Privacy notice for STATIQ

Version 1.4 · Effective from: 2026-10-14 · Controller: JIWA HOLDING AS

1. Who we are

JIWA HOLDING AS (organisation no. 832 249 092, c/o Patrik Rusthan Widenqvist, Jernbanegata 8, 1606 Fredrikstad, Norge) is the controller for its own processing of account, security and operational data in the STATIQ iOS app and web application. Responsibility for player data is described below. Privacy enquiries: privacy@statiqsport.com.

2. Personal data we process

The contract with the adult customer does not automatically provide a legal basis for other players’ data. Where GDPR applies, the controller must establish a basis for recording and sharing data according to the specific purpose.

We do not process health information, precise location or marketing profiles.

When several people use the same workspace, its owner and an authorised administrator can see members' chosen display names, roles and access status. Email addresses are not shown in the member overview. An invitation link contains a random token displayed once. The server stores only the SHA-256 hash, and the invitation expires after seven days or when used or revoked. The recipient's browser or Apple app may hold the raw token locally for at most one hour to complete sign-in and onboarding. It is deleted on redemption, permanent failure, sign-out or expiry and is never used in logs or telemetry.

Personal accounts for coaches and parents

Adult coaches and parents may use personal accounts within their subscription's features. The subscription tier does not determine who is the controller of player data. JIWA HOLDING AS is the controller for account, security and operational data.

If you record on behalf of a club or another organisation, you must have its authorisation. The organisation must establish the purpose, legal basis, information for players and guardians, recipients and deletion rules. Processing JIWA carries out on the organisation's behalf must be governed by documented instructions and a data processing agreement.

If you record on your own initiative outside purely private family use, you are normally the controller for your own purposes and must establish the legal basis, information for players, recipients and deletion rules. Being a parent does not give you authority over other players’ data. Confirming adulthood or buying a subscription does not itself provide a legal basis.

Purely private family use may fall within the household exemption, depending on the actual recording and sharing. The exemption does not cover club operations, commercial use or sharing with an indefinite audience. Where it applies, the user does not need a GDPR legal basis for that processing. JIWA’s own privacy obligations remain. Use only necessary data and share only with intended recipients. The conditions for protected rosters and minors below still apply.

Where a club or an independent user is the controller and JIWA processes player data on their behalf, documented instructions and a data processing agreement must cover the processing. This applies regardless of subscription tier, including Personal.

Protected team rosters

For official cup/federation capture or club team administration, the organisation's administrator can enable names for each team. Full names are then also processed, linked to jersey numbers and internal player IDs. Before activation, the organisation documents controllership, purpose, legal basis, participant information and a specific deletion date. JIWA HOLDING AS processes these data under the organisation's instructions and agreement; responsibility and legal basis must be clarified before use with real participant data.

Names are stored separately, with access for authorised organisation administrators. They are not included in ordinary statistics reports, sharing links or offline data. A roster without names sends only jersey numbers; the raw file is not stored. The administrator can provide access to, correct and delete names in the protected roster. Names are also deleted on anonymisation or when the team/workspace is deleted. The expiry date blocks reading immediately and is included in the automatic deletion job. A policy may run for no more than 730 days; this is a product limit, not a statutory deadline.

Administrators can also import multiple teams and rosters using a Team ID from another system or one generated by STATIQ. The protected roster can include first and last name, date of birth or birth year only, and an imported paid-licence flag. A date of birth is not a national identity number, and the licence flag is not proof of payment. The organisation may use these fields for age checks and, if separately approved, future matching with a federation player register. This feature has no active external register connection. The fields follow the same access, expiry, correction and deletion rules as names above.

In a personal workspace, the owner may import first and last names with jersey numbers after setting an active policy for each named team. Before importing, the owner must explicitly confirm their authority to process the data and that players have been informed. This confirmation is not consent given by each player. Birth dates, birth years and licence flags are prohibited in this Personal flow. Names stay in the protected roster, outside game statistics, offline data and shared reports. The owner may correct or erase names and revoke the policy.

