Taco Sports — Privacy Policy

At a glance

• Operator: Taco Sports, operated by Joshua Gibb (Ontario, Canada)
• Contact: support@tacosports.ca • Postal address available on request
• We collect: first name, email, password (hashed), team roles, thumbnails, game videos (from team managers), IP logs, and basic view counts
• We do not sell or share your data for advertising; no ads or third‑party tracking
• Security: TLS for non‑video data; video streaming currently not encrypted in transit (planned to add)
• Delete your account anytime in‑app or email us

1) Who we are

Taco Sports is operated by Joshua Gibb (sole proprietor) in Ontario, Canada. Contact us at support@tacosports.ca. Postal address is available upon request via email.

2) Scope

Applies to iOS and Android apps. A future web version will follow this policy.

3) What we collect

• Account: First name, email, password (hashed)
• Roles/Teams: Team membership and manager/admin role
• User content: Team thumbnails; game videos uploaded/streamed by team managers; team metadata
• Technical: IP address (logs retained up to 6 months, may reset sooner); basic video view counts
• No in‑app payments or sensitive data collected
• No push notifications at this time

4) Data sources and permissions

When uploading past games, managers pick a specific file from the device. We do not request full photo library access. No Camera/Mic/Contacts/Calendar/Health permissions are requested at this time. No third‑party imports.

5) How we use data

• Provide the service: authentication, profiles, team management, uploads/streams
• Security: protect against abuse and maintain reliability (limited IP logging)
• Support and moderation: respond to reports and support emails
• No marketing

6) Legal bases (EU/UK, if applicable)

Contract (to provide the service); Legitimate interests (security). Consent will be requested for any future optional features (e.g., push, non‑essential cookies, social login scopes).

7) Children and minors

General audience. We do not collect age. Parents/guardians can contact support@tacosports.ca if they believe a child has provided personal information without appropriate consent.

8) User‑generated content and visibility

• Profiles are private by default
• Team managers’ names and emails are visible to other managers within the same team
• Games require sign‑in; a limited clip may be shared on request by a head coach for official review
• No direct messaging features

9) Sharing and processors

We do not sell or share your personal information for advertising. We use service providers bound by contracts to process data on our behalf:

• Firebase (Google): Authentication, Firestore database, Storage (thumbnails), Hosting (tacosports.ca)
• Cloudflare: DNS and email services for tacosports.ca
• Ontario‑based video servers: stream game videos directly from our own servers in Ontario, Canada
• Future social login (Apple/Google), if enabled

10) Advertising and tracking

No ads, ad measurement, or cross‑context behavioral tracking. If a web version launches, we may use strictly necessary cookies for sign‑in and caching; a consent banner will be shown where required for any non‑essential cookies.

11) International transfers

Databases are hosted in the United States; video files are stored/served from Ontario, Canada. For EU/UK users (if/when served), we use the European Commission’s Standard Contractual Clauses (SCCs) and supplementary measures as needed to lawfully transfer personal data to the United States and Canada.

12) Security

• In transit: TLS for all non‑video data. Video streaming is currently not encrypted in transit (planned to add)
• At rest and access: Firebase Security Rules and role‑based access for teams; access controls on our video servers
• Vulnerability management: configurations and rules updated as needed; report issues to support@tacosports.ca

13) Data retention

• Account data: until you delete your account or the service is shut down
• Game videos: deleted within 60 days after the season ends; a copy may be provided to the team’s head coach on request
• IP logs: up to 6 months, may be cleared sooner (e.g., on server updates)
• Backups: none currently; if added later, retained no longer than 6 months

14) Your rights and choices

Delete your account in‑app at any time, or email support@tacosports.ca for help. Regional rights (e.g., access, correction, portability, objection) are respected where applicable.

15) Emails and communications

We send only transactional emails (support responses, password resets). No marketing emails. No SMS.

16) Moderation and reports

We do not pre‑review content. Reports are handled by the operator (Joshua Gibb) and, where relevant, in consultation with team admins.

17) Third‑party links and integrations

We may link to external sites for scores, team info, or our website. Their privacy practices apply on their sites. If Apple/Google sign‑in is enabled in the future, their policies will apply to authentication.

18) Law enforcement requests

We require valid legal process (e.g., subpoena, court order, warrant) unless there is an emergency involving danger of death or serious physical injury. We will attempt to notify affected users unless legally prohibited or notification would be futile or dangerous.

19) Changes to this policy

We may update this policy. For material changes, we will notify you by email and/or in‑app. Some in‑app notices may require updating the app to view.

Regional notices

• Canada (PIPEDA; Quebec Law 25): We limit collection to what is necessary, provide access/deletion, and use service providers under contractual safeguards. Cookie consent will be shown for any non‑essential cookies if a web version launches.
• United States (CPRA, etc.): We do not sell or share personal information for advertising. No cross‑context behavioral advertising.
• EU/UK (GDPR): Legal bases as above; SCCs/IDTA for transfers. We may appoint an EU/UK representative if required and will update this policy.

Contact

Email: support@tacosports.ca. Postal address provided upon request. In Canada, you may also contact the Office of the Privacy Commissioner: priv.gc.ca.

Data inventory (summary)