Privacy Policy

Academy X ("we", "us") is a gamified football training companion that helps young players complete technical and physical skill challenges, track progress, and level up. We are the data controller responsible for your personal data under the UK GDPR and the Data Protection Act 2018. This policy explains what data we collect, why, the legal basis for each use, and your rights.

• Account details — name, email address, and password (managed securely by our auth provider).
• Profile information — display name, playing position, teams and clubs you play for, professional club supported, favourite player, and an optional thumbnail photo you choose to upload.
• Training activity — challenges completed, experience points (XP), streaks, badges, virtual coins, and reactions you give or receive.
• Video submissions — short clips you record or upload so our AI coach can verify a skill challenge. These are processed for verification and then handled as described under "Data retention".
• Payment information — membership subscriptions are processed by Stripe. We never see or store your full card details.
• Usage data — limited device and app interaction data used to keep the service running and improve it.

• To run your training experience (profiles, progress, leaderboards) — contract (you asked us to provide the service) and legitimate interests (showing ranked progress).
• To verify skill attempts with AI by reviewing your video submission — consent. You choose whether to record or upload a clip for each challenge, and you can withdraw consent by deleting the submission.
• To send training reminders, streak nudges, and membership updates — consent, which you can withdraw at any time in your profile.
• To process subscription payments — contract.
• To improve the drills, challenges, and features we offer — legitimate interests, using aggregated or anonymised data where possible.

Academy X is designed for young footballers and we follow the Information Commissioner's Age Appropriate Design Code. If you are under 16, a parent or guardian must review this policy and help you create and use your account. By setting up an account for a child, the parent or guardian confirms they consent to the child's data — including any video submissions — being processed as described here. We do not knowingly collect data from children without parental involvement. If you believe a child has provided data without consent, contact us and we will delete it.

We apply high-privacy defaults for children: profiles are not advertised to third parties, video submissions are not used to train external models, and location is not collected.

When you submit a clip to complete a challenge, an AI model reviews the footage to confirm the skill was performed and to give you coach feedback. This is not an automated decision that produces legal effects about you — it only decides whether to award in-game XP. A human (admin/coach) can review any submission on request. You may withdraw consent for a submission by deleting it from your account at any time.

Your display name, training activity, and earned badges appear on in-app leaderboards, team rankings, and alongside reactions from other users. Your password, email, and payment details are never shown to other users. Only you can edit your own profile; admins can manage accounts when needed to provide support.

• Stripe — processes membership payments securely (see Stripe's privacy policy).
• Google — optional sign-in via your Google account.
• Cloud hosting & AI providers — used to run the app, store data, and verify video submissions. Some operate outside the UK; we only transfer data under appropriate safeguards such as UK International Data Transfer Agreements or the UK addendum to the EU Standard Contractual Clauses.
• Email delivery — used to send training reminders and account notifications.

• Account & profile — kept while your account is active; deleted when you delete your account.
• Training activity & reactions — kept with your account; removed on account deletion.
• Video submissions — retained only as long as needed to verify the attempt, provide feedback, and allow admin review (up to 90 days), then deleted. The ChallengeProgress record of your completion is kept with your account.
• Payment records — kept by Stripe according to financial regulations; we keep only your membership tier and billing status.

Under UK GDPR you have the right to:

• Access — ask what data we hold about you and receive a copy.
• Rectification — correct inaccurate or incomplete data.
• Erasure — delete your account and associated data (right to be forgotten), available in-app.
• Restriction — ask us to limit processing in certain circumstances.
• Portability — receive your data in a structured, machine-readable format.
• Object — object to processing based on legitimate interests or for direct messages.
• Withdraw consent — at any time, for processing based on consent (e.g. video submissions, reminders), without affecting processing already done.

To exercise any right, use the in-app account deletion or contact us through the in-app support channel. We respond within one month. If you are not satisfied, you can complain to the Information Commissioner's Office (ICO) at ico.org.uk.

We use secure, access-controlled storage, encrypted connections, and strict role-based permissions so that one user cannot access another's private data. Video submissions are stored privately and only reviewed for verification. Despite these measures, no system is perfectly secure; we will notify affected users and the ICO of any personal data breach as required by law.

We may update this policy as Academy X grows. We'll notify you of significant changes by email or in-app. Continued use after changes means you accept the updated policy.

Questions about your data? Reach out through the in-app support channel and our team will help. This document is provided to help you understand how we handle your data; it is not a substitute for formal legal advice.