Privacy
What we collect, and what we refuse to.
Last updated 12 October 2026
Dawrify runs amateur competitions in public — that is the point of it. This page is the honest account of which data that involves, where it goes, and the lines we do not cross. It describes what the software actually does today, not what a template says it might.
01The short version
- We measure how the site is used so we can fix what is broken. There is no advertising, and nothing about you is sold or shared for marketing.
- We have never sold personal data and the business does not depend on doing so.
- The public site sets two cookies: one remembers your language, the other counts your visit without naming you.
- Competition pages are public and appear in search results — that is what organizers come to us for.
- Players' dates of birth are used to tell two people of the same name apart and to check age eligibility. They are never published.
- Most player data is entered by the organizer running the competition, not by the player. The section on that is the one worth reading.
- Professional football in the app comes from an outside provider. We fetch the data for you so they never see your device — but their pictures load from their servers, which does.
- Match alerts are opt-in. Turn them on and the app registers a notification token with the company that runs the phone's push service (Google on Android, Apple on iPhone), which is what carries a push to a phone; leave them off and no token exists.
This is a summary and nothing turns on it. The sections below are the actual terms.
02Who we are
Dawrify is a competition platform for amateur football, operated by Dawrify, Casablanca, Morocco. We are the data controller for the personal data described on this page — meaning we are the ones answerable for it.
For anything on this page, and for everything else, write to [email protected]. It reaches a person, not a queue.
03What we collect about account holders
If you create an account — as an organizer, an assistant, or a fan following competitions — we hold the following. There is nothing else; this is the table the database actually has.
- Identity
- Your email address, first and last name, and an optional phone number. A profile photo if you set one, or the avatar from your Google account if you signed in that way. If you use Sign in with Apple and choose to hide your email, the address we hold is one Apple creates to forward to you.
- Credentials
- A cryptographic hash of your password — never the password itself, which we cannot read or recover. If you use Google Sign-In or Sign in with Apple, we store that company's permanent identifier for your account instead.
- Account state
- Your role, whether the account is active, whether your email has been verified, and which sign-in method it uses.
- Sign-in security
- The time and IP address of your last sign-in, the count of consecutive failed attempts, any lockout expiry, and when the password last changed. This is how we detect somebody trying to break into your account.
- Sessions
- For each device you stay signed in on: a hashed session token, a description of the device, the IP address it was issued to, when it was last used, and when it expires.
- What you follow
- The tournaments, teams and players you follow, and whether you have asked to be alerted about each one. If you star a single fixture, that too — a short-lived row that deletes itself a few hours after full time.
- Alerts, and the device they reach
- If you turn on match alerts in the mobile app, we store the notification token the operating system issues to that installation, which platform it is, the app version, the language it asked for, and when it was last seen. That token identifies an app installation, not you; it is not an advertising identifier and we do not use it as one. We also store which categories of alert you want, and any quiet hours you set, with the timezone they are meant in.
- Your notification feed
- One row for each alert we generated for you: what happened, in which match, when, whether you have opened it, and whether the push went out or was held back. It is the inbox the app shows you, and it exists whether or not your phone ever buzzed.
- Your football
- If you set up your football in the mobile app and are signed in, we store what you chose: why you use Dawrify (to play, to follow or to organize), your home city, your main competition and team, a professional club if you picked one, and — only if you say so — the player profile you identify as yourself. We use it to personalise what the app shows you and to decide which announcements are relevant to you. Skip any question and nothing is stored for it; if you never sign in, none of it leaves your phone.
We do not collect payment details, because there is nothing to pay for yet — see the terms on early access. We hold no card numbers and have no billing system in which to hold them.
04Data about players, entered by somebody else
This is the part of Dawrify that deserves the most care, and the part most policies skate over. A squad list is not filled in by the players. It is filled in by the organizer or team manager running the competition, and it describes people who may never have visited this website.
