Privacy

What this covers

This page says what Relay records about the people who use it, why, and what happens to it afterwards. It covers the Relay website and everything behind a sign-in.

Relay is used by coaches and by their athletes, and most athletes are school age. That single fact shapes every choice below: the service asks for the least it can, keeps an athlete out of view of everybody except the coaches of their own teams, and carries no advertising of any kind.

What a coach gives

An email address, a password and the name of a team. A display name is taken from the email address and can be changed afterwards. The time zone of the browser used at sign-up is read once, so that a session scheduled for Tuesday is Tuesday where the team trains.

If a coach subscribes, Stripe collects the payment details. Relay keeps only what Stripe hands back: a customer reference, a subscription reference, which plan it is, and when the period ends. No card number reaches Relay.

What an athlete gives

A name, a password and a join code. That is the whole of it. Relay does not ask an athlete for an email address: it generates an internal one that is never displayed and never receives mail, and a username to sign in with.

An athlete may add a real email address later, from the Profile screen. It does nothing until a code sent to it is typed back into Relay, and once verified it is used for password recovery and reminders and for nothing else. It can be removed again.

Everything else on an athlete record is what they or their coach put there: which teams they are on, what has been scheduled for them, what they logged and any note they attached to it, and whether they said they are going to a meet.

What the service records by itself

A log of the coach actions that change a team — removing or restoring an athlete, replacing a join code, inviting or removing an assistant, archiving a team — so that it is always possible to say who did what.

A one-way hash of the network address behind a sign-up, a failed sign-in or a join-code attempt, salted with a secret and with the current date, used to slow down guessing. The address itself is never written down, the hash cannot be turned back into one, and today's hash of an address has no relationship to yesterday's.

If notifications are switched on, the delivery address the browser issues for push messages and the keys those messages are encrypted with.

There is no analytics service, no advertising network, no session recorder and no tracking pixel anywhere in Relay. The browser talks to no server other than Relay's own.

What it is used for

To run the service: to show a coach their team, to show an athlete what is scheduled for them, and to record what they did.

To send the notifications an account has asked for, and no others.

To keep the service working and safe: rate limits, diagnosing failures, and stopping abuse.

To take payment from coaches who subscribe, and to tell a coach about their own trial and subscription.

Nothing is used for advertising. Nothing is sold. Nothing is handed to a data broker.

Cookies

Two, and both are necessary for the service to work. One holds the sign-in session; no script can read it, and it is discarded when you sign out. One remembers which team a coach was last looking at, so that opening Relay lands on the right screen.

There are no advertising cookies, no analytics cookies and no third-party cookies at all. That is why Relay asks you nothing about cookies.

Who else handles it

A small number of companies process data on Relay's behalf, under contract, and none of them may use it for their own purposes.

One runs the database and the sign-in system. One runs the website. Stripe takes payment from coaches who subscribe. An email provider delivers password resets, a coach's billing notices, and reminders to athletes who have verified an address. For push notifications, the messaging service belonging to whichever browser is being used receives an encrypted message and the address to deliver it to, and cannot read what is inside it.

These companies may handle data in a country other than yours; where that happens it is under the safeguards their contracts require. Nothing is shared with anybody else, except where the law requires it.

Athletes under 18

An athlete account exists because a coach asked for it: Relay is brought to a team by the person coaching it. Nobody under 13 may hold an account.

An athlete's name and username are visible to the coaches of the teams they are on. They are not visible to other athletes, and they are published nowhere.

A parent or guardian who wants to know what Relay holds about their athlete, or wants it deleted, can ask the athlete's coach or write to the address below. Either way it will be acted on.

How long it is kept

For as long as the account exists. When a trial or a subscription ends nothing is deleted; the account becomes read-only.

Deleting an account removes the person: their name, their username, their sign-in details, any address they added and any device registered for notifications. What the team planned and what was logged stays with the team, with no name attached, so one person leaving does not damage everybody else's season.

Delivered notifications and the records behind rate limiting are cleared on a schedule rather than kept indefinitely.

Your choices

Notifications can be switched off from the Profile screen, and an athlete can remove an address they added.

An account can be deleted from the Profile screen, by the person it belongs to.

A copy of what Relay holds about you, or a correction to it, can be asked for at the address below.

How it is protected

Every request is checked inside the database itself, against rules that decide which rows a signed-in person may read or write. The website does not decide that, so a fault in the website cannot hand somebody another team's data.

The sign-in session is carried in a cookie that no script can read. An invitation that grants coaching rights is stored only as a hash of itself. Join codes are rate limited by address and by code, and stop working the moment a coach replaces them.

No security is perfect. If something goes wrong that affects you, you will be told.

Changes to this policy

This policy will change from time to time, and the date at the top of the page says when it last did. A change to what is collected, or to who processes it, is announced in the app before it takes effect.

Contact

Write to legal@relay.invalid.