Privacy

What we collect

• Account information: the name and email address of the adult who creates the account, and the organisation they belong to.
• Athlete profile: the pitcher’s age or age band, throwing hand, and development stage. For athletes under 13 this is collected only after a parent or guardian has given consent; see our children’s privacy page.
• Training data: logged throwing sessions, workload, and the programs generated from them.
• Device and pitch data : measurements you import from TrackMan or Rapsodo, and public Statcast data. We do not receive data from any club’s private systems.
• Assessment answers: if you take the pitcher-type assessment, your answers are scored in your browser and nothing is stored unless you give us an email address to send the result to.

What we do not do

• We do not sell personal information, and we do not sell or share the personal information of anyone under 16 for cross-context behavioural advertising in any circumstances.
• We do not run behavioural advertising and we do not integrate third-party advertising SDKs. Our analytics are first-party and scoped to your organisation.
• We do not make a minor’s profile, video, or results publicly visible. Profiles are private by default and there is no public leaderboard or recruiting search.
• We do not use your data to make claims about preventing injury. The platform manages workload; it does not promise an outcome.

Why we are allowed to hold it

For most of what we hold, the basis is the contract you entered into when you took out a membership. We cannot generate a program without knowing who it is for. For anything involving a child under 13, and for anything involving health-adjacent information such as injury history, the basis is your explicit consent, which you can withdraw at any time.

How long we keep it

Training and program data is kept for as long as the account is active. Records of security-relevant actions are kept for 24 months online and archived for seven years. That retention is a legal minimum and it is the one category that survives a deletion request.

Video upload is not open yet. The retention we have designed for it is 12 months in active storage and a further 36 months archived, with an export offered before anything is deleted. That is a plan, not a description of something currently holding your data.

Your rights

Wherever you live, you can ask us for a copy of your data, ask us to correct it, and ask us to delete it. If you are in the EU or EEA you also have the right to object to processing and to lodge a complaint with your supervisory authority; if you are a California resident you have the rights set out in the CCPA and CPRA, including the right not to be discriminated against for exercising them.

A parent or guardian may exercise all of these on behalf of a child. We answer GDPR requests within one month and CCPA requests within 45 days.

Self-service export and deletion are being built. Until they ship, email us and we will do it by hand within the same deadlines.

Who we share it with

Only the service providers we need to run the platform: hosting, database, video processing, email delivery, payments, and error monitoring. Each of them only receives what that job requires. We do not share athlete data between organisations. If we are ever required to disclose data by law, we will tell you unless we are legally prohibited from doing so.

Security

Every organisation’s data is isolated at the database level, not only in application code, so a bug in one query cannot expose another organisation’s records. Access is role-scoped, and every change to a record (who made it, what it was before, and when) is written to an audit trail we cannot edit.

Two controls are designed but not yet built, and we would rather say so than imply them: a log of every read of a minor’s records, and expiring, access-logged links for shared video. Video upload is not open yet, so there is nothing being shared under a weaker control in the meantime. When it opens, those controls ship with it, not after.

If we discover a breach affecting your data we will notify you, and the relevant authority within 72 hours where that applies.