Privacy Policy

Updated October 12, 2026 · Questions? privacy@armlog.ca

This privacy policy describes how ArmLog (the “App”) collects, uses, and shares information. Mathieu Rancourt (“we”, “us”) publishes and operates the App. We provide it to youth baseball and softball leagues (each, a “League”) and their volunteer coaches and administrators, for the purpose of tracking pitch counts and mandatory-rest eligibility for youth players.

Each League controls its own records. We operate the App’s infrastructure. A League’s administrators decide who may use the App for that League and which player and team records the League keeps in it. In data-protection terms, each League is the controller of its players’ records and we act as a processor on that League’s behalf. Privacy questions about the App generally can be directed to the contact above. Questions about a specific player’s record are best directed to an administrator of the League that maintains it, but you may also contact us and we will work with that League to address them.

Who uses the App

The App is intended for adult coaches and league administrators (age 18+). The App is not designed for use by children, and minors do not create accounts or sign in. Coaches enter information about youth players for the purpose of league record-keeping and pitch-eligibility tracking.

Information we collect

Information you provide when you create an account

Name
Email address
Password. Firebase Authentication stores only a hash of it. We never see or store the password in plain text.

Information coaches and administrators enter about players

Player name
Jersey number
Team and division
Pitch counts and the dates of pitching outings, and the time each entry was recorded

Approved coaches and admins enter this information for the purpose of tracking pitch counts and mandatory rest periods. Within a League, player records are visible to that League’s approved coaches and admins, so that a player’s pitch counts can be aggregated correctly across every team they play for.

If a League chooses to subscribe, its administrator provides billing details directly to Stripe, our payment processor. See “Payments” below.

Information collected automatically

Firebase Authentication assigns each account a unique identifier (UID), used internally to associate your account with the records you create.
Firebase Authentication may collect IP address and basic device metadata (for example, timestamps of sign-in attempts) for security purposes such as rate-limiting and abuse detection. We do not use this data for any other purpose.

The App does not use third-party analytics, advertising SDKs, or tracking technologies. We do not track you across other apps or websites. We do not sell or share your personal information with third parties for marketing purposes.

Our website (armlog.ca) and Google Analytics. Our marketing website, not the App, uses Google Analytics in Google’s “consent mode”. Until you click “OK” in the cookie notice, Google Analytics sets no cookies. It still receives limited information about each visit without cookies: the page you view, the buttons you click, your browser and device type, and your approximate location. If you click “OK”, Google Analytics also sets cookies so that it can recognize repeat visits. Google processes this information for us, and it may be stored outside Canada. We use it only to understand which parts of the website help leagues. To stop Google Analytics completely, click “No thanks” in the cookie notice, or click “Cookie choices” at the bottom of the website and then “No thanks”. This deletes the analytics cookies.

How we use the information

To authenticate coaches and administrators.
To maintain accurate league pitch records and to calculate mandatory rest periods between pitching outings.
To allow league administrators to approve accounts and manage their League’s data.
To administer a League’s subscription.
To respond to support requests.

Where the information is stored, and how Leagues are kept separate

Account credentials are stored in Firebase Authentication (Google LLC). Player, team, pitch-event, and profile records are stored in Google Cloud Firestore, in Google’s northamerica-northeast1 (Montréal, Canada) region. Firebase Authentication is operated globally by Google and may store credential and sign-in metadata on servers in the United States. Google’s privacy practices are described at https://firebase.google.com/support/privacy.

Some of our service providers (Google for sign-in and website analytics, and Stripe for payments) may store or process information outside Canada, including in the United States. Information held in another country is subject to that country’s laws, and courts, law enforcement and national security authorities there may be able to access it under those laws.

Each League’s records live in a separate database. We do not store multiple Leagues’ players in shared tables distinguished by a label. Every League gets its own physically separate Firestore database, and the security rules for each one name that League specifically. This means one League’s coaches cannot reach another League’s player records even in the event of a rule error, rather than relying on every query remembering to filter correctly.

All Leagues use one shared sign-in system. One account belongs to exactly one League at a time. The League data that each account can reach stays separate, as described above.

Payments

Stripe, Inc. processes subscriptions. When a League administrator subscribes, they enter their payment details directly with Stripe. We never receive or store card numbers. We store only a Stripe customer and subscription identifier and the resulting subscription status for the League.

Stripe receives the billing details the administrator gives it — name, email, and payment method — and the League identifier the subscription is attached to. Stripe does not receive any player data. Stripe’s privacy policy is at https://stripe.com/privacy.

We do not sell or rent your personal information.

