Touchline is a football tactics board operated by TOSH in South Africa. This notice explains what personal information we process, why, and your rights under the Protection of Personal Information Act, 2013 (POPIA). “We” means TOSH; “you” means anyone who uses Touchline.
What we collect
- Account details: your email address. If you sign in with Google, also your name and profile picture from Google.
- Sign-in sessions: a secure cookie that keeps you signed in for up to 30 days, the browser you signed in from, and when. We store only a hash of the session token.
- Your content: tactics, saved teams, notes, events you record for analysis, crests and pitch images you upload, and the preview images for tactics you share.
- Subscription records: your plan, billing period, amounts, payment status and a PayFast subscription reference. Card details go straight to PayFast; we never see or store them.
- Security data: IP addresses in short-lived counters that limit repeated sign-in attempts, and standard server logs.
We don’t use advertising or analytics trackers. Football data (teams, fixtures, line-ups) comes from API-Football and is not personal information about you.
Why we use it
- To create your account and sign you in (email links are single-use and expire after 15 minutes).
- To store and sync your tactics across your devices, and to show tactics you choose to share.
- To run your subscription, including recurring billing and cancellations.
- To keep the service secure and working, and to meet legal and tax obligations.
We process this information because it’s needed to provide the service you signed up for, to comply with the law, or for our legitimate interest in keeping Touchline secure.
Who we share it with
Only service providers who help run Touchline, and only what each needs:
- Render: hosting and our database.
- Resend: sends sign-in emails.
- Appwrite: stores images for shared tactics.
- PayFast: takes payments and manages recurring billing.
- Google: only if you choose “Sign in with Google”.
Some of these providers store data outside South Africa. We only use providers bound by data-protection terms that give your information protection comparable to POPIA. We don’t sell your personal information.
What others can see
Your tactics are private unless you share them. “Anyone with the link” tactics can be viewed by people who have the link; “Public” tactics can be found and copied by other users, with your display name if you’ve set one.
How long we keep it
- Your account and content: until you delete them. Deleting your account removes your account, cloud tactics, saved teams and share links.
- Sessions: up to 30 days, or until you sign out.
- Subscription and payment records: as long as the law requires for tax and accounting (usually five years).
Your tactics and saved teams belong to your account and sync across your devices. Each account has a separate browser cache for offline editing. Attached match videos remain in that account’s cache on the device where you added them.
Your rights
You can ask to see the personal information we hold about you, have it corrected or deleted, or object to how we use it. Most of this you can do yourself on your account page, including deleting your account. For anything else, email touchline@tosh.co.za and we’ll respond within 30 days.
If you’re unhappy with how we’ve handled your information, you can complain to the Information Regulator (South Africa) at inforegulator.org.za.
Children
If you’re under 18, a parent or guardian must agree to you using Touchline and to this notice.
Security
We use encrypted connections, hash session tokens, verify payment notifications with PayFast, and limit repeated sign-in attempts. No system is perfectly secure; if a breach affects your information, we’ll tell you and the Information Regulator as POPIA requires.
Changes
We’ll update this notice when what we do changes, and tell signed-in users about significant changes.