What we store,
and what we refuse to

There is no column for these

Not "we do not collect them" — the columns do not exist in the schema, so they cannot be filled in later by accident.

• Date of birth

  League age is stored as a whole number. It is the only age fact the pitching rules need, and it is not a personal identifier.

• Photographs

• A child's email address, phone number or home address

• Parent or guardian contact details

• Any link between a player's device and a name on the roster

  This one is structural. Devices and roster entries live in separate tables with no column joining them. The only thing connecting a device to a child is a jersey number and a coach's own memory.

What a coach's roster holds

• A jersey number, and optionally a name

  The name field can be left empty for every player and the whole product still works, including printed lineup cards. We ask for a first name and a last initial, never a full legal name. Jersey-only is a supported way to run this, not a degraded one.

• League age, as a whole number

• Whether they pitch, whether they catch, and which positions they play

• Pitching outings: a date and a pitch count

  When a coach records an outing thrown for another team, we store the date and the count. We do not store which team, and there is no column for it.

What a player's device holds

A player joins a team with a share code. Their device gets an anonymous token and, if they choose to enter one, a jersey number. That is the whole record.

Which badges a player has found is kept on their own device and never sent to the server. A badge is between the child and the app.

Coach accounts

An email address, a name you choose, and a password stored as a one-way hash. Accounts are invite only; there is no public sign-up form.

Sign-in attempts are recorded, per email and per address, to stop password guessing. They are deleted after thirty days.

Getting your data out, or deleted

Deleting a team deletes its roster, its outings and its device records. Deleting your account deletes all of it. There is no soft-delete holding pen and no archive copy.