Privacy policy

Last updated 1 November 2026

• 1. Who we are
• 2. Who is responsible for what
• 3. What we collect
• 4. Why we use it, and our lawful basis
• 5. Children and young players
• 6. Who can see what
• 7. Companies that help us run Bibwell
• 8. How long we keep it
• 9. Keeping it safe
• 10. Your rights
• 11. Cookies and this website
• 12. For clubs: our data processing terms
• 13. Questions and complaints
• 14. Safeguarding concerns
• 15. Changes to this policy

1. Who we are

Bibwell is run by Ryan Taylor, trading as Bibwell.

Email: hello@bibwell.co.uk. Use this for anything about your data, including the requests and complaints described below.

2. Who is responsible for what

Data protection law (the UK GDPR and the Data Protection Act 2018) talks about a controller, who decides how information is used, and a processor, who handles it on the controller's behalf.

• Your club or team is the controller of the team's information: players, ratings, fixtures, results, availability, medical details and messages. The coaches decide what goes in and who's invited.
• Bibwell is the processor for that information. We store it and run the app for the team, following the terms in section 12.
• Bibwell is the controller of what we need to run the service itself: logins, the emails we send, support requests and security logs.

If you have a question about your child's information in a team, you can ask the team's coach or club welfare officer, or ask us and we'll help.

3. What we collect

We don't store photos of players. The only image a team uploads is its club badge. We don't take card details: payments aren't part of Bibwell at the moment.

4. Why we use it, and our lawful basis

• To run the team: squads, line-ups, fixtures, results, stats, player development, and keeping families informed. Lawful basis: legitimate interests, the club's and the families' interest in a well-run team. We think this is what people expect when they join.
• To provide your account and keep you informed: invites and password links by email; fixture and squad details, replies and match updates as notifications on devices where you've turned them on, and by email only if you tick Email me too. Lawful basis: legitimate interests, and providing the service you asked to use. You choose what you're told about in the app's Account menu.
• Medical and emergency details are health information, a "special category" of data with extra protection. They're used only to keep the child safe at training and matches. Lawful basis: the parent's explicit consent, which can be withdrawn at any time by asking the coach to remove them. If someone's life is at risk, they may be shared with the emergency services (vital interests).
• Incident and safeguarding records are kept because England Football expects clubs to record them. Lawful basis: legitimate interests and, for safeguarding, the substantial public interest condition for safeguarding children.
• Security logs and support: to keep the service safe and help when something goes wrong. Lawful basis: legitimate interests.

We don't use anyone's information for advertising or marketing, we don't sell it, and we don't make automated decisions about anyone.

5. Children and young players

• Children don't have accounts. Accounts are for coaches and for parents and guardians aged 18 or over, who are invited by the team's coach.
• A parent or guardian sees only their own child's card, practice and progress. Other families see just a player's name and shirt number in the squad, line-ups, results and awards.
• Rating numbers are hidden from families by default. Families see positions, strengths and progress arrows. The coach can choose to show the level, skill numbers or match ratings. Children are never ranked against teammates.
• Nothing about a player is public. There are no public profiles and nothing is shown to search engines.
• Following England Football's guidance on photographing and filming children, Bibwell doesn't hold photos or film of players. If your club shares images elsewhere, it should get written parental consent first, as that guidance sets out. Bibwell lets a coach record whether photo consent has been given.

6. Who can see what

• The team's coaches see the team's information, including medical and incident records.
• Parents and guardians see their own child's card, the team's fixtures, line-ups shared with them, results, the Updates board and polls.
• A parent asked to track a match can update that match's score, clock and substitutions, and nothing else.
• Bibwell support can open a team only to help it, for a limited time. Each visit and change is logged and visible to the team's coaches.
• If a team switches on its public page, anyone can see what its coaches choose to put there: the club badge, finished results (scores and opponents only, never upcoming games, times or venues, and no player names), news posts and photos, sponsors, and the names of coaches who choose to be shown. Photos are only posted when the coach confirms everyone pictured has photo consent, and hidden details such as where a photo was taken are removed. The match day live view is behind a password the team shares with families, and shows the score and goals with first names only, never the venue.
• Nobody else. We'll only share information if the law requires it, for example with the police, or to protect a child from harm.

7. Companies that help us run Bibwell

These companies handle information for us under contracts that require them to keep it safe and use it only for us:

A fixture's map is only loaded from Google Maps if you tap Show map. Directions links open Google Maps, where Google's own privacy policy applies. Where information is handled outside the UK, it's protected by safeguards UK law approves, such as the UK's adequacy regulations or the UK International Data Transfer Addendum.

8. How long we keep it

• Team information is kept while the team uses Bibwell. When a team is closed, it's deleted straight away, and it drops out of our backups within 14 days.
• A player who leaves stays in the team's past seasons (results, stats and awards) unless the club asks for them to be removed. Their medical and emergency details are deleted when they leave.
• Accounts are deleted when a person is removed from their last team.
• Backups of the whole database are kept for 14 days. Server logs are kept for a short time, normally under a month.
• Clubs can ask us to delete any information sooner.

9. Keeping it safe

• Everything travels encrypted (HTTPS), and the servers are in the UK.
• Passwords are stored scrambled (hashed), so they can't be read, even by us. Sign-in links in emails work once and expire after 7 days.
• Every request is checked against strict access rules, so people see only what their role allows.
• The database is backed up every night.
• If something goes wrong that puts people's information at risk, we'll tell the affected clubs straight away. Where the law requires it, we'll report it to the ICO within 72 hours and tell the people affected.

10. Your rights

You have the right to:

• get a copy of the information held about you, or about your child;
• have anything wrong corrected;
• have information deleted, and restrict or object to how it's used;
• receive your information in a format you can take elsewhere;
• withdraw consent (for medical details, for example) at any time.

Ask the team's coach, or email hello@bibwell.co.uk. It's free, and we'll reply within one month. Parents and guardians can make these requests for their children. An older child who understands their rights can make a request themselves.

11. Cookies and this website

Bibwell uses one cookie, called bibwell, which keeps you signed in. It's strictly necessary, so it doesn't need your agreement. It lasts 60 days and is removed when you sign out.

The app also saves a few settings on your device, such as which team you last opened. There are no analytics, advertising or tracking cookies.

12. For clubs: our data processing terms

When your team uses Bibwell, we process your team's information on your behalf. We will:

• use it only to provide Bibwell to your team, and as you instruct;
• make sure anyone who can access it is bound to keep it confidential;
• keep it secure, as described in section 9;
• use only the companies listed in section 7, and tell you before adding others;
• help you respond when someone asks to see, correct or delete their information;
• tell you without undue delay if there's a breach affecting your team's information;
• delete your team's information when you stop using Bibwell, or give you a copy first if you ask (coaches can also export it from the app);
• give you the information you need to show you're meeting your own data protection duties.

As controller, your club should tell its members that it uses Bibwell, for example in its own privacy notice or membership form, and link to this policy. It should also add medical details only with a parent's agreement.

13. Questions and complaints

If you're unhappy with how information has been handled, please tell us first at hello@bibwell.co.uk. We'll acknowledge your complaint within 30 days, look into it without undue delay, keep you updated, and tell you the outcome.

You can also complain to the Information Commissioner's Office (ICO) at ico.org.uk/make-a-complaint or on 0303 123 1113.

14. Safeguarding concerns

15. Changes to this policy

We'll update this page when anything changes and show the date at the top. If a change affects how your information is used, we'll tell coaches in the app or by email first.