Privacy policy

Last updated November 3, 2026

Walk-Off Works ("we", "us") makes the InningUp app, the web app at app.inningup.com and the website at inningup.com. This page says what they collect, why, who sees it, and how to delete it. The terms of use are the other half of the agreement.

The short version

• You do not need an account to record and review on your phone. Recordings stay there until you sign in for backup. Requesting a sign-in or verification code sends the contact information needed to deliver it.
• Sign in with an email code or Sign in with Apple. Where SMS is enabled, an adult account holder can add a verified phone number and explicitly remember a device for text-code sign-in. A new or forgotten device uses email or Apple first. Accounts are for people 18 and older.
• No ads. No analytics tools in the app or the web app. No third-party software in the app that follows you. No tracking. We do not sell or rent your data.
• After you sign in, your sessions are saved to our own storage at Cloudflare, linked to your account. You choose whether video clips go up, and whether only on Wi-Fi.
• You decide who can see a player: family you invite, and a coach only when you join their team. A coach sees what you allow. You can leave a team any time and the coach stops seeing the player right away.
• Parents look after their children's profiles. Children do not have accounts.
• For a new player, we ask to use recorded video to improve ball tracking as part of setup. The request is not consent. No video becomes eligible for training until that player's parent or guardian, or the adult player, explicitly agrees.
• You can delete a session, a player, or your whole account, in the app and on the web.

What the app records on your phone

• Camera video. The app uses the camera to follow the ball. It keeps a short clip around each pitch or hit if "record clips" is on. You can also record a side-on swing, import a video you choose, or keep recent footage for review. The app does not use the microphone; an imported video may already contain sound.
• Numbers for each pitch or hit. Speed, where the ball crossed the plate, break, a spin estimate, pitch type, exit speed, launch and spray angle, estimated distance, a quality grade, and the path of the ball. These are estimates made by the app. They are not official measurements.
• Set-up details. Which hand throws and bats, batter height, pitching distance, field, where the camera was placed.
• Players. A name, hands, height and an optional jersey number or position, for each player you add.
• What you type or correct. Session titles, corrected pitch types and outcomes, and "not a real pitch" marks.
• Your sign-in. When you sign in, the server makes up a random number for your phone and a secret token. The token is kept in the iPhone Keychain.

The app does not ask for your location, contacts, photos library, microphone or health data. It does not read your contacts or photos.

Your account

• What we keep. Your email address, the name you gave (optional), the time you agreed to the terms, the players you look after, and, if you add one, your verified account phone number. A phone number belongs to the adult account holder, not a child's player profile.
• How we use your email. To send you a six-digit sign-in code, to send an invite when you ask us to invite someone, and to tell you about a change to your sign-in email. We do not send marketing email and we do not give your address to anyone else. An invite email holds a link, who invited, and the team name. It never names a player.
• Sign in with Apple. If you use it, Apple gives us a number that identifies you to us, your email address (your real one, or the private address Apple makes if you choose to hide it) and, the first time, your name. We do not get your Apple password. If you hide your email, sign-in codes and invites go to Apple's private address, and Apple passes them on. When you delete your account we also tell Apple to disconnect it from InningUp.
• Signing in. Codes expire after 10 minutes and work once. InningUp's sign-in database stores code hashes. Email and SMS delivery systems necessarily receive the code; the SMS gateway and Twilio may retain message content for delivery, logs or duplicate-send protection. On the website a session cookie keeps you signed in for up to 30 days. In the app the sign-in token stays in the Keychain. These are for authentication, not tracking.
• Optional text codes. Adding or changing your phone number requires a recent email or Apple sign-in and a verification text. You can then choose to remember this browser or phone for SMS sign-in for up to 90 days. A separate secret proof is kept in a secure, HTTP-only browser cookie or the iPhone Keychain. A phone number and a text code alone cannot enroll an unknown device. Using SMS does not extend this remembered period. A new device or expired proof returns to email or Apple.
• Signing out. On the phone, signing out keeps every session and player on the phone and stops backup. Ordinary sign-out can retain an explicitly remembered SMS device so you can sign in there again with a text code. The signed-out iPhone can remove its saved SMS proof locally. In account settings you can revoke remembered devices or unlink the number, which also ends the SMS sessions they authorized. The web and app provide controls for other active sessions and phones.
• Changing your email. We send a code to the new address first, and a short notice to the old one.

Account requests and optional backup

The player's name is also saved inside each session's settings, so it goes up with the session. A first name or a nickname is enough.

Things you share yourself. If you export a CSV file, share a summary card or share a clip, it goes where you send it, through the share sheet. We do not see it. The CSV and the card can include the player name and the numbers.

Every upload uses an encrypted (HTTPS) connection. The server stores only a one-way scramble of your token, never the token. It answers a request only with data you are allowed to see. Something you may not see looks to you like something that does not exist.

Sessions you recorded as "examples" (the made-up ones behind "Look around with an example") are never backed up.

Young players

Players of all ages use the app, including young players, and it records video of the player.

