Privacy Policy

Underdog is the data controller for the personal data described in this policy, for the purpose of operating the platform on behalf of the clubs and organisations that use it (each a “club”). Your club is generally responsible for deciding who is added to its roster and what role they hold; Underdog processes that data under the club's direction.

Contact us about this policy at rundogie@gmail.com.

Account & membership: name, email address, and your role (admin, coach, or player) at each club you belong to.

Athlete performance data: GPS-derived training metrics (distance, speed, high-speed running, sprints, and related load metrics) recorded by your club's own GPS hardware; fitness test results (e.g. beep tests, sprint tests, time trials); gym session logs players enter themselves; and daily wellness check-ins (readiness, sleep, soreness, mood).

Injury & availability records: body area, severity, type, and status history logged by coaches/admins as part of managing player availability.

Coach-recorded video: when a coach records an exercise demonstration in the app, the clip is uploaded directly to a private, unlisted YouTube video and linked from the exercise. Only someone with the exact video link can view it; it is not searchable or published to any channel's public listing.

Schedule data: training and match times your club enters.

Technical data: a session cookie that keeps you signed in, and — if you opt in — a push-notification token so we can send reminders to your device. We don't use third-party advertising or tracking cookies.

Enquiries: if you contact us through the website (e.g. the “Get access” form), we collect the details you provide — typically your name, club, and email.

• To provide the platform: showing coaches and admins the availability, wellness, load, and injury status of players on their squad.
• To show players their own data and history.
• To send you emails and push notifications you've requested or that relate to your account (e.g. wellness reminders, welcome emails).
• To maintain and improve the security and reliability of the service.
• To respond to support requests and enquiries.

Where your club is a customer of Underdog, we generally process player and staff data under a contract with the club (or the club's legitimate interest in managing its own squad), acting on the club's instructions. Where processing involves sensitive information — see the next section — we or your club rely on your explicit consent.

Wellness check-ins and injury records can reveal information about your health, which receives extra protection under data protection law. This data is entered voluntarily (by you, or by a coach/physio on your behalf as part of managing your availability to play) and is visible only to admins and coaches at your own club, never shared outside it, and never used for anything other than squad management.

Many GAA clubs run underage squads. Where a player is under 16, their profile and any check-ins, injury records, or performance data are managed by the club and/or a parent or guardian, and access to any account used by a young player should be supervised by a parent, guardian, or coach in line with the club's own safeguarding policy. Clubs are responsible for obtaining any parental/guardian consent required before adding an underage player to the platform.

We use a small number of service providers (“sub-processors”) to run Underdog. We don't sell personal data, and we don't share it for advertising.

• Supabase — our database, authentication, and file storage provider.
• Vercel — hosts the Underdog web app.
• Resend — sends transactional emails (welcome emails, password setup).
• Google / YouTube — hosts coach-recorded exercise videos as unlisted, link-only videos on Underdog's own account.
• Your club's GPS provider (e.g. StatSports, Catapult PlayerTek, SPT, or PlayerData) — if your club uses GPS tracking hardware, Underdog retrieves session data from that provider using your club's own account with them. This is data flowing into Underdog, not data we send elsewhere.

Some of these providers process data in, or transfer data to, the United States. Where that involves a transfer of personal data outside the European Economic Area, we rely on appropriate safeguards, such as the European Commission's Standard Contractual Clauses.

We retain personal data for as long as your club has an active account with Underdog, and for a reasonable period afterwards to comply with legal obligations, resolve disputes, and enforce our agreements. A club admin can request deletion of a player's data at any time — see your rights below.

Under GDPR, you have the right to:

• Access the personal data we hold about you
• Have inaccurate data corrected
• Request erasure of your data, subject to any legal retention requirements
• Object to or restrict certain processing
• Receive a copy of your data in a portable format
• Withdraw consent at any time, where processing is based on consent

To exercise any of these rights, contact your club admin or email us at rundogie@gmail.com. You also have the right to lodge a complaint with the Irish Data Protection Commission (dataprotection.ie).

Access to club data is enforced by row-level security policies in our database, so a user can only see data belonging to organisations they're a member of. We use encrypted connections (HTTPS) throughout, and access to administrative tools is restricted to authorised staff.

Underdog uses a single essential cookie to keep you signed in. We don't use advertising or cross-site tracking cookies.

Coach-recorded exercise videos are hosted on YouTube. When you watch one, Google's own privacy policy applies to that viewing session.

We may update this policy from time to time. We'll update the “last updated” date above when we do.

Questions about this policy or how your data is handled? Email us at rundogie@gmail.com.