Privacy Policy

Yalla Goal (“Yalla Goal”, “we”, “us”, or “our”) is a mobile application and related online services that help users discover, manage, and reserve football pitches and other sports venues operated by independent venue owners and administrators (“Venue Owners”). This Privacy Policy explains how we collect, use, disclose, and protect information about users of the app, including players, Venue Owners, and their authorized administrators (collectively, “you” or “users”).

By creating an account, accessing, or using Yalla Goal, you acknowledge that you have read and understood this Privacy Policy. If you do not agree, you should not use the app or related services.

This Privacy Policy is effective as of August 8, 2026 and may be updated from time to time as described in the “Changes” section below.

This Privacy Policy applies to:

• The Yalla Goal mobile application on iOS and Android.
• Any websites, APIs, or backend services we operate that are used to support the app.
• Customer-support and administrative communications relating to venue reservations, account management, and privacy or legal requests.

It does not apply to:

• Independent Venue Owners’ own websites, apps, or offline practices.
• Third-party services such as Apple Maps, Google Maps, Clerk, Supabase, or hosting providers, which process data under their own policies and terms.

When you use Yalla Goal, you may provide information directly to us or to our service providers. This includes:

1. Account and profile information (via Clerk)
   • Name or display name.
   • Email address.
   • Profile image (optional).
   • Authentication factors (for example, password or passkey) and multi-factor authentication details, if enabled.
   • Session identifiers and related token data used to keep you signed in.
2. Booking and venue use information (stored in Supabase)
   • Clerk user ID.
   • Name and email associated with your account.
   • Venue name or identifier, booking date, start time, duration, and price.
   • Cash-payment status (for example, paid, unpaid, or refunded) as recorded by the venue or the app.
3. Venue administrator information

   Authorized Venue Owners or administrators may provide:

   • Venue business name and type (for example, football pitch or indoor facility).
   • Venue address and precise coordinates (latitude and longitude).
   • Contact phone numbers and other business contact details.
   • Venue descriptions, rules, and policies.
   • Venue and pitch photos, logos, and other media.
4. Support and communications

   When you contact us, we may process:

   • The email address or other contact method you use.
   • The content of your request, such as booking disputes, bugs, or privacy requests.
   • Any attachments you choose to send, such as screenshots.

Please do not include sensitive categories of information, such as health records beyond what is reasonably needed for safety communications, government ID numbers, or payment card details, in support messages.

When you use the app, certain information is collected automatically by us or our infrastructure providers.

1. Device and usage information
   • Device type, operating system, and app version.
   • Basic technical logs such as request timestamps, error logs, and server performance data.
   • IP address, general locale, and basic routing information used for service security and troubleshooting.
2. Authentication and authorization information

   Clerk and Supabase process authentication tokens and related claims to determine whether requests are authorized, including your Clerk user ID, session state, and Supabase row-level security checks.

3. Maps usage data

   Apple Maps and Google Maps may receive device and location-related data when the app displays maps or directions, as described in their own privacy policies.

We do not presently include a separate third-party analytics SDK for behavioral tracking or crash reporting in the production app.

Yalla Goal uses location data in two distinct ways:

1. Foreground device location (players and users)
   • With your permission, the app accesses your current foreground device location to calculate distance to nearby venues and display them on maps.
   • This location is processed for the current session and is not stored in our booking or venue database as a historical player-location record.
   • You may deny or revoke location access at any time in your device settings. Nearby sorting and map distance features may be limited, but you can still browse venues manually.
2. Venue coordinates (Venue Owners)
   • Authorized administrators may provide exact venue coordinates when creating or editing a venue.
   • These coordinates are stored as part of venue business data so users can find the location and obtain directions.

We do not request or use background location, Bluetooth-based location, or geofencing for marketing purposes.

Photo-library access is requested only in the following context:

• When a Venue Owner or administrator chooses venue images, the app may request permission to access the device photo library, limited to the specific images the administrator chooses.
• Selected images are uploaded to a secure Yalla Goal storage bucket designated for venue images, such as Supabase storage or equivalent infrastructure.
• The app does not scan or upload other photos from the library and does not request camera access for players.

Players currently do not upload public content, such as match photos, within the app. If this changes, any new use of images will be described in updated documentation and policies.

We use personal and non-personal information for the following purposes:

1. Providing and improving the service
   • Authenticate accounts and keep users signed in using Clerk.
   • Provide venue search, maps, and nearby results.
   • Create, display, and manage bookings and booking codes.
   • Assign venue owners, enforce venue ownership permissions, and prevent double-booked or conflicting reservations.
   • Offer support and respond to user or venue requests.
2. Security and fraud prevention
   • Protect accounts and venues from unauthorized access.
   • Monitor for suspicious booking patterns or abuse, such as mass fake reservations or scraping.
   • Enforce row-level security in Supabase so users only access bookings and data appropriate to their role.
3. Legal compliance and risk management
   • Comply with applicable laws, regulations, and lawful requests from authorities.
   • Maintain records required for accounting, dispute resolution, and fraud prevention.

