Your team's data, and where it goes

Your team stays in your browser. Online sync is off by default, and while it's off nothing about your team leaves your device. The only thing the app sends is usage counts, which never include player data. You can turn them off in Settings.

Dugout Relief is run by Niall Keleher. Last updated November 4, 2026. Questions: info@dugoutrelief.com

At a glance

What's kept, where, and who can read it
What	Where it's kept	Who can read it
Roster, lineups, pitch counts, and stats	Your device. With online sync on for that team, an encrypted copy on our server too.	You, and coaches and viewers you invite to the team. We can't read the server copy.
Photos of a stats sheet or scorecard	Nowhere. Read on your device, then dropped; only the numbers you import are kept, with your stats.	No one: the photo never leaves your device.
Backup files	Wherever you save them. We never receive them.	Anyone who has the file.
Account (optional)	Our server: your email and a hash of your password.	Us.
A calendar link you import	Your device, with the team (and its synced copy) if you have it remembered. Our server downloads the calendar for you and keeps neither.	You, and coaches you share the team with.
Messages you send us	Our email inbox.	Us.
Usage analytics	Fathom Analytics, in the United States.	Us, as totals. No player data.

For parents

The coach's roster stores each player's name, uniform number, league age, positions, and a chart color. It doesn't ask for birthdays, photos, parent contact details, or medical notes. There are no parent or player accounts.

Player details stay on the coach's device. If the coach turns on online sync, player details are encrypted before upload, and only coaches and viewers on the team can read them. We can't.

To have a player's details removed, ask the coach. In the app: open Roster, tap the pencil by their name, then Remove player. Players who don't return are under Past players; choose Remove… there. Removing a player deletes their name from the roster and from the synced copy, and other coaches' devices get the change the next time they sync.

Saved games keep the player's stats under a random number, so the team's totals still add up. Once the name is removed, nothing in the app links that number back to the child. Older backup files still contain the name; the coach should delete those separately.

On your device

Your roster, rules, schedule, lineups, pitch counts, and stats are saved in this browser on your device. You can use the app without an account or an internet connection.

Downloaded backup files stay with you, and a GameChanger stats file is read in your browser. We receive neither.

To remove one team, open SettingsTeams and choose Delete. To remove everything, choose Reset, then Clear all data. Clearing this site's browser data also removes the local copy.

If you create an account

Creating an account is optional. We store your email, a one-way hash of your password (not the password itself), and your sign-up date. Creating an account doesn't send your team data. This browser keeps a sign-in token so you stay signed in. Changing or resetting your password signs you out on every device.

Signing in doesn't turn on online sync. Choose which teams to sync in the Account section.

A team owner can invite someone by email, as a coach (can change the team) or a viewer (can only look). We email that address a one-use link. The database keeps the address, the role, and a hash of the link; accepting requires an account with the same email.

If you turn on online sync

Online sync starts off. To turn it on, open SettingsAccount and choose a team. The app encrypts that team on your device before sending it, so our server keeps a copy we can't read. Your devices, other coaches and viewers on the team, and your backup files hold the key.

The server copy holds the team's roster, rules, seasons, schedule, and saved games. Games under way and sample games stay on your device. Current coaches and viewers can open the shared roster, schedule, and saved games, with their lineups, pitch counts, and every player's stats. A viewer's device holds the team key like a coach's, so a viewer can read everything a coach can. What stops a viewer changing the team is our server, which refuses their changes, not the encryption. In the same way, coaches can change the team but only the owner can delete players, games, or the team itself, and only the owner can invite, remove, or change anyone's access. Who can do what

Our server can see account emails, team membership, invitation addresses, and device records, including public keys. For synced teams it also sees team and item IDs, each item's type and encryption key version, when it changed, and its size. It sees your internet address too. It can't read player names, ages, positions, lineups, pitch counts, stats, opponents, fields, or game dates and times.

How the encryption works

Each synced team has its own random key. The app seals every item with AES-256-GCM before it leaves your device. Each device has its own key pair (ECDH on the P-256 curve), and the team key is wrapped for each approved device with HKDF. All of it runs in your browser's built-in Web Crypto. Keys never come from your password.

To add a device, enter the short code it shows on a device already approved for that team. The code never reaches our server. While the request is open, the server keeps a check value made from the code (PBKDF2, 600,000 rounds). It can't use that value to read your team.

The owner gets a recovery code when sync starts. We don't store recovery codes. When ownership moves to another coach, the previous owner's code stops working and the new owner makes their own. After a coach is removed, the team key changes and the owner gets a new code. Anyone already on the team can approve a new device for someone else on it, so the owner doesn't need to share the code.

A downloaded backup file includes the team's key. Restore it on a new device to open your server copy without the recovery code. Anyone with the file can read the team, so keep it as safe as the code. If you lose every device, the code, and every backup file, not even we can recover the server copy.

