Privacy Policy

The whole of this notice, in about thirty seconds:

• We measure football drills from a video the player records on their own phone. The video is the raw material; the result is a value, a score and a confidence figure.
• Nobody under 18 can record anything until a parent or guardian has approved their account. Until then the account is locked.
• Videos are private by default. They are never public, never sold, and never sent to clubs, agents or scouts.
• Data, uploaded files and backups are stored inside Saudi Arabia.
• Consent can be withdrawn at any time, and the account re-locks the moment it is.
• A guardian can see everything their child sees, export it, or ask us to delete it.
• We never use a minor’s data for advertising, marketing or profiling.

Account and sign-in

• Your phone number. It is your identity in the app.
• Your role: player, parent or guardian, coach, academy, or platform admin.
• Your language, English or Arabic, and the direction the app lays itself out in.
• The one-time codes we send you, with the time each was sent, used, failed or expired.
• A record of the devices signed in to the account, so a sign-in can be recognised and ended.

Player profile

• Full name and username.
• Date of birth, which decides whether a guardian must approve the account and places the player in an age group.
• Gender, so an academy’s age groups and squads are kept right.
• City and nationality.
• Profile photo, if the player adds one.
• Primary position, secondary position and dominant foot.
• Years played.

Growth and body measurements

• Height and weight, recorded over time so progress can be seen.
• The height and weight of both parents, where the player chooses to give them.
• An optional InBody report the player uploads, from which the measurement engine reads body composition figures.
• Any injury areas the player records.
• Every part of this is optional. None of it is a medical assessment, and we do not treat it as one.

Attempts

• The video of the attempt, recorded in the app.
• The drill it belongs to.
• The measured value, in the drill’s own unit.
• Any sub-metrics the drill produces.
• The score out of 100 the app gives the measured value.
• A confidence or margin-of-error figure, so a reader knows how firm the number is.
• Where an attempt is rejected, the specific reason it was rejected.

Guardian and consent

• The guardian’s name, relationship to the player and phone number, as the child gives them at sign-up. Until that guardian signs in, this is the only data we hold about them.
• The guardian’s own account once they sign in with that number.
• The approval or rejection itself, stored with its date and time, and kept as the record of consent.
• Any later withdrawal of that approval, stored the same way.

Academy and coach

• For an academy: its commercial registration and sporting licence documents, uploaded so an admin can verify it, plus its name, city, contact person, trial and subscription state, and any drill documents it uploads.
• For a coach: their profile, the academy whose invitation they accepted, and the age groups that academy assigned to them.

Activity in the app

• Sessions: their date, time, place, description, drills, and whether there is a game.
• Session invitations, a player’s attendance answer, and any reason given for declining.
• The attendance a coach marks by hand: present, late or absent.
• Coach notes, drill recommendations, and evaluations of drills the engine does not measure.
• Academy membership, join requests, and whether they were accepted or declined.
• Campaign entries.

Technical and security data

• A device token, so a notification can reach the right phone.
• App version and platform, so we can support the build you are on.
• Security records: sign-in attempts, one-time code rate limits, and blocked requests.
• An audit entry for every administrative action taken on the platform.

What we deliberately do not collect

• Passwords. There are none. Sign-in is a phone number and a one-time code, so there is nothing to leak or reuse.
• Social accounts. There is no Apple, Google or Facebook sign-in.
• Precise location. A player types their city. We do not read GPS and the app does not track where anyone is.
• Card numbers. Subscriptions are bought through the App Store or Google Play, and the store takes the payment.
• Advertising identifiers, third-party trackers, or anything bought from a data broker.
• Contact lists or photo libraries. The camera is used only for a recording the player starts; the photo library only for a file a user picks.

Personal data reaches us from a small number of places, and we tell you which each time:

• From you. Everything you type: your profile, your measurements, your answers, the files you choose to upload.
• From a child naming a guardian. A player under 18 gives their guardian’s name, relationship and phone number so we can ask that guardian to approve the account. We hold nothing else about the guardian until they sign in.
• From an academy. The coaches it invites, the age groups it assigns, the players it accepts, and the sessions it runs.
• From a coach. Attendance, notes, recommendations, and the evaluation of drills the engine does not measure.
• From the measurement engine. The value, sub-metrics, score and confidence figure produced from an attempt, or the reason it was rejected.

Consent, which is the basis we rely on most and guard most carefully

• A parent or guardian’s explicit approval before a player under 18 can use the app. Nothing a minor does in the app happens without it.
• A guardian’s separate approval before an under-18 player can join an academy.
• The optional things a player chooses to add: a profile photo, an InBody report, parents’ measurements, injury areas.
• Push notifications, and any message that is not needed to run the account.
• Consent is given freely, can be refused without losing the rest of the service, and can be withdrawn at any time.

