How long we keep data
This page is a draft, written from the code and server configuration on 14 October 2026. It has not been reviewed by a lawyer yet and is not ready to sign. It describes what Clubkit actually does today; open gaps are marked open.
Annex 3 to the data processing agreement: when data is deleted or anonymised. In short: two years after a member leaves, or earlier on request.
Principle
A member's data is deleted or anonymised two years after they leave, or earlier on request.
"Leaving" in Clubkit means the membership is set to inactive (by club admins or, for children, by a guardian through "Leave the club").
Open: automatic anonymisation two years after leaving is not built yet. Until then, club admins or the Provider carry it out on request. Planned: a daily server job that anonymises inactive memberships once the period has passed, as described under "Deleting an account".
Deleting an account (on the person's request)
Anyone can delete their own account in the app (confirmed with their password). In one step:
- Fan memberships (following a club) are deleted.
- All other memberships are anonymised: the name is replaced by "Deleted member", the membership becomes inactive, and every personal field is cleared: phone, date of birth, emergency contact, medical notes, email, invite email, profile photo and membership photo (the image files are deleted), website listing off, extra permissions and coach assignments removed.
- Kept (without reference to the person): the anonymised membership with its club history (replies, attendance, line-ups, match events, squad places) and the club's fee records (without staff notes). Reason: the club's match reports and statistics stay consistent.
- Deleted: own availability entries with notes, waiting-list entries, invitations sent to the person, the user account with sessions, login data, devices (push tokens) and notification settings.
- Invitations the person sent stay valid, without reference to them.
- Club owners can only delete their account after transferring ownership.
Deleting an account also removes the nationality and clears the playing positions.
Members without an account
Club admins can fully delete members who have no account of their own (roster-only).
Open: for members with an account, club admins can today only set them inactive, not anonymise them. Until that exists, the Provider carries out deletion requests made to the club.
Exporting data
Anyone can export their own data as a file in the app (account, memberships, replies, attendance, availability, invitations, teams, line-ups, fees, devices, notification settings). Password hashes, session tokens and push tokens are not included.
Children and young people
- Until handover, guardians manage their child's profile and consents (e.g. for photos).
- From the handover age set by the club (between 12 and 17, default 14) the child can take over their own account. Guardians can still see, but no longer change.
- If a young person under 18 deletes their account, the membership is not anonymised: it goes back to the guardians, who manage it again. Consents, photo and history stay. Leaving the club is a separate step for the guardians.
- At 18 all guardian links end automatically (daily server job); guardians get an email. If the person has no account of their own by then, all consents are set to "no" until they decide themselves.
- At 17½ Clubkit reminds the guardians once by email about the handover.
- Leaving the club by a guardian: the membership becomes inactive and the guardian links end. The two-year period starts then.
- Under-18s cannot be given extra permissions (e.g. media or admissions); the server rejects it (from round 05).
Consents
Consents (internal, club website, Facebook, Instagram, press) are stored as a history: each decision with its time and the person who made it. Withdrawal takes effect immediately for the future (e.g. the person disappears from the squad on the website). The history is kept as evidence.
Other periods
| Data | Period today |
|---|---|
| Email and push dispatch log (queue) | 30 days after sending or final failure |
| Push tokens | deleted as soon as Apple/Google report the device as unregistered, and with the account |
| Events, replies, matches on the devices of members, guardians and fans | last 12 months only; older ones are removed from devices (they stay on the server for club admins and coaches) |
| Local data on the device | deleted on sign-out |
| Withdrawn join requests | deleted immediately |
| Backups | 30 days; deleted data may remain in backups until then |
| A club's data after the contract ends | see DPA clause 11 |
Open:
- Decided (accepted or declined) join requests are not deleted automatically.
- Expired sessions (with IP address and device identifier) are not cleaned up automatically (check).
- No retention period is set for server logs.
- Whether fee records must be kept longer for tax or association-law reasons is the club's decision.