1. Scope and who is responsible
This policy applies to the Uniqer website and app, including accounts, player profiles, memberships, the waitlist, and contact and support interactions. A separate notice may apply where another service gives you its own privacy information.
Controller: Unique Erudition Oy, Business ID 3584630-5, Limonadikuja 1 C 72, 00390 Helsinki, Finland (“Uniqer”, “we”, “us”). As controller, we decide why and how the personal data described here is used.
Our Data Protection Officer is Joni Leimala. You can contact him at dpo@uniqer.net.
2. What data we use, why, and our legal basis
| Activity | Personal data | Why we use it | GDPR legal basis |
|---|---|---|---|
| Account creation and settings | Adult account holder’s full or display name, username or handle, email address, user ID, password processed by Supabase, and access and refresh tokens | To create and administer the adult account, authenticate the account holder, keep them signed in, communicate about the service, and protect the account | Performance of our contract (Article 6(1)(b)) and our legitimate interest in securing accounts and preventing misuse (Article 6(1)(f)) |
| Parent-managed child profiles | Child’s display name or profile name, date of birth or age information, player details, parent-child account link, and an optional profile photo or avatar if that feature is available and the adult account holder chooses to add one | To let an adult account holder create and manage a child player profile and provide the training service to the child | Performance of the contract with the adult account holder (Article 6(1)(b)) and, where applicable, compliance with legal obligations relating to children’s data (Article 6(1)(c)) |
| Player profile and personalisation | Country, optional date of birth, language or locale defaults, coach-persona gender presentation, playing position, club, years played, playing level, strongest and weakest skills, training goal, weekly training hours, training surface, preferred intensity, preferred foot, competition category (Women/Girls, Men/Boys, or Para athlete), optional height, and an optional profile photo or avatar if that feature is available and you choose to upload one | To build your player profile and tailor training content, difficulty, coaching, and recommendations to you | Performance of our contract with the adult account holder (Article 6(1)(b)). Where the optional “Para athlete” field reveals a child’s disability data, that processing is special-category data (Articles 6(1)(a), 8, and 9(2)(a)) |
| Training, learning, and performance | Training sessions generated and completed; exercise scores and difficulty ratings; session ratings and journal notes; quiz answers and scores; learning completions; challenge results and votes; UQ and skill progression; and achievements | To deliver training, track history and progress, calculate scores, provide challenges and leaderboards, and personalise future sessions | Performance of our contract (Article 6(1)(b)) and our legitimate interest in maintaining and improving the requested training service (Article 6(1)(f)) |
| Challenges and user content | Challenge videos that may include your image and voice, optional feedback text and attachments, dispute reasons, and training-journal notes | To operate challenges, review disputes, provide support, and save your session notes | Performance of our contract (Article 6(1)(b)); our legitimate interests in moderating challenges, resolving disputes, and keeping the service safe (Article 6(1)(f)); and consent from the adult account holder where device permission or applicable law requires it (Articles 6(1)(a) and 8) |
| Friends and social features | Friends list, friend requests, invite links, email addresses entered for invitations, and opponent or training-partner searches by name, username, or email | To provide friend connections, Double training, invitations, and challenges | Performance of our contract (Article 6(1)(b)) and our legitimate interest in delivering invitations requested by users while limiting their use and preventing misuse (Article 6(1)(f)) |
| Preferences and notifications | Timezone, date and clock format, week-start day, email and push preferences, training reminders, challenge updates, and friend-request settings | To display the app correctly and send the service messages and optional notifications you choose | Performance of our contract for requested service notifications (Article 6(1)(b)); consent for optional marketing or notifications where required (Article 6(1)(a)); and our legitimate interest in remembering your settings (Article 6(1)(f)) |
| Waitlist and launch updates | Email address, signup time, consent status, and engagement with our messages | To manage the waitlist, send requested launch or product updates, and maintain an unsubscribe record. You can unsubscribe using the link in our emails or by contacting us | Your consent (Article 6(1)(a)); compliance with legal obligations and our legitimate interest in respecting and demonstrating your preferences for the unsubscribe record |
| Contact and support | Name, email address, selected topic, message, and later correspondence | To answer questions, provide support, and take steps you request before entering a contract | Steps before a contract (Article 6(1)(b)) where relevant; otherwise our legitimate interest in replying and operating customer support (Article 6(1)(f)) |
| Website delivery and security | IP address, date and time, requested page, referrer, device/browser details, and security logs | To deliver the website, keep it secure, diagnose faults, and prevent abuse | Our legitimate interests in providing a reliable and secure website (Article 6(1)(f)) |
