REP11 Privacy Policy

Applies to: the REP11 app on Android and iOS (on iPhone and iPad it is in Apple's TestFlight beta testing for now), the household web version of REP11, and the REP11 website. Publisher: Bolly Labs Pty Ltd (ACN 701 365 246), South Australia, Australia. Contact: support@rep11football.com (If you already have hello@rep11football.com, that reaches us too, it is the same inbox, and you never need to re-send anything to the address above.) Postal address: Reception, 16 Matthew Street, Stanthorpe QLD 4380, Australia Telephone: +61 420 100 690

Version: v1.12 · first published 2026-08-24, effective 2026-08-25 · v1.12 effective 2026-10-08 (§11 lists what changed) · published before legal review, see the note below.

About this version: please read this first. This policy describes what REP11 does today. The claims it makes about the code in the app (that there is no advertising or behavioural tracking code, that it never asks for the camera, microphone or location, and that deleting a player removes everything held about them) are checked automatically against our own source code each time we build the app. It has not yet been reviewed by a lawyer. That review will happen before REP11 is released publicly, and if it changes anything here we will publish the new version and say what changed. We would rather tell you that plainly than let a polished page imply a sign-off it has not had.

The short version

REP11 is a football training app used mostly by children. We built it so that using it well requires almost nothing about you.

• Kids never hold accounts here. A parent's account, a parent's card, always. One adult signs up and owns the account. Everyone under 18 in the household is a profile inside it: no email address, nothing to sign up for and nothing to wait for. A player in the 13+ age band may be given their own sign-in by a grown-up of the household, for their own phone; it shows only that player's own training (§1).
• The app on Google Play and the App Store asks a grown-up to sign in first, and then backs the family's players and training up to REP11's family service (§2.6 lists everything the app sends). The household web version can still be used without an account.
• We do not show advertising to children. Not on any profile, not in any family account, not at any age band. No exceptions and no "tasteful" ones.
• We do not sell personal information, and we do not share it with advertisers or data brokers. There is no advertising SDK in the app.
• No photographs. Players are represented by illustrated avatars. There is no photo upload, no camera access, and no video upload. The one picture the app can send is a picture of the app's own screen, attached when a grown-up or a player aged 13 or older sends us feedback, and they can remove it first (§2.3).
• No messaging between people. No player can message another player, and nobody can contact a child through this app. The one thing anyone in the household can send is feedback to us. See §2.3, and note that a child can use it.
• We never see your card. Subscriptions are billed by Apple or Google.

The rest of this document is the detail behind those sentences.

Which REP11 each section describes. Parent sign-in and family account records are available in the store app. When a grown-up signs in, the app backs up the family's players and training to REP11's family service so it can be restored on another phone. Signing in is the consent; a grown-up can stop backup by signing out of the phone, or delete the account, in Account settings. The screen shows the last completed backup; do not assume data is recoverable until that completes. The designated purchase rehearsal uses a separate test service and disposable test families. It does not replace a U12 household's lasting account or complimentary access. Club features described below remain specific to the private household web version unless the app explicitly offers them.

Family backup. After the account holder signs in, REP11 stores players' nicknames, age bands, appearance, plans, player choices, drill and quiz history, scores, rep totals, streak protection, trophies and family cheers in its family service on Cloudflare (§4 and §8 say where that is). Consent covers players later added on that phone. Because the store app now asks a grown-up to sign in before anyone trains, every family using the store app has this backup; the only way to stop it is to sign out of that phone (§9). Backup runs while the app is open and online; offline changes remain local until a later successful backup. Signing in to the same account on a replacement phone can restore the saved family. Matching nicknames never merge players. Device preferences, downloaded media and profile PINs are not backed up. Child training is not sent to RevenueCat, advertising or behavioural tracking services.

A grown-up can sign out of a phone, which stops its backup, without deleting local practice or the existing cloud copy. Account deletion removes the account and a family solely owned by it from the live service; a family with another adult remains. Deleted data can remain in Cloudflare backups for up to 30 days. Uninstalling a phone's app removes its local practice, including changes that have not completed backup. Rehearsal data on the separate test service is not migrated into a lasting family account.

1. Who this policy is for

People use REP11 in four different ways, and the answer to "what do you hold about me" is different for each:

The rule underneath the table: an account belongs to an adult, and only to an adult. One grown-up signs up and pays; everyone under 18 plays as a profile inside that account. A grown-up may give a player in the 13+ age band their own sign-in for their own phone; it shows only that player's own training, never the account, plans or other players. There is no child email address, and no way for a child to be contacted through this app.

We treat every player as a child. Rather than sorting people into stricter and looser regimes by age, we apply the protections designed for children to everyone who uses REP11, including the adults. It is simpler, it is safer, and it means we never have to guess someone's age to know how to treat their information.

An account is the main thing that creates a record with us, but it is not the only one: feedback you send us (§2.3) and a club application (§2.5) are also records we hold, and both can exist without an account.

2. What we collect

2.1 A player profile (child or adult)

• A display name. A first name or a nickname. The app asks for what a player wants to be called, not for a legal name, and we ask parents not to use surnames.
• An age band (5–8, 9–12, 13+). Bands set the difficulty and reading level of content.
• No birth year and no date of birth. We planned an optional, parent-entered birth year (the year only) so a profile could move up a band on its own. It is not collected today, in either version of the app. If we add it, this section and our store declarations change first, and it will stay optional.

