Lockerbook

Data Security and Privacy Plan

Last updated: October 1, 2026

Vermonster's Pro Shop ("we," "us") publishes Lockerbook, a scorekeeping app for school and club sports. This plan describes how we protect student data. A New York school district may attach it to its contract with us under New York Education Law § 2-d and Part 121 of the Regulations of the Commissioner of Education (8 NYCRR § 121.6). A district's own data privacy agreement controls if it conflicts with this plan.

1. How Lockerbook handles student data

  • Coaches enter it, and it stays with them. Coaches type rosters (names, jersey numbers and, optionally, a nickname, position, graduation year and MaxPreps athlete ID) and game statistics. That information is stored on the coach's iPhone or iPad. When the head coach shares a team with staff, it is kept in the head coach's own iCloud account and shared only with staff the coach invites.
  • We run no server that holds student data, and we can't see or access any team's roster or statistics. As designed, we don't receive student personally identifiable information from the district.
  • Never collected: athlete contact information, birth dates, photos, health or medical information, location, or device identifiers for tracking. There are no ads, analytics or third-party SDKs in the app.
  • The live link (optional, off by default) publishes a game's public scoreboard: team names, score, clock and plays with jersey numbers only. The app is built so athlete names can never be sent to it (§ 7).

2. How we meet state, federal and local requirements

Law or requirement How we meet it
FERPA (20 U.S.C. § 1232g; 34 CFR Part 99) Coaches enter records under the school's direct control, as a "school official" would, for the sole purpose of keeping team statistics. Records stay on staff devices or in their iCloud; the school controls editing and deletion. We never re-disclose, sell or use them for any other purpose.
COPPA (15 U.S.C. §§ 6501–6506; 16 CFR Part 312) The app and website aren't directed to children, and we collect no personal information from anyone through them. Athletes never use the app.
NY Education Law § 2-d and 8 NYCRR Part 121 We sign the district's contract rider, attach its Parents' Bill of Rights with the supplemental information (§ 4), follow this plan, limit use to the exclusive purposes in § 4, train anyone with access (§ 5), and notify the district of a breach within 7 calendar days (§ 8). We never sell student data or use it for marketing or commercial purposes.
NY SHIELD Act (GBL §§ 899-aa, 899-bb) The safeguards in § 3. We hold no "private information" (such as Social Security, driver's license or account numbers, or biometric data). If a breach ever involves it, we notify affected New York residents and the Attorney General as the law requires.
NY Child Data Protection Act (GBL art. 45-A) Lockerbook isn't primarily directed to minors, and its users are adult coaches and staff. Athletes' names or jersey numbers entered by coaches are handled only as strictly necessary to keep the team's book, with no ads, no sale and no profiling.
District and local policies We follow any additional terms in the district's data privacy agreement and its media or streaming rules. Coaches can turn off the live link for any game or team, and the district can require it be kept off (§ 7).

3. Administrative, operational and technical safeguards

Technical

  • Encryption at rest: the team file is protected with iOS Data Protection (encrypted whenever the device is locked). A team shared with staff is stored in the head coach's iCloud account with every record in CloudKit encrypted fields (end-to-end encrypted).
  • Encryption in transit: every connection uses HTTPS/TLS; calendar links typed as http or webcal are upgraded to HTTPS.
  • Access on the device: an optional Face ID or passcode lock, a privacy screen in the app switcher, and a head-coach PIN (stored only as a salted hash) for changing final statistics.
  • Least privilege by design: staff roles (head coach, assistant, associate, scorekeeper, viewer) decide who can do what; only the head coach can correct final statistics or manage staff.
  • Minimal data: the app asks only for what a scorebook needs; roster imports read only name, jersey, position, grade and MaxPreps ID and ignore every other column.
  • Exports: created with file protection and removed from temporary storage when the export screen closes. The MaxPreps stats file has jersey numbers only.

Operational

  • No Lockerbook server or database holds student data, so there is no central store to breach.
  • No third-party SDKs (analytics, ads, crash reporting or otherwise). Adding one requires a written decision and a privacy review first.
  • Every change is reviewed before release, and automated tests check that names never reach a public output (redaction tests).
  • Developer accounts (Apple, GitHub, the website host) must use strong unique passwords and two-factor authentication.
  • Test data uses fictional names only; real rosters are never used in development or support.

Administrative

  • One accountable person (currently the owner of Vermonster's Pro Shop) is responsible for this plan and reviews it every year and whenever the app changes how data is handled.
  • Support requests are handled without rosters: we ask for jersey numbers, never names.

