How we handle your personal information, and the choices you have.
Last updated: August 10, 2026 (version 2026-08-10)
In short: we collect what we need to run a sports league — your account details, your match results, and messages you send. We do not sell your data, we do not run ads, and we use no third-party analytics or tracking. You can download or delete everything at any time.
Sports Portal ("we," "our," or "us") is operated by Vancouver Jamaat — Sports Portal, based in Vancouver, British Columbia, Canada. This policy covers the web application at sports.vancouverjamaat.ca and the Sports Portal mobile app (package ca.vancouverjamaat.sports).
For the purposes of the EU/UK General Data Protection Regulation (GDPR) we are the data controller for this information. Under Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and British Columbia's Personal Information Protection Act (PIPA), we are the organisation accountable for it.
Our Privacy Officer can be reached at sports@vancouverjamaat.ca.
What we do not collect: we use no third-party analytics, no advertising SDKs, no tracking pixels, and no cross-site trackers. We do not collect location data, contacts, or anything from your device beyond what is listed above.
GDPR Art. 6 requires a lawful basis for every use of personal data. PIPEDA and PIPA require that we identify the purpose at or before collection. This table is our complete record of both.
| Purpose | Data used | Legal basis | How long we keep it |
|---|---|---|---|
| Account creation, authentication, and session management | Name, Email address, Hashed password, Username | Performance of a contract | For the life of the account, then deleted within 30 days. |
| Player profile, match records, ratings, and leaderboards | Date of birth, Gender, Profile picture, Match results, Skill ratings, Badges | Performance of a contract | For the life of the account. After deletion, match results are retained in anonymised form so opponents' historical records stay accurate. |
| Direct messages, comments, and team chat between members | Message content, Sender and recipient identifiers | Performance of a contract | Until deleted by the sender or until account deletion, whichever is first. |
| Push and email notifications about your activity | Device push token, Web push subscription, Email address | Consent | Until you revoke the permission or delete your account. |
| Optional marketing and newsletter emails | Email address, Name | Consent | Until you withdraw consent. |
| Tournament entry-fee payment processing | Payment status, Stripe customer reference | Performance of a contract | Transaction records are retained for 7 years to meet Canadian tax and accounting obligations. |
| Security, abuse prevention, and rate limiting | IP address (hashed), Request paths, Timestamps | Legitimate interest | Server logs are retained for 90 days. |
| Demonstrating compliance — consent records and data-request handling | Consent decisions and versions, Data-request history, Hashed IP address | Legal obligation | Retained for 7 years after the account closes, as evidence that requests were honoured. |
Where we rely on consent, you can withdraw it at any time without affecting anything we did before you withdrew it. Where we rely on legitimate interest, we have weighed our interest against your rights and you may object at any time (see section 6).
Our database and service providers are located in the United States. If you are in Canada, the EEA, or the UK, your personal information is transferred outside your country and may be accessible to courts and law enforcement in the destination country under its laws.
For EEA and UK users, these transfers rely on the European Commission's Standard Contractual Clauses together with encryption in transit and at rest. For Canadian users, this notice is given in accordance with PIPEDA's transparency requirement for transfers to third-party processors abroad.
These rights apply to everyone using Sports Portal, regardless of where you live — we apply the strongest standard uniformly rather than varying it by region.
Exercise any of these instantly from your Privacy Centre when signed in.
Not signed in, or no longer have access to your account? Use the data deletion request form or email sports@vancouverjamaat.ca. We respond within 30 days and never charge a fee.
We want to be precise about this, because "delete everything" is not quite what happens — and you should know that before you ask.
Deletion is permanent and cannot be undone. We hold your request for 14 days first — your account is locked immediately, but you can cancel during that window. After that, we can no longer identify your account to restore it.
No system is perfectly secure. If we discover a breach affecting your personal information, we will notify you and the relevant regulator as required — within 72 hours under GDPR Art. 33, and as soon as feasible under PIPEDA's breach-reporting requirement. If you find a vulnerability, please report it to sports@vancouverjamaat.ca.
Sports Portal is not directed at children under 13 (16 in the EEA, where GDPR Art. 8 sets a higher age for consent to online services). We do not knowingly collect personal information from children below these ages.
Where a league includes youth players, accounts must be created and managed by a parent or guardian who consents on the child's behalf. If you believe a child has given us personal information without that consent, contact us and we will delete it promptly.
If you are unhappy with how we have handled your information, please contact us first at sports@vancouverjamaat.ca — we would rather fix it directly. You also have the right to complain to a regulator at any time:
| If you are covered by | Contact |
|---|---|
| PIPEDA (Canada) | Office of the Privacy Commissioner of Canada |
| PIPA (British Columbia) | Office of the Information and Privacy Commissioner for BC |
| GDPR (EU/EEA) | Your national Data Protection Authority |
| UK GDPR | Information Commissioner's Office (ICO) |
Skill ratings, leaderboard positions, and matchmaking suggestions are calculated automatically from your match results. These affect who you are matched against and where you appear in rankings, but they have no legal or similarly significant effect on you under GDPR Art. 22.
If AI performance insights are enabled for your league, aggregate match statistics — never your name, email, or messages — are sent to Anthropic to generate a written summary. This feature is off by default.
If we make a material change to how we use your information, we will update the version at the top of this page and ask you to review and accept the new policy the next time you sign in. Minor clarifications and typo fixes will not trigger a re-consent prompt.
Your full consent history — what you agreed to and when — is visible in your Privacy Centre.