Performance of a contract, or steps taken at your request

• Creating your account and signing you in with a one-time code.
• Measuring an attempt and returning a value, a score and a confidence figure, or a rejection and its reason.
• Running academy membership, sessions, attendance, coach notes and recommendations.
• Managing an academy’s 30-day trial and a subscription bought in the app.
• Entering and running campaigns.

Legitimate interests, limited to safety, security and keeping the service working

• Preventing fraud, abuse and account takeover, including rate limits on one-time codes.
• Keeping an audit trail of administrative actions, so a decision about a child’s account can always be traced to a person.
• Finding and fixing faults, and keeping the service available.
• We never rely on legitimate interests to profile a minor, to market to anyone under 18, or to widen who can see a child’s data. Those need consent, and for a minor they need a guardian’s consent.
• We do not rely on legitimate interests at all where the Personal Data Protection Law rules it out, including for the sensitive data described in the next section.

Legal obligation

• Keeping consent and withdrawal records for as long as the law requires us to be able to show that consent existed.
• Responding to a lawful request from a competent authority.
• Meeting tax and accounting duties on subscriptions and campaign payments.

What you have to give us, and what you can refuse

• A phone number is required. Without it there is no way to sign you in, because there is no password.
• A date of birth and a gender are required for a player: the date of birth decides whether a guardian must approve the account, and both place the player in the right age group and squad.
• A guardian’s phone number is required for a player under 18, because the account cannot be unlocked without one.
• Everything else is optional: the profile photo, the InBody report, the parents’ measurements, the injury areas, the notifications. Refusing any of them costs you nothing except the feature it feeds.

What is sensitive here

• Health data: the injury areas a player records, and the body composition figures the measurement engine reads from an InBody report.
• Body measurements: the player’s height and weight over time, and both parents’ height and weight where the player chooses to give them.
• A face is visible in an attempt video and in a profile photo. The engine reads movement from the video; it does not identify anyone by their face, and we build no biometric template from a video or a photo.

How we handle it

• All of it is optional. The app measures drills and returns results without a single one of these.
• We rely on explicit consent, and for a player under 18 on the guardian’s consent. We never rely on legitimate interests for it.
• It is visible to the same small circle as the rest of the account, set out under who can see what, and to no one else.
• It can be removed on its own, at any time, without closing the account.
• It is never used for advertising or marketing, and never to decide anything about a person beyond the drill it belongs to.

• A player under 18 is locked from the moment they sign up. They can fill in a profile and nothing else: no recording, no attempt, no academy, no session, and no visibility to any coach.
• At sign-up the child gives their guardian’s name, relationship and phone number. We contact that number and ask the guardian to sign in with it and a one-time code, then approve or reject the account.
• Approval is explicit and logged with its date and time. That record is the consent we rely on for everything the child does afterwards.
• A guardian can withdraw approval at any time from their own account. The child’s account re-locks immediately: recording stops and the player is no longer visible to coaches.
• A minor’s data is never used for profiling, advertising or marketing, is never sold, and is never shared for anyone else’s commercial purposes.
• Accounts belonging to minors are flagged internally, so every access check, export and deletion request is handled against the stricter rule by default.
• If we learn that an account presented as an adult’s belongs to a minor, we lock it until a guardian has signed in and approved it.
• The app is not built for a child under 7, and we do not knowingly hold data about one. If we learn that we do, we delete it.
• The guardian requirement applies for as long as the player is under 18.

The player sees

• Their own profile, growth data and uploads.
• Their own attempts, videos, results, scores and confidence figures.
• Their own ratings and progress over time.
• Their sessions, their academy, and the state of any request to join one.

The parent or guardian sees, for each child they approved

• Everything the child sees: every attempt, every video, every rating, every session and attendance answer, the academy the child belongs to and every request to join one.
• The consent record itself, and the ability to withdraw it.
• Nothing about any other family’s child.

The coach sees

• The players of the academy whose invitation they accepted, and only in the age groups that academy assigned to them.
• Those players’ attempts, videos, results and ratings, their session attendance, and the notes and recommendations written for them.
• Nothing about a player outside those age groups, and nothing about a player at another academy.
• A coach can evaluate the drills the engine does not measure. A coach can never change a result the engine produced.

The academy sees

• Its own coaches and players, and the results recorded under its roof.
• Its sessions, its membership requests, its own uploaded drill documents, and its trial and subscription state.

The platform admin sees

• What running the platform requires: accounts, academy verification documents, drills and content, campaigns, plans, announcements and moderation.
• Every action an admin takes is written to an audit log, with who did it and when.

