ClubTuck Privacy Policy

1. Information We Collect

1.1 Data You Provide

When you use ClubTuck, you may provide:

• Account Details: Email address, used to create an account and sign in (via Firebase Authentication)
• Product Information: Product names, prices, stock quantities, categories
• Member / Player Data: Names, balance information, transaction history
• Sales Records: Assignment details, payment status, transaction amounts
• Organization Settings: Club/business name, currency preferences, operational settings

1.2 Automatically Collected Data

Data Type	Purpose	Storage Location
Device Information	App optimization and sync identification	Local device only
Sync Metadata	Multi-device synchronization	Firebase Cloud Firestore
Error Logs	Bug fixes and stability	Local device only

1.3 Device Permissions

ClubTuck requests the following device permissions, each used only for the stated purpose:

• Camera: To scan product barcodes. Camera images are processed on your device and are not stored or transmitted.
• Location (Android): Required by our payment provider, Stripe, to enable in-person “Tap to Pay” card payments — the payment card networks mandate location access for in-person payments. Location is used only in connection with payment processing; ClubTuck does not track, log, or store your location.
• NFC (Android): To read contactless cards during in-person “Tap to Pay” payments.
• Biometrics (Face ID / Touch ID / Fingerprint): To secure sign-in. Biometric data is handled entirely by your device's operating system and is never transmitted to us or any third party.

2. How We Use Your Information

2.1 Primary Purposes

• Core Functionality: Provide point-of-sale operations, inventory management, and sales tracking
• Data Synchronization: Enable multi-device access to your business data
• Payment Processing: Facilitate secure payments, including in-person “Tap to Pay” card payments, through Stripe
• Offline Operations: Ensure app functionality without internet connectivity

2.2 Data Processing Principles

3. Data Storage and Security

3.1 Local Storage

• Primary Storage: Most business data is stored locally on your device in an app-private database, isolated by your device's operating-system sandbox.
• Sensitive Credentials: Credentials used for biometric sign-in are stored in your device's secure keystore (iOS Keychain / Android Keystore).
• Access Control: Access is protected by your device-level security (passcode, Face ID, or fingerprint).

3.2 Cloud Storage (Firebase)

• Purpose: Multi-device synchronization and backup
• Security: Data is transmitted over HTTPS (encrypted in transit) and stored encrypted at rest by Google Firebase
• Access: Firebase security rules restrict access to your organization's data only
• Location: Data stored in Google Cloud Platform data centers

3.3 Payment Data Security

• Payment Processing: All payment data is handled by Stripe's secure infrastructure
• In-Person Payments (Tap to Pay): On supported devices, ClubTuck can accept contactless card payments in person using the device's NFC reader. Card details are encrypted and processed by Stripe; ClubTuck never receives or stores card numbers.
• Transaction Records: Only transaction identifiers and status are stored in ClubTuck
• No Card Storage: Card numbers are never stored on your device or in the cloud

4. Data Sharing and Third Parties

4.1 Service Providers

• Firebase (Google): Authentication, cloud storage and synchronization
  • Purpose: Account sign-in and multi-device data sync
  • Data: Account email, business records, sync metadata
  • Privacy Policy: https://policies.google.com/privacy
• Stripe: Payment processing
  • Purpose: Secure in-person and online card payments
  • Data: Payment card and transaction information during a payment only
  • Privacy Policy: https://stripe.com/privacy

4.2 No Data Sales

5. Your Privacy Rights

5.1 Data Control

• Full Control: You maintain complete control over your business data
• Local Access: Access all data directly on your device, even offline
• Export Capability: Export your data in standard formats (CSV, JSON)
• Deletion Rights: Delete individual records or all data at any time

5.2 Account Management

• Data Portability: Request a copy of all your data
• Account Deletion: Request complete account and data deletion by emailing us
• Sync Control: Enable/disable cloud synchronization at any time

6. Data Retention

6.1 Retention Periods

• Business Data: Retained until you choose to delete it
• Transaction Records: Retained for up to 7 years for tax/accounting purposes
• Sync Metadata: Retained for 30 days after last device sync
• Error Logs: Automatically deleted after 30 days

6.2 Deletion Process

7. International Data Transfers

If you use ClubTuck outside your home country:

• Cross-Border Sync: Data may be transmitted between countries for multi-device access
• Cloud Storage: Firebase data centers are located globally, with appropriate safeguards
• Legal Compliance: All transfers comply with UK GDPR, EU GDPR, and applicable local privacy laws

8. Children's Privacy

ClubTuck is designed for club and business use and is not intended for children under 13. We do not knowingly collect personal information from children under 13.

9. Changes to This Policy

• Updates: We may update this policy to reflect changes in our practices or legal requirements
• Notification: Material changes will be communicated through the app or by email
• Continued Use: Continued use of ClubTuck after changes constitutes acceptance

10. Legal Basis for Processing (UK & EU GDPR)

For users in the United Kingdom and European Union, our legal basis for processing your data:

• Contractual Necessity: To provide the ClubTuck services you've requested
• Legitimate Interests: To improve app performance and security
• Legal Obligation: To retain transaction records where required by law