice

We may update this notice from time to time. The "Last updated" date at the top will always reflect the most recent revision. Significant changes will be noted in the app's Change Log.

---

Contact

For any questions about your data, this privacy notice, or to exercise your data rights:

Email: Atmos.football@gmail.com

---

Home · Blog · About · Contact · Privacy