| Audience measurement and marketing technology | Cookie or similar identifiers, page views, scrolls, outbound clicks, site searches, form interactions, video engagement, file downloads, page URL and referrer, approximate location, device/browser information, and IP-derived information | To understand website use, improve Uniqer, measure campaigns, and produce aggregated statistics | Your consent (Article 6(1)(a)), where required. Non-essential storage or access on your device also requires prior consent under applicable ePrivacy law |
| Memberships and subscriptions | Account or customer identifier, subscription product, entitlement status, purchase, renewal, cancellation, and refund information, and relevant app-store transaction data | To activate and manage memberships, verify access, provide support, and maintain transaction records | Performance of our contract (Article 6(1)(b)); compliance with legal obligations such as accounting and tax rules (Article 6(1)(c)); and our legitimate interest in preventing fraud and resolving transaction issues (Article 6(1)(f)) |
| Product analysis and diagnostics | Anonymous analytics ID; account ID after login; page and feature events; session duration; UTM parameters; limited traits such as playing position, skill level, and onboarding status; platform; app version; environment; online/offline state; and crash or API-error metadata. We do not send names, email addresses, passwords, or free-text messages to product analytics, and we do not use PostHog session replay | To understand how the product is used, improve features, diagnose problems, and measure product performance | Your consent for optional analytics (Article 6(1)(a)), where required; our legitimate interest in maintaining security, stability, and essential service performance (Article 6(1)(f)) |
Optional sensitive data and media
Selecting “Para athlete” may reveal information about a disability and therefore special-category data under GDPR. This field is optional and is used only to personalise competition and profile context. If a profile photo, avatar, or challenge video is uploaded, it may contain a person’s image and, for videos, voice. We do not use this media for biometric identification.
Data we do not collect
The app does not collect precise geolocation, payment-card numbers, government identifiers, advertising IDs, device address-book contacts, or data from HealthKit, Google Fit, or medical devices. We do not use PostHog session replay. Friend invitations use an email address or username that you enter yourself.
Where the data comes from
Adult account and child-profile data comes from the adult account holder and, where appropriate, from the child using the managed profile. We generate account IDs, tokens, training plans, progress, scores, achievements, and other service results from use of the app. Other users may provide information when they search for a profile, send an invitation or friend request, train with the player, vote, or participate in a challenge. We also receive subscription status from app stores and our service providers, and delivery, technical, and engagement information from service providers.
When data is required
An adult must provide the required account details to create an account. Required child-profile and player details are needed to provide personalised training through a managed profile. Optional fields, features, and permissions are identified when requested. A child does not provide a separate email address or password. You do not have to join the waitlist, upload a video or profile photo, provide optional profile data, enable optional analytics or notifications, or contact us. Without particular data or permissions, the related optional feature may not work.
Automated decisions
Uniqer uses profile, training, quiz, and performance inputs to generate sessions, calculate UQ and skill progression, award achievements, and personalise training content and recommendations. These activities involve profiling, but they do not make decisions that produce legal or similarly significant effects for you.
3. Who receives your data
We do not sell personal data. Depending on the features used, other users may see profile details made available, username, an uploaded profile photo or avatar, friend or challenge activity, challenge videos, votes, scores, achievements, or leaderboard position. Invite recipients receive the invitation and information needed to identify who sent it.
Access within Uniqer is limited to authorised team members. Service providers receive data only where needed for the purposes above. Current providers include:
- Contabo and Hostinger — provide virtual private servers and related infrastructure alongside servers operated directly by Uniqer.
- Supabase — provides authentication, account and profile database, and related backend services. Our Supabase project is hosted in the Netherlands.
- Hostinger and SMTP2GO — provide email hosting and email-delivery services.
- Apple App Store and Google Play — process membership purchases, renewals, cancellations, refunds, and related app-store account and transaction data. Apple and Google act as independent controllers for store payments under their own privacy notices.
- RevenueCat — manages memberships, subscription status, purchase validation, and related transaction events.
- PostHog — provides product analytics, usage statistics, and diagnostics. Session replay is not enabled.
- Encharge — waitlist collection, email automation, and—after you accept marketing cookies—website engagement tracking.
- FormSubmit — receives contact-form submissions and forwards them to our team email; its documentation states that submissions are retained for 30 days.