We do not sell personal information, use behavioral advertising within the app, or collect or store payment card, bank, Apple Pay, or Google Pay details. All current payments are made in cash at the venue according to the venue’s rules.

We rely on certain service providers to operate Yalla Goal:

1. Authentication — Clerk

   Clerk provides user account creation, sign-in, and session management, and processes account data such as name, email, profile image, authentication factors, and session identifiers. Clerk acts as an authentication provider under its own terms and privacy policy.

2. Database and storage — Supabase

   Supabase provides our primary database, serverless functions, and venue-image storage. It processes booking records, venue data, and related logs subject to its own terms and privacy documentation.

3. Maps providers — Apple Maps and Google Maps

   Apple Maps and Google Maps provide map display, distance calculations, and location-based directions, and process location-related data as described in their policies.

4. Hosting and infrastructure

   Cloud hosting and networking providers may process basic service logs and operational data to keep the app available and secure.

We do not currently embed third-party advertising SDKs or cross-app tracking technologies. If we add new service providers or trackers in the future, we will update this Privacy Policy or provide additional disclosures consistent with applicable laws.

Where privacy laws such as the General Data Protection Regulation (GDPR) apply, we process personal data on one or more of the following legal bases:

• Performance of a contract, such as providing the app and bookings you request.
• Our legitimate interests, such as securing the service, improving functionality, and preventing misuse.
• Compliance with legal obligations, such as keeping certain records for accounting or tax purposes.
• Your consent, such as for optional location access and photo-library access.

We retain information only for as long as necessary to fulfill the purposes described in this Privacy Policy or as required by law.

1. Account and booking data
   • Account information is kept while your account is active.
   • When you permanently delete your account using the in-app “Delete account and data” feature, we request deletion of the Clerk account, sessions, account-linked bookings in Supabase, and venue-ownership assignments tied to your account.
2. Retained records

   Certain information may be retained after account deletion if reasonably necessary for:

   • Fraud prevention and security investigations.
   • Dispute resolution with venues or users.
   • Accounting, tax, or other legal obligations.

   Wherever feasible, retained data will be minimized or anonymized, such as by storing non-identifiable booking statistics.

3. Venue business content

   Venue business records, such as venue descriptions and photos, may be reassigned to another authorized administrator or removed separately, even if an individual administrator deletes their personal account.

We implement technical and organizational measures designed to protect information from unauthorized access, loss, misuse, or alteration. These measures include:

• Encrypted network transport, such as HTTPS.
• Secure native token or credential storage on user devices.
• Signed Clerk sessions and secure token validation.
• Supabase PostgreSQL row-level security policies restricting access based on Clerk user IDs and roles.

No system can guarantee absolute security. You are responsible for maintaining the confidentiality of your account credentials and promptly notifying us of any suspected unauthorized use.

Yalla Goal is not directed to children under 13 years of age, and we do not knowingly collect personal information from children under 13. If a parent or guardian believes their child has provided personal information without consent, they should contact us so we can take appropriate steps, including deletion where applicable.

Depending on where you are located and where our providers operate, your information may be transferred to and processed in countries with different data-protection laws than your own. Where required, we take steps to ensure that such transfers comply with applicable laws, such as using appropriate contractual safeguards between us and our service providers.

Subject to applicable law, you may have rights regarding your personal information, such as:

• Access: Request a copy of information we hold about you.
• Correction: Request that we correct inaccurate or incomplete information.
• Deletion: Delete your account within the app or request deletion by email.
• Restriction or objection: In certain cases, object to or restrict specific processing activities.
• Portability: Request a structured, machine-readable copy of certain data you provided, where technically feasible.

You also have choices regarding permissions and features:

• You may deny or revoke location access.
• You may deny or revoke photo-library access for venue images.
• You may sign out of your account, change language preferences if available, or delete your account.

To exercise your rights or make a privacy-related request, contact us at privacy@yallashoot.app. We may need to verify your identity before fulfilling certain requests.

We may update this Privacy Policy from time to time to reflect changes in our practices, services, or legal requirements. When we make material changes, we will provide notice within the app, such as through a banner or in-app message, or via the contact information associated with your account.

The “effective” date at the top of this policy indicates the latest revision.

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, contact us at:

We will review and respond to privacy inquiries within a reasonable timeframe, subject to applicable law.