Draft: under legal review. This version applies while Rugger is being tested with a small group. When the reviewed version is published, we'll ask you to read and agree to it.

Rugger: Privacy Policy

1. Who this policy is for

This policy explains what personal data Rugger collects from players and club users (club admins and coaches), why, where it's kept, and what rights you have over it. Read it alongside the Rugger Safeguarding Policy.

Rugger is for adults (18+) at launch. You must be 18 or over to create a player account. Age is self-declared at sign-up; see Section 5.

2. What we collect

When you create an account:

• Your email address and a password. The password is stored only in scrambled (hashed) form by our login provider; nobody at Rugger can see it.
• Whether you signed up as a Player or a Club account.

Player profile:

• Name, date of birth, sex, height, weight, playing positions, dominant hand and foot, nationality, town or city, and club (if you join one).
• A profile photo, if you add one: the square you crop it to, saved as a small image with the rest of your saved data (see Section 7), so it shows on any device you log in on. Only you can see it; it isn't shared with your squad.

Training and health-related data (see Section 4):

• Logged sessions: sets, reps, weights, effort (RPE) per set if you add it, and whether a session was completed; and, if you answer the question after a gym session, how long it took. How hard a gym session was (1–10) is worked out from the weights and reps you logged, against your best on each exercise, and kept with the session; it gives the session's training load (with its minutes) and helps adjust your programme.
• Readiness check-ins (sleep, soreness, fatigue), asked before a gym session and on your rugby training days.
• Prehab areas you choose for extra attention (up to two of ankle, knee, hip, lower back and shoulder). This can hint at a past or current problem with that area, so we treat it as health-related.
• We don't collect injuries. You can opt out of or swap an exercise without saying why, and nothing is recorded. Injury details saved by earlier versions of the app are deleted the next time your data is saved.
• Test results: strength (one-rep maximums), Bronco time and top speed, whether you entered them, they were estimated from your logged training, or a coach in your squad entered them after a test session. A coach can also record results for their team's own tests (for example a jump or sprint test): these are seen by you and that team's coaches and club admin, and never used in comparisons. Any result a coach enters is also saved with your own data, so it stays on your profile, even after you leave the team or club; you can delete one at any time in Profile → Other Test Results, which removes it from your coach's records too. The coach's copy is deleted when you leave the team.
• Bodyweight history and nutrition targets.
• Rugby training: on each training day you can say how hard it was (1–10) and how long it lasted, which gives its training load, and add GPS data.
• Sessions you log by hand (Log Activity, or Add GPS Data on a training day): rugby training, a match, or another activity (such as a run, bike, swim or row), with whichever of these you add: total distance, top speed, high-speed running distance, high-intensity distance, distance per minute, maximum heart rate, minutes, effort and, for other activities, your pace, average speed or split. Other activities count towards your training load and nutrition, and their load (not the details) is shared with your squad if you've agreed to that, see below. A top speed you type in is shown on your profile as self-reported, never as verified. (Uploading GPS files isn't available yet.)
• If you connect Apple Health or Google Health Connect (phone app only, not the web version): sleep duration and quality, resting heart rate, heart-rate variability, and energy burned. We only request these.

Rugby CV and Player Hub:

• Playing history, highlight video links, your transfer status and who can see it, the level you're aiming for, and test results shown on your profile.
• Your public profile (only if you choose to be visible; not yet switched on): if you turn on "Show me on Player Connect", or make your transfer status visible to clubs, Rugger keeps a copy of your Rugby CV on its servers so others can see it: name, positions, club, team and level, town, date of birth (only your age is ever shown to others), height, weight, preferred foot and hand, nationalities, playing history, the test results on your profile (and whether they're verified), your transfer status, and who may see it. Nothing else, no training logs, check-ins, nutrition or wellness data. It's deleted when you turn visibility off. Other players and clubs only ever see you once you've passed the age check.
• Requests and invitations: a club's invite to trial, your interest in a club's opportunity, and message requests between players: who sent it, to whom, any message (up to 500 characters), and the answer. Stored on Rugger's servers.
• Blocks you make, stored on Rugger's servers so the person you block can't see you or contact you through Rugger.
• Opportunities clubs post (title, type, positions, description).

