Privacy Policy
The short version
- Without cloud sync, the only thing StatTrack sends anywhere is your email address and password, so you can have an account. Everything else stays on your phone.
- Cloud sync is optional and off unless you subscribe to it. Turning it on copies the stats you record — athlete names, teams, games and numbers — and the photos and video you attach to our servers, so they survive a lost phone and reach your other devices.
- Without a subscription, photos and video never leave your phone. They stay on the device that took them.
- This changed in version 1.2. Earlier versions of this policy said photos and video were never sent under any subscription. That is no longer true if you turn cloud sync on, and we would rather say so plainly here than leave you to find it in Section 4.
- No advertising. No analytics. No tracking. Nothing sold or shared.
- You can delete your account, and everything with it, from inside the app.
The rest of this document is the detail behind those points.
1. Who we are
AWM Studios LLC, a limited liability company owned by Andy Mize, publishes StatTrack and is the data controller for the account information described in Section 3. StatTrack appears on the App Store and Google Play under that ownership. Contact us at privacy@stattrack.tech.
2. Scope
This policy covers the StatTrack mobile app. It does not cover the App Store or Google Play themselves, which have their own policies and which we do not control.
3. What we collect from everyone
Four things, whether or not you subscribe to cloud sync, and this is the complete list:
- Your email address. It identifies your account and is the only route to recovering it.
- Your password. Sent over HTTPS and stored by Supabase only as a salted hash. We never see it, and we never store it in a readable form.
- The version of these documents you accepted, and when you accepted them. A record of what you agreed to.
- The date your account was created.
If you subscribe to cloud sync we also hold a record of that subscription: which plan, its status, when it expires, and the transaction identifier the App Store or Google Play gave it. We never receive your card details or billing address — the payment is made to Apple or Google, and all we get back is confirmation that it happened.
We do not collect your name, your location, your contacts, your device identifiers, or any advertising identifier.
4. What cloud sync sends, if you turn it on
Cloud sync is off unless you subscribe to it, and it is the only thing that sends anything from Section 4a to us. With it on, the following is copied to our servers so it survives a lost phone and reaches your other devices:
- Athlete names, birth years and profiles
- Teams, sports, seasons and positions
- Games, opponents, dates, locations and notes
- Every statistic you record
- Any custom stats you create
- The photos and video you attach to a game, an athlete or a season
- Your theme and colour preferences, so a new phone looks the way you left the last one
Photos and video are stored with Cloudflare R2, under your account and nobody else's. They are uploaded from your phone straight to that storage — they do not pass through our other systems on the way. We do not look at them, we do not process them to recognise anyone or anything, and they are used for nothing except giving them back to you.
If your subscription ends, photos and video are removed from our servers after 90 days. The copies on your phone are untouched. That grace period exists so a lapsed card or a gap between seasons does not cost you anything, and it is deliberately shorter than for statistics, which we keep indefinitely — media costs meaningfully more to store, and holding it forever for someone who has stopped subscribing is not something we can promise honestly.
Each record is stored against your account and readable only by it. Enforcement is at the database itself, not just in the app: a request carrying anyone else's credentials cannot read your rows.
Turning off or cancelling sync stops further copying. What is already there stays, so resubscribing picks up where you left off — deleting your account (Section 9) removes it.
4a. What never leaves your device
This applies whether or not you subscribe:
- A randomly generated device identifier, created on your phone and used to keep records consistent between your own devices. It is not an advertising identifier and not tied to your hardware.
- Anything you have not attached to an athlete, team or game — files your phone holds that StatTrack has not been given
Without a subscription, this list also includes your photos, video, statistics and preferences. Nothing in Section 4 is sent unless cloud sync is on.
Everything in Section 4 is also written to your phone first and kept there. The app works entirely offline; sync is a copy, never a move.
5. Children's data
This is the part that matters most, so we will be direct about it.
StatTrack is a tool for adults. Accounts are for people aged 18 and over. The app is not directed at children, is not marketed to children, and children do not use it. The only person who signs in is the parent, guardian or coach keeping the records.
No child ever gives us anything. Everything about an athlete is typed by an adult, on that adult's own phone, about a child in their care. There is no account for a child, nothing for a child to sign into, and no way for a child to send us anything.
Without cloud sync, a child's name and statistics never reach our systems at all. They are written to that adult's phone and stay there.
With cloud sync, a child's name, birth year and statistics are stored on our servers, under the adult's account and readable only by it. We hold them to provide the backup and multi-device access that the account holder subscribed to, and for nothing else. We do not use them to advertise, to profile anyone, to train anything, or to build any record of a child that exists apart from the account it belongs to.
With cloud sync, photos and video of a child are stored on our servers too. This changed in version 1.2; earlier versions said it would never happen, and we are not going to bury the reversal. What it means in practice:
- It only happens if the adult holding the account subscribes and turns cloud sync on. It is not on by default and there is no way for it to happen by accident.
