Skip to content

Privacy

Privacy Policy.

What we collect, what we don’t, and how spectator and admin data is handled across Eggbeater. We do not sell or share personal data.

  • No data sold or shared
  • HTTPS / TLS encrypted
  • Sign-in optional

Effective March 28, 2026Last updated April 5, 2026

Overview & collection

1About this policy

Eggbeater is a tournament-tracking tool for water polo teams and clubs. It does not sell or share personal data. This Privacy Policy describes how the Eggbeater Water Polo app ("the App") handles information when you use it — in any browser, or via our native applications for iOS, Android, and Apple TV. By using the App you agree to this policy. The Apple TV app is a read-only companion that displays public tournament information; it requires no account or sign-in and collects no personal data.

2Information we collect

Information you provide

  • Player roster entries, game scores, live-scoring statistics, and bracket data you create.

Information from Google (if you sign in with Google)

  • Your Google account display name, email address, and profile photo — used only to identify your session and draw your first name in the App header.
  • A Firebase Authentication UID, used to associate your saved preferences with your account in Firestore.
  • A Google OAuth access token for Google Calendar (requested at sign-in time and held in memory only).

Information from Apple (if you sign in with Apple)

  • Your Apple user identifier and the name/email you choose to share — Apple’s Hide My Email may give us a private relay address instead of your real one, and that is the only email we ever see.
  • A Firebase Authentication UID, used the same way as with Google sign-in: to associate your saved preferences with your account.
  • We never receive your Apple ID password or account details.

Admin authentication

  • Admin sign-in uses Firebase Authentication and a Firebase ID token with each API request for verification.
  • Your Firebase UID is stored to a club-specific authentication list to determine admin access.
  • Admin ID tokens are refreshed automatically and never stored server-side persistently.

How we use it

3How we use information

  • Google Calendar access is used only to create, update and delete game events on the calendar you choose.
  • Push subscription endpoints are used only to send schedule, reminder, and announcement notifications.
  • Google sign-in is used only to authenticate your identity and enable cross-device preference sync.
  • Firestore preferences store My Player and selected age groups so your settings can be restored.
  • On-device data (active roster, scores, and stats) stays on your device unless explicitly relayed for live features.
  • Live score data may be relayed temporarily so other spectators can receive real-time updates.

4Google API scopes & Firebase authentication

  • Firebase Authentication (Google Sign-in): the App identifies you and requests OpenID scopes for authentication, along with Google Calendar access in the same consent screen.
  • Google Calendar scope: requested so the App can create and manage game events in the calendar you choose; on later visits the access token is silently refreshed and never written to a server or database.
  • Admin-panel token verification: Firebase ID tokens are verified using Google’s public signing keys, then discarded on each request.

Sharing & infrastructure

5Data sharing

We do not sell, trade, or share your personal information with third parties. The App relies on third-party infrastructure to operate, including:

  • Vercel — for hosting static files.
  • Cloudflare Workers / KV — for push delivery, temporary live-score relay, and club-scoped tournament data.
  • Google Firebase — for authentication and Firestore storage when you sign in.
  • Google LLC — for OAuth and Calendar API services.
  • Apple and Google — for native push delivery and app-store billing.
  • RevenueCat — for subscription / entitlement management.
  • Stripe — for web-based payment processing.

6Security

All communication between your device and our infrastructure is encrypted via HTTPS / TLS. Google OAuth tokens are never stored in cookies, databases, or persistent server-side storage. On-device data is held in memory, and admin API requests are authenticated using Firebase ID tokens verified against Google’s public signing keys. Club admin data remains isolated by club-specific key prefixes and Firestore document paths.

Retention & your rights

7Data retention & deletion

  • On-device data can be cleared at any time by clearing site data or signing out on your device.
  • Preferences are retained until your account deletion.
  • Firebase Authentication sessions can be revoked by signing out in the App or through your Google Account permissions page.
  • Push subscriptions are removed when you unsubscribe, or expire automatically after inactivity.
  • Live score data expires automatically after a short retention period.
  • Google Calendar events created by the App can be deleted by disconnecting calendar sync or deleting them in Google Calendar.
  • Admin authentication data is removed when removed by a club admin.
  • Tournament archives remain under the club’s document and can be deleted by a club admin.

8Children's privacy

The App is intended for use by parents, guardians, and coaches of team members. While the App may track player first and last names, that data is entered by parents or coaches, stored only on their own device unless explicitly synced, and is not knowingly collected directly from children.

9Changes to this policy

If we make material changes to this Privacy Policy, the "Last updated" date will be revised. Continued use of the App after changes constitutes acceptance of the updated policy.

10Contact

Questions about this Privacy Policy or requests regarding your data can be directed to the administrator of your team’s Eggbeater deployment, or to hello@eggbeater.app.