Draft — not legal advice. This document is a plain-English working draft explaining how Coach Baily handles your data. It is pending a professional legal review and may change before then. Some details are marked [TO CONFIRM] and still need to be finalised.

Privacy Policy

Last updated 1 September 2026 · Version 2026-09.3

This policy explains what personal data Coach Baily holds about you, why we hold it, the legal basis for it, who helps us run the service, how long we keep it, and the rights you have over it.

1. Who is responsible for your data

Coach Baily is run by Joe Baily, trading as “Coach Baily”, an individual (sole trader) based in the United Kingdom. For the personal data described here, Joe Baily is the data controller. If you have any question about your data, or you want to exercise any of your rights, contact us at bailyldesign@gmail.com, or by post at 133 Wren Path, London SE28 0DY, United Kingdom.

One important exception: where you use Coach Baily to record information about other people (for example your club’s members and teams), you or your club — not us — decide what is recorded and why. For that information you or your club are the controller and we act as your processor. See section 5.

2. What data we hold, and why

We hold the information you give us so the app can work for you:

  • Your account — your email address and a securely scrambled version of your password, so you can sign in.
  • Your coach profile — your coach name, an optional club name, an optional short bio, your coaching qualifications and affiliations, and an optional profile photo.
  • Your sessions and planning — the sessions you build or save, your folders and tags, your calendar, and any courses you set up.
  • Club data — if you run or belong to a club: the club details, logo, teams, fixtures, tournaments, shared calendar, and who the members are.

We also automatically receive some technical information when you use the app — such as your IP address, browser type, and basic activity and error logs — through the hosting and error-tracking providers listed in section 7. We use this to keep the service running, secure, and working correctly.

We use this information only to provide Coach Baily to you — to run your account, save and show your sessions, put your club logo on your plans, send the emails the service needs to send, and let you plan alongside other coaches in your club. We do not sell your data, and we do not use it for advertising.

3. The legal basis for using your data

Under UK and EU data protection law we must have a legal basis for using your personal data. Ours are:

  • Performance of a contract — most of what we do (creating and running your account, saving and showing your sessions, club features, and the service emails) is to provide the app you asked for under these terms.
  • Legitimate interests — keeping the service secure and working, preventing misuse, fixing errors, and understanding basic usage, where this is not overridden by your rights.
  • Consent — where we ask for it, such as accepting these terms at sign-up and any optional communications. You can withdraw consent at any time.
  • Legal obligation — where we must use data to comply with the law.

4. Automated session suggestions and the AI step

Coach Baily builds session suggestions automatically from a library of real drills. Most requests are handled entirely on our own systems.

When your request is more detailed than our own software can interpret by itself, we send the text you typed to OpenAI, a US-based provider, which reads it and returns a structured version of what you asked for. We send the text of that request and nothing else — your name, email address and account details are never sent with it. Your saved sessions are never sent. And nothing is sent to OpenAI at all when your request is simple enough for us to handle ourselves. OpenAI does not choose your drills; those always come from our own library.

OpenAI states that data sent through its API is not used to train its models, and that it may keep a copy for up to 30 days to check for misuse.

Because the words you type are passed on in this way, please do not type anyone’s personal details — in particular a child’s name — into the session box. Coach Baily never asks for player details, has nowhere to store them, and does not need them to build a session.

This automated step only produces coaching suggestions for you to review — it does not make any decision that has a legal or similarly significant effect on you or on any other person.

5. Information about other people (club members)

Coach Baily lets coaches and clubs record information about other people — for example other coaches, club staff, members, and teams. For that information, you or your club are the controller (you decide what is recorded and why) and Coach Baily is your processor (we hold and handle it on your behalf to provide the app).

If you record information about other people, you are responsible for having a proper legal basis to do so and, where required, for providing any notice or obtaining any consent those people are entitled to. Please only record what is necessary for coaching.

6. Children’s data

Coach Baily is a tool for adult coaches and is not aimed at children. You must be at least 18 to create an account, and children do not create their own accounts. Where a club is set up, the person who sets it up must also be an adult.

Grassroots football involves young players, but Coach Baily has no feature for recording players. There are no player lists, no player records and no information about individual children anywhere in the app. A team in Coach Baily is a named group of coaches — for example “U12s” — with an optional age band such as “Under 12”. We do not ask for, and do not store, any child’s details.

Some boxes in the app accept free text (for example a team name or a session description). Please do not type a child’s personal details into them. If you do, you are the controller for that information (see section 5) and are responsible for having the right permission — normally from a parent or guardian, or another lawful basis.