• An avatar choice from our illustrated set, and a chosen coach character. Both are picks from a fixed list, not uploads.
• Card-style picks: a country (a two-letter code, shown as the flag on the player card), a favourite position, and kit colours. Each is a pick from a fixed list, each is optional, and none is typed text.
• An optional club or team affiliation. A parent can add the name of the club a player trains with from the grown-up settings, or a player can join a REP11-affiliated club by opening that club's own join link, which attaches the club's verified name. The affiliation appears on the player's own card. It does not put the player on the club's board: that is a separate, off-by-default parent choice (§7).
• Training history: which drills were completed and when, stars earned, streak days, experience points, personal bests (and which foot a best was set with, on the drills that are tracked per foot), time spent running a drill timer, quiz attempts and scores, achievements earned, goals awarded and streak saves used, weekly-challenge entries, any custom session built, a one-tap cheer sent to or received from another player in the same household, and an optional one-tap "how did that feel" answer.
• Which drills were opened and worked on, even when nothing was scored. One record a day per drill, with the date, and whether a completion followed. Added 2026-08-25. Until now this app only ever recorded what went WELL, which meant it could not tell that a child was struggling with something; a record of "worked on it, nothing came of it" is what makes that possible. It is stored, it goes with an export and it goes with a delete like the rest of the training history. Two things it is deliberately not: it is not a judgement (no completion does not mean a child gave up, and nothing in the app says or shows that it does), and it is not shown to anybody today. Nothing in REP11 reads these records yet.
• Optional PINs, and the grown-up check. A PIN is a convenience for sharing a phone or tablet between siblings. It is not an account and not a password, and it protects no data from anyone with access to the device itself. A four-digit PIN has only 10,000 possible values, so treat it as a lock that stops a sibling opening the wrong profile, and not as protection for anything that matters.
• In the app on Google Play and the App Store: a player can lock their own profile with a four-digit PIN. Grown-up screens sit behind a grown-up check, which can be the phone's own unlock (fingerprint, face or passcode. The phone checks it and tells REP11 only whether it passed; we never receive any of it), an optional REP11 parent PIN, or a maths question. Once a grown-up is through, the check does not ask again while they stay inside the grown-up screens; it asks again when they leave them or the app goes to the background. Every PIN in the app is kept in the phone's own protected storage, never leaves the phone and is not part of the family backup, so a PIN is set again on a new phone. The grown-up check opens any player's lock and can remove it, so no child can be locked out of their own profile.
• In the household web version: a player can lock their own profile, and there is one optional parent PIN for the household. We never store the digits themselves, only a salted scrypt hash, but in the web version that hash is held on our server, because the profile it locks is held there too. A parent PIN opens any player's lock and can remove it. A forgotten parent PIN is re-set in the app by the press-and-hold check it replaced. An export tells you WHETHER a PIN is set; it never contains the PIN or its hash.

2.2 An account, always held by an adult

An account is created by an adult, who confirms they are 18 or over. The account holder. That adult may be a parent, a guardian, or an adult who plays REP11 themselves; being a parent is not required. Where the account is paid for, the payment goes through Apple or Google, so an adult is necessarily present at that moment; a free account rests on that confirmation alone. Everyone under 18 in the household is a profile inside that account (§2.1), never an account holder. The app on Google Play and the App Store asks for this sign-in first. See the note under the short version.

• A sign-in identity. There are three ways in, and we keep the one you use:
• Sign in with Google (Android, iPhone and iPad): we receive the identifier Google gives us for your account plus the email address on it.
• Sign in with Apple (iPhone and iPad): we receive the identifier Apple gives us, and the email address Apple shares. You may choose Hide My Email, and then we only ever see a private relay address. That works perfectly well for us.
• A one-time code sent to your email address ("Sign up with email" on Android; "Sign in another way" on iPhone and iPad, for an account that already exists). We keep the address you typed, and send it a six-digit code that works once, for 10 minutes. We store only a scrambled (hashed) form of the code, delete it once it is used, and clear it out after it expires. If you do not see this option yet, it is still being switched on; Google and Apple work in the meantime.

We never set or store a password, so there is no password for us to lose.

• The phones signed in to your family. Each time someone signs in, we keep a sign-in record: when it started, when it was last used, how they signed in (Google, Apple or email code) and the kind of phone, its brand on Android (for example "Samsung phone"), or "iPhone" or "iPad", never the exact model, a phone number, a serial number or an advertising ID. The grown-ups see this list in Account settings → Signed-in devices, can sign any phone out, or sign out everywhere at once. A family can be signed in on at most eight phones; signing in on a ninth signs out the one used least recently.
• A security email when a phone signs in. Every time a grown-up's account signs in after its very first sign-in (on a new phone, or the same phone signing in again) we email the account holder which kind of phone it was and how it signed in, so you can sign it out if it was not you. It goes only to the grown-up who holds the account, never to a child, and it is the only email we send apart from sign-in codes: no newsletters and no marketing from the app. These emails, and the sign-in codes, are sent for us by Resend (§4).
• Subscription state, whether the account has an active plan, and which one. Managed for us by RevenueCat (§4).
• Family membership, which profiles belong to the account, any join code issued, and the grown-ups in the family: at most two. A second grown-up joins only in person, signing in with their own Google or Apple account on a phone already in the family; both see the same players and the same plan.
• Your 18-or-over confirmation. When you tick that you are 18 or over and agree to the Terms and this policy, we record on your account that you ticked it (the band "18+", never a birth date), when you first ticked it, that it was a tick, and which version of the terms you agreed to.
• A player's own sign-in (13 and over, optional). A grown-up of the household can give a player in the 13+ band their own Google or Apple sign-in, in person on a phone already in the family. We keep the identifier Google or Apple gives for that sign-in (never their email address, which we clear the moment the sign-in is linked to the player), which player it is, its sign-in session records and the phones it is used on. It shows only that player's own training. A household has at most five Google or Apple sign-ins, grown-ups included. It is removed when a grown-up takes it away, when the player or the family is deleted, or when the player deletes it in the app; the player's training stays with the family.

