Privacy and terms

Feed is a personal project, run by one person in the UK for korfball coaches. It is not a company. Anything below that says “we” means that person, and the address for every question here is hello@korf-feed.co.uk. Under UK data protection law that person decides what Feed collects and why, and so is the controller of what it holds.

Your account: the email address and username you sign up with, a salted hash of your password (never the password itself), and whether your address has been confirmed.

Your sessions: one row per signed-in browser, holding a hash of the session token, when it expires, and the browser, operating system and rough location (city and country, never the IP address) it was signed in from, so the account page can show you which is which.

Emailed links: the confirm-your-address and reset-your-password links are stored hashed too, and deleted once used or expired.

What you log: teams, rosters, games and every event in them, with the YouTube video id each game was logged against. A roster is a list of people’s names, shirt numbers and gender that a coach typed in. A player can ask the coach or us to have their name removed.

Rate-limit counters: short-lived counts keyed by account or by IP address, so sign-in and email forms can’t be hammered. They expire within a day.

Nothing else. Feed has no advertising and no tracking pixels. It counts page views and page speed, and records errors when something breaks; both are covered below.

Your account, sessions, teams and games are used to give you the service you signed up for, and for nothing else. The rate-limit counters, error reports and page-view and speed counts are used to keep Feed secure, working and fast, which is a legitimate interest of running it; they hold nothing that identifies you beyond what is described on this page.

A roster is a coach’s own record of their team, and the coach decides what goes in it. Feed keeps it to run that team’s pages, and removes a name when asked.

The app runs in London and the database is hosted in Europe, so your account, teams and games are stored in the UK and Europe. The domain’s DNS provider sees only what it needs to route a request. The email and error-reporting services below are run by companies that may handle their share of your data outside the UK and Europe.

An email service delivers the emails Feed sends: address confirmation, password resets, and team invitations. It sees the recipient address and the message.

YouTube plays the footage. The player is loaded from YouTube’s cookieless host, so watching a video inside Feed does not set YouTube’s advertising cookies, but your browser does connect to Google to fetch it and Google’s own privacy terms apply to that connection.

Page-view and speed counts show us how the site is used and where it is slow: which page, roughly where from (country-level, worked out from your IP address, which is not stored), the kind of device and browser, and how long the page took to load. They set no cookies, do not track you across other sites, and are never linked to your Feed account.

Error reports go to an error-reporting service when something breaks, so the fault can be found and fixed. A report holds the error message, where in the code it happened, the page address (with any share key or emailed-link token removed), your browser and device type, and the time. Your account details are not attached, and reports are used for nothing else. The same service also gets a note if your browser blocks something on a page for security reasons.

No data is sold, and none goes to anyone other than the services described on this page.

Feed sets one cookie, the session cookie that keeps you signed in. It is HTTP-only, sent over HTTPS only, and lasts up to 90 days, ending sooner if you don’t use Feed for 14 days. There are no other cookies and nothing is stored in your browser for tracking. The logger keeps its keyboard shortcuts and video-window preference in your browser’s local storage; that never leaves your machine.

Everything is private by default. A team, its analytics and each game are visible only to the people its owner has added, until the owner chooses to share a link or make a surface public. How that works is in the guide.

Your account and what you log stay until you delete them. Sessions expire after 14 days without use, and never last more than 90 days from sign-in. Reset links expire after an hour, confirmation links after a day and rate-limit counters within a day. A daily sweep removes whatever has expired. Error reports are kept for up to 30 days, then deleted automatically.

You can delete your account from the account page. That removes your account, your sessions, and every game that only you could reach. Teams you own alone go with it. A game shared with another club stays, because it is their record too, but your account is no longer attached to it.

If you are the only owner of a team that has other members, Feed asks you to make someone else an owner first, or delete the team, so the others aren’t stranded.

To have a player’s name removed from a roster, ask the coach who runs that team, or email hello@korf-feed.co.uk and we will handle it. The same address answers any other question about your data, including a copy of what Feed holds about you.

You can ask for a copy of what Feed holds about you, ask for it to be corrected or erased, and object to how it is used. Email hello@korf-feed.co.uk and we will reply within one month. If you are not happy with the answer, you can complain to the Information Commissioner’s Office at ico.org.uk.

Feed is provided as it is, free of charge, with no promise that it will keep running or keep your data forever. Back up anything you would mind losing. You are responsible for what you enter and for who you share it with. That includes other people’s names: only record someone if you have a fair reason to.