Account emails

Supabase Auth sends essential account emails through Resend: invitations, registration confirmation, password recovery and email change confirmation. Resend processes the recipient address, message content with an action link and delivery metadata. The account password is not sent in the email. Do not share the action link with others.

Quote requests

The contact’s name, business email, organization and country, plus optional phone number, team/user/game counts and message, are used to respond to the request and prepare a quote. The quote feature sends this information through Resend to contact@statiqsport.com, an alias for JIWA’s regular mailbox at one.com. A request does not subscribe you to marketing and is not stored in the app database. Retention in the mailbox and by email providers must be manually limited to the purpose and any legally required retention.

Resend (Plus Five Five, Inc.) uses Ireland as its sending region but stores message content and delivery logs in the United States, as described in Resend’s privacy information. The standard data processing agreement applies to the existing account through the service terms. The transfer to Resend relies on the EU-U.S. Data Privacy Framework (DPF). The DPF register showed active status with re-certification under review on 8 October 2026. The sending region does not mean EU storage.

one.com’s standard data processing agreement forms part of JIWA HOLDING AS’s existing agreement. one.com lists Danish data centres and backups for hosting, and system monitoring in Denmark and India. The agreement requires transfer safeguards, such as standard contractual clauses (SCC), for subprocessors outside the EEA. The scope of processing in India for this email plan is not yet confirmed; the service is therefore not described as limited to the EEA. This concerns the mailbox for contact, support and privacy enquiries.

3. Children and minors

Statistics may concern players under 18. Players are recorded with minimal data (jersey number + nickname) by the adult who owns the workspace and confirms responsibility during onboarding. The app is not directed at children as users. Parents or guardians can request access, correction, anonymisation or deletion through the workspace owner or privacy@statiqsport.com. The adult owner may optionally enable a separate protected roster of names under the conditions above and confirms their responsibility.

4. Sharing and recipients

We never sell data. Subprocessors (see the subprocessor list) process data on our behalf under a data processing agreement: Supabase (database/authentication, EU), Cloudflare (app and API operation), Apple (App Store subscription), Stripe (web payment). Shared reports are read-only links that expire after 7 days by default, at most 30 days, and can be revoked. Anyone with the link can open the report and download PDF, CSV and JSON without an account. The link should therefore be shared only with intended recipients and is not indexed by search engines.

5. Retention

The versioned retention schedule provides the complete overview. The main rules are:

• An active account, workspace and necessary paid history are retained while the account is active and the purpose remains.
• When a subscription is cancelled, paid access continues until the end of the paid period. The workspace then moves to Free. Cancellation does not start a deletion deadline, and previously saved history remains readable, exportable and deletable.
• An inactive Free account is notified after 24 months without owner sign-in or workspace activity. Deletion occurs no earlier than 30 days after confirmed delivery to the recipient, only if the account remains inactive. New activity stops deletion. Operational verification in production is still required before launch.
• Finalised game copies with all events confirmed by the server are deleted at startup, on returning to the app and hourly while it is active, without a network connection. A closed or suspended app cleans up on its next run. Unconfirmed data are retained. Local confirmation of finalisation must be present; unknown finalisation is retained.
• On account deletion, access and sharing links are revoked immediately. The account and workspace are deleted or anonymised without undue delay, within 30 days at the latest.
• A player is deleted immediately if no necessary history exists. Otherwise, the identity is anonymised without undue delay, within 30 days at the latest.
• Sharing links last 7 days by default and at most 30 days. Generated report files are deleted after 30 days.
• A pending workspace, group, game or complimentary-seat invitation token on the recipient's device is deleted within 1 hour, and earlier on redemption, permanent failure or sign-out.
• A workspace invitation expires after 7 days. The server's token hash and minimised invitation metadata are deleted within 30 days after redemption, expiry or revocation.
• Ordinary technical logs must be deleted after 30 days, redacted error, diagnostic and operational security logs after 90 days, and minimised audit events after 365 days. Provider-managed log deadlines must be configured and documented before launch.
• Minimal evidence of privacy requests and consent: 3 calendar years from case closure or the end of the customer relationship, calculated in UTC. Open cases are retained; older cases without a known closure require review.
• Primary accounting records are retained for 5 years after the end of the financial year. Secondary records are retained for 3 years and 6 months where this rule applies.

