Privacy Policy
Last updated: October 20, 2026
1. Who We Are
RuckMob LLC, a Florida limited liability company ("RuckMob," "we," "us," "our"), operates the website www.ruckmob.com, a rugby statistics, scouting, and analysis platform. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website or create an account.
For privacy-related inquiries, contact us at info@ruckmob.com, or by post at RuckMob LLC, 2150 N Miami Ave, Miami, FL 33137.
2. Information We Collect
2.1 Account Information
When you create an account, we collect your email address (required), name (optional), and password. Your password is cryptographically hashed using bcrypt and is never stored or accessible in plain text. If you choose Continue with Google instead, Google shares your name, email address and profile picture link with us and we hold no password.
At sign-up we also ask for your date of birth (or, on the coach sign-up, confirmation that you are 18 or older) to apply the minimum age for your region. We check it and then discard it: we keep only a record that you passed the age check. If you are under 16 outside the EU and UK, you must confirm you have a parent's permission; that confirmation is checked and not stored. We also record which version of our Terms you accepted, whether you opted in to marketing emails (and when), how you signed up (email or Google), and, if you choose one, your primary role (e.g. player, coach, fan).
2.2 User-Generated Content
If you use scouting notes, we store the content you write, sharing preferences, and the identity of users you share notes with. Notes are private by default and only visible to you unless you explicitly share them. Shortlists you build are stored against your account and visible only to you.
If you use the coach portal, we store your access request (the team, your role and title, and any link you give as evidence), the match data you submit (line-ups, scores and scorers), photos of paper match sheets you upload, the email addresses you enter to invite staff or to invite a player to claim their profile, and endorsements you write about players. Match data is published on the public site; an endorsement becomes public once the player approves it.
2.3 Automatically Collected Information
- IP address — used for rate limiting and abuse prevention, held in server memory only and discarded after 5 minutes. At sign-up, our hosting provider derives your country from it so we can apply the right minimum age; the country is not stored. If someone who is not an administrator tries to open an admin page, the attempt is written to our hosting provider's short-lived server logs with the IP address, account ID (if signed in) and browser type, so we can investigate it. We do not store IP addresses in our database.
- Profile view data — when you view a player profile, we record the visit to calculate trending players. Authenticated views are deduplicated (one count per user per player per 24-hour period). Anonymous views are periodically archived and aggregated.
- Google Analytics — we use Google Analytics 4 with Google Consent Mode. Before you consent, it transmits only cookieless, anonymised measurement pings (no Client ID and no cookies). If you accept analytics cookies, it sets first-party cookies to measure usage. We do not enable Google Analytics advertising or remarketing signals (ad storage, ad user data, and ad personalization remain denied at all times).
- PostHog — product analytics to understand how features are used; autocapture is disabled. Before you consent it runs in cookieless mode: it records page views and feature usage but writes nothing to your device — no cookies, no local storage — and identity is a salted hash computed on PostHog's servers that is rotated daily, so visits cannot be linked across days or sites. If you accept analytics cookies, it sets first-party cookies, links usage to your account when you are signed in, and may record anonymised session replays of your visit to help us diagnose usability problems; all form inputs are masked, so anything you type — email, password, date of birth — is never captured. Session replay and account-level analytics never run before consent. We also use PostHog's data warehouse to analyse non-personal public sports data from our database (player, team, match, and statistics records). This ingest excludes all personal data — no account, contact, profile-claim, or date-of-birth information is included.
2.4 Profile Claims and Favorites
If you mark a player, team, or competition as a favorite, we store the association between your account and the entity you favorited. If you submit a claim on a player profile, we store the claim record (which player, claim status, how it was verified, admin review notes if any) and any details you give to support it — date of birth, current club, hometown, nationality and a message. We also store your personal preferences (e.g. which gender content to default to) so the site remembers your choices across visits.
2.5 Information We Do Not Collect
We do not collect payment or financial information, precise geolocation, social media account data (beyond what Google shares if you sign in with it, described above), biometric data, or any data classified as "sensitive" or "special category" under applicable data protection laws. We do not run third-party advertising and we do not sell, rent, or trade your personal data to anyone.
