Privacy Policy

SquadLock (“we”, “us”, “our”) operates the SquadLock website at squadlock.app and the SquadLock mobile application. This policy explains what personal data we collect, how we use it, and the rights you have over it.

For the purposes of UK data protection law (the UK GDPR and the Data Protection Act 2018), the data controller is RM Technologies Services Ltd, 101 Devonshire House, Aviary Court, RG24 8PE, Basingstoke, UK. You can reach us about any privacy matter at the contact details in section 11.

1. Information We Collect

On the website

• • Waitlist signups — the email address you submit to join the waitlist or receive product updates.
• • Attribution data — the marketing source you arrived from (UTM parameters and ad click identifiers such as gclid/fbclid), the referring page, your IP address and browser user-agent. We use this to understand which channels bring people to SquadLock.

In the app

• • Account information — name, email address and password (hashed) when you register.
• • Location data — only when you explicitly grant permission, used solely to find nearby ringers.
• • Match & team data — availability votes, roster confirmations, payment records and team memberships you create.
• • Device information — push notification tokens for delivering alerts.
• • Diagnostics — crash reports and basic performance data from the mobile app (via Sentry), used only to find and fix bugs.

2. How We Use Your Data & Our Lawful Bases

Under the UK GDPR we must have a lawful basis for each use of your data. Our bases are:

• • Waitlist & product updates — your consent, which you give by submitting your email. You can withdraw it at any time (see section 6).
• • Operating your account, matches, votes and rosters — performance of our contract with you (our terms of service).
• • Push notifications — your consent, given when you opt in on your device.
• • Showing your ringer profile to captains searching for substitutes — our legitimate interest in operating the substitute-finding feature you chose to join.
• • Advertising measurement (Meta & Google) — your consent, given via the cookie banner (see section 3).
• • Security, fraud prevention and meeting legal obligations — our legitimate interests and legal obligations.

3. Cookies, Analytics & Advertising

On your first visit we show a consent banner. No advertising or analytics cookies are set, and no data is sent to Meta or Google, unless and until you accept. If you decline, the site continues to work normally. Strictly-necessary cookies (and the cookie that records your consent choice) do not require consent.

The cookies and similar technologies we use are:

• • sl_consent — first-party, stores whether you accepted or declined advertising cookies so we do not ask again. Lasts 12 months. Set regardless of choice; strictly necessary.
• • _fbp, _fbc (Meta Pixel) — set only after you accept; used to measure whether an ad led to a signup. Typically last up to 90 days.
• • _ga and related Google tags — set only after you accept; used for advertising/analytics measurement. The _ga cookie typically lasts up to 2 years.

When you accept, we also send conversion measurement events from our server to Meta and Google. These can include a hashed (irreversible) version of your email, your IP address and browser user-agent, and the advertising identifiers above — solely to measure whether an ad led to a signup. We never sell your data and never share your email in plain text.

4. Data Sharing

We do not sell your personal data. We share data only with:

• • Meta & Google — advertising measurement, only with your consent (see section 3).
• • Hosting & email providers — our application hosting (Railway), database (Neon, hosted in the UK/EU) and email routing (Cloudflare) providers, to run the service and send you transactional and waitlist emails.
• • Expo / EAS — for push notification delivery.
• • Sentry — crash and performance diagnostics from the mobile app (hosted in the EU), used solely to find and fix bugs.
• • Your team members — your name, availability and ringer profile are visible to members of teams you join.

5. International Transfers

Our database and core infrastructure are located in the UK/EU. Some of our providers — notably Meta and Google (advertising measurement) and certain hosting and notification services — may process data in the United States or other countries outside the UK. Where data is transferred outside the UK, we rely on appropriate safeguards such as the UK extension to the EU–US Data Privacy Framework and/or the UK International Data Transfer Agreement (or Standard Contractual Clauses) with those providers.

6. Data Retention

We keep waitlist emails until you ask us to remove you or until we launch and migrate you to an account. We keep account data for as long as your account is active, and delete or anonymise it within a reasonable period after you delete your account, unless we must keep it to meet a legal obligation. Marketing attribution and advertising-measurement data is kept in a form tied to you for no longer than 24 months. You can request deletion at any time using the contact details below.

7. Your Rights

If you are in the UK or EU, you have the right to access, correct, or delete your personal data, to object to or restrict its processing, to data portability, and to withdraw consent at any time. Withdrawing consent is as easy as giving it: for advertising cookies you can decline (or later clear the sl_consentcookie in your browser to be asked again), and for any processing based on consent you can email us to withdraw. Withdrawing consent does not affect processing already carried out. You also have the right to lodge a complaint with your data protection authority — in the UK, the Information Commissioner's Office (ico.org.uk).

8. Security

Passwords are hashed with bcrypt. All network communication uses HTTPS. Authentication tokens are stored in encrypted device storage.

9. Children

SquadLock is not directed at children under 16. We do not knowingly collect data from anyone under 16.

10. Changes

We may update this policy from time to time. The updated version will be indicated by a revised “Effective date” at the top of this page.

11. Contact

Questions about this policy, or want to exercise your rights? Contact us at [email protected].