Deleted data in backups are blocked from ordinary use and expire at the next rotation, with at most 28 additional days. The platform setting must be documented before launch.

6. Your rights

In the app and on the web, you can view and correct account information, export account and workspace data (JSON + reports), request account deletion, revoke report links, remove unused players, anonymise players while preserving the boxscore, and leave a workspace you do not own. Account exports also include your memberships, invitations you created or redeemed, and minimised provenance for game events you recorded. They do not export other members' identities or secret invitation tokens. A deletion request blocks access immediately and can be withdrawn before final deletion takes place. You also have the right to complain to the Norwegian Data Protection Authority (Datatilsynet).

7. Security

Workspace-level row security, encrypted local device database (SQLCipher, key in Keychain), TLS throughout, minimised logs with mandatory masking, append-only event log and audit trail. See the security overview.

When the security check is enabled, STATIQ uses Cloudflare Turnstile against automated attempts to sign in, register, resend confirmation and reset passwords. Cloudflare receives the IP address and ordinary browser/device information, as described in the Turnstile Privacy Addendum. STATIQ does not send email addresses, passwords, session information or player data to the challenge page. The single-use token is held only in memory until the authentication attempt, or until the check expires or is cancelled. STATIQ does not write the token to logs or persistent storage.

8. Transfers outside the EEA

The app database is stored in the EU (Supabase eu-north-1). Norway is part of the EEA, and EU-based storage does not change retention deadlines. Cloudflare, Apple, Stripe, Resend and one.com may process data outside the EEA. Such a transfer requires a valid transfer basis and necessary supplementary measures, documented in the subprocessor list.

9. Changes

This notice is versioned. Material changes are announced in the app before taking effect.

Optional product analytics (2026-10-05)

Help JIWA HOLDING AS improve STATIQ by sharing sign-in counts, device category, features used and active time. The owner can connect these statistics to your account. No player data, screen recordings or precise location are collected.

Off by default. Your choice does not affect access. Turning this off deletes your recorded usage sessions. Sessions are otherwise kept for up to 90 days.

These data are linked to your account and available only to the platform administrator with two-factor authentication. The purpose is to improve the product, based on your voluntary consent. Country is your own selection, not GPS or inferred from an IP address. No analytics SDK, analytics cookies, screen recordings, keystroke content or player data are included. Your choice is saved to your account. Measurements are deleted after 90 days, immediately on withdrawal or when you request account deletion. Your measurements are included in your account export. Name, email, access and last known sign-in are used separately for necessary access administration.

Optional Google Analytics on the homepage

JIWA HOLDING AS uses Google Analytics on the public homepage / to understand visits, only after your voluntary consent (GDPR Article 6(1)(a)). Google receives cookie identifiers, page views and ordinary browser, device and network information. The IP address is processed with the network request and may be used for approximate geographic information. The website does not send account, workspace, game or player data, query parameters, URL fragments or the referring URL in the analytics configuration. Advertising signals and ad personalization are disabled in the website tag.

The Google tag is not used on sign-in, payment or game surfaces, in EEZE or in the iOS app. Your choice does not affect access to STATIQ. The cookie statement describes choices, local storage and withdrawal. Browser expiry periods are not deletion periods for measurements held by Google. The Google property's actual retention setting has not been confirmed in this delivery. See the supplier list for the provider and transfers.