- Google — Google Tag Manager deploys a Google tag and a Google Analytics 4 event tag after you accept Analytics cookies. The configured Analytics event is named “Uniqer web”; ecommerce-data collection is disabled. Enhanced Measurement collects page views, scrolls, outbound clicks, site searches, form interactions, video engagement, and file downloads. Email-address redaction is active. Google Signals and user-provided-data collection are disabled, User-ID is not implemented, and the property is not linked to Google Ads or BigQuery. Blended reporting identity uses available device identifiers and modeled data. Google may use aggregated and de-identified measurement data for modeling contributions and business insights and may access account or Analytics data for technical support and account recommendations. The broader “Google products & services” data-sharing option is disabled. Website typefaces are hosted on Uniqer's servers, so viewing pages does not send a font request to Google.
- Paperform — hosts the externally linked Uniqer waitlist/form experience. Data entered there is processed as explained at the point of collection and in Paperform’s privacy information.
- Featurebase — hosts the externally linked Uniqer public roadmap. If you open that page or submit feedback there, Featurebase processes the information as explained at the point of collection and in Featurebase’s privacy information. Featurebase states that it primarily hosts customer data in the EEA.
- Professional advisers, courts, regulators, public authorities, or a buyer of our business where disclosure is required by law or reasonably necessary to protect rights, handle a transaction, or establish or defend legal claims.
Providers acting for us must process data only under appropriate instructions and safeguards. Some providers may also act as independent controllers for limited purposes described in their own notices.
4. Transfers outside the EU/EEA
Where Contabo, Hostinger, PostHog, and SMTP2GO allow Uniqer to choose a region, we use EU locations in Finland, the Netherlands, or Germany. Our Supabase project is hosted in the Netherlands. Featurebase states that it primarily hosts customer data in the EEA, with limited ancillary processing outside the EEA by subprocessors. Encharge states that its primary data centre is in Ireland but may use subprocessors in other locations.
Some providers process data outside the European Economic Area. Paperform states that its default hosting is in the United States, RevenueCat stores service data on AWS in the United States, and Apple and Google process App Store and Google Play transactions according to their own notices.
Where EU/EEA personal data is transferred to a country that does not benefit from an EU adequacy decision, we use an appropriate GDPR transfer mechanism—such as the European Commission’s Standard Contractual Clauses—and supplementary safeguards where required. You may contact us for information about the relevant safeguard and, where available, a copy.
5. Cookies and similar technologies
The website uses cookies and similar technologies to deliver pages and, if you choose, to measure use and support waitlist and marketing tools. On a first visit we show a cookie settings panel. You can accept all optional cookies, reject them, or choose Analytics and Marketing separately. You can change that choice later using Cookie settings in the footer.
The uniqer_consent cookie is necessary: it stores your choice, the time you made it, and a policy version so we can ask again if our cookies change. Google Tag Manager loads so we can apply your Analytics choice through Google Consent Mode. The Google tag and Google Analytics 4 event tag do not set analytics cookies until you accept Analytics. Encharge tracking is not loaded until you accept Marketing. Typefaces are hosted on this website, so viewing pages does not send a font request to Google. Google Tag Manager does not itself set tracking cookies.
Uniqer has not changed the default cookie durations of Google Analytics or Encharge. The cookies we are aware of are:
| Name | Provider | Duration | Purpose |
|---|---|---|---|
uniqer_consent |
Uniqer | 12 months | Remember your cookie choice (necessary) |
_ga |
Google Analytics 4 | 2 years (default) | Distinguish unique visitors, only after you accept Analytics |
_ga_* |
Google Analytics 4 | 2 years (default) | Remember session state for the Uniqer web measurement stream, only after you accept Analytics |
| Encharge first-party cookies | Encharge | Until deleted from the browser; Encharge does not publish a named default expiry | Identify website visitors and match waitlist or email activity, only after you accept Marketing |
You can also limit or delete cookies through your browser. Blocking all cookies can affect essential features, including remembering this choice.
6. How long we keep data
We keep personal data only for as long as needed for the stated purpose, then delete or anonymise it unless law requires longer retention:
- Account and player-profile data: while your account is active, including any profile photo or avatar you upload. After an account or child profile is deleted, we remove it from live systems within 30 days. Encrypted backups may keep residual copies for up to 90 days, after which they are overwritten. Those backup copies are not used for any other purpose. Subscription records needed for accounting may be kept longer, as described below.
- Authentication tokens: until they expire, are revoked, or are replaced. Password handling and authentication records follow Supabase’s applicable security and retention controls.
