← Back to PEAK

Privacy Policy

PEAK Suite ("PEAK", "we", "us") is a basketball team-management and game-tracking application operated by Konstantinos Athanasios Samouladas, Greece, reachable at support@peakbasketball.app. This policy explains what personal data PEAK handles, why, who else is involved, and the choices you have.

Who is responsible for what

• Your account, and messages you send us: we decide how this data is used, so we are its controller.
• Everything a club puts into PEAK — players, rosters, games, schedules, attendance, finances, announcements: the club (the organisation in PEAK) decides what to record and why, so the club is the controller and we process that data on its behalf as its processor. If you are a player or parent with a question about your data, you can contact your club, or us and we will help.

Data we handle

• Account: email address, name, password (stored only as a hash), sign-in times, and which organisations you belong to and with what role.
• Organisation and team: organisation and team names, colours, seasons, competitions, coach and staff roles.
• Player profiles: name, jersey number, position, dominant hand, optional measurements (height, weight, wingspan, reach, vertical) and coach notes.
• Date of birth and injury details: optional. Injury details are health data. Both are stored encrypted and can only be read by a club's staff (see Security).
• Games and statistics: the events logged during a game (shots and their court position, rebounds, fouls, substitutions, timings) and the statistics calculated from them.
• Schedule and attendance: practices, games and events, and who attended.
• Announcements: messages staff post to a team, and any files attached to them.
• Team finances: fees due, payments recorded against players, and team expenses.
• Player and parent accounts: when a club invites a player or parent, their account is linked to the player's profile so they can see their schedule, attendance and statistics.
• Notifications: if you turn them on, a push subscription for your device (an address issued by your browser's push service, plus the browser and device type).
• Issue reports: what you write, the email you give, and technical details about the app and device to help us fix the problem.
• Contact form: your name, email, club, number of teams and message.
• On your device: a local copy of saved games and settings so the app works offline — see Cookies & local storage.

We do not use advertising trackers, analytics pixels or session recording, and we do not sell personal data. Fonts and scripts are served from our own domain, so opening PEAK does not send your address to a font or script host.

Why we use it, and on what legal basis

• To provide the service you or your club signed up for — accounts, team management, game tracking, player portal, exports: performance of a contract. For club data, the club's own legal basis applies.
• To keep PEAK secure, prevent abuse, and provide support: legitimate interests.
• Push notifications: your consent, which you can withdraw at any time by turning notifications off in the app or your browser.
• Replying to issue reports and contact messages: legitimate interests, or steps taken at your request before entering a contract.
• Billing and accounting records: legal obligation.

Children

Players can be under 16. A player account exists only when a club invites that player. The club is responsible for having a lawful basis for the player data it records and, where the law requires it, for obtaining consent from a parent or guardian — including before inviting a player under 16 to create an account. The player portal shows a player their team's schedule and their own attendance and statistics. Player and parent accounts cannot read anyone's date of birth or injury details. We do not market to children. If you believe a child's data is in PEAK without proper consent, contact us and we will work with the club to resolve it.

Who can see it

• Members of your organisation, according to their role. Owners and coaches manage the club's data and assistants can view it. Players and parents use the player portal, and cannot see other players' dates of birth or injury details.
• Anyone with a game's share link. When a coach shares a game, anyone who has the link can view its box score, including player names, until the coach stops sharing it.
• PEAK staff. Authorised PEAK staff can access account and organisation data through our support console where needed to provide support, fix problems, or manage subscriptions.

Service providers

• Supabase — database, sign-in, file storage and server functions. Hosted in the EU.
• Vercel — hosting and delivery of the application.
• Resend — delivers the emails we receive from issue reports and the contact form.
• Your browser's push service (for example Apple, Google or Mozilla) — delivers notifications you have turned on. Their content is encrypted for your device, so the push service cannot read it.

Some of these providers are based outside the European Economic Area. Where personal data is transferred outside the EEA, it is protected by safeguards recognised under the GDPR, such as the EU Standard Contractual Clauses or the EU–US Data Privacy Framework.

How long we keep it

• Account data: until you delete your account.
• Club data: until the club deletes it, or the organisation is deleted.
• Push subscriptions: until you turn notifications off, or the browser retires the subscription.
• Issue reports and contact messages: up to 24 months, then deleted.
• Backups: deleted data can remain in database backups until those backups are overwritten on their regular schedule.

Your rights

Under the GDPR you have the right to access your data, correct it, have it erased, restrict or object to how it is used, receive it in a portable format, and withdraw consent at any time. Much of this you can do yourself: edit any field in the app, export games and statistics, or use Settings → Delete account, which permanently removes your user, your memberships, and any organisation you are the only owner of, along with its teams, players, games, schedules and attendance. For anything else, email support@peakbasketball.app. For club data, we will pass your request to the club or help it respond.

You also have the right to complain to a data protection authority. In Greece this is the Hellenic Data Protection Authority (www.dpa.gr); you can also contact the authority where you live.

Security

• All traffic is encrypted with HTTPS. Passwords are stored only as hashes.
• Access rules in the database itself mean members of one organisation cannot read another organisation's data, and each role sees only what it should.
• Dates of birth and injury details are encrypted with AES-256 before they are stored. The key is held in a separate secure vault, and only a club's staff can have them decrypted.

Changes

If we change this policy materially we will say so in the app and update the date above.

Contact

Questions? support@peakbasketball.app