Privacy Policy

ThatPlay provides the tool. You control the content. You choose what video you analyse. Local videos stay on your device, while your analysis can be saved securely to your ThatPlay account.

1. Who operates ThatPlay

ThatPlay is a privately developed, free, non-commercial service operated by a private individual in Sweden. There is no company behind it, and no charge is made for using it.

Privacy contact: privacy@thatplay.se. Website: https://thatplay.se.

2. Scope

This policy covers the ThatPlay web application and website, including account handling, analysis data stored in ThatPlay Cloud and information stored locally in your browser.

ThatPlay is a tool for adults working with sports analysis. It is not directed at children, and players appearing in analysed video are not automatically ThatPlay users.

3. Your video stays on your device

Local video files selected for analysis remain on your device. ThatPlay stores the analysis associated with the video, but does not upload the original local video file to ThatPlay Cloud.

If you choose “Remember this video on this device”, your browser stores a file reference locally so the same file can be reconnected later. This is a device-specific local connection, not a cloud backup — it does not exist on your other devices.

• Stored locally for reconnection: a browser file handle/reference, file name, file size, duration, last-modified value and a lightweight fingerprint.
• Removing that connection (“Forget video on this device”) deletes ThatPlay's remembered reference. The original video file is never deleted by ThatPlay.

4. Data stored in ThatPlay Cloud

Depending on how you use the service, the following may be stored in your account:

• Account identifier, email address and authentication information handled by the authentication provider
• Profile and preferences: display name, team/club, role, profile picture, language
• Matches and video metadata (file name, duration, frame rate, fingerprint values, notes)
• Moments, Categories, Tags, classifications, observations and notes
• Player numbers and positions used in your analysis
• Tactical board data, Reviews, Comparisons and question cards
• Reference video metadata (YouTube video ID, source URL, title, thumbnail, notes)
• Legal acceptance records (document, version, timestamp) and consent settings
• Technical and security information necessary to operate the platform

We do not assume that this data is anonymous. A player number, position or coded identifier can still relate to an identifiable person depending on your context.

5. Purposes and legal bases

We do not use consent as a blanket basis for running the service. Consent is used only where it is genuinely required and freely given, such as optional marketing email.

We do not use your video, notes or identifiable analysis content to train AI models.

• Account and authentication — creating and securing your account. Legal basis: performance of a contract.
• Providing ThatPlay — saving and retrieving your analysis data and delivering requested functionality. Legal basis: performance of a contract.
• Security and abuse prevention — protecting accounts and the platform. Legal basis: legitimate interests in operating a secure service.
• Customer support — answering requests and diagnosing issues. Legal basis: performance of a contract and legitimate interests.
• Legal obligations — where information must be retained under applicable law. Legal basis: legal obligation.
• Product analytics — ThatPlay currently uses no third-party behavioural analytics. Feature counters are stored only in your own browser.

6. Our roles under data protection law

ThatPlay can have different roles for different processing.

ThatPlay as controller: for user account administration, authentication, platform security, support, legal compliance and our own necessary service administration.

ThatPlay as processor: where a club, team or other organisation uses ThatPlay to store or process analysis data about individuals for its own purposes, ThatPlay may act as a processor on that customer's behalf under a Data Processing Agreement.

The exact role depends on the actual processing and is assessed case by case.

7. Recipients and service providers

We share personal data only with providers needed to run the service. Active providers are listed on the Subprocessors page, including purpose and, where confirmed, data location.

Embedded third-party content (for example a YouTube reference video) is loaded from that provider. Loading it means your device communicates with that provider.

8. International transfers

Where personal data is processed outside the EU/EEA, an appropriate transfer mechanism is required. The current hosting and transfer details are listed on the Subprocessors page and are being confirmed with our infrastructure provider; we do not state a mechanism we have not verified.

9. Retention

• Account and analysis data: kept while your account is active, or until you delete the item or the account.
• Deleted account: deletion is immediate and permanent. Your account, the cloud analysis data linked to it, your profile picture and your consent records are removed, and the deletion is verified afterwards. There is no grace period and no restore. Routine infrastructure backups expire on their own and are never used to recreate a deleted account.
• Security and technical logs: retained only as long as needed for security and operations. A published retention period will be added once it is fixed in our infrastructure configuration.
• Local device storage: remains on your device until you remove it in the app or clear your browser storage.

10. Security

Access to your data requires authentication. Data is isolated per user by row-level security rules enforced by the database, privileged operations run server-side, and secrets are stored outside the frontend code.

We do not claim any security certification. We describe what we actually do.

11. Your rights

Contact privacy@thatplay.se for any privacy request. We will not disclose other people's personal data in response to a request.

• Access, rectification and erasure of your personal data
• Data portability — export your data as JSON from Settings → Privacy & data
• Restriction of, or objection to, processing based on legitimate interests
• Withdrawal of consent where processing is based on consent
• Deletion of your account from Settings → Privacy & data

12. Cookies and local storage

ThatPlay uses strictly necessary cookies and local storage to keep you signed in and to remember your preferences and local video connection. Details are in the Cookie Policy.

13. Complaints

You can always contact us at privacy@thatplay.se. You also have the right to lodge a complaint with your supervisory authority. In Sweden this is the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY), imy.se. Contacting us is not a precondition for contacting the authority.

14. Changes to this policy

We update this policy when the product changes. Version 1.0, last updated 2026-08-09.