Club accounts (club admins and coaches):

• Club admins: the club's name, your name, a contact email and your role at the club; our review decision on the club, who made it, and any notes (for example, what we checked).
• Everyone on the club side: your name as your club knows you, your role in the club (admin or coach), and, for coaches, the one team you look after. Coaches and club admins also use scouting (finding players open to their club) once it opens; there's no separate scout account.
• The club's teams, each team's player join code, and staff invite codes (who created them, and when they were used or cancelled).

Your club and team:

• The club and team you pick are chosen from Rugger's club list: club names, towns, counties and league levels compiled from public Wikipedia pages (no personal data). Your choice is saved with your account.
• If you add a club that isn't listed, we keep its name, town and country and which account added it. Until Rugger checks and approves it, only you can see it; after approval, everyone can find it. If we hide it (for example, a duplicate), you keep your team on your profile.
• Club badges are images uploaded by a club's own admin, and are publicly viewable. Clubs without one show their initials.

Asking to join a squad: If your club is on Rugger, you can ask to join your team's squad instead of entering a code. You can be in up to 3 teams at one club (for example the 1st XV and the 2nd XV), and you share with the coaches of each team you join. When you ask, we keep your name and main position, the consent wording you agreed to, and when you asked. These are shown to that team's coaches and the club's admin so they can approve or decline you. The request is deleted once it's answered or you cancel it; if approved, the squad sharing below starts.

Reports you make (safety): If you report another user, the report is sent to Rugger (it isn't kept only on your device). We keep: your account, who you reported (their account reference and the name you saw), the reason, any note you add, when you sent it, and our review (who reviewed it, the outcome and any notes). Nobody in the app can see reports, not you, the person you reported, or any club. When a report arrives, Rugger's safeguarding contact gets an email saying only that a report arrived, its reason and when, no names or report details. If you delete your account, the report is kept (it may still need action) but no longer linked to your account.

Squad sharing with your coach (only if you choose to join a squad): If you join your club's squad with its join code, and tick to agree, Rugger keeps a copy of the following on its servers so the coaches of each team you're in and your club's admin can see it:

• The name and main position shown on your profile.
• Your daily readiness colour (green, amber or red), never your answers to the sleep, soreness and fatigue questions.
• How many training sessions you completed each day, and which days had a session planned.
• Your training load each day: how hard × how long, for gym sessions (how hard is worked out from your sets, see above), rugby and other activities you log (such as runs), as one number per day for each (no sets, weights, distances, pace or heart rates).
• How many minutes you played in each match you log, so your coach can plan your conditioning at training. Your coaches can also log a match on the dashboard: the line-up (your shirt number), and the subs and cards (yellow or red) with their minute, from which your minutes are worked out. Theirs count on the dashboard (with an estimated match load if you didn't log the match yourself), you see your minutes on your Match Day, all of it is in Download my data, and it's deleted when you leave the team.
• Your test results (squat, bench press, deadlift, Bronco, top speed), marked as tested, self-reported or estimated from your training. Results a coach entered show as tested.
• Your sex and position group, used only to compare your test results anonymously with similar players. Your club can't see these, and no one sees anyone else's results in those comparisons.
• A record of when you agreed to share, any newer wording you agreed to, and when you left.

Players who joined a squad before training load and test results were added to sharing share only their readiness colour, sessions, planned days and the three main lifts, unless they agree to the newer wording in the app. Likewise, the load from other activities is only shared by players who have agreed to the wording that added it (15 Oct 2026), and match minutes only by players who have agreed to the wording that added them (26 Oct 2026).

Nobody at the club sees your check-in answers, bodyweight, nutrition, prehab areas, or the exercises, sets, weights or effort in your sessions.

Age check (planned, not yet live): Before a player can be seen by clubs, we plan to ask them to complete an age check with Yoti, our age-verification provider. It's usually a quick face scan, with a photo ID as an alternative. The age check isn't switched on yet; we'll update this section with exactly what Yoti processes and keeps before it is.

Subscriptions and payments:

• If you subscribe, payment is taken by Stripe on its own secure page. Your card details go to Stripe, never to Rugger.
• Rugger keeps: your Stripe customer and subscription references, your plan (monthly or yearly), its status (for example active or cancelled), when it renews or ends, and whether you've cancelled.
• To set up your subscription we give Stripe your email address and your Rugger account reference.
• Before you subscribe, you get a sample week; we keep nothing extra for that.

Tester codes: if you enter a tester code, we keep which code you used and when.