- They are stored against that adult's account and readable only by it. Nobody else, including us, looks at them.
- We do not run any recognition, matching, tagging or analysis over them. No face detection, no age estimation, nothing that tries to identify who is in a picture. They are files we hold and hand back.
- They are never used to advertise, to profile anyone, or to train any model — ours or anyone else's. See Section 7, which is a list of things we do not do and is binding.
- They are deleted immediately when the account is deleted, and 90 days after a subscription ends.
If you would rather no image of your child ever reached a server, do not subscribe to cloud sync. Everything else in StatTrack works without it, permanently and at no cost beyond the app, and that is a deliberate design choice rather than a limitation.
If you are that adult, you can see, correct or delete any of it at any time, from the app or by writing to us — Section 9. Deleting your account removes all of it.
If you believe a person under 18 has created a StatTrack account, contact us at privacy@stattrack.tech and we will delete it.
6. Who else is involved
Supabase provides our authentication and database hosting. Your email address, the hash of your password, and — if you subscribe to cloud sync — the records in Section 4 are stored on Supabase infrastructure in the United States (AWS US East, Ohio — region us-east-2). Supabase processes this only to provide that service to us. Their privacy notice is at https://supabase.com/privacy
Apple and Google handle payment if you subscribe to cloud sync, under their own policies. We send them nothing about you; we ask them whether a subscription is valid and they answer. We never receive your card details.
Those are our only processors. There is no analytics provider, no advertising network, no crash reporting service, and no other third party embedded in this app.
7. What we do not do
To be explicit, because plenty of apps do these things:
- We do not show advertising.
- We do not include any analytics or tracking SDK.
- We do not track you across other apps or websites, and we do not use any advertising identifier. Our Apple privacy manifest declares no tracking and no tracking domains.
- We do not sell, rent, or share personal information with data brokers.
- We do not use your data to train machine-learning models.
- We do not build advertising profiles.
8. How long we keep things
Your account information is kept until you delete your account, and is then removed.
Statistics copied by cloud sync are kept until you delete your account. Cancelling a subscription stops the copying but does not delete what is already there — so that resubscribing, or coming back on a new phone, finds your seasons where you left them.
Photos and video are treated differently, and this is the one place where cancelling costs you something. They are kept for 90 days after a subscription ends, and then deleted from our servers. The copies on your phone are never touched. We will tell you inside the app before that happens, not after. Resubscribing within the 90 days keeps everything; after it, the statistics are still there and the media is not.
The difference is cost, and we would rather explain it than pretend it away: statistics are small enough to keep for someone who may come back next season, and media is not.
If you want any of it gone without waiting, delete your account or write to privacy@stattrack.tech.
Data on your device stays there until you delete it, delete your account, or uninstall the app.
Ordinary server logs kept by our hosting provider for security and reliability are retained on their standard schedule and are not used to build any profile of you.
9. Your rights and how to use them
At any time, you can:
- See what we hold. It is the four items in Section 3. Write to privacy@stattrack.tech and we will send you your record.
- Correct it. Write to the same address.
- Delete everything. In the app: Settings → Account → Delete account. The same route is described at https://stattrack.tech/delete-account
- Take your data with you. Everything meaningful is already on your device.
- Withdraw your consent. Delete your account.
- Complain. To us first, please — but you may complain to your data protection authority.
Deleting your account removes your account record from our systems and erases all StatTrack data from the device you delete it on. It is immediate and cannot be undone.
If you are in California, we do not sell or share personal information as those words are used in the CCPA, and we have not done so in the past twelve months. We will not treat you differently for exercising any of the rights above.
Where the GDPR applies, our lawful basis for handling your email address is performance of a contract — you asked for an account and an account requires an identifier. Recording your agreement to our terms rests on our legitimate interest in being able to show what was agreed.
10. Security
- All traffic between the app and our servers uses HTTPS.
- Passwords are hashed by Supabase. We never see them.
- Your sign-in tokens are held in the device's secure storage — the Keychain on iOS, the encrypted preferences store on Android — not in ordinary app settings.
- App data on your device sits in private storage that other apps cannot read.
No system is perfectly secure. If a breach ever affects your information, we will tell you and the relevant regulator as the law requires.
11. International transfers
Our servers are in the United States. If you use StatTrack from elsewhere, your email address is handled there. Where required, transfers rely on the appropriate safeguards, such as the European Commission's standard contractual clauses.
12. Changes to this policy
If we change this policy in a way that materially affects you, we will tell you in the app before it takes effect. Every version is numbered, and the one you agreed to is recorded against your account.
13. Contact
For privacy questions, data requests, or to report a concern. We read what arrives there and we answer.