Privacy Policy

1. Who we are

Whistle is a referee companion app for grassroots football, provided by 10th Dimension Limited as part of MuddyStuds. This policy explains how we handle information when you use the Whistle Android app (uk.co.muddystuds.whistle), visit this website (www.whistleapp.co.uk) or contact us.

Data controller: 10th Dimension Limited is the data controller for personal data processed in connection with Whistle and this website.

Contact: contact@muddystuds.com.

We are based in the UK, so this policy is written to meet UK data protection law (UK GDPR and the Data Protection Act 2018) and the EU GDPR. We apply the same approach to everyone, wherever you are.

2. The Whistle app

Whistle helps referees keep the in-game record — goals, cards, warnings and referee reports — and export those reports.

Your account. Whistle uses a sign-in account. When you create one, your email address and password are handled by Firebase Authentication, a service from Google; passwords are stored by Firebase in protected (hashed) form and we cannot see them. Linked to your account, we also store your profile and app settings.

Your referee notepad. The match records you keep in Whistle — such as teams, goals, cards, warnings, notes and referee reports — are stored on your device so the app works pitch-side. Where they are saved to your account or included in an optional cloud backup, a copy is stored with your account by Google Firebase so it can be restored. We use your account and notepad data only to sign you in, keep your data with your account and restore it. It is not shared with anyone else unless you choose to share or export a report.

Crash reports (Firebase Crashlytics). If Whistle crashes, the app sends a crash report to Firebase Crashlytics, a service from Google, so we can find and fix the problem. It contains technical details such as your device model, Android version, the Whistle version and the details of the crash, together with a random installation ID. Crash reports do not include your name, email address or match records, and are deleted automatically after 90 days.

Usage analytics (Google Analytics for Firebase). Whistle uses Google Analytics for Firebase, a service from Google, to understand how the app is used so we can improve it — for example the screens you view and your app sessions — with a random app-instance ID and your approximate location worked out from your IP address. Usage analytics is not linked to your account, name or email address. Event data is deleted automatically under our retention setting (no more than 14 months).

Google processes this app data for us as our service provider (processor) and may process it outside the UK and EEA under appropriate safeguards (see section 9).

Deleting your account. Uninstalling Whistle removes the data stored on your phone but does not delete your account. To delete your account and the data stored with it, follow the steps on our Delete your account page.

Whistle is free for referees who sign up to Match Referee. If you sign up to Match Referee, that service’s own privacy information applies to the details you give it.

3. Information we receive through this website

If you email us. When you contact us at contact@muddystuds.com, we receive your email address and whatever you choose to include in your message, so that we can reply.

Hosting and delivery. This website is a static site hosted on Amazon Web Services (Amazon S3 and Amazon CloudFront). As with any website, your browser’s requests pass through these services, which handle technical information such as your IP address, browser type and the pages requested in order to deliver the site and keep it secure. We do not use this information to build profiles of visitors.

Fonts and page components. To display the site, your browser loads fonts from Google Fonts and styling and script files from the jsDelivr and cdnjs (Cloudflare) content delivery networks. When it does, those providers receive your IP address and basic browser information as part of the request. Their own privacy policies apply.

This website has no sign-up forms or mailing list. Its only account page is the email action page used to verify the email address or reset the password for a Whistle account; it works directly with Firebase Authentication (section 2).

4. Cookies and analytics

This website does not set cookies and does not use analytics or advertising tools. (Analytics in the Whistle app is covered in section 2.) If we add analytics in future, we will update this policy first and, where the law requires it, ask for your consent before any non-essential cookies are set.

5. Children and grassroots football

Whistle is intended for referees and match officials aged 18 and over. It is not directed at children, and we do not knowingly collect personal data from children (including, in the United States, from children under 13 under the Children’s Online Privacy Protection Act, COPPA). If you believe a child has sent us personal data, for example by email, contact contact@muddystuds.com and we will delete it.

Grassroots matches often involve young players. Match records a referee keeps in Whistle are stored on their device and, where saved to their account or a cloud backup, with that account (section 2); we use them only to provide the app to that referee. Referees are responsible for recording player information lawfully and in line with the rules of their league, county FA or association.

6. Legal bases (UK and EU GDPR)

Where UK or EU data protection law applies to personal data we process, we rely on:

• Contract — providing your Whistle account and storing and restoring the data you save to it
• Legitimate interests — operating and securing the app and this website, fixing crashes and understanding how the app is used, and replying to emails you send us
• Consent — only if we ask for it for a specific optional purpose in future

7. Retention

Your Whistle account and the data saved with it, including cloud backups, are kept until you ask us to delete your account; we then delete them within 30 days, as explained on our Delete your account page. Data stored only on your device remains until you delete it or uninstall the app. Crash reports are deleted after 90 days and app usage analytics event data after no more than 14 months. Emails you send us are kept only as long as needed to handle your enquiry and keep a basic support record. Technical request data handled by our hosting and delivery providers is kept in line with their own practices.

8. Your rights wherever you live

Whatever country you live in, you can ask us to:

• tell you what personal data we hold about you and give you a copy
• correct anything that is wrong
• delete it
• stop or limit using it for a particular purpose, or withdraw consent you have given

Under UK GDPR and EU GDPR, you also have the right to object to processing based on legitimate interests and, in some cases, to data portability.

To make a request, email contact@muddystuds.com. It is free. We may ask for information to confirm the request comes from you (for example, by replying from the email address you used to contact us), and we aim to reply within one month.

To delete a Whistle app account and the data stored with it, follow the steps on our Delete your account page. Uninstalling the app does not delete your account.

Complaints. If you are unhappy with how we handle your data, please contact us first so we can try to put it right. You can also complain to the data protection authority where you live, work or think the problem happened — in the UK, that is the Information Commissioner’s Office (ICO).

9. International transfers

We are based in the UK. The service providers mentioned above may process data in other countries, including the United States, where data protection laws may differ from those where you live. Where personal data is transferred outside the UK or EEA, we rely on the safeguards the law allows, such as adequacy decisions or standard contractual clauses in our providers’ terms.

10. Security

We take reasonable technical and organisational steps appropriate to a small app and static website. Account sign-in is handled by Firebase Authentication, and account data is stored with Google Firebase and sent over encrypted connections. The site is served only over HTTPS. No method of electronic transmission or storage is perfectly secure.

11. Changes

We will update this policy as Whistle develops. The “Last updated” date above will change when we do.

12. Contact

Questions about privacy, or requests to use your rights: contact@muddystuds.com.