In short
- TeamFlow is a free tool run by RaSky Robotics, a student robotics team in Craiova, Romania. We are the controller of your data.
- We collect what you give us (your account and your team’s work) and a small amount of technical data needed to keep the service secure.
- There are no ads, no analytics and no tracking. We do not sell your data or use it for marketing.
- People in your team see your profile and the work you share with them. Authorized TeamFlow staff can access data when it is needed for support, moderation or security.
- You can ask for a copy of your data, correct it or delete it. You can delete your account yourself in Settings, and write to help@teamflow-ftc.com about anything else.
This summary is here to help. The full text below is what applies.
1Who we are
TeamFlow (teamflow-ftc.com) is a web app that helps FIRST Tech Challenge teams organise people, tasks, events and money. It is run by RaSky Robotics, FIRST Tech Challenge team #19109, Colegiul Național „Elena Cuza”, Craiova, Romania, which decides why and how your personal data is processed. In GDPR terms we are the controller.
TeamFlow is a non-commercial project. It is free, it has no paying customers and it is maintained by volunteers. We have not appointed a data protection officer; the contact below reaches the people responsible for the service.
Contact for anything in this policy: help@teamflow-ftc.com.
2Data we collect
Your account
- Name, email address and password. We never store the password itself, only a one-way bcrypt hash of it.
- Optional details you add: a username, a short bio and a profile photo.
- A phone number, only if we ask you to confirm your contact details. Only authorized TeamFlow staff can see it.
- Two-factor sign-in, if you turn it on: the secret behind your authenticator codes and the public keys of your passkeys. Passkeys never send us your fingerprint or face; that stays on your device.
- Your appearance settings (theme, accent colour, text size, motion), so they follow you between devices.
- When you accepted the Terms and this policy, and which version you accepted.
Your team’s work
- Teams: name, FIRST team number, description, logo, city, country, time zone, date format and currency.
- Who belongs to which team, their roles, permissions and departments.
- Tasks and sub-tasks, who they are assigned to and their history.
- Calendar events, including competitions copied from FTCScout or natie.ro.
- Funds: sponsors, income, expenses, amounts and the PDF receipts you upload.
- Invitations: the name and email address of the person invited, the role offered and who sent it.
Some of this may be about other people, for example a teammate you invite or a sponsor you record. Only add what your team really needs and make sure you are allowed to share it.
Technical and security data
- Sign-in sessions: a random session identifier, when it expires and when it was last used, with the IP address, approximate country and browser type it was used from.
- A log of what is done with your account, such as signing in, changing your email or password and adding or changing items in a team, with the IP address, approximate country and browser type. It is used to protect accounts and keep the service secure.
- Security records kept by the server that sits in front of TeamFlow: the IP address, approximate country (from Cloudflare) and browser type of visits to the home page (at most one record per address per hour), sign-in attempts (IP address, the email or username typed, whether it worked, browser type), automatic blocks of addresses that attack the service, and security alerts such as a rejected upload.
- The IP address you registered from, used to detect fake or abusive accounts.
- Short-term counters of failed sign-ins and registrations per IP address, kept only in memory.
- Records of support and moderation actions, kept for accountability.
- The approximate country each request comes from (from Cloudflare), used to protect accounts and keep the service secure.
- Signals from automated checks for fake accounts and abuse, for example whether an email domain can receive mail. To check a domain we only look up its public DNS records.
What we do not collect
We do not use analytics, advertising or social media trackers, we do not build profiles of you for marketing and we do not collect your precise location. We do not ask for special categories of data such as health or religion; please do not put them in TeamFlow.
