The bang on the head nobody passed on
A knock in a Thursday PE lesson. School logs it. Nobody rings the football club, because nobody ever does.
Saturday, her coach sees it before kick-off, so the return-to-play protocol gets followed.
Security and trust Safeguarding, data protection, and where it all lives
Safeguarding
first.
SHOT is built for youth sport, so safeguarding and data protection are not features sitting on top of the product. They are the shape of it. This page says what we hold, who can see it, and what you can do about it.
What it is for
A policy nobody reads
protects nobody.
Most safeguarding in grassroots sport is a document a club signed once. Ours is structural: it is in how accounts work, who can message whom, and what gets seen by the person who needs to see it. Two examples of what that means on a Saturday.
The week that was too much
Sports day, two games and two sessions across three organisations. Each coach sees only their own part of it, so each thinks it was a normal week.
The load is visible in one place, so somebody pulls the intensity down before something tears.
Age tiers
Different ages.
Different rules.
Under 13
A parent or guardian holds the account with the young person. Profiles are private by default, a handle is shown rather than a full name, and no adult outside the club structure can reach them.
13 to 15
The young person uses it themselves, with a one-off guardian approval and the guardian still attached. Coach direct messages to under-18s are off, by design, not by setting.
16 and over
They hold their own account and their own record. Guardian View continues only where they choose to keep it on.
Included on every tier, including free. Safeguarding is not something a club unlocks by paying. A club running SHOT for nothing gets the same age tiers, the same consent flows and the same controls as anyone else.
Your data
Who controls what,
in plain words.
- Clubs act as data controllers for Athlete data. SHOT is the processor.
- SHOT Clubhouse Ltd is the controller for marketing data only.
- The Athlete's development record is portable, exportable and deletable. It belongs to them and it leaves with them.
- Full Subject Access Request support.
- ICO registration and a Data Processing Agreement are available on request.
- Consent flows are built into every Athlete profile, and Guardian View is opt-in per Athlete.
UKhosted in AWS eu-west-2, London
AES-256encrypted at rest
TLS 1.3encrypted in transit
Dailybackups
Rolebased access: coach, Athlete, guardian, admin
Auditactivity log for club admins
Sub-processors: AWS, Supabase, Resend, Vercel. Full list on request. Single sign-on is available for school and organisation arrangements, with session timeout controls.
For schools
Evidence for
personal development.
Pupil-level progress evidence across every sport the school offers, multi-sport and multi-term, aligned to the personal development judgement rather than to participation counts. The data comes from lessons and sessions that happened, not from a survey at the end of term.
Free tier.
Same protection.
No card required, and safeguarding and data protection included on every tier.