Last updated 12 September 2026
OpenXI is an app for organising pickup soccer. This policy says what personal information the app collects, why it is collected, who else sees it, and how you get a copy of it or delete it. It covers the OpenXI mobile app and this website.
OpenXI is operated by Marko Mikovic as an independent developer ("we", "us"). For anything in this policy, write to support@openxi.app.
| What | Why |
|---|---|
| First and last name | So other players in your group know who is on the roster. |
| Email address and phone number | To sign you in and to send the one-time codes that prove it is you. One of the two is required; both are kept only if you give both. |
| Date of birth | To enforce the minimum age of 13. We store the date and use it only for that check and to show your age if you choose to. |
| Profile photo and cover image | Shown on your profile and beside your name on rosters. Optional. |
| Playing details: positions, preferred foot, experience level, country, clubs you support | Shown on your profile so organisers can balance sides. All optional. |
| Your groups, games, attendance and reliability record | To run the roster and the waitlist, and to show organisers who turns up. Visible to the other members of the groups you are in. |
| Payment records: amounts, dates, status, and the last four digits and brand of a card | To charge game fees and show you what you paid. Full card numbers never reach our servers — see section 3. |
| Device details: push token, platform, app version, last time the app was open | To send notifications to the right device and to diagnose faults. |
Each of these is requested only when you use the feature that needs it, and you can refuse or withdraw it in your device settings. The app works without them, minus that feature.
Card payments are processed by Stripe. Your card details are sent directly to Stripe and are never stored on our servers; we keep only a Stripe customer reference and the record of what was charged, when, and whether it succeeded. Stripe processes that data as an independent controller under its own Privacy Policy, and it may use it to prevent fraud and to meet its legal obligations.
We do not sell personal information, and we do not share it for advertising. We use the following service providers, each only for the purpose named:
| Provider | What it does for us |
|---|---|
| Supabase | Hosts the database, sign-in, file storage and live updates. |
| Stripe | Processes card payments and game fees. |
| Twilio | Sends the one-time codes used to verify a phone number. |
| Resend | Sends account email, such as sign-in codes. |
| Apple and Google | Sign-in, if you choose "Continue with Apple" or "Continue with Google". |
| Google Maps and Places | Finds and displays pitches and venues. Searches are sent to Google as you type. |
| Expo | Delivers push notifications and app updates. |
| Fly.io | Resizes and re-encodes the photos you upload. |
| Cloudflare | Distinguishes people from bots at sign-up. |
We also disclose information where the law requires it, and to protect the safety of players or the integrity of the service.
Your name, photo, playing details and attendance record are visible to members of the groups you join. A private group is invisible to people outside it. You can hide your playing attributes from your profile in Privacy and sharing. Your email address, phone number, date of birth and payment records are never shown to other players.
The data is stored on servers in the United States and processed by the providers listed above, which may operate in other countries. We keep your information for as long as your account exists. When you delete your account we delete your profile, your photos, your playing details and your device records. Records we are required to keep — principally payment and refund records for tax and anti-fraud purposes — are retained for as long as the law requires and are no longer linked to a usable profile.
Depending on where you live you may also have the right to object to or restrict how we use your information, to have it sent to another provider, and to complain to a data protection authority. Write to support@openxi.app and we will answer within 30 days.
OpenXI is not for children under 13. We ask for a date of birth at sign-up and refuse the account if it is under 13. If you believe a child under 13 has an account, write to support@openxi.app and we will delete it.
Connections to the app are encrypted in transit. Access to your records is enforced in the database itself, row by row, so one player's account cannot read another's. No system is perfect; if a breach affects you we will tell you and the relevant authority as the law requires.
If this policy changes we will update the date at the top, and for a change that matters we will tell you in the app before it takes effect.