For each player, an organizer can record: first and last name, date of birth, gender, nationality, playing position, preferred foot, a short biography, and photographs — a portrait, a celebration shot, and a lineup image. Per competition, they also record the team, shirt number, captaincy, and eligibility, and from there the match record accumulates: appearances, goals, cards, substitutions, suspensions, and career statistics.
If your details are on Dawrify and you did not put them there, you do not have to go through the organizer to get them changed or removed. Write to [email protected] and we will act on it ourselves.
Organizers who enter this data are required by our terms to have the standing to do so, and to have told the players their data is being entered. We have made that a term rather than an assumption, but we are aware a term is not a guarantee — which is why the paragraph above exists and why a request from a player outranks the organizer who typed the row.
05What is public, and what never is
Competition pages, team pages, player pages and match pages are public. They can be read without an account, they are indexed by search engines, and they are meant to be — an amateur competition that nobody can find is the problem Dawrify exists to solve.
On a public page you may see:
- A player's name, photograph, shirt number, position, nationality and club
- Their match record: appearances, goals, assists, cards, minutes, and career totals
- Team squads, fixtures, results, tables and standings
The following are never published, and no public page or structured-data feed contains them:
- Dates of birth. They are held so that two players with the same name are not merged into one person, and so that an under-17 competition can check eligibility. Neither purpose requires showing them, so we do not.
- Any account holder's email address, phone number or IP address.
- Anything at all about fans. Who you follow is yours; no page lists a player's or a team's followers. The same goes for the player profile you say is yours: it personalises your own app and is never shown on the player's page or anywhere else.
06Why we are allowed to process it
- To run the service
- Performance of our agreement with you. Without an email address there is no account; without a squad list there is no team sheet.
- To publish competitions
- Our legitimate interest, and the organizer's, in a competition being findable and followable — balanced against the players' interests, which is why the list above stops where it does.
- To keep accounts secure
- Our legitimate interest in preventing unauthorised access. This covers the sign-in IP addresses and lockout counters.
- To send you service email
- Performance of our agreement — verification codes, password resets, and account setup. We do not send marketing email.
- To send you match alerts
- Your consent, given when the app asks permission to notify you and when you switch a category on. Withdraw it whenever you like, in the app's notification settings or the operating system's. Deny the permission and the alerts still collect in the app's own feed while your phone stays quiet; switch the category off and neither happens.
- To meet legal obligations
- Where a law requires us to retain or disclose something.
07Analytics, advertising and tracking
We measure how this site is used. Which pages get opened, roughly which country from, what gets clicked, and when something breaks. It is how we learn that a league page is unreadable on a phone, or that search keeps returning nothing for a name people keep typing.
There is no advertising here: no advertising pixel, no tag manager, no advertising profile built about you, and no following you to other sites. Nothing we measure is sold, rented, or shared for marketing, and none of it is used to make a decision about you as an individual.
The measurement is carried out for us by an analytics provider acting on our instructions — it is in the list of who else touches your data, below. You can still check the claim we have always made here without trusting us: open your browser's network tab on any page of dawrify.com and note that every request goes to dawrify.com. The measurements reach that provider through our own servers, not by your browser contacting theirs.
The organizer dashboard is measured more closely than this site, because that is where people get stuck. Alongside the same page views and clicks, we record the screen: what was displayed, where the pointer went, what was clicked. Anything typed into a field is masked before it leaves your browser — we can see that a field was filled in, never what was put in it. Recordings are kept for thirty days and then deleted. The counts and clicks are kept for a year. We watch them to answer one question: why does an organizer create a competition, add a single team, and never come back.
Because a recording captures what was on the screen, a player's name, photograph or date of birth can appear in one — they are on the organizer's own screens. They are never sent to us as measurements in their own right, they are not used to build anything about that player, and nobody outside the people named below ever sees them.
Once you are signed in, the measurements are attached to your account identifier, together with whether you are an organizer or an assistant and whether your email address has been confirmed. Your name and your email address are not sent. When the dashboard crashes, the error and the page it happened on are sent so that it can be fixed.
The mobile app carries no analytics or crash-reporting SDK. We do not build advertising profiles, we do not enrich your data from data brokers, and we have never sold or rented personal data to anyone.
