Most of these photos are of children.
That single fact shaped the architecture. What follows is not a policy page — it is what the code actually does.
Originals are never public
Full-resolution files live in a private bucket with no public object and no allUsers binding. They leave it only through a signed URL valid for five minutes, issued after an authorisation check against a paid order.
Private by default
A new gallery is private, non-indexed, watermarked and download-off. Security Rules refuse to create a gallery that is public from birth — it is not a setting you can forget.
Controlled reference recognition
Jersey numbers stay primary. Optional player references are organisation-scoped and never used for global face search. Single appearance signals stay in review; only tightly gated agreement across face, kit, several references, roster and context can auto-assign. References are deleted when the feature or player assignment is switched off.
Tenant isolation in the rules
Every document carries its organisation, and Security Rules verify membership before any read. The rules are the floor; server checks sit on top, never instead.
Pseudonymous access logs
IP addresses and user agents are stored as salted hashes. Enough to investigate abuse of a share link, not enough to identify a household.
Consent and retention
Guardian consent records, configurable retention, gallery expiry, and export or deletion requests tracked against the statutory one-month deadline.
Technical measures
- Data location
- Firestore in eur3, photo storage in the EU multi-region, application hosting in europe-west4
- Transport
- TLS everywhere; HSTS on the production domain
- Secrets at rest
- Passwords and access codes hashed with scrypt and a per-secret salt
- Share tokens
- 186 bits of entropy, stored as a peppered SHA-256 lookup hash
- Attestation
- Firebase App Check on the web client
- Payments
- Stripe; card data never touches Sportfolios
- Audit
- Every mutation writes an actor, target, before and after
- Sessions
- httpOnly session cookies; role changes revoke refresh tokens immediately
Read the privacy policy for the legal detail.