Last updated: 13 September 2026
Data controller: INFOTECH SERVICE FZ-LLC, RAKEZ free zone, Ras Al Khaimah, UAE. Contact: support@goolazo.app Registration and profile: name, email, avatar, and your football profile (position, level, age, dominant foot, goals, weak spots, sessions per week, session length, equipment, preferred time of day). Signing in with Google or Apple: if you choose that route, the provider passes us your email, name and profile picture. We never see your Google or Apple password. Service usage: training history, progress, XP, streaks, level, conversations with your coach, psychology module entries, participation in leagues and challenges. What other players see: your name, avatar, position, level, XP, streak and number of sessions appear in the global leaderboard and in your league table. Everything else, including your email, age and subscription details, stays visible to you alone. Nutrition (optional): what you log as eaten, and, if you set a daily target, your sex, weight and height. This counts as health data, so we process it only with your explicit consent, which you give by setting a nutrition goal. The module is optional and the data can be deleted at any time. Food photos (Elite plan): the image is sent to a recognition service to estimate the portion and is NOT stored by us or in your history. Only the text estimate you confirm is saved. Parent loop (optional): the email of a parent or coach you allow to receive a weekly report. We collect this address from you, send only activity reports to it, and use it for nothing else. Every email contains an unsubscribe link. Invitations and videos: your invite code, the link between who invited whom, and the video links you submit yourself to claim a reward. Reports: if you report another player's profile or an answer from the AI coach, we keep the report, its reason and, for a coach answer, a copy of that text so we can review it. Before you register: your onboarding quiz answers, age included, are saved as a draft so you do not have to fill them in twice. The draft is tied to a technical cookie rather than to you, and is deleted after 30 days if no account follows. If you leave a contact on the waiting list, we keep that email or Telegram handle and the invite code you arrived with. Technical data: language, time zone, country from your IP address, device type, platform and app version. The IP address is used to prevent abuse and to pick the right payment method: it is never written to our database and stays only in server logs for up to 30 days. Notifications: if you allow them, we store the device or browser token without which a notification cannot be delivered. The token is removed when you sign out of the app. Payment data: we never store card numbers. They are handled by payment providers and app stores. On our side we keep only the fact of the payment: amount, currency, plan, period, date and the provider's transaction reference.
We never sell your data or share it for marketing. The following services process data solely to run the platform:
Coach Carlos and coach Mateus are answers from a language model, not from a live person. The request to OpenAI or Anthropic carries your name, age, position, level, goals, weak spots, dominant foot, available days and minutes, equipment, weekly plan, completed sessions, your nutrition diary if the module is on, and the text of your messages. Permission for this transfer is asked separately, in the app: before your first message to the coach and before your first meal photo. Without it no data leaves the app. You can withdraw the permission at any time in settings, the rest of the service does not depend on these features. Under our agreements with them, neither OpenAI nor Anthropic trains its models on this data. Food photos are not kept after processing. Your coach conversation is stored in your account so the talk picks up where it left off, and is deleted together with the account. Training plans and coach answers are recommendations: no automated decision with legal effects on you is made.
Data is stored on Supabase servers with encryption at rest (AES-256) and in transit (TLS 1.3). Database access is strictly restricted. Passwords are stored as bcrypt hashes and never transmitted in plaintext. However, no system provides absolute protection: we recommend using a unique strong password. International transfers. We are a UAE company and our processors operate in the European Union and the United States, so your data leaves the country you live in. The Supabase database and the production PostHog analytics project are hosted in the European region. With processors that handle data of people in the European Economic Area we have signed the European Commission's Standard Contractual Clauses. Retention periods: profile, sessions, coach conversations, nutrition diary and profile photo: as long as the account exists, erased at once when it is deleted; onboarding draft created before registration: 30 days; notification token: until you sign out of the app or revoke the permission; payment records in our database: deleted together with the account. Transaction confirmations remain with the payment provider and the app store, and in our accounting records outside the app, where they must be kept for 5 years; product analytics events: 12 months, without name or email; error reports: 90 days; server technical logs: up to 30 days.
You may at any time:
For data requests, write to support@goolazo.app we will respond within 30 days.
Essential cookies keep you signed in (Supabase Auth session tokens), remember your language and hold the key to your onboarding draft (the goolazo_draft cookie) so your answers survive until registration: without them the service does not work. Analytics cookies are set by PostHog: they show which screens people use and where journeys break. We use no advertising cookies and share nothing with ad networks. The store app uses no cookies: the session lives in the device's secure storage. You can clear cookies in your browser settings, but that signs you out.
The service is intended for players aged 13 and over. In the European Economic Area each country sets its own age of consent for online services, between 13 and 16: if you are below that age in your country, you may use Goolazo only with the permission of a parent or legal guardian. We ask for your age in the onboarding quiz and rely on your answer: we do not verify documents. We do not knowingly create accounts for children under 13, and we delete such an account together with all its data when we find one. A parent or legal guardian may request a copy of a child's data, its correction or full deletion by writing to support@goolazo.app and naming the account email. Goolazo carries no advertising: the product uses no ad networks and no cross-app tracking, and shows no App Tracking Transparency prompt. The nutrition module is designed for teenagers and never offers weight reduction to users under 18: that goal does not exist in it. All calculations are estimates and are not medical advice.
We will notify you by email at least 14 days before any material change takes effect. Continuing to use the service after that means you accept the new version.
Exercise videos in Goolazo are generated with artificial intelligence from real training movements and reviewed by our team before release. The people shown do not exist and no personal data was used to create them. These videos carry an “AI” mark in the frame.
Data controller: INFOTECH SERVICE FZ-LLC, RAKEZ free zone, Ras Al Khaimah, UAE. For privacy questions, withdrawal of consent, data export and deletion, write to: support@goolazo.app