Dugout

Dugout is operated by Richard Murphy, trading as Dugout (“we”, “us”). We are the data controller for the personal data described below. Contact us at admin@dugout.ie.

• Player roster — player names, team assignments, and active status, entered by coaches and stored on our servers. Each player is identified by a name-derived identifier (e.g. adam-al).
• RSVP responses — when a parent or guardian submits availability via an RSVP link, we store the player identifier and availability status against the relevant session.
• RSVP analytics — we collect device type, operating system, browser name, and whether the page was opened in WhatsApp. We do not store full user-agent strings, referrer URLs, or screen dimensions.
• Coach accounts — email address and a securely hashed password (bcrypt). A session cookie is used for authentication.
• Push notifications — if a coach enables browser push notifications, we store a technical endpoint URL and a device label (e.g. “iPhone · Safari”) needed to deliver alerts.
• Local storage — we save your child's player selection on your device so you don't have to choose them again next time. This data stays on your device and is not sent to our servers.
• Cookies — we use a single session cookie for coach login. No tracking cookies are used on parent-facing RSVP pages.

• Availability data and analytics — processed under legitimate interest (GDPR Art. 6(1)(f)) to coordinate team activities and improve the service. Our legitimate interest is reducing the administrative burden on volunteer-run clubs.
• Coach accounts — processed under contract performance (Art. 6(1)(b)) to provide the service the coach has signed up for.

We do not sell personal data or use it for advertising.

Data is stored in MongoDB Atlas and the application is hosted on Vercel. Both act as data processors on our behalf and process data in accordance with GDPR. Some processing may occur in the United States under standard contractual clauses.

• MongoDB Privacy Policy
• Vercel Privacy Policy

Coaches may upload WhatsApp text or poll screenshots to automatically create match sessions. This content is sent to OpenAI for parsing and may include participant names visible in the text or screenshot. OpenAI acts as a sub-processor and processes this data under their Privacy Policy. Only coaches can trigger this feature; parents do not interact with it.

• Availability data — retained for the current season.
• Sessions — archived or deleted after 12 months.
• RSVP analytics — retained for up to 90 days.
• Coach accounts — retained until the account is closed.
• Push notification subscriptions — removed when unsubscribed or inactive.

You may request deletion of your data at any time by emailing admin@dugout.ie.

Under GDPR and the Irish Data Protection Act 2018, you have the right to:

• Access the personal data we hold about you.
• Request correction of inaccurate data.
• Request deletion of your data.
• Object to processing based on legitimate interest.
• Request a portable copy of your data.

To exercise any of these rights, email admin@dugout.ie. We will respond within 30 days.

You also have the right to lodge a complaint with the Irish Data Protection Commission at dataprotection.ie.