2.3 Feedback you choose to send

If you use the in-app feedback control we store what you wrote, what screen it was about, and the app version. Please don't put personal details in it; we don't need them, and we'd rather not hold them. The app has a "GIVE FEEDBACK" button on most screens; it sends only the words you type, the reason you pick and which screen it was about, never which player wrote it.

A picture of the screen, for grown-ups and players aged 13 or older. When a grown-up, or a player aged 13 or older, sends feedback from the app, a picture of the screen they were on goes with the note, so we can see what they mean. It is shown before it is sent and can be taken off by tapping Remove. That picture can show what was on the screen at the time, such as a player's first name or avatar, so we treat it like the note itself: it comes only to us, nobody else can see it, and it is deleted with the note (12 months, §8). A child's feedback never carries a picture.

My feedback. The phone remembers the notes it sent, so a grown-up can see in Account settings what happened to each one. To ask, the phone sends us the note's number and a code made from the note's own words. Nothing else, and no account or player is attached.

When something goes wrong. If signing in, backing up or syncing fails, the app sends us a short note of which step failed and its error code, with the app version and the kind of phone. It never includes a name, an email address, an account, anything about your child or anything typed, and we keep these notes for 14 days. We only count them, so we can see when something is broken for families and fix it.

2.4 The website

Reading the public pages at rep11football.com collects nothing about you. The pages, this one included, carry no analytics, no tracking pixels, no advertising code, no embedded third-party content, and no cookies of any kind. Nothing on the site needs to remember you, so nothing does. (app.rep11football.com is different: it is the household web version of the REP11 app itself, not a page about it. It runs the app's own code, holds the household's profiles as described in §2.1 and §8, and is reachable only from inside our private network, so a stranger cannot open it.)

The one page that can receive anything is the feedback page (/feedback), and it only holds what you choose to put in it:

• What you write is stored and shown publicly on that page, without any name attached. The form has no name field at all. The page says this before you send.
• An email address is optional, for people who want a reply. It is never shown publicly, never shared, and is used to reply to you, plus, only if you tick the box, to send occasional REP11 updates you can stop at any time.
• Photos you attach come only to us and are never displayed on the site.
• To stop one visitor flooding the wall, the page keeps a scrambled (hashed) form of the sending address for rate-limiting. It cannot be turned back into your address and is used for nothing else.
• Delete any of it (your note, your email, a photo), by asking at the address in the header; the same works if you change your mind about updates.

That page uses JavaScript to work (the rest of the site runs none), and what you submit is stored with our hosting provider (§4, Cloudflare) in a database in their Oceania region. The admin view of that page, which only we use, remembers our own access key in our own browser. It stores nothing in yours.

As with any website, our hosting provider handles each request and sees the IP address it came from, in the ordinary course of serving the page. We do not receive that as a report and build no profile from it.

If we ever add analytics to the website, this section changes first, and so do our store declarations.

2.5 A club application (adults only)

A club official can apply, from the club page of the household web version (the app on Google Play has no club page today), to affiliate their club with REP11. The form collects what it shows: the club's name, website, suburb and state, and the applicant's own name, role and email address. This is business contact information about an adult, used to assess the application, manage the affiliation and reply to the applicant. It is stored with our club records, not on any player's profile, and players never see it. If the club is approved, the only club identity that ever reaches a player's screen is the club's name and badge. Ask us at the contact address above to correct or delete an application's details.

2.6 Everything the app on Google Play and the App Store sends

This is the whole list. Each item says where it goes and points to the section with the detail.

• Signing in (§2.2), to REP11's family service: the sign-in token Google or Apple gives the phone (or the email address and code you typed), the kind of phone, and your 18-or-over tick. Google or Apple checks who you are; we never receive your password.
• The family backup (§1 and the short version) (to REP11's family service, while the app is open and online, for every signed-in family: the account and family, each player's nickname, age band, avatar and the in-game look built for it, kit and card choices, stronger foot, plans and player choices, and the training record) completed drills and sessions, quiz attempts and scores, rep counts, fitness sets, stars, streaks, trophies, personal bests and family cheers.
• Team features, only if a grown-up switches them on (§7). A coach's team, the team wall's cheers and football handshakes, and REP11 Arena.
• Feedback you choose to send (§2.3), the My feedback look-up (§2.3) and the short note when signing in, backing up or syncing fails (§2.3).
• Drill videos: when a video plays, the app asks REP11's video service on Cloudflare for that drill's video; the request says which drill and nothing about the player.
• Membership testing, only behind the grown-up check and a separate Continue, to RevenueCat (§4).
• App updates, to Expo, below.

Nothing about a player goes to an advertiser, a data broker or an analytics company, and the app contains no advertising or tracking code.

App updates. The REP11 app checks whether a newer version of itself is available, and downloads it if there is one. That check goes to Expo (§4), the company whose build tools REP11 is made with, not to us.

What the check carries:

• which version of the app is installed, and whether it is running on Android or iOS (the platform only. No identifier of the phone);
• a random ID that Expo's update tool creates for this installation the first time the app opens, and then reuses. It is a string of random characters. It is not a name, an email address, an account or an advertising ID; it is not connected to a player, a profile or anything a player does; and we never see it. We name it here because it stays the same for that installation, and an identifier that persists deserves saying out loud even when it means nothing to us.

What the update check does not carry: no profile, no name, no age band, no avatar, no scores, no training history, no quiz answers. None of what the app records is any part of it. That goes only to REP11's own family service, as listed above.

In our Google Play Data safety declaration this ID is why the app answers yes to Device or other IDs: collected for app functionality, not shared with anyone, and not linked to any person. We collect it only so the app can be updated, which is an internal operation of the app; it is never used to contact anyone or to build a profile of anyone, and we could not do either because we never receive it. Expo's crash information is explained under Expo in §4. The rest of the list above is what our store declarations describe as the account, the training record, app activity, feedback and diagnostics.

