VolleyVis — Privacy Policy
Last updated: 21st of September 2026 Version: 1.0
1. Who we are
VolleyVis (the "Service") is operated by Boddy.dev Ltd ("we", "us", "our"), a private limited company registered in England and Wales. We are the data controller for the personal data described in this policy, except where we act as a processor on your behalf (see section 4).
- Company number: 17305692
- Registered office: The Poplars Bevis Lane, Wisbech St. Mary, Wisbech, England, PE13 4RR
- Data protection contact: contact@boddy.dev
- ICO registration number: ZC254378
This policy explains what personal data we collect, why, who we share it with, how long we keep it, and your rights. It should be read with our Terms and Conditions, which include a Data Processing Addendum (Annex A).
2. Scope
This policy applies to the VolleyVis web application and related pages. It does not cover third-party services we link to or embed (such as YouTube), which have their own privacy policies.
3. The personal data we collect
3.1 Data you give us when you create and use an account
| Data | Where it comes from |
|---|---|
| Your name (display name) | You provide it at signup |
| Your email address | You provide it at signup |
| Your password | You set it; stored only in hashed form by our authentication provider — we never see it in plain text |
| Account/profile data | Your subscription tier and settings |
3.2 Content you create in the Service
Team sheets, player names, squad numbers and playing positions, match titles, dates, locations, VolleyScript match notation, computed statistics, free-text notes, and any YouTube video URL you add to a match. See section 4 for how we treat personal data about other people that you enter.
3.3 Billing data (only if you subscribe to a paid plan)
If and when paid plans are enabled, our payment provider Stripe processes your payment. Your card details are entered directly with Stripe and are never received or stored by us. We store only your Stripe customer/subscription identifiers and subscription status.
3.4 Support data
If you submit a bug report in the app, we send the report — your description, the page you were on, any screenshots you attach and, only if you leave the "include my email" box ticked, your email address — to our issue-tracking provider (Linear) so we can respond. Please crop out other people's personal data from screenshots.
3.5 Technical data
We use a strictly-necessary session cookie to keep you logged in. We do not use analytics, advertising, or tracking cookies, and we do not run third-party tracking scripts. See section 9.
We record the date you accepted these terms and the Privacy Policy (and which version), and the date your account was last used (refreshed at most once a day) so we can apply the retention policy in section 10.
When you choose a password, we check it against the Have I Been Pwned breached-password list. Only the first five characters of a one-way hash of the password are sent; the password itself never leaves our servers and cannot be reconstructed from what is sent.
Our sign-in and sign-up forms are protected by Cloudflare Turnstile, which processes your IP address and browser signals to tell people from bots.
We do not knowingly collect special-category data (such as health or injury information). Please do not enter it into free-text fields.
4. Data about players and other individuals — our role
The Service lets you record personal data about individuals who are not users of VolleyVis — players (including opponents and, potentially, children), identified by name, number and performance statistics.
For that data:
- You (the account holder, coach or club) are the data controller — you decide to record it and are responsible for having a lawful basis and any required consent or privacy notice (for children, from a parent/guardian).
- We act only as your data processor, storing and processing that data on your instructions under the Data Processing Addendum in our Terms (Annex A).
If you are a player, parent or guardian with questions about how your (or your child's) data is used, please contact the coach or club that entered it; we will help route requests to them where we can (see section 8).
5. Why we use your data and our lawful bases
| Purpose | Personal data | Lawful basis (UK GDPR) |
|---|---|---|
| Create and operate your account; provide the Service | Name, email, content | Contract (Art. 6(1)(b)) |
| Authenticate you and keep the Service secure | Email, session, login data | Legitimate interests (Art. 6(1)(f)) — securing our Service |
| Process payments and manage subscriptions | Email, billing identifiers | Contract; legal obligation for tax/accounting records |
| Respond to your support/bug reports | Email, report content, screenshots | Legitimate interests — supporting our users |
| Maintain, troubleshoot and improve the Service | Content, technical data | Legitimate interests — running and improving the Service |
| Comply with legal obligations | As required | Legal obligation (Art. 6(1)(c)) |
Where we rely on legitimate interests, we have balanced them against your rights; you may object at any time (section 8).
We do not use your data for advertising and we do not sell it.
