This policy explains how Special One Academy handles personal data in its mobile and web application (the “App”). Parents and guardians should read it before creating a player profile.
Special One Academy, a trading name located in Beit Iba, Palestine, operates the App and the academy services. It decides why and how the personal data described in this policy is used.
OverX Technologies Inc., 2 Bloor Street West, Suite 700, Toronto, Ontario M4W 3E2, Canada, develops, technically maintains, and publishes the App in the Apple App Store and Google Play. OverX is not an academy operator or provider of sporting services. Where OverX accesses personal data for maintenance or support, it does so as a technical service provider acting on Special One Academy’s instructions.
Privacy and support contact: info@specialone.ps
Telephone: +972 56 653 7777
Technical publisher contact: info@overx.tech
We collect names in English and Arabic, mobile number, optional email address, account role and status, authentication information, and account-security records. Guest bookings or enrolments also create or use an account based on the name and verified mobile number provided.
A parent or legal guardian provides and controls each player profile. It may contain the player’s name, date of birth, gender, school, username, encrypted credentials, and medical notes. Medical notes may include conditions, allergies, medication, or participation limitations. They are used for player safety and are available only to the parent or guardian, authorised administrators, and the coach assigned to a session the player is enrolled on.
We process bookings, booking references, enrolments, program and session attendance, attendance notes, late cancellations, no-shows, booking restrictions, redemption orders, and related dates and status information. Where transport is selected, we also process the trip type and pickup and drop-off locations.
Payments are currently collected in cash by authorised academy staff. The App does not collect or store payment-card numbers. We record amounts, ILS currency, payment status, purpose, wallet balances, wallet transactions, redemptions, refunds, cash withdrawals, and the staff member who completed a transaction.
Wallet balances do not expire. They may be spent or redeemed at the academy. An account holder—or a parent or guardian for a child wallet—may request a partial or full cash withdrawal in person. After identity and authority are verified, an administrator deducts the balance and provides the same amount in ILS cash without a withdrawal fee.
A player may message only their own parent or guardian. Players cannot privately message academy staff or other members. Parents and adult members may receive announcements and polls and may reply privately to an administrator. We store message content, participants, timestamps, delivery and read status, poll selections, and notification history so these features work across devices. Messages are not end-to-end encrypted.
We process Firebase push-notification tokens, platform and device identifiers, authentication tokens, security and audit records, and server logs that may include an IP address. The camera is used by authorised staff to scan redemption QR codes; camera images are processed on the device and are not uploaded or stored. Face ID, Touch ID, or fingerprint checks are performed by the device, and we do not receive biometric data.
We do not sell personal data and do not use it for third-party advertising or behavioural profiling.
A player profile must be created and managed by a parent or legal guardian. The parent or guardian confirms that they have authority to provide the child’s information and consent to its use for the purposes in this policy. They may correct the profile, control family messaging and wallet permissions, set spending limits, and request deletion. A child account cannot independently change these permissions.
| Recipient | Purpose |
|---|---|
| OverX Technologies Inc. | Development, hosting support, technical maintenance, security, and store publishing |
| Google Cloud Platform / Firebase | Application hosting, database, authentication, real-time messaging, and push notifications |
| HotSMS | Delivering OTP codes and academy SMS messages |
We may disclose limited information to emergency medical providers, insurers, professional advisers, or public authorities where necessary to protect a player, manage a claim, comply with law, or establish or defend legal rights. Service providers may use data only to provide their contracted service.
The main application servers, Cloud SQL database, and Firestore database are configured in
Google Cloud’s me-west1 region. OverX is located in Canada, and Firebase,
notification, support, or network services may route or process limited data in other
countries. Data processed elsewhere may be subject to the laws of that location. We use
access controls and contractual or organisational safeguards appropriate to each provider.
| Data | Normal retention |
|---|---|
| Active account and player profile | While the account or profile remains active |
| Medical notes | While the player profile is active; deleted within 30 days after profile or account deletion unless connected to a safety incident, insurance claim, or legal requirement |
| Messages, poll responses, and notifications | 12 months |
| Inactive device tokens | Up to 90 days |
| Bookings, enrolments, and attendance | 3 years |
| Wallet, payment, withdrawal, and accounting records | 7 years, or another period required by applicable accounting law |
| Audit and security logs | 2 years |
| Expired OTP records | Codes expire within 5 minutes; expired records are removed by a daily automated job |
| Encrypted backups | Rolling period of no more than 30 days |
These periods are enforced by an automated job that runs daily and deletes data once its retention period has passed.
Incident, safeguarding, insurance, dispute, or legal records may be retained longer where reasonably necessary. Anonymous statistics that can no longer be linked to a person may be kept indefinitely.
You may request deletion through the App or through our account-deletion page. We may verify the request to protect the account and any child profile. Account access is disabled promptly, and profile, medical, message, device, and other data that is not required for a legitimate retained record is deleted or irreversibly anonymised. Account access ends immediately and the data is cleared at the point of deletion. Deleted information may remain in encrypted backups for up to 30 days before automatic removal.
Required wallet, accounting, safety, fraud-prevention, audit, insurance, or dispute records may be retained for the periods in section 7. Access to retained records is restricted, and they are not used for marketing.
We use TLS in transit, access-controlled infrastructure, role-based permissions, audit logs, and encrypted storage for player credentials. Access to child and medical information is limited according to operational need. No system is perfectly secure; please contact us immediately if you suspect unauthorised access.
Subject to applicable law, you may request access to or a copy of your data, correction, deletion, restriction, or withdrawal of consent. Withdrawal does not affect processing already completed and may prevent us from safely providing a feature. Contact info@specialone.ps. You may raise a complaint with a competent Palestinian authority.
We may update this policy as the service or legal requirements change. We will update the effective date and notify users in the App of material changes. Where renewed consent is required, we will request it before the relevant processing continues.
Special One Academy
Beit Iba, Palestine
info@specialone.ps
+972 56 653 7777