4. Parents' Bill of Rights: supplemental information

We comply with the district's Parents' Bill of Rights for Data Privacy and Security. For each contract, the supplemental information is:

Item Lockerbook
Exclusive purposes for which student data will be used Keeping the team's rosters, game statistics and box scores; preparing files the coach chooses to share (such as the MaxPreps stats file); and, only when the coach turns it on, a jersey-number public scoreboard. Nothing else.
Subcontractors and how we make sure they protect the data Apple (iCloud / CloudKit) stores data in the coach's own iCloud account and the live-link scoreboard, under Apple's security and privacy terms. Our website host serves lockerbook.app and never receives student data. No other subcontractor. We review both each year (§ 6).
Contract duration, and what happens to data when it ends The term on the district's invoice or agreement. When it ends, the data stays on the district's staff devices and iCloud accounts, under the district's control. Coaches can export it and delete it in the app (Settings → Delete All Lockerbook Data). Any live-link scoreboard is deleted automatically within a week of the game. We hold no copy to return or destroy; on request we certify this in writing.
Challenging accuracy A parent, or a student 18 or older, asks the district or the team's coach. The coach corrects it in the app (the head coach can edit final statistics, with an edit history). We'll help the district if asked.
Where data is stored On staff iPhones and iPads in the United States and, for a team shared with staff, in the head coach's iCloud account (Apple data centers).
Encryption At rest: iOS Data Protection on the device; CloudKit encryption in iCloud (every record of a team shared with staff is in encrypted fields, end-to-end encrypted). In transit: TLS.

5. Training

Anyone who could access student data under a contract, currently only the owner, completes training on FERPA, COPPA, New York Education Law § 2-d and Part 121, the SHIELD Act and the Child Data Protection Act before access and every year after that. The training is recorded with its date. Anyone new must complete it before any access.

6. Subcontractor oversight

We use only the subcontractors listed in § 4. Before adding one, and every year after that, we check that its security and privacy terms are at least as protective as this plan and the district's agreement, and we bind it to those terms in writing where the law requires. We would tell the district before any new subcontractor handled student data.

At public interscholastic games, the team names, jersey numbers and players on the field are observable by any spectator. Schools routinely publish them in rosters, programs and on scoreboards, and FERPA lets schools designate participation in officially recognized activities and sports, and the height and weight of athletes, as directory information (34 CFR § 99.3). Even so, Lockerbook's public scoreboard is narrower than what a spectator sees:

  • It is off by default and turned on per game by the coach.
  • It shows team names, the score, the clock and plays with jersey numbers only. It never includes a name, nickname, position, injury, note or substitution, and the app is built so names can't be sent to it.
  • It is deleted when the coach turns it off, and otherwise one week after the game.
  • The district can require it be kept off for any team or for all teams, and we'll help the district confirm that.

8. Security incidents and breach notification

  1. Contain: turn off the affected feature (for example, the live link) and stop any further exposure.
  2. Assess: what data, which teams and people, and since when.
  3. Notify the district within 7 calendar days of discovering a breach or unauthorized release of its student data, with what happened, what data, and what we're doing. Cooperate with the district's and law enforcement's investigation.
  4. Notify others as the law requires: affected New York residents and the Attorney General under the SHIELD Act, and anyone else federal law requires. Where Education Law § 2-d requires it, we pay or reimburse the district's cost of notifying parents and eligible students.
  5. Fix and verify: fix the cause, add a regression test, and record the incident.

9. Data return and destruction

We hold no copy of a district's student data, so there is nothing for us to return. At the end of a contract the district's coaches can export their data (spreadsheet, box score and MaxPreps files) and delete it from their devices and iCloud. On request, we confirm in writing that we hold no district student data.

10. NIST Cybersecurity Framework

Part 121 requires alignment with the NIST Cybersecurity Framework version 1.1. The table below maps our practices to its five functions; it maps the same way to CSF 2.0, which adds a Govern function (covered by § 3 Administrative and § 6).

Function Our practices
Identify Data inventory (what the app stores, where, who sees it) kept current in our internal privacy doc; no student data held by us; subcontractors listed in § 4; yearly plan review.
Protect Data Protection encryption at rest, TLS in transit, Face ID lock, head-coach PIN, staff roles with least privilege, minimal data fields, no third-party SDKs, reviewed changes with redaction tests, 2-factor authentication on developer accounts, yearly training.
Detect Security reports to contact@lockerbook.app; Apple and GitHub account security alerts; automated tests that fail if a public output ever carries a name.
Respond The incident steps in § 8, including 7-day district notice and SHIELD Act notice.
Recover Fix, test and release (critical fixes submitted within 48 hours); coaches' data stays on their devices and in their iCloud and backups; record lessons in the incident log.

Contact

Vermonster's Pro Shop · contact@lockerbook.app · subject line "Data privacy agreement"