fcommitTRUST
Trust and security
What we have checked on this website, how it protects the people who visit it, and where to find our privacy and legal documents.
Website checks
These are checks we ran ourselves on this website, with public tools. They are not third-party certifications, and they are not an audit of the FCommit app. Each result shows the date it was checked.
- HTML. No errors or warnings on every page, in all 24 languages. Tool: W3C Nu HTML Checker (version 26.9.16). Checked .
- CSS. Valid CSS, no errors, checked against the CSS level 3 + SVG profile because the stylesheet also styles the site’s SVG icons. The validator’s remaining notes say only that CSS variables cannot be checked without a browser and that a few rules carry browser prefixes. Tool: W3C CSS Validation Service. The badge in the footer of every page links to the check. Checked .
- Accessibility. No violations found by automated testing with axe-core (WCAG 2.2 level A and AA rules) on every page, at desktop and phone widths. Lighthouse scored accessibility 100 on the homepage, pricing, drills, planner and Arabic pages. Checked .
- Connection security. Grade A+ from the Qualys SSL Labs server test: only TLS 1.2 and 1.3, HSTS for one year, and none of the tested TLS vulnerabilities found. Checked .
- Internet standards. 95% on the Internet.nl website test and 97% on its email test. IPv6, DNSSEC, HTTPS, security headers, and the email authentication records DMARC, DKIM and SPF all pass. The remaining deductions are older encryption options that our hosting and email-routing provider still offer. Checked .
Automated tools find only part of the accessibility problems a person can meet, so this is not a claim that the site conforms to WCAG. If something on the site is hard to use, please tell us at support@fcommit.app.
How this website protects you
- No cookies, analytics, tracking pixels, embedded content or third-party scripts. Fonts, images and code all come from our own domain.
- A strict content security policy tells your browser to load nothing from anywhere else, with one exception: the page where you set a new password may talk to our sign-in provider and nothing else, and its form is the only one on the site.
- The site is served over HTTPS, and browsers are told to keep using HTTPS (HSTS). It cannot be shown inside another site's frame.
- It asks your browser for no camera, microphone, location or payment access.
- The only thing the site may keep in your browser is a small note that you closed the language suggestion, so it does not appear again.
- Our hosting and security provider, Cloudflare, processes technical connection data such as IP addresses to deliver pages and protect the site. The privacy policy explains this.
Privacy and legal documents
For player data, the coach or club is the controller and FCommit is the processor. For coach accounts, FCommit is the controller.
- Privacy policy
- Notice for parents and guardians
- Data processing agreement
- Sub-processors
- Terms of service
- Company details
These documents were approved by the owner on 26 September 2026 without a lawyer’s review, updated on 5 October 2026, and take effect when FCommit 1.1 is released. Each page says so.
Contact
Questions about privacy: privacy@fcommit.app. Questions about the app or this website: support@fcommit.app.