Dugout Privacy Policy
Last updated: 2 September 2026
This Privacy Policy explains how Pounce & Flow Ltd (“Dugout”, “we”, “us”, “our”), a company registered in England and Wales under company number 17324576 with its registered office at 128 City Road, London, EC1V 2NX, collects, uses, and protects personal data when you use the Dugout platform at dugoutapp.com (the “Service”).
We are committed to complying with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
If you have questions about this policy, contact us at privacy@dugoutapp.com.
1. Who this policy applies to
Dugout is used by amateur football clubs (“Clubs”) and their members. This policy covers personal data belonging to:
- Club Admins: people who set up and manage a Club's account on Dugout
- Coaches / non-playing staff: people with a Membership but no Player record
- Players: people registered to a Club's squad
- Anyone visiting dugoutapp.com
Dugout is intended for adult (18+) users in its current version. If we later extend the Service to youth teams, we will update this policy and put appropriate additional safeguards in place first.
2. Our role: controller and processor
This is important because it affects who you should contact about your data.
- Where a Club uses Dugout to manage its own members (for example, a Club Admin adding a Player's name, email, and match stats), the Club is the data controller and Dugout acts as a data processor, processing that data only on the Club's instructions and under our standard Data Processing Agreement (dugoutapp.com/dpa), which every Club agrees to when it accepts our Terms of Service. If you're a Player or coach and have questions about how your Club is using your data, you should contact your Club first.
- Where Dugout determines the purpose and means of processing, for example account and billing information for the Club Admin who signs up, platform usage data, and communications with us directly, Dugout is the data controller.
3. What data we collect
| Category | Examples | Collected from |
|---|---|---|
| Account data | Name, email address, login credentials (one-time login codes, not stored passwords) | Club Admins, Members at sign-up or invite/join |
| Membership data | Role (admin/coach/player), Club affiliation, invite or join-link status | Club Admins |
| Player & match data | Squad selections, formations, goals, assists, clean sheets, Man of the Match/Dick of the Day, availability responses | Club Admins, Coaches, Players |
| Billing data | Club subscription tier, billing contact, transaction history (card details are handled entirely by Stripe, we never see or store full card numbers) | Club Admins, via Stripe |
| Technical data | IP address, device/browser type, log data | Automatically, via your use of the Service |
| Communications | Support emails, correspondence with us | Directly from you |
We do not knowingly collect special category data (for example, health or medical information) as part of normal use. Please don't include this in free-text fields.
4. Cookies and analytics
We use strictly necessary cookies required for login sessions and core functionality.
We also use PostHog to understand how the Service is used, for example, which features are used most, and to help us fix bugs and improve the product. This may involve collecting data such as pages viewed, actions taken within the Service, device/browser information, and approximate location (derived from IP address). We do not use this data for advertising, and we do not sell it.
Where analytics relies on non-essential cookies or similar technologies, we ask for your consent via a cookie banner where required by law, and you can withdraw that consent at any time (see Section 8). Where analytics is based on our legitimate interest in understanding aggregated product usage, you can still object as set out in Section 8.
5. How and why we use data
| Purpose | Lawful basis |
|---|---|
| Providing the Service (accounts, squad management, stats, fixtures) | Performance of a contract with the Club / Necessary for our processor role |
| Processing subscription payments | Performance of a contract |
| Sending transactional emails (invites, join-link approvals, availability requests, login codes) | Performance of a contract / Legitimate interests |
| Maintaining security and preventing abuse | Legitimate interests |
| Responding to support requests | Legitimate interests / Performance of a contract |
| Improving the Service via product analytics (PostHog) | Consent (non-essential cookies) / Legitimate interests (aggregated, non-identifying insights) |
| Complying with legal obligations | Legal obligation |
We do not sell personal data, and we do not use Player or Member data for advertising.
6. Who we share data with
We share data with sub-processors who help us run the Service, under contracts that require them to protect your data:
- Hosting & infrastructure: Vercel (application hosting), [Neon / Supabase] (database hosting)
- Payments: Stripe (subscription billing; PCI-DSS compliant. Dugout never handles raw card data)
- Transactional email: [Resend / Postmark]
- Product analytics: PostHog (usage analytics to help us improve the Service)
Some of these providers may process data outside the UK/EEA (for example, in the United States). Where this happens, we rely on appropriate safeguards such as the UK International Data Transfer Addendum or Standard Contractual Clauses, and only use providers with adequate data protection commitments.
We do not share personal data with third parties for their own marketing purposes.
7. Data retention
- Account and Membership data is retained for as long as your Club's subscription is active, plus a reasonable period afterwards to allow account recovery and to meet legal/accounting obligations.
- Match and stats data is retained as part of the Club's historical records for as long as the Club maintains its account, since this is core to the Service's purpose (season-on-season stats and leaderboards).
- If a Club's account is closed, we will delete or anonymise personal data within 60 days, except where we're required to keep it longer by law (for example, billing records).
- You can ask your Club Admin, or us directly, to delete your individual account data at any time, subject to the Club's legitimate need to keep historical match records.
8. Your rights
Under UK GDPR, you have the right to:
- Access the personal data we (or your Club, as controller) hold about you
- Rectify inaccurate data
- Erase your data in certain circumstances
- Restrict or object to certain processing
- Port your data to another service
- Withdraw consent at any time, where processing is based on consent
If your data is held by your Club (as controller), we'll help facilitate your request but you should contact your Club directly in the first instance. If Dugout is the controller (for example, billing data), contact us at privacy@dugoutapp.com.
You also have the right to lodge a complaint with the UK Information Commissioner's Office (ICO) at ico.org.uk.
9. Security
We use industry-standard measures to protect your data, including encrypted connections (HTTPS), one-time login codes rather than stored passwords, and access controls limiting who can see Club data. No system is 100% secure, but we take reasonable steps appropriate to the sensitivity of the data involved.
10. Children
Dugout's current version is designed for adult players and staff (18+). We do not knowingly collect data from anyone under 18. If you believe a child's data has been provided to us, contact privacy@dugoutapp.com and we'll remove it.
11. Changes to this policy
We may update this policy from time to time, for example as we add features like analytics. We'll post the updated version here with a new “Last updated” date, and notify Club Admins of material changes by email.
12. Contact us
Pounce & Flow Ltd
128 City Road, London, EC1V 2NX
privacy@dugoutapp.com
This document is a starting draft based on Dugout's current product scope. It should be reviewed by a qualified solicitor before publication or before any real Club data is processed on the platform, particularly to confirm the controller/processor split, sub-processor list, and international transfer mechanisms once hosting/email providers are finalised.