3. Legal Basis for Processing
Where applicable (including under the EU General Data Protection Regulation, UK GDPR, and similar laws), we process your data on the following legal bases:
| Data | Legal Basis |
|---|---|
| Account data (email, name, password or Google sign-in, sign-up records) | Performance of contract (providing the service) |
| Scouting notes | Performance of contract (core feature) |
| Session cookie | Strictly necessary (authentication) |
| Viewer tracking cookie | Legitimate interest (analytics deduplication) |
| IP address (rate limiting) | Legitimate interest (security and abuse prevention) |
| Profile view tracking | Legitimate interest (trending player features) |
| Cookieless audience measurement (Google Analytics, PostHog) | Legitimate interest (aggregate usage measurement; no device storage, no identification) |
| Analytics cookies, session replay and account-level analytics (Google Analytics, PostHog) | Consent (set only after you accept the cookie banner) |
| Password reset emails | Consent (user-initiated request) |
| Coach portal emails (access decisions, match-sheet reviews, staff and permission changes, and a weekly reminder about played matches missing your team's data, which you can switch off in the portal), decisions on profile claims, profile edits, photos and S&C results you submit, and contact-form replies | Contract (sent only about requests and submissions you make) |
| A coach-staff invite emailed to an address a team's head coach enters | Legitimate interest (letting a team's verified head coach add their staff; one email is sent, and the invite keeps the address, team and role) |
| A profile-claim invite emailed to an address a team's coach enters for one of their players | Legitimate interest (letting a player's coach help them claim their own profile; one email is sent, and the invite keeps the address, player and team) |
| One email after you create an account, if the name on it matches a player profile nobody has claimed | Legitimate interest (helping you find and claim your own profile; sent at most once, and a claim is still reviewed before it is linked) |
| Newsletter and product-update emails | Consent (optional opt-in at signup; withdraw any time) |
4. Cookies and Tracking Technologies
We use a minimal set of first-party cookies. With your consent we also set analytics cookies (PostHog and Google Analytics). We do not use advertising cookies, tracking pixels, or third-party advertising trackers.
| Cookie | Type | Purpose | Duration |
|---|---|---|---|
| sb-*-auth-token (may be split into numbered parts; a short-lived *-code-verifier is added during Google sign-in) | Essential | Keeps you signed in (Supabase Auth) | Until you sign out; the session it holds ends after 7 days of inactivity or 30 days after sign-in |
| rp_viewer_session | Functional | Deduplicates profile view counts | 90 days |
| ruckmob_prefs | Functional | Remembers your homepage display preferences when signed out | 1 year |
| ruckmob_cookie_consent | Essential | Stores your cookie consent preference | 1 year |
| _ga, _ga_* | Analytics (consent) | Google Analytics — usage measurement; set only after you accept | 2 years |
| ph_* | Analytics (consent) | PostHog — product analytics; set only after you accept | 1 year |
The session cookie and consent cookie are strictly necessary and do not require consent. The viewer tracking cookie is only set after you accept cookies via our consent banner — if you decline, a temporary anonymous identifier is used instead and no persistent cookie is stored. Analytics cookies (Google Analytics, PostHog) are set only after you accept via the consent banner. Before acceptance both run cookieless with no device storage: Google Analytics via Consent Mode, PostHog via server-side hashed identity that is rotated daily. If you decline, any analytics cookies and local storage set during an earlier acceptance are cleared. You can change your choice at any time from the Cookie preferences link in the site footer, and delete cookies through your browser settings. Disabling cookies may affect your ability to use certain features.
