Each club or event organizer using Event Guardian is the data controller for the competitors, guardians and staff they register — the same relationship as any club keeping a paper register today, just digitized. Event Guardian Ltd is the data processor: we run the software and the infrastructure it depends on, under each club's instruction, and never use a club's data for our own purposes.
All of it exists for one purpose: confirming that a child leaves an event with someone authorized to collect them, and producing a record if that's ever questioned. For a club, that's processed under legitimate interest (safeguarding minors in their care) and, for staff/guardian accounts, under contract (providing the service they signed up to use). Nothing here is used for advertising, and nothing is sold or shared with data brokers.
The database is Postgres on Supabase, hosted in the UK, with row-level security that enforces club isolation at the database itself — not just in the app's UI. Photos sit in a private storage bucket and are only ever served as signed links that expire after an hour; there is no public URL for any image in the system.
Processors involved in running the service:
An event's competitor, guardian and handover data is deleted automatically 14 days after the event's end date — a fixed rule, not a per-event setting a club can extend. The club's owners and admins get a warning email 3 days beforehand. Staff and guardian accounts persist until the club removes them or the account holder requests deletion (see below).
Every cookie this app sets is functional, not tracking: a session cookie (who you are), which club/event you currently have selected, and — mid-handover on an iPhone, which reopens the app at a fresh page for every tag tap — the two tags scanned so far. None of it is readable by, or shared with, any other site. The installed app/PWA caches only its own build files for offline loading; no page containing competitor or guardian data is ever written to the device cache.
A competitor's record is entered by club staff or a linked parent/guardian, never by the child directly, and photo consent is tracked per child rather than assumed. Because this data exists to protect a child at an event, denial is the default: an adult not on a competitor's authorized list is refused, not given the benefit of the doubt.
You can ask the club that registered you (or, for a linked guardian, your own child) to correct or remove your record at any time — they hold it. If you have your own login, go to Account and use Request account deletion; a request is confirmed by a human rather than actioned instantly, because a login can be tied to an append-only handover record that — like a paper logbook — can't be rewritten after the fact. For anything else, or if you don't have a login, use Contact, or submit a formal request — access, correction, deletion, or portability — through our data privacy request form.
If how the app handles data changes, this page changes with it — there's no separate policy drifting out of sync with the software. Material changes affecting existing clubs will be communicated directly, not just posted here.
Questions about this policy, or a data request for a club that's no longer running: use the contact form.