Removing a coach changes the key and re-encrypts the server copy, so that coach can't read future syncs. The new key reaches only the remaining coaches' devices that already had the old one. It can't erase data already downloaded to the removed coach's devices or old backup files. The owner must save the new recovery code.

Because this is a web app, your browser runs code we send. A strict content security policy limits scripts and fonts to our own site. We serve our own reviewed copy of Fathom's script, so no code from Fathom's site runs in the page; Fathom only receives counts. The app also caches its files so it works offline.

Deleting your account

To delete one team's online copy, open SettingsAccount and choose Remove from the server. The copy on your device stays.

To delete your account, open SettingsAccount and choose Delete account. First, transfer each shared team you own, or remove it from the server. If you're a coach or viewer on someone else's team, ask its owner to remove you so the team key can be changed. We then remove your account and its remaining synced teams from the live database. Teams on this device stay here.

When you send us a message

When you send a feature request or problem report from the app, we email your message and its category, any reply address you give, the app's version, and your browser's user-agent string, which can identify your browser, operating system, and device. We add no team data; anything you write is sent. Feedback isn't stored in our database. Unsent messages stay on your device, including one you send with no signal: it waits there until the app can reach our server, and you can delete it from Help until then.

When you import a calendar

Calendar sites don't let a web page read their calendars, so when you add games from a calendar link, the app sends the link to our server, which downloads the calendar from that site and passes it back. The site sees our server's address, not yours. We don't store the link or the calendar. Games come from the calendar's dates, times, titles and places; nothing about players is sent. A calendar file you choose is read on your device and never sent. If you keep the link to check for changes, it's saved with your team like its other settings.

Usage analytics

To learn which features coaches use, the app counts which pages and tabs are opened, which of a fixed list of buttons are used, such as Build Lineup or Print coach sheet, when a team first reaches a setup step (players added, games added, a first game run, first stats in), whether the app was opened from your home screen, and which version of the app is running. Which steps a team has reached is kept on your device so each counts once. We use Fathom Analytics for this. Counts are on unless you turn them off, so they show how most coaches use the app, not only the few who would opt in. We chose that because counts carry no player data.

Counts never include player names, uniform numbers, team names, or anything you type. Fathom uses no cookies and doesn't store your internet address. It uses the address and your browser details to count unique visitors for one day. It records your device type, browser, operating system, country, state or region, and city (worked out from the internet address), the site that linked you here, and how long a page stayed open. Counts are processed and stored in the United States. Use while you're offline isn't counted.

To turn counts off on this device, open SettingsUsage analytics and untick Share usage analytics. The app then stops loading Fathom's script, including on this page. If your browser sends Global Privacy Control or Do Not Track, counts are off. Clear all data keeps your choice; clearing this site's browser data turns counts back on.

We review these counts on our own computer next to daily totals from our server: how many accounts, devices, and synced teams there are, invitations sent and accepted, and the counts of wrong passwords and new accounts below. Totals never include an email, a name, which team or account, or anything in a team, which we can't read anyway.

How long we keep things

Accounts and synced teams: until you delete them. Neon, our database provider, keeps six hours of database history, so a deleted account or online copy may remain there for up to six hours.
Deleted items in a synced team: the contents go at once. A delete marker stays for up to 90 days so your other devices get the deletion; the server keeps its metadata and an encrypted deletion note.
Invitation links: open for seven days.
Requests to approve a new device: open for up to ten minutes.
Wrong passwords, password reset requests, new accounts, messages you send, and calendar links you import: to slow down guessing and spam, we count them by a scrambled form of the email and internet address, never the addresses themselves, and delete the count after an hour. Only how many there were each day is kept.
Daily totals (accounts, synced teams, invitations): kept, since they say nothing about anyone.
Usage counts: Fathom tells visitors apart for one day only.
Server error reports: Sentry keeps them for up to 90 days, and request timings for 30 days.

Who else handles data

FastAPI Cloud: Hosts the app and server. It sees your internet address and the pages your browser requests.
Neon: Our database. It holds accounts, and the encrypted copies of teams with sync on.
Proton: Sends password reset and team invitation emails, forwards your feedback to us, and holds our inbox.
Fathom Analytics: Counts page views and feature use, without cookies, while usage counts are on. It sees your internet address but doesn't store it.
Sentry: Tells us when our server hits an error, and how long requests take. A report says which part of our code failed and the kind of request, with your browser's user-agent string. It never includes your internet address, email, password, team data, or messages. Reports are stored in the United States.

We don't show ads, follow you to other sites, or sell your data.

Questions

Dugout Relief is run by Niall Keleher. Email info@dugoutrelief.com with any question about this page, or to ask us to delete something.