Privacy Policy

1. Who we are

Turf Time (“Turftime”, “we”, “us”, “our”) operates the football ranking platform available at turftime.site. For the purposes of POPIA we act as the Responsible Party for personal information processed through the service.

You can reach us for any privacy question, request or complaint at support@turftime.site.

2. What personal information we collect

We collect only what we need to run the platform:

• Account information: email address, password (stored in hashed form by our authentication provider), display name, username, avatar, country, date of birth, preferred position, and bio.
• Team & match data: teams you create or join, fixtures, match results, goals scored, participants and tournament entries.
• Social activity: follows, join requests, team invites and notifications.
• Support & feedback: messages you send us via the feedback or contact forms.
• Technical data: IP address, browser and device information, and timestamps captured by our hosting and backend logs.

3. How we collect it

We collect personal information directly from you when you sign up, complete your profile, create a team, log a match, send feedback or interact with other users. Some technical information (such as IP address and request logs) is collected automatically by our hosting provider when your device communicates with our servers.

4. Why we process it

We process personal information for these purposes:

• To create your account and let you sign in.
• To provide the core service: teams, fixtures, match confirmation, rankings and leaderboards.
• To send in-app notifications about fixtures, results, invitations and requests.
• To keep the platform safe — preventing fraud, abuse, spam and unauthorised access.
• To respond to your support requests and feedback.
• To comply with legal obligations when required.

Our lawful bases under POPIA include your consent (given when you sign up), performance of our agreement with you to provide the service, our legitimate interests in operating a safe platform, and compliance with law.

5. Who we share it with

We do not sell your personal information and we do not use it for third-party advertising. We share it only in these limited cases:

• Our hosting and backend provider (Lovable Cloud, which runs on Supabase infrastructure) processes data strictly on our behalf so the platform can function.
• Other Turf Time users can see the information you make public — your team pages, match results, public profile, username, avatar, followers and following lists, and any content you post publicly.
• Legal authorities where we are legally required to disclose information, for example under a court order or a lawful request from a competent authority.

We do not currently use third-party analytics, advertising networks or marketing email tools. If we add any in the future, we will update this policy first.

6. Cross-border transfers

Our hosting provider processes data on infrastructure that may be located outside South Africa. When personal information is transferred across borders we rely on our provider's contractual and technical safeguards, in line with section 72 of POPIA, to make sure your information continues to be protected to an adequate standard.

7. How long we keep it

• Active accounts: we keep your personal information for as long as your account exists.
• Deleted accounts: when you delete your account we apply a 30-day grace period during which you can recover it. After 30 days we hard-delete your personal data.
• Match and fixture history: we anonymise your matches after deletion so opponents' historical results and rankings remain intact — your name and profile links are removed.
• Backups: encrypted backups are cycled out on our provider's standard schedule.
• Legal records: we may keep limited information for longer where a law requires us to.

8. Your rights under POPIA

Under POPIA you have the right to:

• Ask what personal information we hold about you.
• Ask us to correct information that is wrong or outdated.
• Ask us to delete your personal information.
• Object to processing on reasonable grounds.
• Withdraw consent you previously gave.
• Lodge a complaint with the Information Regulator (South Africa) at inforegulator.org.za, email POPIAComplaints@inforegulator.org.za.

9. How to exercise your rights

Email support@turftime.site from the address on your account and tell us what you'd like to do. We will respond within a reasonable time and aim to complete valid requests within 30 days. We may need to verify your identity before acting on a request.

10. Security

We take reasonable and appropriate technical and organisational measures to protect personal information, including:

• Row-Level Security (RLS) policies on every database table so that users can only read and write the data they are entitled to.
• Encrypted transport (HTTPS) for all traffic to the platform.
• Password hashing handled by our authentication provider — we never see your plain-text password.
• Least-privilege access to production systems and secrets kept server-side.

No online service can be guaranteed 100% secure. We continue to review and improve our controls as the platform grows.

11. Data breach commitment

If we become aware of a security compromise that affects your personal information, we will notify the Information Regulator and the affected users as soon as reasonably possible, as required by section 22 of POPIA. Our notification will explain what happened, what information was involved, what we are doing about it, and what you can do to protect yourself.

12. Children

Turf Time is intended for players aged 18 and over. Users between 13 and 17 may only use the service with the consent of a parent or legal guardian. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has given us information, please contact us and we will delete it.

13. Cookies & local storage

We use your browser's local storage to keep you signed in and to remember basic preferences (for example, the team you were last viewing). We do not use third-party advertising or tracking cookies. If we introduce analytics in the future we will update this policy and, where required, ask for your consent first.

14. Changes to this policy

We may update this policy from time to time as the platform evolves. The “Last updated” date at the top of this page always reflects the current version. Material changes will be communicated in-app or by email where appropriate.

15. Contact

Questions, requests or concerns about your privacy? Email us at support@turftime.site. We read every message.