Legal & Trust
Third-Party Services
Ovalball relies on a small number of external services to run. This page lists them, what each does, and whether it is currently active or supported but not yet switched on. It is written from the actual configuration of the live service, not from a general list of tools.
- Effective date
- 5 September 2026
- Last updated
- 5 September 2026
- Version
- 1.0
Currently active
| Provider | What it does for Ovalball | Information involved |
|---|---|---|
| Supabase | Hosts the Ovalball database and handles sign-in. This is where club, team, player, fixture and messaging information is stored, and where the access rules are enforced. | Effectively all service information, plus account and authentication details. |
| Vercel | Hosts and serves the Ovalball web application at ovalball.co.uk. | Requests to the site, and technical/security information such as error logs. |
| Optional sign-in (Continue with Google). Ovalball receives identity and authentication information only — your name, email address and Google account identifier. It does not request contacts, Drive, calendar, photographs or any advertising data, and Google never shares your password with Ovalball. | Identity and authentication details for people who choose this sign-in method. | |
| Cloudflare | Turnstile, a human-verification check on the sign-in and sign-up pages, used to prevent automated account creation and automated sign-in emails. It checks whether a visitor appears to be a person; it does not identify anyone and is not used for analytics or advertising. | Technical signals about the browser making the request. Turnstile sets no cookie and stores nothing in the browser on ovalball.co.uk; it loads a script from challenges.cloudflare.com and makes one verification request. |
Supported, not yet enabled
These are built into Ovalball but are not switched on in the live service at the date of this page. They are listed for transparency, so the position is clear before they are enabled.
| Provider | Intended purpose | Status |
|---|---|---|
| GoCardless | Collecting club membership payments by Direct Debit where a club enables paid memberships. GoCardless holds the bank details; Ovalball holds references and payment status only. | Supported. Live payment collection is disabled in production. |
| Meta / Facebook | Optional sign-in (Continue with Facebook). Identity and authentication only. | Supported. Not yet enabled. |
| Apple | Optional sign-in (Sign in with Apple), including Apple's Hide My Email relay. Identity and authentication only. | Supported. Not yet enabled. |
Where sign-in providers are enabled, Ovalball will request identity and authentication information only. It will not request contacts, friends, photographs, posts, calendars or advertising data.
Not used
Ovalball does not use analytics platforms, advertising networks or tracking pixels. There is no Google Analytics, no Meta pixel and no comparable tracker in the service. This is verified against the application source and is stated in the Cookie Policy as well.
Location of processing
Our providers may process information outside the United Kingdom. Where that happens, the transfer must be covered by an appropriate safeguard recognised under UK data protection law. We deliberately do not claim a specific data-centre region here, because that depends on provider configuration and we will not state it until it is confirmed and can be kept accurate.
Changes and contact
This list will be updated as providers are added, enabled or removed, with the version and dates above. Questions can go to Pipaxon Technologies Ltd via the Ovalball support page.