Underlap is a tactics board for football analysis, operated by Prodix. This page describes what personal data the product collects, what it is used for, and how to remove it. It covers theunderlap.io and the application at theunderlap.io/app.
What we collect
Account details
You sign in either with Google or with an email link — there is no password. Depending on which you use, we store:
- Your email address, which identifies your account.
- Your name and profile picture, if you sign in with Google and Google provides them.
- Sign-in tokens issued by Google, used to complete sign-in and kept associated with your account.
- Abuse-prevention counters when you ask to be told about plans or request a sign-in link. We count recent attempts so the forms can't be flooded. Your IP address and the address you typed are never stored in readable form for this — only a one-way keyed hash of them, which lets us count repeats without holding the values themselves.
What you make
The boards you build: their titles, the teams and formations you pick, where you place players, any arrows, zones and notes you add, and when each board was created and changed. This is your work and we treat it as private to your account.
Billing
Payments are handled by Flutterwave. We never see or store your card details. We keep only the plan you are on, whether it is active, when the current period ends, and the identifiers Flutterwave gives us to match a payment to your account.
Usage
We record when you export an image, in order to count exports against your plan's monthly limit. We also record when an action is refused for exceeding a plan limit, so we can tell whether those limits are set sensibly. Neither record contains the content of your boards.
Plan notifications
If you ask to be told when paid plans open, we store your email address and the date you asked, and nothing else. It is used to send you that one message, and for no other mail.
Google user data
When you choose "Continue with Google", we request three standard scopes: openid, email and profile. We use the resulting data for one purpose: to create and sign you into your Underlap account, and to show you which account you are signed in as.
We do not use Google user data for advertising, we do not sell it, we do not transfer it to anyone except the infrastructure providers listed below who process it on our behalf, and we do not use it to train machine-learning models. Underlap requests no access to your Gmail, Drive, Calendar, contacts or any other Google service. Revoking Underlap's access in your Google account permissions stops any further access immediately; to also remove the data already stored, delete your Underlap account as described below.
Who else processes it
We keep the list short on purpose. Each of these handles data only to make the product work:
- Vercel — hosting and serving the application.
- Supabase — the database your account and boards live in.
- Google — sign-in, if you use it.
- Resend — sending sign-in emails.
- Flutterwave — taking payment, if you subscribe.
Squad and player statistics come from API-Football. That is a one-way feed into Underlap — no personal data of yours is sent to them.
We do not sell personal data, and we do not share it for advertising. We may disclose data where we are legally required to.
How long we keep it
- Account and boards — until you delete your account.
- Deleted boards — marked deleted and removed from your account immediately; purged from our database within 30 days.
- Export records — kept while your account exists, since monthly limits are counted from them.
- Billing records — kept as long as required for accounting and tax.
- Plan-notification emails — until you unsubscribe, or until paid plans have opened and the list is no longer needed.
- Abuse-prevention counters — deleted automatically within 24 hours. They exist only to count recent attempts, so there is no reason to keep them longer.
Your choices
You can ask us to give you a copy of your data, correct it, or delete it. To delete your account and everything attached to it, email us at the address below from the address you signed up with. We action deletions within 30 days, other than anything we must retain for legal or accounting reasons.
Sign-in uses a cookie to keep you signed in. It is required for the product to work, and we do not use advertising or third-party tracking cookies.
Children
Underlap is not intended for children under 13, and we do not knowingly collect their data.
Changes
If this policy changes in a way that materially affects you, we will say so on this page and update the date at the top before the change takes effect.
Contact
Questions, requests, or deletions: privacy@theunderlap.io.
See also our terms of service.