About videos in particular

• A video is private by default. There is no public profile, no public feed, and no link that anyone on the internet can open.
• Videos are served through private links that expire. A link copied out of the app stops working.
• We do not sell a video or a result, and we do not send either to a club, an agent or a scout.
• If we ever build a feature that would widen that circle, it would be opt-in, and for a minor it would need a guardian’s consent first.

The categories of provider we rely on

• Cloud hosting and storage, for the database, the uploaded files and the backups.
• SMS delivery, to send a one-time sign-in code to a phone number.
• Push notification delivery, to get a result or an invitation to a device.
• App-store payment processing, where Apple or Google takes the payment for a subscription and tells us only that it is active. We never see a card number.

What every one of them is held to

• A written agreement that says what they may do with the data, and nothing beyond it.
• No use of it for their own purposes, no sale of it, and no passing it on to anyone else.
• Storage and processing inside the Kingdom of Saudi Arabia, on the terms set out in the next section.
• Security at least as strong as this notice describes, and a duty to tell us at once if it fails.
• Deletion or return of the data when the work we asked for ends.

Beyond those providers, we disclose personal data only when

• the law or a competent authority in the Kingdom of Saudi Arabia requires it;
• it is necessary to establish, exercise or defend a legal claim;
• there is an urgent risk to someone’s life, safety or health;
• you ask us to, or a guardian asks us to for the child they approved.

If any processing ever had to happen outside the Kingdom of Saudi Arabia, we would do it only where all of the following were true:

• the transfer is permitted by the Personal Data Protection Law and its implementing regulations, including any approval the regulations require;
• the receiving party is bound in writing to a level of protection at least equal to the one the law requires here;
• the transfer is limited to what the specific purpose needs, and never a bulk copy;
• we have assessed the risk in writing first, and the assessment is stricter where a minor’s data is involved;
• this notice is updated and you are told before it takes effect.

Each category is kept only while it has a reason to exist:

• Account data (phone number, role, language): while the account exists.
• Profile, growth and body data: while the account exists, or until the user deletes the item.
• Attempt videos, results and rejection reasons: while the account exists, or until the player or their guardian deletes them.
• One-time codes: minutes. A code is single-use and expires. We keep only the fact that a code was sent, used or failed, and that for security.
• Consent and withdrawal records: for as long as the law requires us to be able to demonstrate that consent existed, which can outlast the account itself.
• Security and audit logs: for the period set by our security policy, and longer only where the law requires it.
• Academy verification documents: while the academy is on the platform, then for the period the law requires.
• Subscription and campaign payment records: for the period tax and accounting law requires.
• Email you send us: until your question is dealt with, and a short period afterwards in case you write again.

When an account is closed, whether by the user or at a guardian’s request

• Deletion begins immediately. We do not hold an account open in the hope you come back.
• The account, profile, videos, results and ratings are removed from live systems within 30 days.
• Backups roll off on their own cycle and are fully replaced within 90 days of the request.
• What survives is only what the law requires: the consent record, and the audit entry showing that the deletion happened.
• Anything we keep for statistics is aggregated first, so it no longer identifies anyone and cannot be turned back into a person.

The measures that matter most, in plain terms:

• Encryption in transit and at rest. Traffic runs over TLS, and stored files and database contents are encrypted where they sit.
• No passwords to steal. Sign-in is a phone number and a one-time code, so there is no password to leak, guess or reuse.
• Rate limits on codes. How many one-time codes can be requested, and how many wrong attempts are allowed, are both capped, and abuse locks the flow.
• Role-based access enforced on the server. Every request is checked against the role and the relationship (guardian to child, coach to age group, academy to player) before a single field is returned.
• Expiring private links for video. A video address is short-lived, so it cannot be forwarded and left working.
• Audit logging. Administrative actions are recorded with the person, the action and the time.
• Minimisation in our own tooling. Personal data is kept out of application logs, and support access is limited to what a specific request needs.
• Separation of duties. Verification, moderation and support are separate permissions, not one master key.

Whatever your role in the app, the Personal Data Protection Law gives you the right to:

• Be informed about how your personal data is used and why, which is what this notice is for.
• Access the personal data we hold about you.
• Receive a copy of it in a readable, portable format.
• Correct anything inaccurate, incomplete or out of date. Most profile fields can be edited in the app directly.
• Request deletion of your personal data, except what we are required to keep.
• Withdraw consent at any time where consent is the basis we rely on. Withdrawal does not undo processing that was lawful before it.
• Object to processing we base on legitimate interests.
• Complain to the competent supervisory authority in the Kingdom of Saudi Arabia, currently the Saudi Data and AI Authority (SDAIA). We would rather you came to us first, but you are not obliged to.