3How we use it and our legal bases
Under the GDPR (Article 6) every use of personal data needs a legal basis. These are ours:
| Purpose | Legal basis |
|---|---|
| Creating your account, signing you in and running the features you use (teams, tasks, calendar, funds, profiles, invitations). | Performing our agreement with you, the Terms (Art. 6(1)(b)). |
| Keeping TeamFlow secure: rate limits, blocking attacks, scanning uploads for viruses, two-factor sign-in, anti-bot checks on sign-up. | Our legitimate interest in protecting the service and its users (Art. 6(1)(f)). |
| Detecting fake teams, impersonation, spam and other abuse, handling reports and moderating content. | Our legitimate interest, and that of our users, in a safe service (Art. 6(1)(f)); our duties under the Digital Services Act (Art. 6(1)(c)). |
| Helping you when you ask for support. | Performing our agreement (Art. 6(1)(b)) and our legitimate interest in answering you (Art. 6(1)(f)). |
| Showing your team’s competitions from FTCScout and natie.ro. | Performing our agreement (Art. 6(1)(b)). |
| Keeping evidence that you accepted the Terms, and answering requests from authorities when the law requires it. | Legal obligation (Art. 6(1)(c)) and our legitimate interest in being able to show we follow the law (Art. 6(1)(f)). |
Where we rely on legitimate interests we have weighed them against your rights, and you can object at any time (see Your rights). Optional profile details such as a photo or bio are entirely your choice and you can remove them whenever you like.
We do not make decisions about you based solely on automated processing that have legal or similarly significant effects. Automated checks only flag accounts and teams; a person reviews every flag before anything is suspended.
4Who can see your data
- Your teammates. People in a team see each other’s name, email address, username, photo, bio, role and department, and the team’s tasks, events and funds according to the permissions the team gives them.
- Authorized TeamFlow staff, when it is needed to support teams, investigate reports, prevent abuse or keep the service secure. These actions are recorded and are only taken when there is a reason to.
- Service providers that help us run TeamFlow, listed below. They only get what they need for their job.
- Authorities, only when Romanian or EU law requires us to share data, for example under a court order.
We never sell or rent personal data and we do not share it with advertisers.
Service providers
| Provider | What it does | Data involved |
|---|---|---|
| Cloudflare, Inc. (USA, with servers worldwide) | Delivers the site, protects it against attacks and runs the Turnstile anti-bot check on the sign-up form. | Your IP address, browser details and the requests you make. Turnstile also reads technical signals from your browser to tell people from bots. |
| FTCScout (ftcscout.org) | Public FIRST Tech Challenge data: team names and competition schedules. | Only the FIRST team numbers or the team name you search for. Requests are made by our server, so your IP address is not shared. |
| natie.ro | Public calendar of FIRST Tech Challenge competitions in Romania. | None. Our server reads the public calendar and sends nothing about you. |
Everything else runs on our own server in Romania: the database, file storage, virus scanning of uploads (ClamAV, run locally) and the fonts used by the site. We do not use Google Fonts or other external font services.
If you use “Add to Google Calendar” or “Add to Outlook” on an event, your browser opens that service and sends it the event details. That is between you and Google or Microsoft, under their privacy policies.
5International transfers
Our server and database are in Romania, inside the European Union. Cloudflare is a US company and may process traffic in data centres outside the EU. Cloudflare is certified under the EU-U.S. Data Privacy Framework, which the European Commission has recognised as giving adequate protection, and its data processing terms include the EU Standard Contractual Clauses.
