Privacy Policy

Last updated 29 September 2026

MyClubs connects people to local clubs: sport, arts and social. This policy explains what personal data we collect, why we collect it, and how you can have it deleted.

Who we are

MyClubs is the data controller for the personal data described here, which means we decide what is collected and why.

For any matter arising from this policy, including exercising any of the rights described below, contact support@my-clubs.co.uk.

What we collect

• Account details. When you sign in with Apple or Google we receive your email address and, if you share it, your name. You can add a phone number, address and postcode to your profile; all three are optional.
• Location. If you grant permission, we use your device location to show clubs near you. It is used to answer that search and is not stored as a location history. You can decline and search by postcode instead.
• Club activity. Clubs you join, join requests you send, sessions you attend, and check-ins recorded at a session.
• Payments. Club dues and session charges are processed by Stripe. We never see or store your full card details. If you save a card for session charges we keep its type, last four digits and expiry, the version of the card terms you agreed to and when, and each club's booking terms you accepted. We keep a record of what each club charged you, for which session, when you were told, and whether it was paid, refunded or waived.
• Things you write, and notes about you. The message you send with a join request, reviews you post, reports you make about a club, and the reason a club manager gives when they change a decision or a charge that concerns you, such as waiving a payment.
• Notifications. If you enable push notifications, we store a device push token so we can deliver them, together with your email and push notification preferences.
• Diagnostics. If crash reporting is enabled we collect anonymous crash and error reports to fix faults.

How we use your data

We use your data to operate the service: to show you nearby clubs, to let clubs manage their members and sessions, to collect dues on a club's behalf, and to send the notifications you have opted into. We do not sell your personal data, we do not use it for advertising or cross-app tracking, and we do not make any decision about you by automated means alone.

Lawful bases for processing

UK GDPR requires us to have a lawful basis for every way in which we process your personal data. We rely on the following:

• Performance of a contract: your account, profile, club memberships, join requests, session attendance and check-ins, and taking payment for club dues. Without these we cannot provide the service you signed up for.
• Consent: using your device location to find nearby clubs, and sending push notifications. Both are granted through your device's permission prompts and can be withdrawn at any time, in your device settings or at Account → Notifications.
• Legal obligation: keeping records of payments that took place, which tax and accounting law requires the clubs, and us, to retain (UK GDPR Art. 6(1)(c); this is also why those records are kept after an erasure request, Art. 17(3)(b)).
• Establishing and defending legal claims: keeping the evidence behind a charge (the attendance record, the terms you accepted and the notice you were sent) for as long as it could be disputed (Art. 17(3)(e)).
• Legitimate interests: service emails about your clubs, crash and error diagnostics, and rate limiting and abuse prevention that keep the service available. We balance these against your interests, and you can object by contacting us.

Who we share your data with

Clubs you interact with see your name, profile details you have added, and your membership, attendance and payment status with them. Once a club holds that information it is responsible for its own use of it, as an independent data controller. Ask the club directly about how it handles member data.

We also use these service providers, who process data on our behalf and only on our instructions:

• Cloudflare: hosts the service, stores its database and uploaded images, and sends service email.
• Stripe: processes payments, under its own privacy policy as an independent controller for its part.
• Apple, Google and Expo: deliver push notifications to your device.
• Sentry: receives crash and error diagnostics, where enabled.

We also disclose data where the law requires it.

International transfers

Some of these providers are based outside the United Kingdom, or may process data on servers outside it. Where personal data is transferred out of the UK, we rely on the UK International Data Transfer Agreement, the UK Addendum to the European Commission's Standard Contractual Clauses, or a UK adequacy regulation covering the destination country. You can ask us for details of the safeguard applying to a particular transfer.

How we protect your data

All traffic between the app and our servers is encrypted in transit, and our hosting provider encrypts stored data at rest. Card details go directly to Stripe and never touch our servers. Access to production data is restricted to the people who operate the service, and every request is authenticated and rate limited.

How long we keep your data

• Your account and profile: while your account is open. Deleting your account erases it (see below).
• Club membership and attendance: while your account is open, then erased with it.
• Notifications: 180 days, or until you delete your account.
• Join requests that were declined or withdrawn, including any message you wrote: 180 days after the decision.
• Invitations to join a club, including the email address they were sent to: an invitation nobody answers expires after 30 days, and every invitation is deleted 60 days after it was sent.
• Reports about a club: one year after they are resolved.
• Sign-in sessions: until they expire or you sign out.
• Records of payments that took place, including confirmed session charges, the card and club terms you agreed to, and the record of who changed a charge and why: six years from the end of the accounting period they fall in, which is the retention period UK tax and accounting law requires, and then deleted. Your identity is removed from these records when you delete your account, so the retained record identifies the transaction rather than you.
• Crash and error diagnostics: up to 90 days.

Deleting your account

You can delete your account and its personal data at any time, from the app: Account → Delete Account. If you have uninstalled the app, use this page instead. Deletion removes your profile, memberships, join requests, attendance, check-ins, notifications, endorsements, reviews and invoices addressed to you, removes your saved card, and cancels any active subscriptions. It cannot be undone. While you still owe a club money for sessions it has already confirmed, deletion waits until that is paid or the club waives it: a debt is not erased by deleting an account.

Your rights

Under UK GDPR you have the right to:

• request access to the personal data we hold about you and receive a copy of it; you can download a copy yourself at any time at Account → Download my data
• have inaccurate personal data corrected
• have your personal data erased; you can do this yourself at any time at Account → Delete Account
• receive your data in a portable, machine-readable format; the download above is JSON
• restrict or object to processing carried out under legitimate interests
• withdraw consent for location or push notifications, without affecting the lawfulness of any processing carried out before you withdrew it

Email support@my-clubs.co.uk to exercise any of these rights. We respond within one month.

If you are unhappy with how we have handled your data you can complain to the Information Commissioner's Office, the UK supervisory authority, at ico.org.uk/make-a-complaint or on 0303 123 1113. We encourage you to contact us first so that we can resolve your concern directly.

Cookies

Our web pages, including this one, do not set cookies and do not use analytics. The app does not use advertising or cross-app tracking identifiers.

Age

MyClubs is a service for adults. You must be 18 or over to create an account, and we do not knowingly collect personal data from anyone under 18. If you believe a child has created an account, email support@my-clubs.co.uk and we will delete it.

Changes to this policy

If we change how we handle your personal data we will update this policy and revise the date at the top. We will notify you of material changes in the app.

Contact

support@my-clubs.co.uk