Privacy Notice: Diamond Eye and fdeye
This one notice covers two related softball scouting apps: - Diamond Eye (deye.kluxy.app), slowpitch - fdeye (fdeye.kluxy.app), fastpitch
App-specific differences are called out in their own sub-sections. Where a section does not name an app, it applies to both.
1. Who we are (controller identity)
The controller of the personal data described here is fiveinnolabs, operated by Victor del Rosal, based in Ireland.
Contact for any privacy question or request: privacy@fiveinnolabs.com
We do not have a statutory Data Protection Officer (we are a micro operation and one is not required), but the address above reaches the person responsible.
fiveinnolabs is the sole controller. If a national federation later directs how the tool is used, this notice will be updated to reflect any joint-controller arrangement.
2. What these apps are, in plain terms
Both apps help a national softball team's coaching staff prepare for games. They gather publicly available match results and statistics about players (mostly opposing teams), the coaching staff's own tracking of games, and turn that into scouting views: batting lines, spray charts (where hit balls land), and a numeric "threat" score that ranks hitters. The apps are free, non-commercial, and shown to a small, closed group of coaches and team members.
3. Whose data we process, and where it comes from
- Opposing athletes (and some domestic league players). We did not collect this from them directly. Source: public WBSC (World Baseball Softball Confederation) and WBSC Europe box scores, rosters, and play-by-play results, plus, for Diamond Eye League Mode, a coach's own iScore scorekeeping exports, plus in-app coach tracking of games. This is the Article 14 situation: data obtained from a source other than you.
- A national team's own players (own-team tracking). Provided through the team's own coaching and performance programme.
- App users (coaches and team members who sign in). Provided by you when you sign in and use the app.
4. What data we hold
Athlete data (both apps)
- Full name (first and last)
- Jersey number, playing position, batting hand, team or nation code, and gender in mixed events
- Performance statistics (for example PA, AB, H, HR, AVG, OBP, SLG, OPS)
- Spray charts: coordinates of where batted balls landed, measured where available or otherwise estimated from handedness and power
- A "threat" score (0 to 100), an automated ranking of how dangerous a hitter is. This is profiling of an identifiable person.
- Defensive shading recommendations and short scouting notes
We do not store athlete photographs. Avatars are drawn from initials only. We do not store injury or medical notes, and we do not intend to.
fdeye U-18 dataset (fdeye only, minors)
fdeye holds a dataset from the 2024 U-18 Women's World Cup (Ireland's own squad) that includes full names, year of birth, spray data, pitch-location data, and game narratives that name individual young players. Some of these players are still minors. It is visible only to Ireland's own coaching staff. See section 11.
User account data (both apps)
- Diamond Eye: on Google sign-in, we store a record keyed by your email address with your first name and how you were granted access. We also store a de-identified signed ID derived from your email. Usage events, chat questions and answers, and feedback are logged.
- fdeye: on Google sign-in, we store a record keyed by your email address with your first and last name, login count, and a capped log of up to 300 recent activity events.
- We do not store your IP address in our application records (verified for Diamond Eye's code; fdeye's worker likewise stores none in its user records). Cloudflare, our host, processes IP addresses transiently to deliver the service. We store a coarse device class derived from your browser's user agent (fdeye also stores the raw user agent string on feedback submissions).
5. Why we process it, and our lawful basis
(a) Opponent scouting (both apps): legitimate interests, Article 6(1)(f)
Purpose: preparing a national team for competitive games by analysing opponents' publicly recorded performance. Our named legitimate interest is competitive opponent analysis for national team preparation, a longstanding and expected practice in sport. We have carried out a Legitimate Interests Assessment (purpose, necessity, balancing) and keep it on file (adopted 2026-07-16). In summary: the underlying stats are already public on WBSC; the audience is small and closed; the app is free and non-commercial; and we minimise what we hold. We recognise that the "threat" scoring and ranking is higher-impact processing, and that the balance shifts against us for minors, which is why minors are handled separately (section 11). You have the right to object at any time (section 13).
(b) Own-team tracking (both apps): legitimate interests / contract
Purpose: supporting a team's own players and performance programme. Basis is the squad and performance relationship plus legitimate interest, not consent, because consent would be fragile given the coach-player relationship. For own-team minors we involve parents or guardians and follow the DPC's child-oriented Fundamentals.
(c) User accounts and access control (both apps): contract / legitimate interests
Purpose: letting you sign in, keeping the app secure, controlling who sees what, and keeping audit logs.
(d) Usage and chat logging (Diamond Eye): legitimate interests
Purpose: understanding how the app is used, managing server load and cost during tournaments, identifying unusually heavy use and curtailing misuse, and improving the tool.
(e) Feedback (both apps): legitimate interests
Purpose: acting on problems and suggestions you send us.
Special category data
The core dataset (stats, spray, jersey, scores) is ordinary personal data, not special category data under Article 9. We deliberately keep out health and injury notes and photographs.
6. Information for scraped athletes (Article 14)
If you are an athlete whose data appears in one of these apps and you did not give it to us directly, this section is for you.
- Categories of data: your name, team, jersey number, position, batting hand, publicly recorded performance statistics, derived spray charts, and a derived "threat" score.
- Source: public WBSC and WBSC Europe results, box scores, and rosters; for Diamond Eye League Mode, a coach's iScore scorekeeping exports; and in-app tracking of public games.
- Purpose and lawful basis: opponent scouting for national team preparation, on the basis of legitimate interests (section 5(a)).
- Recipients: a small closed group of coaching staff and team members. See section 8.
- Retention: see section 10. Your rights, including objection and erasure: see section 13.
