Privacy Policy

Apperrific Ltd. ("we", "our", or "us") operates In The Book, a sports attendance tracking platform. This Privacy Policy explains how we collect, use, store, and protect personal data when you use our Service. We are committed to handling personal data in accordance with the General Data Protection Regulation (GDPR) and applicable Irish and EU data protection law.

1. Who We Are

Apperrific Ltd. is the data controller for personal data you provide when registering for and using the Service as an individual user. For attendance data entered by your organisation (such as member names and attendance records), your organisation acts as the data controller and we act as the data processor.

Our registered address is in Ireland. You can contact our data protection contact at privacy@apperrific.com.

2. Information We Collect

We collect the following categories of personal data:

Account information

• Name and email address (provided on registration)
• Google account information (if you sign in with Google)
• Profile photo (optional, uploaded by you)
• Role and organisation assignment (set by an administrator)

Usage data

• Login timestamps and activity within the Service
• Standard web server access logs (IP address, browser type, pages visited)

Attendance and member data (processed on behalf of your organisation)

• Member names entered by coaches or administrators
• Attendance records (attended, absent, excused) for events
• Team and event information created by your organisation

3. How We Use Your Information

We use personal data for the following purposes and legal bases:

4. Data Storage and Security

Your data is stored on servers located within the European Economic Area (EEA). Profile photos and organisation logos are stored in Amazon Web Services S3 (EU region). We implement appropriate technical and organisational measures to protect personal data, including:

• Encryption in transit (TLS) for all data between your browser and our servers
• Passwords are stored as bcrypt hashes and never in plaintext
• JWT tokens are used for authentication with short-lived sessions
• Access controls limiting who can view data based on organisation and role
• Regular database backups

No method of transmission or storage is 100% secure. While we take appropriate steps to protect your data, we cannot guarantee absolute security.

5. Data Retention

We retain your account data for as long as your account is active or as needed to provide the Service. Attendance and member data entered by your organisation is retained for the duration of your organisation's use of the Service and for a reasonable period thereafter to allow data export.

When an account or record is deleted within the Service, it is initially soft-deleted (hidden but retained) and may be permanently removed after a reasonable period. You may request permanent deletion at any time by contacting us.

6. Sharing Your Information

We do not sell, rent, or trade your personal data. We may share data with:

• Amazon Web Services — for cloud file storage (profile photos, logos)
• Google — if you choose to sign in using Google, your Google account information is used for authentication only
• Legal authorities — where required by law or to protect the rights, property, or safety of Apperrific Ltd. or others

Within your organisation, user accounts, team data, and attendance records are visible to administrators and coaches in accordance with the role-based access controls of the Service.

7. Your Rights Under GDPR

If you are located in the EEA or UK, you have the following rights regarding your personal data:

• Right of access — to obtain a copy of the personal data we hold about you
• Right to rectification — to correct inaccurate or incomplete data
• Right to erasure — to request deletion of your personal data, subject to legal obligations
• Right to restriction — to request that we restrict processing of your data
• Right to data portability — to receive your data in a structured, commonly used format
• Right to object — to object to processing based on legitimate interests
• Right to withdraw consent — where processing is based on your consent

To exercise any of these rights, contact us at privacy@apperrific.com. We will respond within 30 days. You also have the right to lodge a complaint with the Data Protection Commission (Ireland) at dataprotection.ie.

8. Cookies

The Service uses a small number of essential cookies and browser storage to maintain your session and preferences. We do not use advertising cookies or third-party tracking cookies. The only third-party scripts loaded are Tailwind CSS (CDN), Alpine.js (CDN), and optionally the Google Identity Services script for Google sign-in.

9. Children's Privacy

The Service is not directed at children under 16 years of age and we do not knowingly collect personal data from children. The attendance records managed through the Service may include information about minors (e.g. team members who are underage athletes). The organisation using the Service is responsible for ensuring appropriate consents are in place for any personal data relating to minors.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on this page with a revised date. Your continued use of the Service after changes are posted constitutes your acceptance of the updated policy.

11. Contact Us

For any questions, concerns, or requests relating to this Privacy Policy or your personal data, please contact us at: