drilldb Your team sports training hub

Privacy Policy

As of 31 October 2026. Interim version, pending legal review. The German version of this page is the binding one. This English text is a courtesy translation.

1. Controller

MoveNext IT & Sports e.U., Mühlschüttelgasse 61/18, 1210 Vienna, Austria
Email: privacy@drilldb.app

MoveNext IT & Sports e.U. is the controller for the personal data we need to provide and manage drilldb, for sign-in, for the security of the service and for our communication. For the data a club manages in drilldb about its members, the club is the controller and we process that data on its behalf:

Data Controller
Account, sign-in, profile, settings, personal layer, personal library us
Acceptance of the terms and, for a club, of the data processing agreement us
Content and its visibility, share links, listed clubs, reports about content, feedback, technical logs us
Memberships and roles in a club, invitations, join requests the club; we act as its processor
In future: teams, scheduling, training history, ratings and notes the club; we act as its processor

This is governed by a data processing agreement under Art. 28 GDPR, the annex to our terms of service, which a club concludes by accepting the terms: whoever creates a club accepts it when creating it, and for an existing club one of its administrators accepts it. Until that has happened for an existing club, we process this data solely to provide the features the club uses. Questions about data a club is responsible for are best sent to the club; you can also send them to us, and we pass them on.

No data protection officer has been appointed. On the current assessment the conditions of Art. 37 GDPR are not met: the processing is neither a core activity of large-scale regular monitoring nor large-scale processing of special categories of personal data.

2. The short version

  • drilldb stores your email address, a minimal profile and the content you create.
  • There is no tracking, no analytics cookies and no advertising.
  • Your profile is not public by default. Content you make public is visible to, and can be copied by, every signed-in user.
  • If someone invites you into a club, we process your email address before you have an account. Section 6 describes what happens.
  • You can delete your account in the app at any time. It cannot be undone, and it does not reach copies other people have already made. Section 10 describes what happens.

3. What we process

Data Purpose Legal basis
Email address; when signing in with Google, the identifier, email address and name Google provides Account, sign-in, one-time codes Art. 6(1)(b) GDPR (contract)
Acceptance of the terms: the version accepted (its date), the time, your confirmation that you are 18 or older Concluding the contract and evidencing it; emailing you the version you accepted Art. 6(1)(b) GDPR; for the evidence, (f) (legitimate interest in being able to prove the contract)
Acceptance of the data processing agreement for a club: version, time, the accepting administrator Concluding and evidencing the agreement with the club (section 1) Art. 6(1)(b) and (f) GDPR (legitimate interest in being able to prove it)
Profile: display name, profile picture, short description, profile visibility Showing you to other users Art. 6(1)(b) GDPR
Settings: language, search languages Running the application Art. 6(1)(b) GDPR
Content: drills and their variants, their fields, tags and equipment, images and external links; training sessions built from drills; collections of drills and sessions Core function Art. 6(1)(b) GDPR
A club's logo, uploaded by its administrators Presenting the club Art. 6(1)(b) GDPR
Personal layer: favourites, your ratings and notes on drills and sessions, saved searches, recently viewed drills and sessions. Only you see your notes; only you see your rating — others see, from five ratings, only the average and how many Core function Art. 6(1)(b) GDPR
Organizations and memberships, roles, join requests with an optional message Working together in a club Art. 6(1)(b) GDPR; for memberships and requests the club is the controller (section 1)
Invitations: the invitee's email address, the club, the offered role, timestamps Inviting someone into a club (section 6) see section 6
Share links for individual drills and sessions Passing a drill or a session to people without an account Art. 6(1)(b) GDPR
Passkeys, if you set one up: a public key, the passkey's identifier, its name, when it was created and last used. Your fingerprint, your face and your device's PIN never leave the device; we never receive them Signing in without a code Art. 6(1)(b) GDPR
Contact form on the website: name (optional), email address, message, the page you write from Answering your enquiry Art. 6(1)(b) GDPR where it concerns an account or a contract, otherwise (f) (legitimate interest in being able to answer enquiries)
Technical logs: IP address, time, resource requested, errors Operation, stability, abuse prevention Art. 6(1)(f) GDPR (legitimate interest in a working, abuse-free service)
Reports about content, by email or through "Report a problem" in the app Handling the report; obligations under Art. 16 of Regulation (EU) 2022/2065 Art. 6(1)(c) GDPR
Feedback in the app: kind (bug or feature request), area, title, description and the further messages on it, its status, and the context the app shows before sending — app version, page, platform, language; no screenshots Handling and answering your feedback, fixing bugs and developing drilldb Art. 6(1)(b) GDPR; for developing the service, (f) (legitimate interest in a working, improving service)

Registration. Your account is created as soon as you request a sign-in code or first sign in with Google. Once you have entered the code or signed in with Google, we ask you on a page of its own to accept our terms of service and to confirm that you are 18 or older. If you decline, the account just created is deleted at once. If you accept, we store which version you accepted, when, and your age confirmation, and email you the version you accepted. If you stop before deciding, we ask again at your next sign-in; a new account that has neither accepted nor been used is deleted automatically after 7 days (section 9). We likewise ask accounts created before the terms were published, and every account when there is a new version, at their next sign-in; without accepting, signing out and deleting the account are all that remain.

You are under no obligation to provide this data — although without an email address no account is possible, and without accepting the terms no use.

There are no paid tiers at present, and we process no payment data. We will update this policy before that changes.

4. Visibility: profile, content and clubs

Your profile is visible only to the members of your clubs by default (and to the administrators of a club you ask to join, section 5). If you make it public, your display name, picture and short description are visible to anyone, signed in or not.

Your profile picture is stored under a random address that cannot be guessed. That address is not an access control: anyone who was once allowed to see your profile may know it and can keep fetching the picture, even after you make your profile non-public — until you replace or remove the picture; then it is no longer available there.

Content. You decide for each drill and each session who may see it: only you, your organization, or public. For public content:

  • It is visible to every signed-in drilldb user. Without signing in there is no overview and no search, and search engines do not index it.
  • It can be copied by others. A copy is an independent record belonging to the copying organization. If you later delete the content or make it private, existing copies do not disappear — they belong to someone else by then.
  • A search can be sorted by how often a drill was copied. Who copied it is not shown.
  • Tags and fields defined only inside your organization stay inside it; on a public drill, others see only what they may read themselves.

Share links. If you share a drill or a session by link, the link is the key: whoever has it sees that one drill or session — a session with its drills — without signing in — as you are allowed to see it at that moment — but not your profile or your library. The link cannot be guessed, may be passed on by its recipients and can be revoked at any time; after that it opens nothing. Pass it on accordingly.

Listed clubs. A club can choose to be listed so that coaches can ask to join it. Its name is then visible to anyone, signed in or not, together with its logo and how many public drills it has, and nothing else from its record. Personal libraries can never be listed. If a club is named after a person, listing publishes that name; the club's administrators decide, and the default is unlisted.

5. Recipients inside the application

  • Members of your organization see what is visible at organization level, and your display name on the content you created.
  • Administrators of your organization can change organization-wide settings, manage members and manage the organization's content. They do not see other people's private content or your personal layer.
  • If you ask to join a club, its administrators see your profile — even if it is not public — and your optional message (up to 500 characters) while the request is open. They receive an email with your display name. Decided requests are kept as a record; you receive an email about the decision.
  • Your personal layer — favourites, saved searches, recently viewed drills — is visible to you alone.
  • Your feedback, with every message on it, is seen only by you and by us — not by your club and not by other users. When we answer, you receive an email about it.
  • A club's acceptance of the data processing agreement — version, time and who accepted it — is seen by that club's administrators.

6. Invitations — if you do not have an account yet

This is the information for people who have received an invitation into a club (Art. 14 GDPR). The inviting club is the controller for the invitation; we process it on the club's behalf and give this information for it too.