10How long we keep it
Account and player records are deleted in two stages. When something is deleted in the product it is marked deleted and disappears from every page, every feed and every search result immediately. The underlying row survives for a period afterwards, because a competition's history is interlinked — removing a player outright mid-season would silently rewrite match records and league tables that other people rely on.
If you want the underlying record erased and not merely hidden, say so when you write to us and we will erase it, subject only to anything we are legally required to keep. Ask, and we will tell you plainly what remains and why.
Sessions expire on their own: an access token lasts an hour and a stay-signed-in token thirty days, after which it is dead whether or not you signed out. Server logs are kept short-term for security and debugging.
Notifications are kept for 90 days and then deleted, read or not. A starred fixture deletes itself a few hours after that match ends. A notification token is deleted outright when you sign out on that device — a sign-out is you asking to be forgotten on that phone — and is retired the moment Google tells us the installation is gone, so we do not keep sending to a phone that is no longer listening. Closing your account erases all of it: the tokens, the preferences, the stars and the whole feed.
11How it is protected
- Passwords are stored only as salted hashes. Nobody at Dawrify can read your password, and a database breach would not reveal it.
- Traffic to the site, the dashboard and the app is encrypted in transit.
- An account locks itself after five consecutive failed sign-ins, for a period that lengthens as attempts continue, and sign-in attempts are rate-limited independently of that.
- Stay-signed-in tokens are stored hashed, expire on a fixed schedule, and can be revoked.
- The mobile app holds tokens in the operating system's secure keystore rather than in ordinary app storage.
No system is beyond compromise, and we are not going to claim otherwise. If we ever suffer a breach affecting your data, we will tell you and the relevant authority, and we will tell you what actually happened rather than issuing a statement about how seriously we take security.
12Children and youth competitions
Dawrify supports age-category competitions, so we know that youth players' data is on the platform. It arrives the same way all player data does — entered by an organizer or coach, not by the child.
An organizer entering a minor's details must have the authority of that child's parent or guardian to do so. That is a term of using Dawrify, not a suggestion. For youth competitions we hold the same fields as for any other, and the same rule applies with more force: dates of birth are never published, and neither is anything else that is not on the public list above.
A parent or guardian can ask us to correct or remove any child's data, and does not need the organizer's agreement to do it. Write to [email protected] and we will act.
Accounts are a separate matter: Dawrify accounts are for people aged 16 and over. If we learn that a younger person has created one, we will remove it.
13Your rights, and how to actually use them
You can ask us to:
- Give you a copy of everything we hold about you
- Correct anything that is wrong
- Delete your account and your personal data
- Stop processing your data, or object to a particular use of it
- Export your data in a portable format — organizers can already export teams and players to a spreadsheet from the dashboard at any time
You can close your own account from the app: Profile, then Close account. Everything else on this list, and deletion for anyone whose data is here without an account, is by email — write to [email protected] and we will confirm within 30 days. The steps for both are at dawrify.com/delete-account.
We will not charge you for any of this, and we will not require you to explain why. If we ever need to verify that a request really comes from you before acting on it, we will ask for the least we can get away with.
If we handle a request badly, you can complain to the Commission Nationale de contrôle de la protection des Données à caractère Personnel (CNDP) in Morocco. If you are in the European Union or the United Kingdom, you can complain to your national data protection authority instead. We would rather you gave us the chance to fix it first, but that is your call, not ours.
14Where the data is
Our servers and our stored images are hosted in Europe. Where a provider named above is based outside Morocco or the European Economic Area, that transfer relies on the standard safeguards those providers publish — including the European Commission's standard contractual clauses.
15Changes to this page
The date at the top is the last time anything on this page substantively changed. If we change something that materially affects you — a new recipient of data, a new purpose, a new category collected — we will tell account holders by email rather than quietly editing the page and moving the date.
16Contact
Privacy questions and requests, and anything else: [email protected]. Dawrify, Casablanca, Morocco.