We share your information only as follows:

Within your League. Player records, team rosters, and pitch event history are visible to that League’s approved coaches and admins so that pitch counts can be aggregated across teams. Coach names and the identity of who logged a pitch event may be visible to other coaches and admins in that League. We share nothing between Leagues.
With our service providers. Google (Firebase) hosts the App’s authentication and database infrastructure. Stripe processes subscriptions. We also use a small number of standard technical tools to operate, support, and troubleshoot the App, which can involve access to League records while diagnosing a problem. Each provider acts on our behalf, under contract, and receives only what is needed for that purpose.
As required by law. We may disclose information if required to do so by law or valid legal process.

Your choices and rights

Update your account. You can change your name and email from inside the App.
Delete your account. You can permanently delete your account from inside the App, from the account menu. This deletes your name, email, and login credentials. Pitch events you previously logged remain in your League’s record because they are part of that League’s pitch-count history, but they no longer contain your name or email — only an internal identifier that is no longer linked to a person.
- If you are the only administrator of a League that is still in use, the App will ask you to promote another member to administrator first, or to delete the League entirely. This is to avoid leaving a League with nobody able to manage it.
Delete your League. A League administrator can permanently delete their entire League from inside the App. This deletes that League’s database — every player, team, and pitch record in it — and cancels any active subscription. Other members of that League keep their sign-in accounts and can join a different League.
Reset your password. You can request a password reset email from the sign-in screen.
Request data access or deletion by email. If you cannot use the in-app controls, email us at privacy@armlog.ca and we will respond within 30 days. For requests concerning player records (which are maintained by a League), we may need to coordinate with that League’s administrator before deleting or changing the record.

Depending on where you live, you may have additional rights under laws such as PIPEDA (Canada), Québec’s Law 25, the GDPR (EU/UK), or the CCPA/CPRA (California), including the right to access, correct, or delete personal information we hold about you, to withdraw your consent, and to lodge a complaint with a supervisory authority (in Canada, the Office of the Privacy Commissioner of Canada). You can exercise these rights by contacting us at the email above.

Children’s privacy

The App is not directed to children under 13, and children do not create accounts in the App. Adult coaches and admins enter player records (which may relate to minors) solely for a League’s record-keeping needs — pitch counts and mandatory rest periods. Each League directs which player records it maintains.

If you are a parent or guardian of a player and you would like your child’s information deleted from the App, please contact an administrator of your League. You may also email us at privacy@armlog.ca and we will coordinate with the League to delete the record.

For League administrators: telling families. Your League decides which player records to keep in ArmLog, so your League is responsible for telling families and getting their consent, usually at registration. You can add a sentence like this to your registration form: “Our league tracks each player’s pitch counts and rest days in ArmLog, so that every coach sees the same totals. ArmLog stores the player’s name, jersey number, team and pitch counts. Details are at armlog.ca/privacy.”

Data retention

We keep a League’s data while the League uses ArmLog, and for up to 24 months after it stops. We do not delete a League’s records just because a subscription ends or a season is over.

This is deliberate. Subscriptions are annual and the sport is seasonal, so a League that lapses in the autumn and returns in the spring is an ordinary case — automatically deleting its roster in between would destroy records its administrators expect to find waiting for them.

A League counts as inactive when, for 24 months in a row, it has no active subscription, no pitch outings logged and no administrator sign-in. Before we delete an inactive League, we email its administrators at least 30 days in advance. If an administrator asks us to keep it, we keep it. Otherwise we delete the League’s database and every player, team and pitch record in it.

The corresponding obligation is that deletion must actually work when someone asks for it. There are three ways to ask, and all three are real:

Delete your own account, from inside the App.
Delete your whole League, from inside the App, as an administrator. This deletes that League’s database in its entirety.
Email us at privacy@armlog.ca. We will delete what you ask us to delete and confirm when it is done, within 30 days.

We keep account information until the account is deleted. Backups, if any, are overwritten on a rolling basis, so deleted data may persist in a backup for a short period after deletion before being overwritten.

Security

We use Firebase Authentication and Firestore security rules to restrict access to each League’s data to that League’s approved coaches and administrators, and we give each League its own separate database as described above. Connections between the App and our servers are encrypted in transit using TLS. No internet service can be guaranteed 100% secure, but we work to protect your information using industry-standard practices.

Changes to this policy

We may update this policy from time to time. When we do, we update the “Updated” date above. Before a material change takes effect, we also email the administrators of every League, so that they can review it and tell their members.

Contact

ArmLog’s privacy officer is accountable for ArmLog’s compliance with this policy and with applicable privacy law. Questions, requests and complaints can be sent to the privacy officer at privacy@armlog.ca.