  • Where we got your address: an administrator of the club named in the invitation entered it.
  • What we process: your email address, the club, the offered role, and when the invitation was created, sent, accepted, revoked or expired.
  • Why: to deliver the invitation and let you accept it. The email is a one-off system message, not advertising; opens and clicks are not tracked. If you do not accept, you do not become a member of anything.
  • Legal basis: Art. 6(1)(f) GDPR — the club's legitimate interest in inviting coaches to work together.
  • Recipients: the club's administrators (they see the address in the list of invitations), our database provider and our email provider (section 8), which processes the whole message including the invitation link.
  • Retention: an invitation is deleted automatically 90 days after it is accepted, revoked or expires; an open one when it expires. On request we delete your address without delay.
  • Your rights (section 13) apply equally — in particular you may object to the processing (Art. 21 GDPR), to the club or to us; we pass your objection on and delete the invitation.

7. Semantic search — not active yet

drilldb is meant to find drills by meaning as well, across languages. Semantic search is not active at present: no content and no search query is sent to a provider for it. Before it is activated we will update this policy and name the providers, the relevant processing locations and the transfer mechanisms.

For semantic search, a mathematical representation (a vector) is computed from drill content released for it. A vector is not readable original text, but it can carry information about the text it came from, and we therefore treat it as data in need of protection.

Content is sent to an external provider only to the extent the activated feature requires. Fields and tags internal to an organization are not included in representations used across organizations, as long as other organizations may not see them. The feature is activated only once the provider, retention, transfer basis, access protection and a contractual commitment not to use the data to train third-party AI models have been checked.

Before activation, every organization gets two settings, free in every tier: whether its public drills are used in cross-organization search and recommendation results, and whether other organizations' content is included in its own results. Before AI features use an organization's training history, notes or other personal data, we will extend this policy.

8. Processors and recipients

Provider Processing Location / third country Safeguard
Supabase Database, authentication, file storage, sending notifications Core project data in AWS eu-west-1 (Ireland); Supabase's support, account and operational data may be processed outside this region; company based in the USA Data processing agreement; for transfers to third countries, standard contractual clauses or the applicable Chapter V GDPR mechanism
Cloudflare Delivering and protecting the website and application; IP addresses and request and security metadata arise. Spam protection for the contact form (Turnstile): IP address, TLS fingerprint and User-Agent of your browser, which Turnstile checks when the form loads to recognise automated requests Global network; company based in the USA Data processing agreement; EU-US Data Privacy Framework, standard contractual clauses as fallback
Mailtrap (Railsware Products Studio LLC) Sending system messages (sign-in codes, invitations, join-request notices, the version of the terms you accepted, receipts and decisions for reports, feedback notices; messages from the contact form to us) with the addresses and content they need; content and logs of sent emails at most 30 days USA, US infrastructure Data processing agreement (part of Mailtrap's terms); EU-US Data Privacy Framework where the processing is covered, otherwise standard contractual clauses
Google LLC Signing in with Google: identifier, email address and name USA and further Google infrastructure Legal basis: Art. 6(1)(b) GDPR, at your request. Transfer: EU-US Data Privacy Framework where the processing is covered

For data a club is responsible for (section 1), these providers are our sub-processors. Providers for semantic search and for payments will be added before those features start (sections 3 and 7).

9. Retention

  • Account and profile data: until the account is deleted, then to the extent of section 10. A new account that has not accepted the terms within 7 days and holds nothing (no drills, sessions, plans, collections or share links, no club) is deleted automatically, as if you had deleted it yourself (section 10).
  • Acceptance of the terms: until the account is deleted; it is deleted with it.
  • Acceptance of the data processing agreement: as long as the club exists. If the account of the person who accepted it is deleted, the record stays with the club, without their name and email address.
  • Feedback: until your account is deleted; it is deleted with it, with every message on it.
  • Passkeys: until you delete them in Settings or delete your account; they are deleted with it.
  • Contact form: we do not store the message in the application; it reaches us as an email to support@drilldb.app. We keep it there as long as the enquiry and our answer require, and delete it afterwards unless a statutory retention duty applies; at Mailtrap, section 8 applies.
  • Content: until you delete or archive it. Content belongs to the organization it was created in and therefore stays when you leave that organization; the content of your personal library is deleted with your account (section 10).
  • Join requests: a decided request is deleted automatically 90 days after the decision; an open one stays until it is decided or withdrawn. Deleting your account deletes all of your requests, and on request we delete a single one sooner.
  • Invitations: see section 6.
  • Technical logs: one day at Supabase. Cloudflare provides us with no access logs for the website and the application; what Cloudflare itself processes to prevent abuse is governed by its data processing agreement.
  • Reports about content: as long as handling and evidencing the decision requires. Two years after the decision a report is separated automatically from the person who made it; the report and the decision then remain without any link to you.

