Privacy Policy
Last updated: 26 September 2026
The short version. This app is a window onto the record the academy already keeps about your child: which team they are on, whether they came to training, what their coach wrote about their progress, and what you owe.
To let you in, we need your phone number. That is the only thing we ask you for.
We show no advertising, we run no analytics or tracking software of any kind, we do not follow you into other apps or websites, and we never sell or rent anyone's information. Not your child's, not yours.
1. Who is responsible for your information
Beirut Football Academy (BFA) SARL, a company registered in Lebanon under Commercial Register No. 2033128, at Zalka Highway, Lebanon Centre, Block B, Floor 9, Lebanon.
For anything in this policy (a question, a correction, a copy of your data, or a deletion request), write to info@bfa-lebanon.com or call the academy on +961 76 354 532. A person reads that inbox.
2. What this policy covers
The BFA app in all the forms it is offered: the family portal on the web, the BFA app for iPhone, iPad and Android, and the app used by BFA coaches and administrators. The app is a view onto the academy's own management system; it does not build a separate profile of anyone.
3. What we collect, and why
If you are a parent or guardian
| What | Why |
|---|---|
| Your mobile phone number | It is your username. It is also how we send you a sign-in link over WhatsApp, so you do not have to remember a password. |
| Your password, if you choose to set one | To sign you in. We never store the password itself, only a salted PBKDF2-SHA-256 hash of it, which cannot be turned back into your password. |
| A sign-in token, kept on your own device | So the app remembers you and does not ask you to sign in every time. |
| Your child's photo, if you choose to add one | Shown on their player card and profile, to you and to the academy staff who already see their registration. It is stored in the academy's management system. You can replace it any time from the profile, and it is removed if you delete your login or ask at your branch. |
| Failed sign-in attempts | Five wrong attempts lock the account for fifteen minutes. This record is discarded within the hour. |
About your child, shown to you
- Their name, their team, and the branch they train at.
- Attendance: whether they were marked present at each session.
- Praise their coach gave them, and their termly assessment: how they are developing across the academy's pillars, with badges and a player card.
- Fixtures, results and academy events.
- Invoices, what has been paid, and the balance on your family account.
This is the academy's existing record of your child's football: the same information a coach could tell you at the touchline. It is created by BFA staff in the course of running the academy, not gathered from your phone.
If you are a BFA coach or administrator
- Your name, your work email address, your role, and the branches you are allowed to see.
- A salted hash of your password. Your Odoo password is never handled by this app.
- A log of the actions you take that change academy records: who marked what, and when. This is an accountability record for the academy, and it is not shown to parents.
- If you turn on notifications: the address your phone gives for them (a browser subscription, or in the BFA app for Android a Firebase Cloud Messaging device token), stored with your staff account and used only to deliver BFA notifications, such as a plan waiting for you. It is removed when you turn notifications off, or when your phone reports it no longer exists.
- Through the app, the player registration details the academy holds for safety and emergencies: photograph, date of birth, parents' names, school, level, identification number, blood type and contact number. Access is limited to the branches you work at, and every read of a player outside your branch is refused by the system.
Collected automatically
- Server records. Like any website, our hosting provider records the fact of a request: an IP address, a timestamp, which page or endpoint was asked for, and the browser or device type. These are operational and security records, kept briefly.
- On your device. A sign-in token and a few small preferences: whether you have seen the welcome screens, which report you last opened, which posts you have applauded. They live in your browser's local storage, they never leave your device except the sign-in token when it authenticates you, and clearing the app's data removes them.
- No advertising, and no advertising software in the app.
- No analytics or tracking tools. There is no Google Analytics, no Facebook SDK, no crash-reporting or session-recording service. We have not embedded any third-party script.
- No tracking across other companies' apps or websites, and no linking of your data to data brokers.
- No selling, renting or trading anyone's information, ever.
- No background access to your phone's location, camera, microphone, contacts or photos. The one exception is in your hands: when you choose to add your child's photo, your phone's own picker opens and only the picture you select is uploaded. The app never browses your photo library itself and has no permission to.