The site also keeps a few settings in your browser's own storage. They stay on your device and are never sent to us:
| Key | Purpose | Duration |
|---|---|---|
| ruckmob_cookie_consent | Your cookie choice (also kept in the cookie of the same name) | Until you change it or clear site data |
| rp_recent_searches | Your recent searches in the header search box | Until you clear site data |
| rugbyProspects_pickerGender | Whether lists show men's or women's rugby | Until you clear site data |
| matchTimeDisplay | Whether kick-off times show in your time zone or the venue's | Until you clear site data |
| rugby-prospects-lineups | Line-ups you save in the line-up builder | Until you delete them or clear site data |
| rp_view:* | Stops one visit counting twice towards a player's profile views | Until you close the tab |
5. How We Use Your Information
- To create and maintain your account
- To authenticate you and maintain your session
- To provide platform features (scouting notes, player comparisons, profile views)
- To calculate trending players and aggregate statistics
- To prevent abuse via rate limiting
- To send password reset emails when you request them
- If you use the coach portal, to email you when your access request or a match sheet you submitted is reviewed, when your staff access or permissions change, and (unless you switch it off) once a week when a played match is still missing your team's data
- To email you when a profile claim, profile edit, photo or S&C result you submitted is approved or rejected
- To email a staff invite to an address a team's head coach enters, so they can join that team on the coach portal
- To email a player an invite to claim their profile, at an address their coach enters
- Once, after you create an account, to email you if the name on it matches a player profile that nobody has claimed yet
- To send occasional news and product-update emails — only if you opted in at signup. You can withdraw this consent at any time from the Email preferences toggle in your dashboard's Account tab (every email will also include an unsubscribe link).
- To improve platform performance and fix bugs
- To comply with legal obligations
Beyond the optional opt-in emails above, we do not use your data for marketing, advertising, profiling, automated decision-making, or any purpose other than providing and improving the service. We never sell your data or share it with third parties for their marketing.
6. Third-Party Services
We use the following third-party services to operate the platform. These providers process data on our behalf under their respective privacy policies and applicable data processing agreements:
| Provider | Purpose | Location | Transfer safeguard |
|---|---|---|---|
| Supabase | Database hosting, authentication, password reset emails | United States | SCCs + UK Addendum |
| Vercel | Website hosting, serverless functions, server logs | United States | SCCs + UK IDTA |
| Cloudflare | Image hosting and delivery (player photos, team logos) | United States | DPF, SCCs fallback |
| PostHog | Product analytics (cookieless before consent; cookies, session replay and account linkage only after consent); data-warehouse analysis of non-personal public sports data | United States | DPF, SCCs fallback |
| Resend | Sending account emails (coach portal notifications, profile-claim decisions, contact-form messages) | United States | DPF, SCCs + UK Addendum fallback |
| Google Analytics | Usage measurement (Google Consent Mode; cookieless before consent) | United States | DPF |
DPF = EU-US Data Privacy Framework (including the UK Extension and the Swiss-US Data Privacy Framework). SCCs = Standard Contractual Clauses adopted by the European Commission in Decision 2021/914. See section 7 for how these apply.
We do not share your personal information with any other third parties. We may disclose information if required by law, legal process, or governmental request.
Business transfers: if RuckMob is involved in a merger, acquisition, or sale of assets, your personal data may be transferred to the acquiring entity as part of that transaction. We will notify you by email and a prominent notice on the platform before your data becomes subject to a different privacy policy.
7. International Data Transfers
All data is stored and processed in the United States through the service providers listed in the table above. If you access the platform from outside the United States — including from the European Economic Area, United Kingdom, Switzerland, Canada, Australia, or New Zealand — your personal data is transferred to and processed in the United States.
We have a data processing agreement in place with each of these providers. Transfers of personal data out of the EEA, the United Kingdom, and Switzerland are made under the safeguard shown for that provider in the table above: either the provider's active certification under the EU-US Data Privacy Framework (including the UK Extension and the Swiss-US Data Privacy Framework), or the Standard Contractual Clauses adopted by the European Commission in Decision 2021/914 and incorporated into that agreement. Where a provider relies on the Data Privacy Framework, the Standard Contractual Clauses apply as a fallback if that certification lapses or is invalidated.
We do not rely on your consent, or on any other derogation under Article 49 GDPR, as the basis for these transfers. You may request a copy of the safeguards that apply to a specific transfer by contacting us at the address in the Contact section.