• Accounts are for people 18 and older. Signing up asks the person to say they are 18 or older. That is their statement, not a check. A child does not get an account.
• A parent or guardian holds the account and decides who sees each child's profile: family they invite, and any team they join. They decide whether video clips are shared, how far back a coach sees, and when to leave.
• A coach can make a profile for a player (a "managed" profile) so the coach can record for them. The coach holds that profile until the family takes it over with a link. Until then the family has no access to it. Coaches agree in the terms to make a managed profile only with the parent's or guardian's permission and to hand it over or delete it when the family asks.
• We do not ask for a child's email address or phone number. The player name is required for a profile; a first name or a nickname is enough.
• If a player is under 18, a parent or guardian must decide whether their videos may help train ball tracking. The app asks separately for each player and records the account, declared relationship, policy version and date of that confirmation. Creating an account, accepting the terms, backing up a video or sharing it with a coach does not grant training permission.
• We do not knowingly collect personal information directly from children under 13. Children cannot create accounts. A child's profile exists because a parent or guardian made it, or a coach made it with a parent's permission. If you believe a child has made an account, or that a profile exists without a parent's permission, write to [email protected] and we will look into it and delete it where it is not right.

Coaches and sharing

A team is made by a coach. A coach invites a player's family with a link or a code. When a parent accepts, that player joins the team and the team's staff (the head coach, coaches, and assistants) can see that player's numbers. Nobody sees a player because a coach typed their name.

What a coach sees, per team, once you join. - The player's sessions, pitches and hits, with the charts and totals, from the date you chose: all of the player's history, or only sessions from the day you joined. - Video clips, only if "Share video clips" is on for that team. You can turn it off at any time and the clips stop being available to that team. - Whether a coach may record sessions for the player: you choose with "Coaches can record for this player". Assistants never record. - A coach on one team does not see your other teams, and cannot see other players in your family.

What a coach never sees. The names or email addresses of the player's family, the notes the family writes, the player's other teams, and your phones or account details.

You are in charge. - You choose at joining time: which player joins, whether clips are shared (on by default, and shown clearly), and how far back the coach sees. You can change both later in the app (Settings > Back up and share) and on the web. - Leaving a team ends the coach's access right away. The coach loses the player at once, including anything that coach could see before. The coach's own phone keeps the sessions that coach recorded; they stay on that phone until the coach deletes them. - You can see who looked. The sharing screen (in the app and on the web) lists the latest times someone on a team looked at the player's numbers or watched a clip, with the person's name and the team. Looks are kept for 90 days and are written at most once an hour per person and kind of look. Your own looks and your family's are not listed. - Team numbers. A coach sees a roster and a leaderboard of the players on the team. Players and families do not see other players.

Notes. A coach can write two kinds of note on a player. A note "for the player" is visible to the player's family and to the other staff of that team. A "only me" note is visible to that coach alone: not to the family, not to other coaches. An "only me" note is deleted when that coach's access to the player ends (they leave or are removed, the family leaves the team, the profile is handed to a family, or the account is deleted). A family can write notes for itself; those are never shown to coaches. A family member who has only "viewer" access sees no notes. If a coach deletes their account, the notes they wrote "for the player" stay with the family and show "Deleted user" as the author.

Family. The person who owns a player can invite family as a guardian (can see and manage) or a viewer (can see numbers). The owner and guardians see the name and email of each person with access. Nobody can remove the owner. Anyone can remove themselves.

If a team is deleted by its head coach, its players are un-linked and keep all of their data. If a head coach deletes their account, the team passes to the next coach, or is deleted if there is no one.

The website

The web app at app.inningup.com shows the same data as the app and lets coaches manage teams. It is served by the same Cloudflare Worker as the app's server. It has no analytics and no advertising. The only scripts from other companies are the Cloudflare Turnstile check, which the sign-in form may show to tell people from bots (Cloudflare sees your browser and internet address when it is shown), and, only if you choose "Continue with Apple" on the web, Apple's sign-in script. The website keeps one sign-in cookie, as described above. On the web app you can export all of your data as a CSV file and delete your account.

The marketing site (inningup.com). It has a waitlist form. If you use it we keep your email address, and only use it to tell you when a spot opens, until you ask us to remove it. The site counts page visits with a simple analytics script that we run. It is not used for advertising and it does not follow you to other sites.

What we do not collect

Precise or approximate location, contacts, photos library, microphone audio, advertising identifier, browsing history, or purchases. The app contains no advertising or analytics software from other companies and does not follow you across other apps or websites.

Where your data is kept

On Walk-Off Works' own Cloudflare account: a Cloudflare Worker (the program that talks to the app and the website), a D1 database (accounts, players, numbers, text, notes), an R2 bucket (video clips), and Cloudflare Email Sending (sign-in and invite email). Cloudflare is our hosting company. Cloudflare handles network connections for the Worker, so it sees your internet address when you connect, and it may keep standard technical logs under its own terms. Cloudflare may process data in more than one country.