6How long we keep it
| Data | How long |
|---|---|
| Your account and profile | Until you delete your account. |
| Sign-in sessions | 30 days if you choose Keep me logged in, otherwise 12 hours or until you close the browser; always until you log out. |
| Account activity log | 90 days, then deleted automatically. |
| Two-factor sign-in step | 5 minutes. |
| Team content | While the team exists. A deleted team can be restored for 30 days; after that its content is deleted with it. |
| Invitations | They expire after 14 days and are deleted with the team, or earlier if the team cancels them. |
| Home page visits, sign-in attempts and security alerts | 90 days, then deleted automatically. |
| Blocks of attacking IP addresses | An automatic block lasts 30 minutes to 7 days, and its record is deleted 90 days after it ends. A block set by hand lasts until it is removed. |
| IP address at registration | 90 days. |
| In-memory rate-limit counters | Up to one hour, and they are lost whenever the server restarts. |
| Automated abuse signals | Until reviewed; resolved or dismissed signals are deleted after 12 months. |
| Record of support and moderation actions | 24 months. |
| Acceptance of the Terms | While your account exists. |
When you delete your account we delete your profile, photo, phone number, bio, preferences, the IP address you signed up from, your sessions, your account activity log, two-factor settings, team memberships and invitations sent to your email address. Teams you created are not deleted: they stay with their members, and if you were the only mentor of a team, the member who joined it earliest becomes its mentor. Tasks, sub-tasks, events, fund entries and receipts you added stay with the team and are shown as added by TeamFlow, without your name. A team left with no members is kept until we tidy it up. Deleted data may remain in backups for a short time until they are overwritten.
To leave a team, open Settings, then Profile, choose Leave team next to it and confirm with your password. A mentor can delete their whole team from the team panel with Delete team: every member loses access at once, and the team can be restored if its mentor writes to help@teamflow-ftc.com within 30 days. After that, the team and its content are deleted permanently. A team’s only mentor cannot leave it, but can delete it or write to help@teamflow-ftc.com to hand the mentor role to someone else.
7How we protect it
- All traffic is encrypted with HTTPS.
- Passwords are stored only as bcrypt hashes. You can add two-factor sign-in with an authenticator app or passkeys.
- Repeated failed sign-ins, mass registrations and scanning are rate-limited and blocked automatically.
- Photos and receipts you upload are checked for their real file type and scanned for viruses before they are stored.
- Access inside a team follows roles and permissions; the session cookie cannot be read by scripts.
- The service runs on our own server in Romania, with the database and files kept there.
No system is perfectly secure. If we learn of a breach that puts your data at risk we will tell the Romanian supervisory authority within 72 hours where the law requires it, and tell you directly when the risk to you is high.
8Your rights
Under the GDPR you have the right to:
- access the personal data we hold about you and get a copy of it;
- correct data that is wrong or incomplete; most of it you can edit yourself in Settings;
- delete your data; you can delete your account yourself in Settings, under Profile;
- restrict how we use your data, for example while a complaint is being looked at;
- receive the data you gave us in a portable, machine-readable format;
- object to processing based on our legitimate interests;
- not be subject to decisions based solely on automated processing that significantly affect you;
- withdraw consent at any time, where we rely on consent, without affecting what happened before.
To use any of these rights, email help@teamflow-ftc.com from the address on your account. We will answer within one month, and may ask you to confirm your identity first. It is free.
You can also complain to the Romanian data protection authority, Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP), at dataprotection.ro, or to the authority in the EU country where you live. We would appreciate the chance to sort it out with you first.
9Children and students
Many TeamFlow users are high school students. In Romania, as under Article 8 of the GDPR, a person can agree on their own to an online service like this from the age of 16. If you are younger than 16, you need permission from a parent or guardian to create an account, and you confirm this when you sign up.
We only collect what a team needs to work together, we never use it for advertising or profiling, and we do not show anyone’s profile to the public.
Parents and guardians can write to help@teamflow-ftc.com to ask what we hold about their child, to correct it or to have the account deleted. If we learn that an account was created without the permission it needed, we will delete it.
Mentors and team leaders who add students should only enter what the team needs and should follow their school’s rules.
11Changes to this policy
If we change how we handle personal data, we will update this page and its version and date. For important changes we will tell you inside TeamFlow before they apply.
12Contact
Questions, requests or complaints about privacy: help@teamflow-ftc.com. For general help with TeamFlow, see the support page.
RaSky Robotics, FIRST Tech Challenge team #19109, Colegiul Național „Elena Cuza”, Craiova, Romania.