Privacy policy

Our public website gives information about the academy, its programs, and how to contact us. The signed-in part of the Service is an internal management system used by our authorized staff to manage player registrations, attendance, subscriptions, fees, and expenses. New accounts must be approved by an academy administrator before they can access it.

Information from Google Sign-In

If you choose to sign in with Google, we receive the following information from your Google Account, with your permission, using the standard openid, email, and profile scopes:

• Your name (first and last name)
• Your email address and whether it is verified
• Your profile picture
• Your Google Account identifier

Google also gives us sign-in tokens, which we store securely and use only to keep you signed in to the Service. We do not request or access your Gmail, Google Drive, Google Calendar, contacts, or any other Google data.

Information you give us

• Account details: if you sign up with email and password, your first name, last name, email address, and password. Passwords are stored only as a secure one-way hash (Argon2) and are never stored in readable form.
• Messages: anything you send us by email or phone.

Player records entered by academy staff

When a player joins the academy, our staff enter the player's details into the Service. This may include the player's name, date of birth, address, phone number, email address, parent or guardian name and phone number, playing style, jersey size, photo, attendance, subscription, and payment records. Many of our players are under 18; their details are provided by a parent or guardian at registration.

Information collected automatically

• Session information: when you sign in, we record your IP address and browser type (user agent) with your session for security purposes.
• Cookies: we use a strictly necessary cookie to keep you signed in. We do not use advertising or tracking cookies.
• Preferences: your light or dark theme choice is saved in your own browser.

• To create your account and sign you in securely
• To let administrators approve, reject, or manage staff accounts
• To send account emails, such as email verification and password reset links
• To manage player registrations, attendance, subscriptions, fees, and academy finances
• To respond to your questions and requests
• To protect the Service against fraud and unauthorized access

We do not sell your information, use it for advertising, or use it to train artificial intelligence models.

Ideal Sports' use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We use Google user data only to sign you in and to show your name, email address, and profile picture inside the Service. We do not transfer it to others except as needed to run the Service (see Who we share information with), to comply with the law, or with your consent, and no person at Ideal Sports reads it except where needed for security, legal compliance, or with your permission.

We share information only with the service providers we use to run the Service, and only as much as each needs:

• Hosting and database providers, which store the Service's data
• Cloudinary, which stores player photos
• Google, for Google Sign-In and for delivering our account emails
• Cloudflare, for our domain and email routing
• Have I Been Pwned, which checks whether a new password has appeared in a known data breach. Only a short, anonymous fragment of a hash of the password is sent; your password and email address are never shared.

Our home page shows an embedded Google Map of our location. Google may collect information when you view or interact with the map, under Google's Privacy Policy.

We may also disclose information if required by the law of Nepal or a valid legal request.

• Account information is kept until your account is deleted.
• Sign-in sessions expire after 7 days.
• Email verification and password reset links expire after 15 minutes.
• Player records are kept while the player is enrolled, and afterwards only as long as needed for the academy's financial and legal records.

The Service is served only over HTTPS. Sign-in cookies are HTTP-only and secure, passwords are hashed, access is limited to approved accounts with assigned roles, and sign-in attempts are rate-limited. No method of storage or transmission is completely secure, but we work to protect your information.

• You can ask us to access, correct, or delete your personal information, or the information of a child in your care, by contacting us.
• You can remove Ideal Sports' access to your Google Account at any time from your Google Account permissions.
• When you ask us to delete your account, we delete your account information and any stored Google sign-in data.

Accounts on the Service are only for adult academy staff. Information about players under 18 is collected from and with the consent of their parent or guardian, and is used only to run the academy. A parent or guardian can contact us at any time to review, correct, or delete their child's information.

We may update this Privacy Policy from time to time. When we do, we will change the effective date at the top of this page. Important changes will be announced on this website.