How to exercise them

• Write to privacy@futureproscout.com, or use the export and deletion controls in the app where they are available.
• We may need to confirm who you are before we act, usually by asking you to confirm from the account in question. This protects you, and above all it protects a child whose data someone else might ask for.
• We answer within 30 days of a complete request. If a request is unusually complex we will tell you why and when to expect an answer, before that period runs out.
• There is no charge, unless a request is repetitive or clearly excessive, in which case we will tell you the cost before doing anything.
• If we refuse a request, we will say so in writing, give our reason, and tell you how to challenge it.

• See everything the child sees: every attempt, every video, every result, every session, every academy request.
• Approve or reject the account at sign-up, with no obligation to explain the decision.
• Approve or reject a request to join an academy. Membership begins only when both the academy and the guardian have said yes.
• Withdraw approval at any time, which re-locks the child’s account immediately.
• Export the child’s data, including the profile and the results.
• Ask us to delete the child’s data and close the account.
• Ask how a specific result was produced, or ask for it to be looked at again by a person.
• Refuse the optional parts: the InBody report, the parents’ measurements, the profile photo, the notifications. None of them is required to use the app.

What we send, and when

• SMS: the one-time code that signs you in. That is the only thing we send by SMS. It is part of signing in and cannot be switched off while you have an account.
• Push notifications: an attempt has been measured, an attempt was rejected and why, a guardian request is waiting, an academy has invited or answered you, a session is coming up, or the platform has an announcement.
• Service messages about the account itself, such as a material change to this notice or a security matter. These are not optional, because you need them.

Your control over them

• Categories of notification can be turned off in the app, and all of them can be turned off in your phone’s settings.
• Turning them off does not limit the app. You will see the same events the next time you open it.
• We send no marketing to anyone under 18, and we never use a minor’s data to decide what to send them.
• For adults, any marketing message would be opt-in and would carry a way to stop it in one step.

• It sets no cookies. There is no consent banner because there is nothing to consent to.
• It stores nothing in your browser. The language you read it in is part of the page address, so there is nothing to remember about you.
• It runs no analytics. We do not count you, measure you, or follow you from page to page.
• It carries no advertising trackers, no marketing pixels, no session recorders, and no social buttons that report your visit.
• Fonts, icons and images are served from this site itself, so opening a page does not tell a third party that you were here.
• Our hosting provider keeps ordinary server logs, such as an IP address, a timestamp and the page requested, to keep the site up and to defend it against abuse. We do not use them to build a profile of anyone.

• The form runs entirely in your browser. Your name, email address, role, subject and message are never submitted to us by this website.
• When you finish it, the site hands the text back to you: it opens a ready-made email in your own mail application, or copies it to your clipboard. Whether it is sent to info@futureproscout.com is your decision, taken in your own software.
• If you never send it, we never receive it. Leaving the page or reloading it discards what you typed.
• Once you do email us, we hold that correspondence as ordinary email. We reply to the address you wrote from and keep the exchange only as long as your question takes to settle.

What it does

• Measures the attempt in the drill’s own unit.
• Turns that value into a score out of 100, on one scale for every drill.
• Returns a confidence or margin-of-error figure alongside the result, so a reader knows how firm it is.
• Rejects an attempt it cannot measure, and shows a specific reason, rather than guessing a number.
• Reads body composition figures from an InBody report, where a player has chosen to upload one.
• Uses only the video and the drill it was recorded for.

What it does not do

• It makes no decision that has a legal effect on anyone, or an effect that is similarly significant. It does not decide who joins an academy, who plays, or what a coach does next. People make those decisions.
• It does not predict that a player will turn professional, and it does not compare a child with a professional player.
• It is not a medical assessment, a diagnosis or a fitness-to-play judgement, including where it reads an InBody report.
• It is not live coaching and it is not match or tactical analysis.
• It does not profile a minor for advertising, marketing or any commercial purpose.

• A small change, such as clearer wording or a new contact address, takes effect when we publish it here.
• A material change, such as a new category of data, a new purpose or a new kind of recipient, is announced in the app before it takes effect.
• Where a material change affects a player under 18, we ask their guardian for consent again, and the change does not apply to that child until the guardian agrees.
• We never apply a new purpose to data we already hold without a lawful basis for it.
• Earlier versions are available on request from privacy@futureproscout.com.

• Privacy, data requests and complaints: privacy@futureproscout.com
• Help with the app: support@futureproscout.com
• Anything else: info@futureproscout.com
• Post: Future Pro Scout, Riyadh, Saudi Arabia