Legal

Privacy Policy

Last updated 29 August 2026

This Privacy Policy explains how the Whystl app (“Whystl”, “the app”, “we”, “us”, or “our”) collects, uses, and protects your information. Whystl is a companion app for rugby referees to time and record matches, track their refereeing, and contribute to a shared directory of clubs and kits, for iPhone and Apple Watch.

Whystl is an independent app, developed and operated from the United Kingdom. Whystl is the “data controller” responsible for the personal data described in this policy. If you have any questions about this policy or your data, contact us at privacy@whystl.app.

Please read this policy carefully. By creating an account and using Whystl, you agree to the collection and use of information in accordance with this policy.

1. Who this policy applies to

Whystl is available globally on Apple’s App Store. This policy applies to everyone who uses the app, wherever you are located, including users in the United Kingdom, the European Economic Area (EEA), and the United States.

Whystl is intended for referees and is not directed at children. We do not knowingly collect personal data from anyone under the age of 16 (or under 13 where permitted by local law). If you believe a child has provided us with personal data, please contact us and we will delete it.

2. Information we collect

We aim to collect only what the app needs to work. Specifically:

a) Account information (via Sign in with Apple)

Whystl uses Sign in with Apple as its only sign-in method. When you sign in, Apple provides us with:

a unique, anonymous identifier for your account;
your name (only if you choose to share it, and only the first time you sign in); and
your email address, which may be a private “relay” address generated by Apple if you choose to hide your real email.

We never see your Apple ID password. You control what Apple shares with us.

b) Referee profile

Information you choose to add to your profile, such as your name, an optional profile photo, your country, and the rugby union(s) and society you referee in. These are shown in the app and used to tailor competition settings.

c) Match and refereeing data

Details of the matches you set up and record — for example team names, kit colours, scores, cards, substitutions, timings, and your match history — so we can sync them across your devices and show your refereeing progress, statistics, and achievements.

d) Community contributions

If you add a club or kit, or confirm a club’s ground location, that information is contributed to a shared community directory so other referees can reuse it. Club and kit entries are not personally identifiable. Ground locations are aggregated across referees; individual location samples remain private to your account.

e) Location data

With your permission, and only while you are using the app, Whystl uses your device’s location to:

suggest nearby teams and clubs when you set up a match; and
let you confirm that you are physically at a club’s ground, which helps map clubs accurately for other referees.

We do not track your location in the background. You can decline or revoke location access at any time in your device’s Settings, and still use the core features of the app.

f) Photos and camera

Used only if you choose to set a profile photo. The image you select is stored with your profile.

g) Health and workout data (Apple Health / HealthKit)

On Apple Watch, Whystl can record a match as a workout using Apple’s HealthKit, so you can capture the activity of officiating a game.

Your health and workout data stays on your device and in Apple Health. We do not collect, transmit to our servers, store, or share your HealthKit data, and we never use it for advertising or marketing. You can review or revoke Whystl’s access to Health data at any time in the iPhone Health app under Sharing → Apps, or in Settings → Privacy & Security → Health.

h) Feedback you send us

If you use the in-app feedback feature, we collect the message you write and any screenshots you choose to attach, so we can understand and respond to your feedback. So that we can reproduce a problem, the app also attaches basic technical context automatically: the app version and build number, your device model, your operating system version, how many matches you have recorded, and your primary union. Screenshots are held in private storage, readable only by you and by us.

i) Diagnostics

We use Apple’s MetricKit to collect crash, hang, and performance diagnostics (such as call stacks and device/OS metadata) and upload them to our backend so we can fix bugs and improve stability. These diagnostics contain no content you have entered, and we do not use any third-party analytics or advertising SDKs, nor do we collect advertising identifiers.

3. How we use your information

We use the information above to:

create and secure your account;
provide the app’s core features and sync your data across your iPhone and Apple Watch;
power community features such as nearby team suggestions and the club/kit directory;
respond to your feedback and provide support; and
maintain, protect, and improve the app, and comply with our legal obligations.

We do not sell your personal data, we do not use your data for advertising, and we do not send you marketing emails.

Whystl carries no advertising, contains no third-party analytics or advertising SDKs, and collects no advertising identifiers. We do not track you across apps or websites owned by other companies, which is why the app never asks for App Tracking Transparency permission. We do not use your data to train machine-learning models.

