Security and privacy
Arm Aware holds a child's name, birth date, and pitch counts. This page explains who can see that information, what we keep, and what we don't.
Who can get in
Access is by invitation
Nobody can join an existing organization, or get access to someone else's child, without an invitation sent to their own email address.
No passwords to leak
You sign in with a one-time code sent to your email. We store no passwords.
No accounts for children
Only parents and coaches sign in. A child is a record in the app, not a user.
Parents control sharing
If a child plays in more than one league, linking the two is the parent's choice. Only dates and pitch counts cross over.
Who can see what
These rules are enforced by the database on every request, not only by the app's screens. We test them by signing in as each kind of account and asking the database directly.
| Account | Can see |
|---|---|
| Parent | Their own children and those children's outings. For a child linked across leagues, the dates and pitch counts from the other league. The other guardians of their child. |
| Coach | The players on the teams they coach, including outings logged by another team's coach, and those players' guardians. |
| Organization admin | Everything inside their own organization. |
| Another organization | Nothing. One league can't see another league's players, coaches, or families, except what a parent chooses to link. |
| Arm Aware support | A short list of people, set directly in the database and never from inside the app. They can read and correct records but can never create or grant access for anyone. |
Email addresses are visible only where the app needs them: to admins, to a child's other guardians, and to that child's coaches.
What we store, and what we don't
What Arm Aware stores
- A child's name and birth date, which the age-based rules need
- Pitch counts and outing dates
- Parent and coach email addresses
- Which team and organization each person belongs to
What it does not store
- Photos, home addresses, phone numbers, or school information
- Passwords, because sign-in uses an emailed code
- Payment card numbers, because billing runs through Stripe
- Logins for children, because they have no accounts
How every request is protected
- You sign inA one-time code sent to your email proves who you are.
- The connection is encryptedEverything travels over HTTPS, so it can't be read on the way.
- The database checks your roleYour role's rules are applied to every table, on every request.
- You get back only your rowsWhatever your role doesn't allow is never sent.
Hosting and payments
Hosting
The database runs on Supabase, which encrypts data at rest (AES-256) and in transit (TLS) and reports SOC 2 Type 2 compliance. The app is delivered over HTTPS through Cloudflare. Those certifications belong to the hosting providers. The access rules above are Arm Aware's own.
Payments
Card payments are handled by Stripe. Arm Aware never sees or stores a card number.
This website
This site has no advertising, no analytics, and no third-party scripts or fonts.
If a plan lapses
An organization keeps its existing records and can still log outings. Data is never held hostage.
What Arm Aware is, and isn't
It is
- An independent tool that applies the published Pitch Smart guidelines
- A rest tracker that works alongside your official scorebook and pitch count record
- One shared answer for coaches and parents about who is rested
It isn't
- Medical advice. A coach's or doctor's judgment always comes first.
- Affiliated with or endorsed by MLB, USA Baseball, Little League, or Babe Ruth League.
- Complete yet. Not covered: annual innings limits, time off from throwing, catcher guidance, limits counted in innings, and league-age rules some leagues use.
Questions from your board or legal team
If an organization's security or legal reviewers have questions, email info@arm-aware.com.