Uninstalling the app discards the ID. With the phone offline the check finds nothing and everything else works normally.

2.7 How we check REP11 is working for families

About once a week we read, from REP11's own family service, which days each family trained, plus a few yes-or-no facts we already hold to run the app: which day the family first signed in, whether it has a plan, whether it joined a coach's team and whether a second grown-up joined. We use it to see whether families keep coming back, and to fix what makes them stop.

What we keep from that reading is one row per family with no family id, account, email, name, child, drill, score or time of day in it, and the rows are shuffled so they cannot be matched back to a family. Our own family is left out. Nothing new is collected for it: it is read from the backup the app already makes, and it is never shared, sold or used for advertising. No analytics company is involved. It is a reading we take ourselves.

3. What we deliberately do not collect

This list is the product decision, not a courtesy:

• No child email addresses, phone numbers or postal addresses.
• No photographs or video of players. No camera or photo-library access is requested.
• No contacts, no microphone, no device advertising identifier.
• No sensors, and no location permission. We do not ask for GPS and we do not read heart rate, steps, motion, calories or anything from Apple Health or Google Fit. A server does see the IP address a request arrives from, which is roughly a city. That is how the internet works, not a location feature.
• But we DO hold fitness information, and we say so on both stores. Your training record (which drills, for how long, personal bests, which foot) is information about physical activity, so it is declared to Google as Fitness info and to Apple as Health & Fitness → Fitness. We have no sensors; that does not make training records something other than what they are, and we would rather declare them than argue the point.
• No health information. Nothing in the app records injury, pain, symptoms, medication, mood or diagnosis. The one "how did that feel" question offers exactly three answers (easy, getting there, tricky), which is about the drill, not about the player.
• No full date of birth (see the band note in §2.1).
• No school name and no coach's name attached to a child's profile in the consumer app. A club or team name is the one exception: it is optional and parent-controlled, and §2.1 and §7 describe exactly what it is and where it shows.
• No behavioural profile for advertising. We do not build one, and there is no third-party SDK in the app that could.

4. Who else is involved

We keep this list short on purpose, and every addition to it is a decision reviewed against this policy, not a technical detail.

• Apple and Google process every subscription payment. They tell us that a purchase is valid; they do not give us your payment details, and we never handle them.
• RevenueCat, where optional membership testing is enabled, validates store purchases and restores and records subscription status on our behalf. After the grown-up explicitly continues, we send the REP11 adult account identifier and transaction information. RevenueCat also receives technical information such as platform, app version and IP address. We do not send child profiles, training history or parent email to RevenueCat, and automatic device identifier collection is disabled. Our own backend receives purchase events through an authenticated webhook. Advertising and attribution integrations remain disabled.
• Restricted Google purchase rehearsal: the designated adult uses a separate staging account and Google licence-test payment methods. Its disposable test records do not replace a U12 family's production account, training or permanent complimentary access. Other store accounts can incur real charges; only confirm a rehearsal when Google shows a test payment method.
• Expo provides the tool that delivers app updates. Each time the app checks for one, Expo receives the app version, the kind of phone, and the random per-installation ID described in §2.6, together with the IP address that any internet request carries. Expo acts as our processor and receives nothing about a player. This happens in the app whether or not anyone has an account.
• Crazytel runs the telephone number printed at the top of this policy. If you ring and leave a message, Crazytel records it and emails us the recording, so a message you leave is held by them as well as by us until we delete it (§8. We keep it as long as the rest of our support correspondence). We deliberately do not have your message transcribed. The option was there, it is cheap, and we turned it off: it would have sent whatever you said (your child's name included, if you used it), through an automatic transcription service, and that is a third company hearing a child's name to save us listening to twenty seconds of audio. It was not worth it. We listen to the message ourselves. Nothing about a call is connected to a player's profile.
• Cloudflare runs REP11's family service. The server the store app talks to, and the database that holds accounts, families, players, the family backup of their training, sign-in records, team features, feedback notes and the failure counts. It also stores feedback screen pictures, plays the drill videos, and hosts our public website, including the website's feedback page and the small database behind it (§2.4). The databases are Cloudflare's D1 service, which we asked to place them in its Oceania region (§8 says exactly what that does and does not promise). The household web version is different: it runs on a computer we operate ourselves in Australia. Cloudflare, Inc. is a United States company operating a global network. Cloudflare acts on our instructions as our processor. It is not permitted to use your information for its own purposes.
• Resend sends the two emails REP11 sends: the one-time sign-in code, and the security email to the account holder when a phone signs in to the family (§2.2). For each one it receives the grown-up's email address and the message (the code, or the kind of phone and how it signed in), and nothing about a child. We send from Resend's Tokyo, Japan region, and we have a data processing agreement with Resend, Inc. (a United States company), which acts only on our instructions. Each email is a simple REP11 email with a plain-text copy. The REP11 logo in it is one picture, the same for everyone, loaded from our own website, so it cannot tell us who opened what. There is no tracking pixel and there are no tracked links: nothing in them is measured.

We do not use advertising networks, data brokers, behavioural analytics SDKs, or any crash-reporting service that profiles users or follows them between apps.

One correction, made 2026-08-31, because the sentence above used to say "or crash-reporting services" without qualification and that was not accurate about the Android app. The app-update service described under App updates above (Expo) does two things we had not spelled out. It sends a random installation identifier with every update check, so it knows which installation to send an update to. And if the app has failed to start, the next update check carries the error message from that failure, so the service can decide whether to undo the update that broke it.

That second one is crash information leaving the device, and we now say so rather than implying otherwise. It is a recovery mechanism, not a monitoring one: it is sent once after a failure, it is not a profile, nobody at REP11 reads a dashboard of it, and neither the identifier nor the error message is connected to a player, a family or an account. Both are declared on our Google Play Data safety listing as Device or other IDs and Crash logs, collected for app functionality and shared with nobody.