6. Who we share your data with
We share personal data only with service providers who help us run VolleyVis, and only as needed. Our current providers (sub-processors) are:
| Provider | Purpose | Data shared |
|---|---|---|
| Supabase | Database, authentication and hosting | Account and content data |
| Vercel | Application hosting | Data processed in transit |
| Stripe | Payments (when paid plans are enabled) | Email, billing identifiers; card data goes directly to Stripe |
| Linear | Handling bug reports you submit | Report text, screenshots, and your email if you opt in |
| Resend | Sending account emails (confirmation, password reset, inactivity warnings) | Email address, name |
| Cloudflare (Turnstile) | Bot protection on sign-in, sign-up and sensitive account forms | IP address, browser signals |
| Have I Been Pwned (Pwned Passwords API) | Checking new passwords against known breaches | First five characters of a hash of the password — never the password or your identity |
| YouTube / Google | Displaying match video you embed | Loaded in your browser when you open a match video; we use the privacy-enhanced youtube-nocookie mode |
We may also disclose data where required by law, to enforce our Terms, to protect our rights or the safety of others, or in connection with a business sale or reorganisation (subject to this policy).
7. International transfers
Some providers process data outside the UK (for example Stripe in the United States). Where that happens, we ensure an appropriate safeguard is in place — such as a UK "adequacy"/data-bridge decision, or the UK International Data Transfer Agreement / Addendum to the EU Standard Contractual Clauses.
8. Your rights
Under UK data-protection law you have the right to:
- access the personal data we hold about you;
- request rectification of inaccurate data (you can edit most of your content directly in the app);
- request erasure of your data ("right to be forgotten");
- restrict or object to certain processing (including processing based on legitimate interests);
- data portability — receive your data in a machine-readable format; and
- withdraw consent where we rely on it (this does not affect prior processing).
Self-service. Signed in, go to Settings:
- Download my data gives you a machine-readable (JSON) copy of everything in your account — profile, team sheets and players, matches (including the VolleyScript source), notes and billing identifiers (data portability).
- Delete my account permanently deletes your account and everything in it, cancels any subscription and removes your customer record from Stripe, and clears the data cached on the device you are using (erasure). Deletion is immediate; we keep only a pseudonymous log entry (an internal account ID and the date) as evidence that the deletion happened.
- You can edit your name, password and all of your content directly.
For anything else — or if you cannot log in — contact contact@boddy.dev. We will respond within one month. There is normally no charge.
After deletion, copies may persist for a limited time in encrypted backups (section 10), in Stripe's records where it must keep them for financial regulation, and in any bug report you sent us that included your email (tell us and we will remove it).
If we process data about you as a processor (for example, you are a player whose stats a coach recorded), we will refer your request to the relevant coach or club (the controller) and assist them in responding.
You also have the right to complain to the Information Commissioner's Office (ICO) — https://ico.org.uk — though we'd appreciate the chance to help first.
9. Cookies
We use a single category of cookie: a strictly-necessary session cookie set by our authentication provider to keep you signed in. Because it is essential to provide the Service you have requested, it does not require consent.
We do not use analytics, performance, advertising or tracking cookies, and we
do not embed third-party tracking scripts. Fonts are self-hosted, so no data is
sent to font providers. When you open a match with an embedded video, YouTube is
loaded in privacy-enhanced (youtube-nocookie) mode.
If we introduce any non-essential cookies or tracking in future, we will update this policy and ask for your consent first.
10. How long we keep your data
We keep your account and content data for as long as your account is active.
Inactive accounts. If you have not used VolleyVis for 18 months we email you a warning. If the account is still unused at 24 months, and at least 30 days have passed since the warning, we delete the account and everything in it automatically. Logging in at any point resets the clock. We never delete an account without having sent a warning first.
We keep billing and tax records for as long as the law requires (generally 6 years). Backups are retained for 6 months and then overwritten, so deleted data leaves our backups within that period.
11. How we protect your data
We use appropriate technical and organisational measures, including row-level access controls so each account can only access its own data, encryption in transit (HTTPS/TLS), hashed passwords managed by our authentication provider (minimum 10 characters, screened against known breaches), bot protection on sign-in, and restricted access to production systems. No system is completely secure; please use a strong, unique password.
If you use the app on a shared device, be aware that some data is cached locally in your browser to support offline use. Logging out clears that cache, and the app also clears it automatically if a different account signs in on the same browser. Always log out on shared or public devices.
12. Children
VolleyVis is intended for coaches, analysts and team staff aged 16 or over, and is not directed at children as users. However, coaches may record data about players who are children. Where that happens, the coach or club is the controller and is responsible for the appropriate lawful basis and parental consent (see section 4 and our Terms). If you believe a child's data has been recorded unlawfully, contact us at contact@boddy.dev.
13. Changes to this policy
We may update this policy from time to time. We will post the new version with an updated "Last updated" date and, for material changes, take reasonable steps to notify you.
14. Contact us
Questions or requests about this policy or your data:
contact@boddy.dev Boddy.dev Ltd, The Poplars Bevis Lane, Wisbech St. Mary, Wisbech, England, PE13 4RR, company no. 17305692 ICO registration: ZC254378