4. Legal bases for processing (UK/EU users)

Where the UK GDPR or EU GDPR applies, we rely on the following legal bases:

Performance of a contract — to provide the app and its core features once you create an account.
Consent — for optional processing such as accessing your location, photos, or Apple Health data. You can withdraw consent at any time.
Legitimate interests — to keep the app secure, to understand and act on feedback, and to maintain and improve the service, balanced against your rights.

We share information only as needed to run the app:

Apple. Sign in with Apple and HealthKit are provided by Apple under Apple’s own privacy policy. MetricKit diagnostics are delivered via Apple.
Supabase (our backend provider). We use Supabase to host our database, authentication, and file storage. Your account, profile, match, community, feedback, and diagnostics data are stored on Supabase’s infrastructure on our behalf. Supabase acts as our data processor.
OpenAI. When you add a new club, the club name and its union are sent to OpenAI to screen the name for inappropriate content and to help suggest the correct official spelling. No account information is sent. This is processed under OpenAI’s terms.
Legal reasons. We may disclose information if required to do so by law, or to protect the rights, safety, or property of our users or others.

We do not otherwise share, rent, or sell your personal data to third parties. Community contributions (clubs, kits, aggregated ground locations) are visible to other Whystl users by design. Everything else is private to your account and protected by per-user access controls.

6. International data transfers

Whystl is used globally, and your information may be stored and processed on servers located outside your country, including outside the UK and EEA. Where we transfer personal data internationally, we take steps to ensure it is protected by appropriate safeguards (such as standard contractual clauses or an equivalent mechanism) consistent with applicable data protection law.

7. Data retention

We keep your personal data for as long as your account exists. If you delete your account, we delete the personal data associated with it, including your teams, presets, and match history. Community contributions that are not personal to you (such as a club or ground you added) may remain in the shared directory so the app continues to work for other referees. We may retain limited information where we are legally required to do so.

8. Deleting your account and data

You can permanently delete your account at any time from within the app: Profile → Delete Account. This removes your account and its associated data, including your teams, presets, and match history. This action cannot be undone.

You can also contact us at privacy@whystl.app for help with deletion.

9. Your rights

Depending on where you live, you may have some or all of the following rights over your personal data:

UK and EEA (UK GDPR / EU GDPR)

access a copy of your personal data;
correct inaccurate data;
delete your data (“right to erasure”);
restrict or object to certain processing;
data portability; and
withdraw consent at any time.

You also have the right to lodge a complaint with a supervisory authority. In the UK, that is the Information Commissioner’s Office (ICO) at ico.org.uk.

California (CCPA/CPRA)

the right to know what personal information we collect and how we use it;
the right to delete your personal information;
the right to correct inaccurate personal information; and
the right not to be discriminated against for exercising your rights.

We do not sell or “share” your personal information as those terms are defined under California law.

Other US states

Residents of states with comprehensive privacy laws — including Virginia, Colorado, Connecticut, Utah, Texas, Oregon and Montana — have broadly similar rights to access, correct, delete and port their personal data, and to opt out of targeted advertising and profiling. Whystl carries no advertising and does not profile users, so those opt-outs do not arise.

Everywhere else

Wherever you live, you can ask us to access, correct, export or delete your personal data. We will honour the request unless we are legally required to keep something, and we will tell you if that is the case.

To exercise any of these rights, use the in-app deletion option or contact us at privacy@whystl.app. We may need to verify your identity before acting on a request.

10. Security

We take reasonable technical and organisational measures to protect your information:

traffic between the apps and our servers is encrypted in transit;
access is enforced in the database itself using row-level security, so one referee’s records cannot be read by another;
your sign-in session is held in the iOS Keychain on your device; and
feedback screenshots are kept in private storage, readable only by you and by us.

However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security.

11. Other services and this website

The app relies on Apple, Supabase, and OpenAI as described above. Their handling of your information is governed by their own privacy policies, which we encourage you to review.

This website (whystl.app) is hosted by Vercel. It sets no cookies, uses no analytics, and does not track visitors. Vercel processes standard server request data, such as IP addresses, for security and to deliver the site.

12. Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will revise the “Last updated” date above and, where appropriate, provide additional notice. Your continued use of the app after changes take effect constitutes acceptance of the updated policy.

13. Contact us

If you have any questions, requests, or complaints about this Privacy Policy or your personal data, please contact:

Whystl — Data Protection
Email: privacy@whystl.app
General support: support@whystl.app

Whystl is a trading name of Iain Downer, an independent developer based in the United Kingdom, who is the data controller. A postal address for formal data protection correspondence is available on request.

This document is provided for the Whystl app. It is not legal advice. You should consider having it reviewed by a qualified legal professional for your specific circumstances.