RevenueCat processes purchase history for subscription functionality and purchase analytics, so the store privacy labels declare App functionality and Analytics for purchase history. This does not enable behavioural tracking of practice, advertising attribution or automatic device-identifier collection. We do not sell personal information, and we do not disclose it for anyone else's advertising.

If that ever changes, it changes here first, and, because the app is used by children, it is a decision made in the open, not a quiet dependency bump.

5. Advertising

• No advertising from any other company, ever, on any plan. Nobody is shown a third-party advertisement in REP11, and because we treat every player as a child (§1), that promise does not depend on anyone's age. Not on any profile, not on the free plan, not on a paid plan, not anywhere. No advertising network, no sponsored content, and nobody pays us to put anything in front of you or your child.
• We may tell grown-ups about our own things. REP11's paid plan, or another app made by Bolly Labs, the company that makes REP11. That is the only kind of promotion in REP11: it appears on grown-up screens behind a parent gate, never to a child and never as pressure aimed at a child; nobody else pays for it; and nothing about you or your child is used to choose it or is shared to show it.
• There is no third-party advertising in REP11, and none is planned. If that ever changed it would be a change to the promises above, and this policy, and the store declarations it feeds, would have to change first, in public, before it launched.

6. Notifications

Reminders are generated on your device. The device shows them, and there is no message from us hiding inside them. Because they are local, we do not collect a push token and cannot target them.

Two honest details. The phone app's practice reminder is also local: the phone schedules it, it asks permission once, and it can be switched off in Settings. In the household web version a reminder is on by default: it stays silent until a player has a streak worth protecting, is limited to one a day, never fires in the quiet hours, and a grown-up can switch it off permanently. An explicit off is remembered forever. Whether one is due is decided by the REP11 server that holds the profile, so the one-a-day rule cannot be argued with by a device; that check tells the server the hour of the day where the device is, and nothing else.

7. Children

REP11 is designed for children and used by children, and that shapes everything above rather than adding a paragraph at the end.

• No under-18 can create an account, at any age. There is one account type and it belongs to an adult, so this is not an age gate we have to police. There is simply no signup path for anyone else to take. The adult confirms they are 18 or over and adds a payment method, and the card is the check that matters: at the paying moment, an adult is there. A player in the 13+ age band can be given their own sign-in by a grown-up of the household (§2.2), but it is never an account: it cannot see the account, plans, prices or other players, and it cannot add anyone.
• Every player is treated as a child, including the adults (§1). We do not sort people into stricter and looser regimes, so nobody's protection depends on us correctly guessing their age.
• The account holder controls a child's profile (an adult aged 18 or over, usually the child's parent or guardian) creating it from their own account, and asking us at any time to correct or delete it (§9).
• Nothing a child does in REP11 is visible on the open internet, and nothing is visible outside the household unless a grown-up switches on the club board, a coach's view or the team wall below. The leaderboard is the household's own profiles by default. There is no friend search, no public profile, no feed, and no way for anyone to message or contact a child through the app.
• The club board is the one sharing feature, and it is off until a parent turns it on. A player whose profile carries a verified club can appear on that club's own board, visible only to other REP11 families at the same club. The board shows exactly four things: first name only (we cut the stored name at the first word, never a surname), avatar, points for showing up this week, and streak. Never a full name, never a photo, and there is no way to reply, react or message from it. The switch lives in the grown-up settings behind the parent gate; a child can ask to be on the board, but the ask is a request and never a grant; and switching it off removes the player from the board immediately.
• Coaches. A grown-up whose family has REP11 Premium can set themselves as a coach and make a team. If your family has Premium, you can join a coach's team with the code they give you. Joining shares nothing. If you switch it on for a player, that player's coach can see two things: the player's first name and in-game avatar (a cartoon player built from preset parts, not a photo, and never their other saved looks), so two players with the same name can be told apart. Nobody sees a child's face. The coach can also give each player a shirt number for their team. The coach's own note on the team, not something we take from your family. The coach never sees which skills they practised or when they trained, and never their scores, stars, streaks, personal bests, surname, age, photo or messages. You can switch it off or leave the team at any time in Account settings, and it stops at once. If a team has an assistant coach, they see a player only if you also say yes to them. A coach can suggest drills from REP11's own library; they cannot write to your child. We keep which team you joined and each switch until you leave the team or delete your account.
• The team wall. If your family is on a coach's team and you switch a player on for the team wall, other players on that team can see the player's first name and REP11's own shout-outs about them (a new personal best, a streak, a team goal). About training, the wall shows only how many players on the team trained today, never who; each player sees just their own flame. They can send one of three preset cheers or a football handshake, never a message. If your family is not on a team, the team wall shows only your own family. You can switch it off in Account settings at any time, and it stops at once.
• REP11 Arena. REP11 Arena is a separate football game made by us. If a grown-up connects it to REP11 and approves which players it may show, Arena reads each approved player's name, shirt number, kit colours and look, and which of Arena's skills the player has collected in REP11 (just the skill's name, such as Cruyff Turn). It never receives stars, scores, dates or training history, and it can never change anything in REP11 or send anything back. A grown-up can remove Arena at any time at REP11 › Arena devices, and it stops at once.
• We ask parents not to use a child's surname as a display name, and nothing in the app requires one.
• United States (COPPA): REP11 is directed to children, and a child's profile inside a parent's account does reach our server. Putting that record under a parent's account does not stop it being information about a child. What is held is set out in §2.1 in full. It is not only a name, an age band and progress, and any shorter summary of it is wrong.

