Privacy: what is stored, where and for how long

Where it is kept

Everything below is kept in one Cloudflare D1 database that belongs to this site. Cloudflare chooses where the database lives; the region is not pinned, so it may be outside your country. The pages themselves are static files served by Cloudflare Pages.

Children

Players are numbers. There is no field anywhere for a child's name, birth date, photo, school, address, position or contact details. The labels a director writes for criteria, age groups and teams are refused if they ask for a child's name, date or year of birth, address, postcode, school or contact details. The notes a director or evaluator writes refuse the @ sign, web addresses and runs of 7 or more digits, and show the reminder to use the player number, never a name. A name typed into a note cannot be detected reliably, so the club is responsible for keeping names out (the terms say so). The director keeps the number-to-name sheet on paper; the app never reads it.

What is stored for a tryout

• The tryout's name, date and time zone, scale, rubric, age groups, teams and their sizes, status, and the club's next steps for the reports.
• Each player's number, age group, whether they withdrew, the team they were placed on, and a note to the family if the director wrote one.
• Each player's family code as a scrambled form (SHA-256) only. The code is shown to the director once, to print, and is not kept. When the club makes new codes, the old code's scrambled form is kept with the tryout, so an old slip says that codes were reissued and when.
• A short history the families can notice: when codes were reissued, when scoring was reopened, when reports were published or hidden.
• Each evaluator's name or role as the director typed it, which groups they score, and their scoring link as a scrambled form only.
• Every score an evaluator saved (a number per criterion) and their optional note for the director, which never appears on a family report.
• The club's report link as a scrambled form, plus a sealed copy that only this server can open with its own secret key, so the director can share it again.

What is stored for an owner

• A random account id, the account name you chose for your passkey manager, and when the account was made.
• For each passkey: its public key, its id, a signature counter, the name you gave it and when it was added and last used. Never a fingerprint, a face or any biometric data: those stay on your device.
• A scrambled form (SHA-256) of your recovery code. The code itself is shown to you once and not kept.
• For each signed in device: a scrambled form of its session id, and when it was made, last used and when it expires (90 days after the last use).
• Your email address, only if you add one, and whether you confirmed it. It is used only for the confirmation link and the one notice, Scores are in. It is the one place an email address is ever stored.
• Notices for you, and a record of each email sent, kept 30 days.

What is stored for evaluators and families

Nothing about them as people. They have no account and no cookie, and are never emailed. An evaluator's saves are stored as the scores above. When a family opens a report, the request is counted for the wrong-code limit below (in a bucket keyed by a scramble of the network address, and one for the tryout); a right code is given back at once, so only wrong codes stay counted. The bucket rows are deleted after 2 hours.

Limits on how fast requests come

To stop guessing and flooding, the server counts, in hourly buckets: score saves per scoring link (240) and per network address (1,200); a director's changes (300); sign-in steps per network address; and wrong family codes per network address (10, which pauses that device or network for an hour) and per tryout from everywhere (300, against guessing spread over many places). The director sees the tryout's count of wrong codes. The address is stored only as a keyed scramble that cannot be turned back into the address, and each bucket is deleted after 2 hours. Network addresses are never written to logs.

How long it is kept

• A tryout and everything in it: read-only once 30 days have passed since both its date and the day it was set up and nothing has changed in it for 30 days. Due for deletion 365 days after the later of its date and the day it was set up: it is then deleted with 7 days to restore (the director sees a notice), and deleted for good after that. Its report link then says the report was removed by the club's schedule for 90 more days.
• A tryout the director deletes: 7 days, while it can be restored, then deleted for good.
• Your account: until you delete it. A deleted account and every tryout in it: 7 days, while you can sign in and cancel, then deleted for good.
• Sessions: until 90 days after the last visit on that device, or until you sign out.
• Passkey sign in requests: 5 minutes. Rate limit buckets: 2 hours. Email records and notices: 30 days.

What stays on a device

On an evaluator's phone, scores not yet sent are kept in the browser's local storage under keys beginning with tryoutscore, with the first 8 characters of their link to tell links apart, until the server confirms each one. The secret part of every link sits after the # sign, which browsers do not send to any server in the address, and a family code is taken out of the address bar as soon as the report page reads it.

How to see and delete it

On your account page, Download everything gives one file with every tryout, player number, score, note and placement you own, without links or codes. Delete my account removes everything after the 7 days above; you can also delete a single tryout. Requests by email go to [email protected].

Cookies

One cookie, and only for directors who sign in: a session cookie that keeps you signed in. It cannot be read by page scripts and is never sent to another site. Evaluators and families get no cookie.

Page counts

Visits may be counted by Cloudflare's own page counter, which sets no cookie and records that a page was opened, never what you typed. There is no other analytics.

Payments

No paid plan is offered at present; if one is added, this page will describe it.

Email

Only directors can receive email, only at an address they added and confirmed, and only for the one notice per tryout. Families and evaluators are never emailed. Emails carry no tracking images.

Typeface

Headings and numbers are set in Oswald, under the SIL Open Font License 1.1, served from this site. The licence is at /fonts/OFL.txt.

Changes and contact

If this policy changes in a way that affects what is stored, the change will appear on this page. Questions go to [email protected].