Privacy policy

This page describes how the current CREZA beta handles your information and the controls available to you. Last updated: 14 October 2026.

Information in your account

CREZA stores your account identity, sports profile, measurements and experience you choose to add, posts, applications, connections and messages. CREZA also stores coaching enquiries and booking requests, including appointment details and notes you choose to add. Previously created workspace records are retained. Authentication is handled by Supabase; account emails use Resend.

Why information is used

Account details let you sign in and receive account emails. Profile information supports discovery and the visibility settings you choose. Posts, messages, applications and booking details are used to deliver those features; reports and account activity help staff address safety, misuse and support requests. Do not include medical records, identity documents or other sensitive details in public posts or ordinary support messages.

Signup asks for your name, email, password and an age check. It does not store the exact age entered in that check as a profile field. Optional profile details can be left blank. Signup records the version and time of your terms and privacy acknowledgement; this is separate from permission for optional videos or notifications.

Service providers and browser storage

Vercel hosts the website. Supabase provides authentication, database and media storage, and Resend delivers account emails. Requests to these services include technical information needed to deliver and secure the service, such as IP addresses and request details. Existing Google connections and optional video providers are described below. See the cookies and browser storage policy for sign-in storage, saved drafts, display preferences and external-player controls.

What other members can see

Your profile visibility and incoming messages can be changed in Preferences. New posts and reposts start Public, including your name and any media you attach. You can choose Connections or Connections and their connections before publishing, and change a post’s audience later. Signed-out visitors and search engines can view Public posts through public post links. Hiding your profile does not hide a Public post. New media uploads use short-lived access links tied to post visibility. Older photos may have permanent public URLs, and a media link already issued may remain usable briefly after you narrow a post’s audience. Club affiliations and experience are self-reported unless stated otherwise.

Optional public profiles

Public sharing is off by default. Members with completed profiles can choose a public link and which additional sections appear. Publishing shares your name, headline, role and sports with anyone who opens that link. Search engines may index it, and visitors can share or save it. You can switch sharing off in your profile, but cannot recall copies already saved elsewhere. A recommendation appears publicly only with the writer’s public-sharing consent and your approval.

Notifications and discovery counts

Your private notification inbox shows activity such as connection requests, messages, recommendations and application updates. CREZA also counts signed-in profile views and search appearances once per member per day. Your analytics show totals for the last 30 days without identifying visitors. Optional daily reports and downloads also contain only aggregate counts. The underlying discovery records contain the viewer and profile account IDs, activity type and date. Records older than 30 days are removed when new discovery activity is recorded. Your own activity and logged-out visits are excluded. Highlight videos load from YouTube or Vimeo only when you choose to play them; those providers then receive the information needed to serve the video.

Private activity

Messages are limited to their conversation participants. Application details are available to the applicant and authorized recruiters; recruiters’ notes stay private to recruiting staff. Support conversations are visible to you and platform staff. Staff can review reported content.

Existing team and client workspace records

Management tools are currently unavailable on the site. Existing records retain their access restrictions. Contact support for help with those records, workspace access or leaving an existing workspace.

Team and client workspaces require accepted invitations. Team members can see the accepted roster and team schedule. Individual client appointments stay private to that client and authorized managers. Agency agents can manage only clients assigned to them. Development notes are visible to authorized managers, not on member profiles. CREZA records new-contact message usage to apply limits that help prevent spam. Team group chat is visible to accepted players and authorized team managers. Tasks are visible to the assigned player and team managers. Removing someone from a workspace ends that workspace access.

Existing Google Calendar & Meet connections

For accounts with an existing Google connection, CREZA uses your Google identity and permission to manage events on calendars you own to create, update and remove Calendar copies and Meet links for sessions you select. CREZA stores your Google account ID, verified email, granted permissions, encrypted access and refresh tokens, and connection and synchronization records. The tokens let CREZA synchronize those sessions after you connect.

Calendar copies sent to Google contain generic session text, times and internal identifiers. They do not include attendees, private client names, notes or documents; CREZA sends no Calendar invitations. Within CREZA, stored meeting links are available only to people authorized to view that session.

Disconnecting Google

Disconnecting through CREZA stops new synchronization, removes the stored links from CREZA and queues deletion of CREZA-created Calendar copies. Contact support for help with an existing connection while workspace controls are unavailable. Your CREZA sessions remain. Encrypted tokens are cleared after cleanup completes; Google account identity and connection/audit history remain. Calendar subscriptions and previously imported .ics copies are separate.

Disconnecting does not automatically revoke CREZA’s access in your Google Account. You can remove CREZA through your Google Account connections. Removing that access before cleanup finishes can prevent Calendar deletion; you may need to delete the Calendar copies yourself. Google controls when existing Meet codes expire, so a previously shared Meet URL may continue to work.

Protecting the service

CREZA uses request limits to reduce spam and abusive traffic. Private security counters record an account identifier or a pseudonymous network identifier, a request category, a time window and a count. They do not store message contents, passwords or full request bodies. An hourly cleanup removes counters after their window has been expired for 24 hours. Hosting and backend providers also process technical request information to secure their services.

Privacy questions and requests

You can request help accessing, correcting or deleting your information by emailing crezasports@gmail.com, including if you cannot sign in. Describe the request without sending a password, sign-in code or unnecessary identity documents. Support may need to verify that the request concerns your account.

Depending on the law that applies to you, you may also have rights to restrict or object to processing, receive a copy of your data, withdraw consent where processing relies on it, or complain to the relevant data protection authority. Withdrawing consent does not undo processing that already occurred.

Your controls

Use Preferences to download your account data, block members or delete your account. Club owners must transfer their club pages before deletion. For assistance, contact support in your account.