How a parent consents. Only an adult can create an account, and only the adult who owns it can create a child's profile inside it. There is no path by which a child's record reaches us without an adult signing in and making it. Before we open REP11 beyond closed testing, the parent will be shown, on that screen and before the profile is created, the notice set out immediately below. In the store app today, a child's profile and training record reach us as part of the family backup, and only after the grown-up has signed in, ticked that they are 18 or over and agreed to this policy (§1, §2.6). The club board, a coach's view and the team wall (the only features that show anything about a child to anyone outside the household) are each separate, off by default, switched on only by a grown-up of the household, and switching either off removes the player immediately.

What a parent is told, and when (the COPPA direct notice: drafted here so the lawyer edits rather than writes it). Before a child profile is created, the parent will see, on that screen and not buried in this page:

• That we have collected their contact details to get their consent.
• That they must consent before their child's profile is created, and what happens if they do not (no profile is created, and nothing about the child is sent to us).
• Exactly what we will hold about the child. The list in §2.1, in full, not a summary, plus anything typed into the feedback box (§2.3), which a child can use.
• What we use it for: running their training and showing their progress.
• Who else sees it: nobody, unless the parent later switches on the club board, a coach's view or the team wall, each a separate, off-by-default choice.
• That we never use it for advertising, and never sell it.
• That the parent can review it, correct it, export it, refuse any further collection, and delete it at any time, and how.
• A link to this policy.
• Bolly Labs Pty Ltd's name, physical address, telephone number and email. COPPA requires all four, and two email addresses is not enough.

What the store app sends is listed in full in §2.6: the family backup of the child's profile and training (under the grown-up's account and consent), the team features a grown-up switches on, feedback, the failure notes, and the update check. Two persistent identifiers are involved, and both exist only to support the app's own internal operations: the update-check identifier (delivering updates. We never receive it), and the grown-up's sign-in record for each phone (keeping the account signed in and secure, §2.2). Neither is used to contact a child, to build a profile of anyone, or for advertising.

• Australia: we follow the Australian Privacy Principles as our standard. In practice that means: we collect only what the app needs to work (§2 and §3); if you send us something we did not ask for (in a name field, a club name or a feedback note) we will destroy or de-identify it once we notice, unless we could lawfully have collected it; we hold it securely (§8); you can see and correct it (§9); and you can complain, with a process and a timeframe (§10).

We follow the Australian Privacy Principles as our standard, by choice, rather than waiting to be told whether a company our size is legally required to. Australia's Children's Online Privacy Code is due to be registered by 10 December 2026; we intend to meet it, and we will re-read this policy against it when it lands.

• UK / EU (GDPR and UK GDPR). REP11 is available worldwide, so this applies. Controller: Bolly Labs Pty Ltd (ACN 701 365 246), South Australia, Australia. Contact: support@rep11football.com.
• Why we are allowed to hold what we hold. Running the app for you (your profile, your training history, your subscription) is on the basis that it is necessary to perform the agreement you made with us when you created an account. Keeping the service secure and working, including the security email when a phone signs in (§2.2) and the weekly reading of which days families trained (§2.7), is on the basis of our legitimate interests, and we have weighed those against your privacy. For a child's profile, the agreement is the parent's, not the child's: we rely on the consent of the person with parental responsibility, given when they create the profile, and on our legitimate interest in running the training they asked for. Three things are consent-only, off by default, and withdrawable at any time: the club board, a coach's view of a player, and a player on a team's wall. Reminders (§6) are part of running the app for a household, and a grown-up can switch them off permanently.
• Your rights. You can ask us for a copy of what we hold, correct it, delete it, restrict or object to what we do with it, take it elsewhere in a portable form, and withdraw any consent you gave, and withdrawing is as easy as giving it, by turning the same switch off. A child's rights are the child's, even where the record sits inside a parent's account; where the child is old enough to exercise them, we deal with the child.
• Complaining. You can complain to your own country's data protection authority. In the UK that is the ICO; in Ireland the DPC; elsewhere in the EU, your national authority.
• Where your data goes. To Australia, where we are; onto Cloudflare's global network for REP11's family service and the website, with the databases placed in its Oceania region (§8 says exactly what we can and cannot promise about where that sits); and, for the two emails in §2.2, through Resend in Japan. Australia does not have an EU adequacy decision, so a transfer out of the EU/UK to us relies on Standard Contractual Clauses. We are putting those in place with our hosting provider, and we will say here when they are signed.
• Children's consent age in the EU. The age at which a child can consent for themselves ranges from 13 to 16 depending on the country. This does not change what we do, because REP11 never relies on a child's own consent for anything: an adult creates the account, an adult creates each profile, an adult gives a player their own sign-in, and the three consent-based features (the club board, a coach's view and the team wall) are switched on only by an adult.
• Automated decisions. We do not make decisions about you by automated means that produce legal or similarly significant effects. Choosing which drill to suggest is not one of those.

8. Where your information is held, and for how long

• Guest play (only on phones that were already playing as guests, §1): on the device. Uninstalling the app removes it. We never receive it unless a grown-up signs in to save it.
• Profiles and training in the app on Google Play and the App Store: in two places: on the phone, and, once a grown-up signs in, in the family's backup in REP11's family service on Cloudflare (§4), together with the account, the family, the sign-in records and the phones signed in to it.
• Accounts and profiles in the household web version: on a computer we operate ourselves, in Australia.
• Sign-in codes and security emails (§2.2): sent through Resend's Tokyo, Japan region (§4).
• REP11's family service and the website's feedback page (§2.4): with Cloudflare (§4), in databases we asked Cloudflare to keep as close to Australia and New Zealand as it can (its Oceania region). We should be straight with you about the limit of that promise: Cloudflare's database service takes our region preference as a hint and does not contractually guarantee the data never leaves it, and its network is global by design. So the honest sentence is: we have asked for this region, we expect it, and we cannot guarantee it. If contractual residency in Australia ever becomes something we must promise, we would have to move to a different provider to promise it, and we would tell you before we did. Bolly Labs Pty Ltd is an Australian company, so we are in Australia whatever the servers are doing.
• How long, by category. "Until you delete it" is not a real answer for a child's record, so here is the actual schedule.