We were not able to contact each athlete individually, because we do not hold contact details for opposing players. We rely in part on Article 14(5)(b) (disproportionate effort), and this published notice is the compensating measure. We keep a written record of that assessment (adopted 2026-07-16). If you object, we will act on it (section 13).
7. Automated decisions and profiling
The "threat" score ranks hitters automatically. It informs coaching decisions but does not produce a legal or similarly significant effect on any athlete, so this is not solely-automated decision-making of the kind restricted by Article 22. We none the less treat scoring of individuals, and especially of minors, as higher-impact, and we assess it in our Data Protection Impact Assessment.
8. Who we share data with (recipients and processors)
We do not sell data and we do not use it for advertising. We use:
- Cloudflare (hosting and storage). Processor. Hosts the apps (Cloudflare Pages) and stores data in Workers KV. Cloudflare's Customer Data Processing Addendum applies automatically. Cloudflare states it is certified under the EU-US Data Privacy Framework (including the UK Extension) and also relies on Standard Contractual Clauses. Workers KV is globally replicated, including to the United States, so storing personal data in it involves an international transfer (section 9).
- Google (Sign-In). Independent controller for the sign-in interaction. When you sign in with Google, Google processes your account identifiers and profile fields under its own privacy policy. We receive and verify the sign-in and then issue our own session cookie. Google is certified under the EU-US Data Privacy Framework.
- Anthropic (Diamond Eye "Ask the Eye" chat feature only). Processor. When you use the chat feature, scouting data (player names, stats, spray, and threat scores) is sent to Anthropic's API in the United States to generate an answer. Your identity (email or user ID) is not sent. Anthropic acts under its Data Processing Addendum, does not use API inputs or outputs to train its models, and its default API log retention is short (currently around 7 days). Transfers rely on Standard Contractual Clauses. fdeye does not use any AI or LLM service.
Owner-only administrative dashboards let the operator see account records and logs for support and abuse prevention.
9. International transfers
Some providers process data outside the European Economic Area, primarily in the United States. These transfers are covered by the EU-US Data Privacy Framework where the provider is certified (Cloudflare, Google) and by Standard Contractual Clauses as a safeguard and fallback (Cloudflare, Anthropic), with UK and Swiss adaptations where relevant. We keep the personal data involved in these transfers to a minimum.
10. How long we keep data (retention)
| Data | App | Retention |
|---|---|---|
| Usage logs | Diamond Eye | 90 days |
| Chat logs (questions and answers) | Diamond Eye | 90 days |
| Feedback | Diamond Eye | 90 days |
| Short-lived query records | Diamond Eye | 7 days |
| User account record | Diamond Eye | Deleted after 24 months without a new sign-in or binding (records created before 16 July 2026 are being migrated to this policy) |
| User account and activity records | fdeye | Deleted after 24 months of inactivity (sliding; pre-16-July-2026 records being migrated) |
| Feedback | fdeye | 90 days (new submissions; earlier items being migrated) |
| Scouting datasets (athlete stats, spray, scores) | both | Reviewed each competition cycle; deleted or aggregated when no longer needed for preparation |
| U-18 event data | fdeye | Retained only for the child's own team staff with documented justification; otherwise deleted or aggregated after the event |
11. Children (minors)
We take children's data seriously and we know it carries the highest risk in these apps.
Our operating rule: an individual minor's detailed data is shown only to that minor's own team coaching staff wherever we control the view. In practice, today:
- In fdeye, the 2024 U-18 dataset (Ireland's own young players) sits behind Google sign-in plus a two-person staff allow-list, is fail-closed, and has been tested. It is a self-scout shown only to Ireland's own staff. It is not opponent-facing.
- Scouting datasets built from public championship results can include opposing athletes who are under 18. Since 16 July 2026, access to fdeye is invite-only (closed team membership), so these views are restricted to a small, verified coaching circle rather than anyone with a Google account. We are moving under-18 opponents to aggregate-only display, and we will remove or aggregate any minor's individual data on request, no reason required.
- We ran a birth-year screen across the app datasets on 16 July 2026 and repeat it when data is ingested. Where a source provides no birth data, we rely on the closed-membership restriction and on removal on request.
- We follow the Irish Data Protection Commission's "Fundamentals for a Child-Oriented Approach" and Sport Ireland safeguarding norms.
Parents and guardians: if you are the parent or guardian of a young player and have any question or request about their data, contact privacy@fiveinnolabs.com. We will respond and, where appropriate, remove or aggregate the data.
12. Cookies
We use a strictly necessary login cookie so that you stay signed in. We do not use analytics, advertising, or third-party tracking cookies, so no cookie consent banner is required.
- Diamond Eye also uses a shared team-access cookie (from the team PIN), a de-identified user ID cookie, and a per-device cookie used to rate-limit the chat feature. All are functional, not tracking.
- fdeye uses a single signed session cookie.
We use local storage and a service worker only to make the apps work offline and load faster, not to track you.
13. Your rights
Under the GDPR you have the right to: access the personal data we hold about you; have inaccurate data corrected; have your data erased; restrict or object to our processing (the right to object is especially relevant where we rely on legitimate interests, which is most of our scouting processing); and data portability where it applies.
To exercise any right, email privacy@fiveinnolabs.com. We aim to respond within one month. There is no charge in normal cases. If you are an athlete and you object to your data being used for scouting, tell us and we will act on it. We do not require you to give a reason.
14. Complaints
If you are unhappy with how we handle your data, you can complain to the Irish supervisory authority: the Data Protection Commission (Ireland), www.dataprotection.ie. The Irish DPC is our lead supervisory authority. If you are in the UK, you may also contact the UK Information Commissioner's Office, though the Irish DPC leads on our processing.
15. Changes to this notice
If we change how we process personal data, we will update this notice and change the date below.
Last updated: 16 July 2026.