Security & Data Protection
How we handle the data your club trusts us with — including children's records.
Where your data lives
Application data is stored in a managed PostgreSQL database on Supabase, running on AWS infrastructure, with encrypted connections (TLS) for all traffic. The site is served through Cloudflare's CDN with HSTS, standard security headers, and bot protection via Cloudflare Turnstile on public forms.
If your club or governing body requires data hosted in a specific region, contact us before signing up and we will confirm the current hosting region in writing.
Sub-processors
We use the following third-party processors to run the service:
| Processor | What they handle |
|---|---|
| Supabase | Database, authentication and file storage for all account and club data. |
| Cloudflare | CDN, DNS, DDoS protection and Turnstile bot protection on public forms. |
| Paddle | Merchant of record for Club Term subscriptions — Paddle processes your card payment to us. |
| Stripe (planned — not enabled) | Planned for club card payments, not currently enabled. When your club's Stripe connection launches, card payments from parents to your club would be processed there. No card data is collected through Stripe today. |
| EmailIt | Transactional email — invoices, account sign-in links and team invitations. |
| Sentry | Error monitoring for the application; event payloads are limited to technical diagnostics. |
Children's data and safeguarding
Clubs store participant profiles — which can include medical notes, emergency contacts and allergy information — under the parent or guardian's account. Children do not hold accounts themselves. Access inside the application is controlled by row-level security on every table, so one club's data is never readable by another, and role-based permissions limit what staff members can see.
Your club is the data controller for participant data; Real Code Ltd acts as the data processor. Our Privacy Policy describes the lawful basis, retention and your rights in detail.
Access control and accounts
- Row-level security enforced at the database on every table
- Role-based access for staff, coaches and administrators
- Multi-factor authentication available for admin accounts
- Passwords are handled by Supabase Auth — we never see or store them
Backups and export
The database is backed up by Supabase's managed backup schedule. Your data is yours: you can export participants and session records at any time, and on cancellation we will provide a full data export on request. We do not hold your data hostage — if you leave, you leave with everything.
Data Processing Agreement
If your club, school or governing body requires a signed Data Processing Agreement, email [email protected] and we will provide one for signature.
Reporting a vulnerability
If you believe you have found a security issue, please report it to [email protected]. We ask that you do not disclose the issue publicly until we have had a reasonable opportunity to investigate and fix it. Our security.txt lists the canonical contact.