Scrumline

Privacy

What we keep about you, and why

Version 2, 18 October 2026. Written for South Africa's Protection of Personal Information Act (POPIA).

Your account: email address and password. The password is scrambled before it's stored, so nobody at Scrumline can read it.
Your profile: first name, surname, the name you were known by at school, team name and picture, if you add one.
Your schools: the schools you went to and the years you were there, if you add them, and which schoolmates confirmed you.
The game: your calls, points, leagues and prizes.
Chat: messages, photos, stickers, reactions and poll votes.
Alerts: a code from your phone's browser that lets us send you alerts, if you turn them on.
Problems you report: what you wrote, the page, the error and your device type, plus your internet address to stop abuse.
How the app is used: simple counts such as signing up, making calls and inviting players, so we know what works. No advertising trackers.
Schools and businesses that claim an account also give a contact name, phone number and payout details. We keep only the last four digits of a bank account.

To run the game: your calls, points, tables and school rankings.
To send the reminders and alerts you choose. You can switch each one off on Profile.
To keep chat safe: messages are checked for hate speech, threats, spam and links.
To pay schools and record every rand given, as the law requires.
We never sell your information or use it for advertising.

People in your leagues see your name, team name, picture and schools, your calls once each match kicks off, and your chat messages. Nobody outside your leagues sees your calls or chat.
Your email address is never shown to other players.
The people who run Scrumline can see your account to fix problems and moderate chat.

Supabase stores the data, on servers in Ireland. Ireland is covered by Europe's data protection law (GDPR), which gives at least the protection POPIA requires.
Brevo sends emails such as sign-in codes and reminders.
Google, Apple and Mozilla deliver phone alerts. They see the alert, not your account.
GitHub hosts the app's pages. It holds no player data.
Paystack handles payments to schools when they start.

For as long as you have an account.
When you delete your account, your personal information is removed straight away. Your calls and points stay under “Former player”, with no name attached, so other players' tables don't change.
Nightly backups hold a copy for up to 14 days, then it's gone. An encrypted copy is also emailed each night to the people who run Scrumline, so we can recover if the database is lost. Those emails are cleared out regularly, so a deleted account can still sit in an old one for a short while.
Money records are kept for 5 years, because tax law requires it.
Records of chat messages removed for breaking the rules are kept to protect other players.

See or correct it: your details are on Profile, and you can change them there.
Delete it: Profile, then Delete my account.
Ask for a copy, object, or ask anything else: use Report a problem on Profile or on the sign-in page. It goes straight to the person responsible for your information at Scrumline, and we reply within 30 days.
Complain: you can contact South Africa's Information Regulator at inforegulator.org.za.

Every player has a password, and the database only lets each person see what they're allowed to.
Scrumline is for adults (18 and older). We don't knowingly keep information about children.
If your information is ever exposed, we'll tell you and the Information Regulator as soon as we can.