- Training, social, and preference data: while your account is active or until you delete the relevant content. After deletion, we remove it from live systems within 30 days, with residual backup copies for up to 90 days.
- Challenge videos, feedback, and attachments: while needed to provide the feature or resolve a reported challenge or dispute. After that, we delete them from live systems within 30 days, with residual backup copies for up to 90 days.
- Waitlist data: until you unsubscribe or we end the waitlist/update service. You can unsubscribe using the link in our emails or by contacting dpo@uniqer.net. We may retain minimal suppression information afterward so we do not contact you again and can demonstrate compliance. Encharge retains encrypted backups for 90 days after deletion. Paperform stores completed waitlist submissions until we delete them or the account storage limit is reached; incomplete submissions are deleted after 30 days.
- Contact and support messages: normally for up to 24 months after the matter is closed, unless a longer period is needed for an ongoing relationship, a legal obligation, or a legal claim.
- FormSubmit copy: FormSubmit states that form submissions are retained for 30 days; copies delivered to our mailbox follow the contact-message period above.
- Security and server logs: Coolify keeps application logs for the current container/deployment. By default they are not retained for a fixed number of days and are typically lost when a new version is deployed, unless separately archived. Uniqer has not configured a longer log-archive period.
- Email delivery logs: SMTP2GO retains activity data for 5 days on Uniqer’s free plan, then deletes it. Uniqer has not extended this period.
- Google Analytics: event-level data associated with identifiers is retained for 2 months. User-level data is retained for 14 months, with that period reset when the user has new activity. These controls do not affect certain aggregated reports. Analytics cookies
_gaand_ga_*expire after 2 years by default. - Membership and subscription records: while your membership is active and for 6 years afterward, to meet Finnish accounting requirements and RevenueCat’s default retention, unless a shorter deletion is required by law or requested where we can lawfully comply.
- Product analytics: PostHog event data is retained for 1 year, which is the default on Uniqer’s free PostHog plan. After that period, events are deleted or anonymised.
7. Your GDPR rights
Depending on the circumstances, you may have the right to:
- access your personal data and receive a copy;
- correct inaccurate or incomplete data;
- ask us to delete your data;
- restrict how we use your data;
- receive data you provided in a structured, commonly used, machine-readable format and transmit it elsewhere;
- object to processing based on legitimate interests and object at any time to direct marketing; and
- withdraw consent at any time.
A child may exercise their data-protection rights directly. A holder of parental responsibility may also exercise rights on the child’s behalf where permitted by law, taking the child’s age, maturity, and best interests into account.
Email our Data Protection Officer at dpo@uniqer.net to exercise a right. Please describe your request clearly. We may ask for proportionate information to verify your identity and protect your data. We normally respond within one month, subject to the extensions permitted by GDPR.
You also have the right to complain to a data protection authority. Because Unique Erudition Oy is established in Finland, our lead supervisory authority is the Office of the Data Protection Ombudsman (Tietosuojavaltuutettu). You may also complain in the EU/EEA country where you live, work, or believe an infringement occurred. See the Finnish authority and the European Data Protection Board list of national authorities. You may contact us first, but you do not have to.
8. Children and young people
Uniqer is designed for football players and may be used by young people, but only an adult aged 18 or older may purchase a subscription and create an account. A store purchase does not by itself prove parental responsibility or authorise Uniqer’s processing of a child’s data.
An adult account holder may create a managed child profile. A child profile does not have a separate login email or password.
In the EU, the age at which a child may independently consent to an online service varies by Member State between 13 and 16. Our parent-managed model applies regardless of that threshold unless and until Uniqer introduces a verified independent account pathway for older teenagers.
Parents or guardians who believe a child profile was created without appropriate authority should contact our Data Protection Officer so we can suspend processing, investigate, and, where appropriate, delete it.
9. How we protect data
We use technical and organisational measures appropriate to the nature and risk of the processing. These include limiting access, using encrypted connections, selecting service providers with appropriate safeguards, maintaining systems, and reviewing retention. No internet service is completely secure, but we work to prevent unauthorised access, alteration, loss, or disclosure and to respond appropriately if an incident occurs.
10. Changes to this policy
We will update this policy when our services or data practices change. The latest version will always show its effective date at the top. If a change materially affects how we use your data, we will provide a more prominent notice and seek consent where the law requires it.
11. Contact us
Unique Erudition Oy
Business ID: 3584630-5
Limonadikuja 1 C 72
00390 Helsinki, Finland
General enquiries: team@uniqer.net
Data Protection Officer: Joni Leimala, dpo@uniqer.net