Feedback you send (testing period): if you use "Send feedback", we keep what you wrote, what it's about (something broke, something confusing, an idea or other), whether you were on the web or a phone, when you sent it, and your login email so we can reply. Only Rugger staff can read it.

Phone notifications (only if you turn them on): if you turn on notifications in Settings, we keep the address your phone's or browser's push service gives Rugger for sending to it (with its encryption keys), which reminders you want, your time zone (so reminders arrive in your morning or evening), and when we last sent one. To decide whether to send a reminder, we check your saved programme and whether today's session is logged. Reminders only say that a session is ready or not logged yet, never your health details, because they can show on a locked phone.

Security checks when you log in or sign up: to stop bots, Cloudflare Turnstile checks that a real person is using the log-in, sign-up and password-reset pages. It looks at technical signals from your browser and device (such as your IP address and browser details); usually you see nothing, occasionally a tick-box.

Guardian consent (not used at launch): The app contains a guardian-consent process for players aged 16–17. It is switched off while Rugger is 18+ only. If under-18s are allowed later, this section must be expanded before that happens (it collects a guardian's name, email, relationship, confirmation of the player's date of birth, the IP address it was submitted from, and the wording they agreed to).

3. Why we collect it, and our lawful basis

4. Health data gets extra protection

Training, readiness, prehab-area, heart-rate and wellness data can reveal health information, which is "special category" data under UK GDPR. We only process it with your explicit consent, given in its own step when you sign up, not as part of accepting the general terms.

Sharing a summary with a squad coach is a separate explicit consent, given when you join a squad. You can withdraw it at any time by leaving the squad (Profile → Your squad → Leave squad): your coach loses access immediately and the shared summary is deleted from our servers.

You can withdraw your health-data consent at any time in Settings → Health data consent. Rugger can't build your training without this data, so withdrawing permanently deletes the training and health data listed in Section 2 (logged sessions, check-ins, rugby sessions, test results, bodyweight history and prehab areas) and ends any squad sharing. Your account, profile and training plan stay; to carry on using Rugger you'll be asked for consent again, or you can delete your account.

5. Age and children

Rugger is for adults at launch. Age is self-declared: we don't currently verify it at sign-up. Because a young person could enter an adult date of birth, we plan to require an age check (Section 2) before any player can be seen by clubs, and all club accounts must be approved by us before they can use Rugger.

If Rugger later opens to 16–17-year-olds, this policy will be updated first, following the ICO's Age Appropriate Design Code.

6. Who processes your data, and who we share it with

Clubs (scouting): only staff of clubs Rugger has approved, and only the profile details you have chosen to make visible.

Your squad's coaches and your club's admin: only if you join the squad and agree, only at a club Rugger has approved, and only the summary listed in Section 2. A coach sees only the squad they're assigned to (if you're in two or three teams, each team's coaches see you); the club admin sees every squad in their club. Club staff also see how your test results compare with the average of similar players (for example "+15 kg"), but never those players' results or who they are, and only once a comparison group has at least 20 players. Squads are for players aged 18 and over. This is enforced by the database itself, not just the app.

Coaches and club admins of a team you ask to join: your name and main position, only until they answer your request.

Service providers who process data for us:

We will have a data processing agreement with each provider before real users' data flows through them. Where a provider processes data outside the UK (for example Anthropic in the United States), we will rely on a recognised safeguard for international transfers.

We do not sell personal data and do not share it with advertisers.

7. Where your data is stored

• On Rugger's servers (Supabase): your login, account type, results a coach entered for a team's own tests, club applications, club staff and invites, and our review records; reports and our review of them; clubs you've added; any open request to join a squad; your public profile (only while you choose to be visible); requests, invitations, opportunities and blocks; and, only while you're in a squad, the summary shared with your coach plus your squad consent record; your subscription status and Stripe references; which tester code you used; and feedback you've sent. The club list and club badges are stored here too.
• Saved with your account, and on your device: your profile (including your profile photo), training logs, readiness check-ins (including your answers), prehab areas, test results, nutrition and wellness data. A copy is kept on Rugger's servers (Supabase) so that logging in on any device restores it, and a copy is kept on your device so the app works offline. Only you can read your saved copy, not your club, coaches or other players. It's deleted when you delete your account.

Browser storage and cookies: the web version uses your browser's storage only to keep you logged in and to hold your data on your device. We don't use advertising or analytics trackers or cookies. If that ever changes, we'll ask for your consent first.