7. The companies that help us run Coach Baily

To run the service we use a small number of trusted providers, who process data on our behalf. They are only allowed to use the data to provide their service to us. They are:

Cloudflare (Pages)
Hosts and delivers the Coach Baily web app.
Web requests (IP address, browser type, pages visited).
Cloudflare (DNS / CDN)
Sits in front of the app and the API to route and protect traffic.
Request information for the app and API addresses.
Cloudflare R2
Stores the images you upload.
Coach profile photos and club logos.
Cloudflare (Web Analytics)
Counts visits so we can see how many people use Coach Baily and which pages they land on.
Privacy-preserving visit counts only. It uses no cookies, stores nothing in your browser, and does not build a profile of you or follow you to other websites.
Render
Hosts the Coach Baily application server (the API).
All app traffic and your data while it is being handled.
Cloudways (Vultr)
Hosts the database where your account is stored.
All of your stored account data, at rest.
Stripe
Takes payment for subscriptions and manages billing.
Your email address and card details, which you give to Stripe directly on their own checkout and billing pages — we never see or store your card number. We send Stripe only an internal reference number for your account or club. No session content, and nothing about players, is ever sent to Stripe. Stripe (Stripe, LLC) is a US-based provider certified under the EU-US Data Privacy Framework and its UK Extension, and relies on Standard Contractual Clauses where applicable.
OpenAI
Reads the session description you type and turns it into a structured request, when your request needs it.
Only the text you type into the session box. No name, email address or account details are sent with it. OpenAI is US-based. OpenAI states that data sent through its API is not used to train its models, and that it may keep a copy for up to 30 days to check for misuse.
Sentry
Tells us when something goes wrong so we can fix errors.
Scrubbed error reports. Hosted in the EU, with IP-address storage turned off, kept for 30 days, and personal details filtered out before sending.
UptimeRobot
Checks that the app and API are online.
Only public status responses — no account details.
cron-job.org
Triggers our daily reminder job at a set time.
None of your personal data — it just calls a scheduled web address.
Resend
Sends the emails from Coach Baily (verify your email, reset your password, session reminders, club invitations, feedback).
Recipient email addresses and the contents of those emails. Emails are sent from the EU (Ireland) region. Resend is a US-based provider certified under the EU-US Data Privacy Framework (and its UK Extension) and relies on Standard Contractual Clauses where applicable.
Google (Gmail)
Receives feedback you send and our own monitoring alerts.
Feedback messages you submit (including the email address you send them from) arrive in the owner's Gmail inbox.

8. Sending data outside the UK

Some of these providers are based outside the UK, including in the United States. Where your data is transferred to the United States, the providers we use are certified under the EU-US Data Privacy Framework and its UK Extension (for example Cloudflare, Render and Stripe) and/or rely on Standard Contractual Clauses together with the UK International Data Transfer Addendum. Where an EU/UK-hosted option is available we choose it — for example, our error-tracking (Sentry) is hosted in the EU, and our transactional email (Resend) is sent from the EU (Ireland) region.

Our AI provider, OpenAI, is also US-based. [TO CONFIRM: confirm which transfer mechanism applies to OpenAI — OpenAI does not appear in the public EU-US Data Privacy Framework list, so this is expected to rest on Standard Contractual Clauses and the UK International Data Transfer Addendum under OpenAI’s data processing terms]

[TO CONFIRM: confirm whether an EU representative (GDPR Article 27) is required for users in the EU]

9. Storage in your browser

When you sign in, Coach Baily stores a secure login token and your basic account details in your browser's local storage so that you stay signed in as you move around the app. This is necessary for the app to work — it is not used for tracking or advertising. Coach Baily does not set advertising or tracking cookies.

We also measure how many people visit the app, using Cloudflare Web Analytics (see section 7). This is deliberately privacy-preserving: it sets no cookies and stores nothing in your browser, so it cannot follow you between visits or to other websites. It tells us how many visits a page received, not who you are.

10. How long we keep your data

We keep your account data for as long as you have an account. Other specific periods:

  • If you delete your account, we permanently remove your account and the data linked to it, including any images you uploaded.
  • If an account is not used for a long time, we may warn you by email and then remove it — currently after 24 months of inactivity.
  • Error reports held by our error-tracking provider are automatically deleted after 30 days.
  • Technical logs are kept for a short period (up to around 30 days), and database backups are retained by our hosting providers on a short rolling schedule, for security and recovery. [TO CONFIRM: verify the exact log and backup periods against the hosting settings]
  • Emails you send us (such as feedback) are deleted when we no longer need them, and in any case within 90 days.

11. How we keep your data secure

We take reasonable steps to protect your data. Connections to the app and API use encryption in transit (HTTPS), passwords are stored only in a securely scrambled (hashed) form, access to systems is limited, and we use monitoring and error-tracking to spot and fix problems. No online service can be completely secure, but we work to keep your data safe.

12. If there is a data breach

If a personal data breach happens that is likely to affect your rights, we will report it to the relevant supervisory authority (in the UK, the Information Commissioner's Office) within the time the law requires, and we will tell you where the law requires us to.

13. Your rights

Under UK and EU data protection law you have the right to:

  • Access — ask for a copy of the personal data we hold about you.
  • Correction — ask us to fix data that is wrong or incomplete (you can edit most of this yourself in your profile).
  • Erasure — delete your account and the data linked to it. You can do this yourself from the Security page in your account settings, or email us and we will do it.
  • Portability — ask for a copy of the data you provided in a commonly used electronic format.
  • Restriction — ask us to pause how we use your data in certain situations.
  • Objection — object to how we use your data, including where we rely on our legitimate interests.
  • Withdraw consent — where we rely on your consent, you can withdraw it at any time, without affecting what we did before.

To exercise any of these, email bailyldesign@gmail.com.

14. Complaints

If you are unhappy with how we have handled your data, you can complain to the UK's Information Commissioner's Office (ICO) at ico.org.uk. If you are outside the UK, you can also contact the data protection authority in the country where you live.

15. Changes to this policy

We may update this policy as Coach Baily grows. If we make an important change we will update the version and date at the top of this page.