| What | How long we keep it | |---|---| | A child's profile and training history | While the account is live. If nobody signs in for 24 months we tell you, and if nothing happens by 36 months we delete it | | The account itself: sign-in identity, email address, join codes | The same rule as the profiles under it: deleted with everything under it at 36 months of silence, or immediately when you delete the account | | A player's own sign-in (13 and over). The sign-in identifier and its session records | Until a grown-up takes it away, the player or the family is deleted, or the player deletes it in the app | | Sign-in records: when each sign-in started and was last used, how it signed in, and the kind of phone (§2.2) | While the account exists, including phones that have been signed out; deleted with the account | | A one-time sign-in code | Kept only as a scrambled (hashed) form; works for 10 minutes; deleted once used, or cleared out after it expires | | The weekly reading of which days families trained (§2.7) | Kept by us with no family id in it, for as long as it helps us improve REP11; it cannot be matched back to a family | | A coach's team, the families that joined it and each player's switch | Until you leave the team or delete your account; a head coach deleting their account removes the team | | The team wall. Each player's switch, the cheers, handshakes, shout-outs and goals | Until you leave the team, or delete the player or your account | | A REP11 Arena link, which players it may show | Until you remove Arena at REP11 › Arena devices, or delete your account | | Feedback you send us | 12 months | | A note that signing in, backing up or syncing failed (§2.3) | 14 days, as daily counts | | A club application we approved | The life of the club relationship, then 24 months | | A club application we rejected or you abandoned | 90 days | | Club-board publication records | Removed when you switch it off; the record that you switched it on or off is kept 12 months | | Purchase and subscription records | 7 years: Australian tax law requires it | | Support and privacy correspondence | 24 months | | The log proving we deleted something | 7 years, minimised |

• Deleting. Delete a profile and its training history goes with it. Delete the account and everything under it goes, the sign-in identity included. Deletion from our live systems is immediate. Two honest exceptions:
• Backups. Our database keeps a rolling recovery window of 30 days, so a copy of a deleted record can survive in that window before it ages out. It is never restored to serve anyone; it exists so that a mistake or a failure on our side does not lose your family's training history. So the full sentence is: immediately from live systems, and within 30 days from backups.
• Purchase and deletion records, which we keep for the periods in the table above because Australian law requires it.
• Security. In plain terms: everything travels over an encrypted connection; access to the live database is limited to the people who run the service, which today is a very small number of people; in the household web version profile PINs are stored only as salted scrypt hashes, never as digits, and in the phone app every PIN stays in the phone's own protected storage and never leaves it (§2.1); and there is no advertising or behavioural tracking code in the app. Our build guards check the SDKs and permissions against that promise. Optional subscription purchase analytics are described separately in §4.

One deliberate exception you should know about, because it is a choice and not an oversight: a profile PIN is never locked out. There is no attempt limit, no timer and no cooling-off period, and we will not add one. A four-digit PIN can therefore be guessed by someone holding the tablet, and we would rather tell you that than imply a strength it does not have. We chose it that way because a child locked out of their own football app by their own PIN is a worse outcome than a sibling guessing 1234, and because the PIN is not protecting anything a person holding the unlocked tablet could not already reach. Treat it as the lock on a bedroom door between siblings, not as the lock on a safe. If you need real protection for a device, use the device's own passcode. That is the one doing the work.

If something does go wrong, we will investigate it, fix it, and tell the people affected and the regulators we have to tell, as quickly as we can establish what happened.

9. Your choices and rights

• See it: ask us for a copy of what we hold about your account.
• Fix it: ask us to correct a name, band or avatar. Age band corrections never remove anything a player already earned.

• Delete it: ask us and we will delete a single player, or your whole account. Deleting a player deletes that player's training history with them.

• Take it with you: ask and we will export your family's training history in a readable format.
• Withdraw: sign out of a phone to stop its backup, or delete the whole account yourself in the phone app (Settings → Parent account → Delete parent account), or ask us. A guest profile that was never saved never involved us at all.
• Feedback you send us: the notes typed into the in-app feedback box belong to the household, not to any one player, so deleting a player does not delete them. They are included in your export and have their own Delete my notes control, which stays behind the parent gate.

• Who can type it: anyone in the household, including a child. The box takes free text, so the app asks (in the box, in words a child can read), for no names, addresses or phone numbers. Nothing typed there is shown to any other user.

To ask for any of these, contact support@rep11football.com.

10. Complaints

Tell us first. We would rather fix it than be reported for it. Email support@rep11football.com with "Privacy" in the subject and tell us what happened. You can also ring the number at the top of this page, though email is better for this: it gives you a written record of what you asked and when, and the clock below runs from the moment it arrives. If you do ring and we miss you, please leave a message. An unanswered call with no message tells us nothing about who to call back or why (and see §4 for what happens to a message you leave).

What we will do, and when. We will confirm we have your complaint within 5 business days, and give you a substantive answer within 30 days. If we need longer we will tell you why and when. If we got it wrong we will say so, fix it, and tell you what we changed.

If you are not satisfied with our answer, you can escalate. You do not need our permission and you do not have to come to us first:

• Australia: the Office of the Australian Information Commissioner, oaic.gov.au
• UK: the Information Commissioner's Office, ico.org.uk
• EU: your national data protection authority
• Anywhere else: your local privacy or consumer regulator

11. Changes

If we change this policy we will update the version and date above, and for any change that affects children or introduces a new third party we will say so in the app before it takes effect.