Where you choose text codes, our private messaging gateway sends the adult account number and verification message to Twilio for SMS delivery. The gateway respects SMS opt-outs. SMS is for authentication, not marketing, and declining or blocking texts leaves email and Apple sign-in available. A delivery request can be kept by our gateway for up to 24 hours to prevent duplicate sends; Twilio has its own delivery records. We do not send player videos, notes or results to Twilio.

The people who run the service can technically read what is stored. They do that only to keep it working, to answer a support request, or, where you switched it on, to improve the app.

We do not sell your data. Cloudflare hosts the service, Apple handles Sign in with Apple when chosen, and Twilio delivers optional text codes. If a court or other authority legally requires us to hand data over, we will do what the law requires and tell you where we are allowed to.

Using recorded video to improve ball tracking

For new player profiles, using eligible recorded video to improve InningUp is the default request in setup. It stays pending until you explicitly agree. Continue without training if you do not want this. Recording, reviewing, backing up and sharing with your chosen family or coaches remain available either way. Existing profiles without permission are not automatically enrolled.

If the player is under 18, only their parent or guardian may agree. An adult player may agree for themselves. A coach, assistant or viewer cannot agree through their team access, and a coach-made profile cannot participate before a family takes it over. The person confirming must declare which of these relationships applies. A confirmation for one player or account does not cover a different player or account.

With permission, eligible uploaded clips and their associated ball-tracking results and corrections may be used to train and evaluate InningUp's pitch and hit detection. Names, notes, email addresses and sign-in details are not training inputs. Video can still show identifiable people; removing profile details does not make the video anonymous. Permission for one player does not give us permission for other people visible in a clip.

Each new app session or import keeps the training choice and a reference to that player's confirmation. The server checks that the confirmation is valid and has not been withdrawn before selecting a clip. Existing sessions without that confirmation are excluded. An offline confirmation must first sync to the account; it does not authorize training on its own. Conflicting offline approvals and withdrawals may require you to confirm again. Older, unscoped confirmations need to be renewed for this policy.

You can decline or withdraw in Help improve InningUp. Withdrawal stops selection for new training work. An old queued approval cannot restore permission, and a later approval does not restore recordings tied to a withdrawn confirmation. We keep a small consent record with the player, account, declared relationship, policy version and times so we can enforce that choice. Withdrawal is separate from deleting your recordings; use the deletion controls below to remove them. Withdrawal does not promise to undo a model already trained from lawfully used data.

Training permission does not change who can watch your clips or turn on new uploads. The phone still uploads a compressed playback copy under your backup and Wi-Fi choices; it does not upload an additional original-quality recording for training.

We have not started training models from customer recordings, and there is no public training export. The consent and eligibility controls described here do not themselves start a training job.

How long we keep it, and how to delete it

• On your phone: until you delete a session (open the session, "Delete session"), remove a player, use Settings > Delete all my data, or delete the app.
• In your account: until you delete it. We do not currently delete an unused account automatically.
• Delete one session or one player. In the app (delete a session) or on the web (delete a session, or delete a player on My data or Sharing). It removes the numbers, notes and clips for it from the cloud.
• Delete all my data (app Settings) erases every session, pitch, hit and clip on your phone, the saved player list and your settings. When you are signed in it also asks the server to delete the backed-up copies the next time the phone is online. It does not delete your account.
• Delete my account (app: Settings > Back up and share; web: Settings > Delete account) asks you to type your email, then deletes: the players only you look after, with their sessions, notes and clips; your sign-ins and phones; and the account itself. A player who has another guardian passes to the guardian who has been there longest, and you leave. A team with other staff passes to the next coach, otherwise it is deleted and its players are un-linked with their data intact. Notes you wrote "for the player" stay with the family, as "Deleted user". Your "only me" notes are deleted. Everything on your phone stays. Deleting clips can take a moment; the app and the website keep going until it says it is done. It cannot be undone.
• Short-lived records are removed by a nightly job: used or expired sign-in codes; counters that limit sign-in attempts (kept for a day); expired website sign-ins; phones that were signed out, 30 days after; invites 30 days after they expired or were switched off; the "who looked" log after 90 days; and unfinished email changes.
• Backups. The database has point-in-time recovery that keeps data for a short period, so a deleted record can exist in a recovery copy for up to about 30 days.
• Deleting the app from your phone does not delete your account. Delete your account first if you want it gone.

Your choices

• Do not sign in, and nothing leaves your phone.
• Turn off "record clips" to stop video being kept. Turn on "Wi-Fi only" to hold clip uploads until you are on Wi-Fi.
• Turn off "Share video clips" for a team, choose "only new sessions", or leave a team, at any time.
• Choose "Continue without training" or withdraw in "Help improve InningUp" to exclude your player's videos from new training work without losing recording or review features.
• Export everything as a CSV file on the website.
• Ask us to delete or fix something by email: write to [email protected] from the address on the account. We can find your data by that address. We aim to answer within a few days.

Changes

If we change this policy we will change the date at the top. If a change means we collect or use data in a new way, the app will ask you first.

Contact

[email protected] · Walk-Off Works · inningup.com