- No card or bank details. The app shows what is owed; payment is made at your branch or directly with the academy.
- No marketing messages to children, and the app never asks a child for personal information.
5. Who else can see this information
Only these companies handle any of it, each because the app cannot work without them, and each only for that purpose:
- Cloudflare hosts the app and stores the account records. Everything travels encrypted.
- Odoo is the academy's management system, where your child's record actually lives. It is BFA's own system, kept behind BFA's credentials.
- Meta (WhatsApp Business Platform) delivers your sign-in code or link and your payment receipts. Meta receives your phone number and the message, because that is what sending a WhatsApp message means. Nothing about your child's football is sent to Meta beyond what is written in the message you receive.
- Google (Firebase Cloud Messaging) and the push service of a staff member's browser deliver notifications to BFA coaches and administrators who turn them on. They receive the device's notification address and the short text of the notification, never a child's record.
Beyond these, we share information only if the law requires it of us, or if you ask us to.
6. Children
This app is designed to be handled by a parent or guardian. The account is yours, opened with your phone number, and everything about your child sits inside it.
- Player Mode lets you open a child's own view: their card, their progress, their next session. It is a restricted door: a device in Player Mode is refused by every part of the system that touches money, account settings or staff functions. That is enforced in the code, not by hiding a button.
- Assessments are written to describe a child's development, never to rank children against each other.
- A child's record is never public, never posted outside the academy's own feed, and never used to advertise anything.
If you believe a child's information has reached the app without a parent's knowledge, write to info@bfa-lebanon.com and we will remove it.
7. How long we keep it
- Your child's academy record: while they are enrolled, and afterwards as part of the academy's history, so that a returning player is not a stranger.
- Invoices and payment records: for as long as Lebanese accounting and tax law requires us to keep our books.
- Sign-in tokens: they expire on their own; sign-in links expire within fifteen minutes to seventy-two hours depending on their purpose, and can each be used only once.
- Failed sign-in records: within the hour.
- Temporary caches: minutes.
8. How we protect it
- Everything travels over an encrypted connection.
- Passwords are salted and hashed with PBKDF2-SHA-256 at 100,000 iterations. Nobody at BFA can read your password.
- Sign-in tokens are cryptographically signed, so one cannot be forged or edited.
- Invitation and password-reset links work exactly once.
- Five failed sign-ins lock an account for fifteen minutes.
- Staff access is scoped to the branches a person works at, and changes to academy records are written to an audit log.
No system is perfect. If we ever discover a breach that affects you, we will tell you.
9. Where your information is
BFA is in Lebanon, but the companies above operate internationally, so your information may be stored or processed on servers outside Lebanon. Wherever it sits, this policy still governs what we do with it.
10. Your choices and your rights
You may ask us at any time to:
- show you a copy of what we hold about you and your child;
- correct anything that is wrong;
- delete your account. You can do this yourself, in the app: Home → Delete my account. It removes your sign-in, your password and every device you are signed in on, including a phone in Player Mode, immediately and without having to ask anyone;
- stop sending you WhatsApp messages from the app.
For anything other than deleting your account, write to info@bfa-lebanon.com from the number or address the academy has for you, and we will act within thirty days.
Two honest limits, and we would rather state them than let you discover them. Deleting your account deletes your login, not the academy's records. Your child remains enrolled; their attendance, coach reports and your invoices stay in BFA's own files, because those are the academy's business records and we are required to keep the financial ones. So deleting your account does not cancel a registration and does not clear a balance. For either of those, talk to the academy. If you want your child's record removed as well, ask us and we will do whatever the law allows.
11. Changes to this policy
If we change what the app collects or who handles it, we change this page and move the date at the top. If the change is significant, we will tell you in the app rather than leave you to notice it.
12. Contact
Beirut Football Academy (BFA) SARL
Zalka Highway, Lebanon Centre, Block B, Floor 9, Lebanon
info@bfa-lebanon.com · +961 76 354 532