What changed in v1.12 (2026-10-08). We brought this policy into line with the app as it is now and with what our store forms say. A new install of the store app has no guest option. A grown-up signs in first; phones already playing as guests keep their players and can save them (§1, §8). §2.6 now lists everything the store app sends (sign-in, the family backup of players and training, team features, feedback, failure notes, drill videos and update checks), instead of saying nothing else leaves the phone, and §4 and §8 say where it is held: REP11's family service on Cloudflare, with its databases placed in Cloudflare's Oceania region. Sign in with Apple is live on iPhone and iPad, and a one-time email code is the third way in (§2.2). We describe the PINs and grown-up check in the phone app (§2.1), the kind of phone kept with each sign-in and the Signed-in devices list (§2.2), and the security email to the account holder when a phone signs in (§2.2). One new company is involved: Resend, which sends the sign-in codes and those security emails from Japan (§4). And we describe the weekly reading of which days families trained, kept with no family id, that tells us whether REP11 is working (§2.7). The header now says the app is on iOS too (in Apple's TestFlight beta testing for now). The coach's view, shirt numbers, the failure notes and "no advertising from any other company" are unchanged. Corrected later the same day, still v1.12: §4 describes the two emails as they now look (a simple REP11 email with our logo and a plain-text copy, still with no tracking of any kind), and the policy's wording no longer uses dashes. Nothing about what we collect, why, or who we share it with changed.

What changed in v1.11 (2026-10-08). Three things. We now say what a coach sees in the plainest words: the player's first name and in-game avatar (a cartoon player built from preset parts, not a photo), and a shirt number the coach can give each player for the team (§7). If signing in, backing up or syncing fails, the app now sends us a short note of which step failed and its error code, with the app version and the kind of phone (never a name, an email, an account or anything about your child) kept for 14 days (§2.3, §8). No new company is involved.

What changed in v1.10 (2026-10-08). Three things. A coach now sees the avatar a player built in REP11 beside their first name (the cartoon figure, never a photo), so two players with the same name can be told apart; nothing else about the player reaches the coach (§7). The team wall paragraph now says exactly what the wall shows about training: how many players on the team trained today, never who. The wall already worked that way, and the old words said more than it shows (§7). And §5 now says plainly that no plan, free or paid, ever shows advertising from another company, and that the only things REP11 may tell grown-ups about are its own paid plan and other Bolly Labs apps. Nothing new is collected and no new company is involved.

What changed in v1.9 (2026-10-07). A coach now sees less. If you switch a player on for a coach's team, the coach sees that player's first name and nothing else: not which skills they practised, not when or whether they trained, and no scores, stars, streaks or personal bests (§7). Nothing new is collected and no new company is involved.

What changed in v1.8 (2026-10-06). When a grown-up, or a player aged 13 or older, sends feedback from the app, a picture of the screen they were on now goes with it unless they tap Remove; a child's feedback never does. We also describe how the app shows what happened to the feedback you sent (§2.3). Nothing else is collected and no new company is involved.

What changed in v1.7 (2026-10-05). Two things. The team wall is now available: a family that joins a coach's team can switch a player on, and teammates then see that player's first name, whether they trained today and REP11's own shout-outs about them, and can send a preset cheer or a football handshake, never a message; without a team, the wall shows only your own family (§7). And we now describe REP11 Arena, our football game: when a grown-up connects it, it reads each approved player's name, shirt number, kit, look and which Arena skills they have collected in REP11, nothing more, and it can never change anything in REP11 (§7). No new company is involved.

What changed in v1.6 (2026-10-03). We brought four statements about the phone app up to date with the app as it is now. The app on Google Play and the App Store asks a grown-up to sign in first (the household web version still works without an account). Signing in backs up the family's players and training so they can be restored on another phone; signing out stops it (§1, §2.2). The app has a "GIVE FEEDBACK" button (§2.3). And the phone's practice reminder is local to the phone (§6). Nothing new is collected and no new company is involved.

What changed in v1.5 (2026-10-03). Three things became available, each off until a grown-up of the household chooses it. A second grown-up can join a family in person, and we now record your 18-or-over confirmation on your account (§2.2). A player in the 13+ age band can be given their own sign-in by a grown-up of the household; we keep only the sign-in identifier, never their email address (§1, §2.2). And a grown-up whose family has Premium can coach a team: if you switch it on for a player, the coach sees their first name and which skills they practised in the last 7 days, nothing more (§7).

What changed in v1.4 (2026-10-02). We describe who holds an account more accurately: an account holder is any adult aged 18 or over who signs in (a parent, a guardian, or an adult who plays themselves), rather than only a parent or guardian. Nothing about what we collect, who receives it or how children are protected has changed.

What changed in v1.3 (2026-09-27). We described optional parent-consented cloud backup in designated test builds, what it saves, recovery and offline limits, and the separation between test families and lasting U12 accounts. We corrected the older statement that parent sign-in was unavailable.

What changed in v1.2 (2026-09-27). We described the restricted Google purchase rehearsal separately from complimentary family access. We corrected the RevenueCat identity to the adult account identifier, named purchase analytics and our own purchase webhook, and kept child training out of that data flow. At that version, optional family training backup remained off in the store app.

What changed in v1.1 (2026-09-02). We said which version of REP11 each section describes, because the app on Google Play keeps everything on the phone while this policy also covers the household web version. We corrected where the training database lives (not on Cloudflare). We stopped describing a birth year we do not collect. We said reminders are on by default in the web version, and where the decision is made. We corrected the Standard Contractual Clauses sentence: they are being put in place, not in place. We named Crash logs alongside the update-check identifier the store app sends. We added the account itself to the retention table. And we removed a claim that a parent can correct or delete a profile from inside the store app: today that is done by asking us (§9). Since v1.0 we had also added the telephone number and named Expo and Crazytel in §4.

If something here is unclear, or you think we have got something wrong, we would genuinely like to know: support@rep11football.com.