Privacy Policy

Last updated: 1 September 2026

1. Who we are

Rugby Ref Coach ("we", "us", "our") is operated by Thornton & Co Holdings in Australia. This policy covers the web application at app.rugbyrefcoach.com and the website at www.rugbyrefcoach.com, together the Service.

It explains what we collect, why, who else sees it, and what you can ask us to do about it.

If anything here is unclear, or you want something removed, email support@rugbyrefcoach.com and a person will answer.

2. What we collect

• Account information - Your email address, and a password managed by AWS Cognito. We never see or store your password.
• Match and coaching data - Everything you enter: events, penalties, laws, phases, field positions, scores, coaching moments, notes and dictated text, plus the match name, date, teams, grade and referee.
• Information about other people - If you name a referee, record a player by number and note, or add referees to an association roster, that is information about someone else. Only enter what you would be comfortable showing them.
• Association data - Association names, membership, roles, join codes, and the reports members submit to the association.
• Activity records - Your last sign-in and last-seen time, and an audit feed of actions taken in the app such as matches created, shared or deleted. The audit feed is automatically deleted after 90 days.
• Usage and analytics data - Browser and device type, approximate location, pages and screens viewed, and in-app actions. See the analytics section below.

3. The AI coaching review

When you choose to generate a coaching review, the match data needed to write it is sent to Anthropic's API and processed by a Claude model. This includes your event log, laws, outcomes, scores and any notes or coaching moments you have written, which may contain names of referees, players or teams.

It is not automatic. Nothing is sent to Anthropic unless you press the button to generate a review for a specific match.

• Anthropic does not train models on it - Data submitted through the Anthropic API is not used to train their models.
• The review is a draft, not a judgement - It is generated from what you logged, it can be wrong, and it is fully editable. Do not treat it as an assessment of a person.
• You can avoid it entirely - If you never generate a review, no match data is sent to Anthropic. You can also clear a review once generated.

Anthropic's own privacy policy is at anthropic.com/legal/privacy.

4. Analytics and cookies

We use Google Analytics 4 to understand which parts of the app are used, so we know what to improve. This sets cookies and sends Google information about your device, approximate location and the screens and actions you use in the app.

We do not send your email address, match content, notes or the names of any people to Google Analytics. We do not use advertising cookies, retargeting or tracking pixels, and we do not sell data to anyone.

You can block it with any browser setting or extension that blocks Google Analytics, or Google's own opt-out add-on. The app works normally with analytics blocked.

Separately, the app stores your sign-in token and your matches in your browser's local storage. That is what makes it work offline, and it stays on your device.

5. Voice dictation

Where you use the microphone to dictate a note, speech recognition is performed by your browser or operating system, not by us. In some browsers, notably Chrome, that means the audio is sent to the browser vendor for transcription under their privacy terms. We receive only the resulting text, which is stored with your match like any other note.

6. Who else your data reaches

We do not sell, rent or trade your personal information. It reaches others only in these ways:

• When you share a report - A share link can be opened by anyone who has it. Sharing by email gives that person read or edit access. You can revoke either at any time, which stops access immediately.
• Associations you join - Administrators of an association can see the matches you submit to it, and your name and email as a member. Ordinary members cannot see other members' email addresses.
• Our service providers - Amazon Web Services hosts the app, database, authentication and email. Anthropic processes the AI coaching review when you request one. Google provides analytics. Each processes data on our behalf or under their own published terms.
• If the law requires it - We may disclose information where required by law, regulation or legal process.

7. Where your data is stored

Data is stored on Amazon Web Services in the Asia Pacific (Sydney) region, ap-southeast-2. If you are outside Australia, that means your information is transferred to and stored in Australia.

The AI coaching review is processed by Anthropic, which may process it outside Australia. Analytics data is processed by Google, which operates globally.

• In transit - Everything is encrypted over HTTPS/TLS.
• Authentication - Handled by AWS Cognito. We never handle your password.
• Isolation - Match data is separated per account and access is enforced on the server, not just hidden in the app.
• Storage - Our storage buckets are not publicly accessible.

No system is perfectly secure, and we cannot guarantee absolute security, but we do not treat that as an excuse.

8. Keeping and deleting data

We keep your account and match data while your account is active.

• Deleting a match - Moves it to a deleted state where it can be restored. It is removed from your lists immediately.
• Deleting your account - Removes your sign-in, so you can no longer access the Service. Match data you created is retained by default, so association records and shared reports do not develop holes.
• Erasing everything - If you want your match data erased as well as your account, email support@rugbyrefcoach.com and say so. We will erase it and confirm when it is done.
• Audit feed - Deleted automatically 90 days after it is written.

We are telling you this plainly because "delete my account" and "erase everything about me" are different requests, and it would be misleading to imply the first does the second.

9. Your rights

• Access - All your match data is visible in the app at any time.
• Correct - Every match, event and note can be edited at any time.
• Delete - Delete individual matches yourself, or ask us to delete your account and erase your data.
• Export - Generate a PDF report of any match.
• Object or withdraw - Stop using the Service, block analytics, and never generate an AI review. None of those stop the rest working.

Australian users have rights under the Privacy Act 1988 and the Australian Privacy Principles. Users in the UK or European Economic Area have rights under UK GDPR and the GDPR, including data portability and the right to complain to a supervisory authority. We will not charge you or make it difficult to exercise any of these.

10. Emails we send

We send transactional emails you cannot opt out of while you hold an account, such as address verification and password resets.

We may occasionally email you about the Service itself. Those carry an unsubscribe link, and unsubscribing is honoured permanently. We keep a record of unsubscribed addresses purely so we do not email them again.

11. Children

The Service is not directed at children under 16 and we do not knowingly collect their personal information. Note that a coach or referee coach may record information about junior players, for example a jersey number and a note. That is your responsibility as the person entering it, and you should follow your club, association or union's safeguarding policy.

If you believe a child's personal information has been entered and should be removed, email support@rugbyrefcoach.com and we will remove it.

12. Changes to this policy

If we change how we handle your data, we will update this policy and the date at the top. Material changes will be notified in the app.

13. Contact

Questions, corrections, deletion requests and complaints all go to support@rugbyrefcoach.com. If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner, or to your local supervisory authority in the UK or EEA.