8. News Content and Third-Party Data
Our news feed aggregates publicly available RSS feeds from rugby news sources (e.g., BBC Sport, RugbyPass, Rugby World). We store article metadata (title, description, link, image URL, publication date) to display headlines. We do not reproduce full article content — clicking a headline takes you to the original source, which is governed by that publisher's own terms and privacy policy.
Player statistics and match data are compiled from publicly available sources, including official league, federation and club publications, public sports statistics websites, public reference sites, and team line-ups that clubs post publicly on social media. Coaches using the coach portal also submit match data for their teams. Articles are automatically removed after 90 days.
9. Data Retention
| Data Type | Retention Period |
|---|---|
| Account data | Until you delete your account from your dashboard |
| Scouting notes | Until you delete them or your account |
| Favorites (players, teams, competitions) | Until you remove them or delete your account |
| Profile preferences | Until you change them or delete your account |
| Profile claims (approved) | Retained for audit purposes; anonymised if you delete your account |
| Profile claims (rejected) | Deleted with your account or 90 days after rejection, whichever first |
| Profile view records | Archived and aggregated periodically |
| News articles | Automatically deleted after 90 days |
| Shortlists | Until you delete them or your account |
| Sign-in sessions | Until you sign out, after 7 days of inactivity, or 30 days after sign-in, whichever comes first |
| Viewer tracking cookies | 90 days |
| Rate limiting data (IP) | 5 minutes (in-memory only) |
10. Data Security
We implement industry-standard security measures to protect your data, including:
- HTTPS encryption on all connections with HSTS enforcement
- Bcrypt password hashing
- JWT-based authentication with sessions that expire after 7 days of inactivity and 30 days at most
- Content Security Policy (CSP) headers
- Rate limiting on all endpoints, including enhanced protection on authentication routes
- Parameterized database queries to prevent injection attacks
No system is 100% secure. While we take reasonable measures to protect your information, we cannot guarantee absolute security. If you discover a security vulnerability, please contact us immediately at info@ruckmob.com.
11. Your Rights
Depending on your location, you may have some or all of the following rights regarding your personal data. These rights apply under the GDPR (EU), UK GDPR, PIPEDA (Canada), the Australian Privacy Act, the New Zealand Privacy Act, and other applicable laws:
- Right of Access — request a copy of the personal data we hold about you
- Right to Rectification — request correction of inaccurate or incomplete data
- Right to Erasure — request deletion of your account and associated personal data
- Right to Data Portability — request an export of your data in a machine-readable format (JSON or CSV)
- Right to Restrict Processing — request that we limit how your data is used
- Right to Object — object to processing based on legitimate interest
- Right to Withdraw Consent — withdraw consent at any time where processing is based on consent
- Right to Complain — lodge a complaint with your local data protection authority
Account deletion and data export are available self-service from your dashboard's Account tab. For all other rights — or if you don't have an account but want us to remove data — contact us at info@ruckmob.com. We respond within 30 days and may ask you to verify your identity before processing your request.
12. Children's Privacy
RuckMob is not directed at children under the age of 13. We do not knowingly collect personal information from children under 13. If we become aware that we have collected personal data from a child under 13 without verified parental consent, we will take steps to delete that information promptly.
Users between the ages of 13 and 18 should use the platform only with the involvement and consent of a parent or legal guardian. If you believe a child under 13 has provided us with personal data, please contact us at info@ruckmob.com.
13. Do Not Track Signals
We do not track users across third-party websites and therefore do not respond to Do Not Track (DNT) browser signals. Unless you accept analytics cookies, our analytics are cookieless and cannot identify you (see section 4), and we never build individual user profiles for advertising purposes.
14. Changes to This Policy
We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated "Last updated" date. For material changes that affect how we process your personal data, we will make reasonable efforts to notify you (e.g., via a notice on the platform). Continued use of the platform after changes constitutes acceptance of the revised policy.
15. Contact Us
If you have any questions about this Privacy Policy, our data practices, or wish to exercise your data rights, contact us at:
Email: info@ruckmob.com