8. How long we keep it

Old records are deleted automatically, once a day:

• Your account and training data: while your account is open. If nobody uses your account for 2 years, we email you 30 days before deleting it. Logging in keeps it.
• Deleted accounts: removed immediately from our servers (see Section 9), apart from the records below that we keep for a set time.
• Backups: we keep secure backup copies of our database for up to 4 weeks, then delete them, so a deleted account is gone from backups within 4 weeks.
• Squad summary shared with a coach (including training load, test results and your benchmark group): deleted as soon as you leave the squad or delete your account.
• Match minutes, subs and cards a coach logged for you: deleted when you leave that team, or with your account.
• Results a coach entered for you: your own copy stays with your data until you delete it (Profile → Other Test Results) or delete your account; the coach's copy is deleted when you leave that team, or when you delete the result.
• Record of when you agreed to share with a squad and when you left: kept as evidence of your consent while you're in a squad, then for 2 years after you leave (or until you delete your account).
• Requests to join a squad: deleted when answered or cancelled, or with your account.
• Reports: 2 years after they're reviewed; kept, without the link to your account, if you delete it.
• Club applications that Rugger turns down: 90 days after the decision.
• Club staff: removed when the club admin removes them or they delete their account. If a club admin deletes their account, the club, its teams and its players' squad sharing stay. A club's last admin must make another staff member an admin first.
• Staff invite codes that have been used, cancelled or have expired: 30 days.
• Clubs you add: kept as part of the club list once approved; ones we hide are deleted after a year. The link to your account is removed if you delete it.
• Feedback: 12 months; deleted with your account.
• Record of staff access (who opened or changed your data, and when; account ids, not copies of your data): 2 years, including after you delete your account, so there's still a record of who saw what.
• Subscription records: while your account is open; Stripe and Rugger keep payment and invoice records for 6 years where the law requires financial records to be kept.
• Which tester code you used: while your account is open.
• Phone notifications: a phone's push address is deleted when you turn notifications off on it, when its push service says it no longer works, or with your account. Your reminder choices are deleted with your account.
• Injury details from earlier app versions: deleted the next time your data is saved.
• Guardian-consent records: not used, because Rugger is for adults. If that changes, we'll set a period here first.

9. Your rights

Under UK GDPR you can: access your personal data; correct it; delete it; restrict or object to processing; and receive a copy in a portable format.

Deleting your account: in the app, go to Settings (the cog on Home) → Delete my account. If you have a subscription, it's cancelled with Stripe at the same time, so you aren't charged again. This permanently deletes your login and the records we hold on our servers, and clears your data from that device. If you used Rugger on another device, that device's copy is cleared the next time you open Rugger there, or when you clear its storage.

Getting a copy of your data: in the app, go to Settings → Download my data. You get one file with everything we hold about your account, including when club staff opened your data, which you can keep or take to another service. You can also ask us using the contact below.

10. Security

Our database tables are locked so they can only be read or changed by Rugger's own server, and every request that touches your data must come from your logged-in account. Logins are handled by Supabase, which stores passwords only in hashed form, with a bot check (Cloudflare Turnstile) and limits on repeated attempts. All connections use HTTPS. These protections are checked automatically: every table, database function, file store and server address is tested to make sure nobody can see or change what they shouldn't (security review, 7 Oct 2026). Rugger's staff and club admins must use two-step login (a code from an authenticator app as well as their password); players and coaches can turn it on in Settings. We keep a record of every time club staff open your data, contact you or answer your requests, and of every action Rugger staff take on our admin pages, so we can check that access was appropriate.

11. Contact and complaints

To exercise your rights or raise a concern, contact privacy@ruggerapp.com. You can also complain to the Information Commissioner's Office (ico.org.uk).

Reporting a safeguarding concern. Use Report on a player's profile in the app, or email Rugger's safeguarding contact, Dan Boer, at dan@ruggerapp.com. We acknowledge every report by the end of the next working day and review it within 3 working days. If anyone is in immediate danger, call 999 first.

12. Changes to this policy

We'll update this policy as the product changes, in particular when the age check goes live, and if under-18s are ever allowed.

Must be reviewed by a data protection professional and checked against the live app before publication. Placeholders and "Implementation status" notes mark where the policy would otherwise promise more than the app currently does.

Rugger Ltd · company number 17501512 · Terms · Privacy · Health Disclaimer