10. Deleting your account, and what it does

You can delete your account directly in the app, under Settings › Account › Delete account; the app first shows you what will be deleted. You can also ask for deletion by email to privacy@drilldb.app. Deletion is final and cannot be undone.

What is deleted: your email address, any link to Google, your sign-ins and sessions, and our sign-in logs that contain your address; your display name, profile picture and short description; your settings and your personal layer (favourites, ratings and notes, saved searches, recently viewed drills and sessions); your memberships and join requests; your feedback with every message on it; the record that you accepted the terms. If you were a club's last administrator, a remaining member becomes administrator so the club is not left without one.

Your personal library is deleted with your account, with every drill and session in it, public ones included, their images and their share links. If other organizations have already copied one of your public drills, that copy stays as their own record; it no longer points to your drill. References other organizations hold to your drills, such as in their collections and sessions, are removed. If you want to keep drills, copy them into a club first.

Content in clubs stays with the club, because it belongs to the club (section 9). It shows "Deleted user" instead of your name; when you signed up or deleted your account is visible to no one in the application. Internally we keep a note that this account is deleted, so that it can neither be restored nor assigned to a club again.

Reports you submitted are kept as the record of the report and its decision (Regulation (EU) 2022/2065, Art. 16 and 17; section 9). If you accepted the data processing agreement for a club, that record stays with the club, without your name and email address. Our providers' logs outside the database, and any backups, expire on their own schedule (section 9).

11. Access, data portability and export

You have the right of access (Art. 15 GDPR) and, where its conditions are met, to data portability (Art. 20 GDPR). We answer such requests within the period in Art. 12(3) GDPR — in principle one month, which can be extended under the conditions set out there. Other people's rights are taken into account.

You can export your drills yourself, at any time: under Settings › Account › Your data you download one file (JSON) with every drill you created — its fields, tags and equipment by name and its images as a file name with a link; links to images that are not public hold for seven days. What this export does not contain, such as sessions, plans or collections, we provide on request in a common, machine-readable format, usually within one month. Write to privacy@drilldb.app.

12. Minors and images

drilldb is meant for coaches, not for players. Only people who are 18 or older may create an account; you confirm it when you accept the terms (section 3).

You can upload images on drills, your profile picture and, as a club's administrator, the club's logo. Images on a drill are seen by whoever may see the drill. An image you explicitly make public, and a club's logo, are stored publicly: anyone who knows their address can fetch them, signed in or not. If you upload a picture in which other people are recognisable — children and young people in particular — you are responsible for having the necessary consent.

13. Your rights

You have the rights of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection (Art. 21 GDPR). Write to the address in section 1.

You also have the right to lodge a complaint with a supervisory authority. In Austria that is the Österreichische Datenschutzbehörde, Barichgasse 40–42, 1030 Vienna, dsb@dsb.gv.at, www.dsb.gv.at.

14. Cookies and local storage

We use no advertising or analytics cookies and no tracking tools. For signing in and for the display preferences you choose (such as language, light or dark mode, card or table view), your browser stores technically necessary information. It serves only to provide the features you ask for. The contact form loads Cloudflare Turnstile, which checks characteristics of your browser when the form loads, to recognise automated requests (section 8). The website reads only whether you are signed in, to show you the way into the app instead of "Sign in". Signing out deletes the sign-in token; display preferences may stay on your device until you remove them in your browser's site data. This does not replace deleting your account.

15. Changes to this policy

We update this policy when the application or the providers we use change — in particular before the features announced in sections 3, 7 and 12 start. We inform signed-in users of material changes by email.