--- title: "How to Protect Your Email When Joining a Sports Club" date: "2026-11-06" author: "Ahsan Luqman" canonical_url: "https://aliasfleet.com/blog/how-to-protect-your-email-when-joining-a-sports-club" tags: ["Email Privacy", "Sports Clubs", "Email Aliases"] description: "Joining a sports club hands an email address to volunteers, shared lists and team apps. One alias per club keeps that mail contained and closable if it leaks." --- # How to Protect Your Email When Joining a Sports Club Joining a sports club hands an email address to volunteers, shared lists and team apps. One alias per club keeps that mail contained and closable if it leaks. Joining a sports club requires a personal email address, and the practical protection is a separate email alias for each club. The alias forwards club mail to the main inbox and can be closed if the club list leaks, so the main address is never exposed. The address is then held on lists run by volunteers, shared in group mail and entered into team apps, and it stays in those places after the member leaves. ## Registration and use of member email addresses A sports club collects an email address at registration and uses it for fixtures, training changes, cancellations, subscriptions, social events and sponsor offers. The Sport and Recreation Alliance's Sports Club Survey 2013 counted [151,000 sports clubs in the UK](https://www.healthclubmanagement.co.uk/health-club-management-news/Report-number-of-sports-clubs-in-the-UK-reaches-151000/307313), each with an average of 141 adult members. The figure is from 2013 and no newer UK-wide count was found. The people handling those addresses are usually volunteers, and the list is often kept on a personal laptop or in a personal email account. [Swim England's data protection guidance for clubs](https://www.swimming.org/swimengland/data-protection-guidance/) says committee members should use a role email address such as secretary@clubname rather than a personal address, and that files containing personal data shared by email should be encrypted. The same guidance discourages committee members from creating their own contact lists, and says member information should be kept central to the club's online management system. ## Cyber incidents in sport The UK National Cyber Security Centre's report on the cyber threat to sports organisations found that at least 70% of sports organisations surveyed had suffered a cyber incident in 12 months, against a 32% average for UK businesses. About 30% of incidents caused direct financial damage, averaging more than £10,000 per incident, and the biggest single reported loss was over £4 million. Business email compromise was the most common outcome of attacks in the sector. In one case, the email of a Premier League club managing director was hacked before a transfer negotiation, and a £1 million fee was nearly diverted before the club's bank blocked it. The full findings are in the [NCSC press release on the report](https://www.wired-gov.net/wg/news.nsf/articles/Defences+tested+as+cyber+attackers+take+aim+at+UK+sports+sector+23072020141500?open). [Town Sports International, a gym chain, exposed 600,000 records](https://www.comparitech.com/blog/information-security/gym-chain-town-sports-exposes-personal-details-of-600000-members-staff-online-report/) of members and staff in an unsecured Amazon S3 bucket with no password, holding names, addresses, phone numbers, email addresses and limited card details. The database was first seen in the wild in November 2019 and was only secured on 22 September 2020. [West Ham United supporters had their full names, dates of birth, telephone numbers, addresses and email addresses displayed](https://www.infosecurity-magazine.com/news/west-ham-supporters-personal/) to other supporters on the club's ticketing website in March 2021, after a technical issue with a third-party provider; no payment details were exposed. Madison Square Garden Sports was hit by a ShinyHunters extortion campaign in June 2026, and the group published the data. [Have I Been Pwned lists 9.8 million affected email addresses](https://haveibeenpwned.com/Breach/MadisonSquareGardenSports) from that breach, added on 24 June 2026. A leaked address gives an attacker a working address tied to a real interest: raw material for phishing. After a breach, the address is checked on [Have I Been Pwned](https://haveibeenpwned.com/) and passwords reused with it are changed. No public record was found of a small community club's email list leaking; the risk for a small club is shown by the sector pattern and by governing-body guidance rather than by a small-club breach count. ## Data protection rules A club that holds member email addresses is a data controller under UK data protection law, even if it is run entirely by volunteers. Swim England's guidance states that a loss of data is a breach of GDPR, while noting that not every breach is notifiable to the ICO. The [ICO's own guidance on personal data breaches](https://cy.ico.org.uk/for-organisations/report-a-breach/personal-data-breach/personal-data-breaches-a-guide) says a notifiable breach must be reported to the ICO without undue delay and no later than 72 hours after the organisation becomes aware of it. If a breach is likely to result in a high risk to individuals, those individuals must also be informed without undue delay. The member cannot audit the club's security: committees change every year, and the list lives on in old inboxes and spreadsheets. The member can only control which address the club was given. ## Team apps and member data Many clubs now run communication through a team app instead of plain email, and Spond is one of the common ones. A [Spond Club member profile](https://intercom-help.eu/spond-club/en/articles/182663-managing-member-information) holds a name, date of birth, contact details and membership status, plus custom fields such as allergies and medical needs. Several email addresses can be linked to one Spond profile, and all notifications go to the profile's primary email address. The club admin cannot see the emails registered in a person's main Spond profile. [Spond states that personal contact details are only visible to verified team members](https://www.spond.com/en-us/news-and-blog/best-youth-soccer-team-communication-app/) and that the platform is GDPR-compliant, and it claims over 3.3 million global users, the vendor's own figure. Not every team app handles data the same way. In February 2026 a [joint investigation by The Markup, CalMatters and the Los Angeles Times](https://beerleagues.app/blog/your-league-app-shouldnt-sell-your-data) reported that TeamSnap, a popular youth and recreational sports management app, had been sharing user data with advertisers and third-party marketers, including names and contact information, purchase history and geolocation data. Common Sense Media gave TeamSnap its lowest rating, Warning, for personal information sold or rented to third parties and shared for third-party marketing. The finding is reported from a secondary summary, not from the original reporting. The member rarely gets a say in which app the club chooses. ## Shared mailing lists A common exposure in a club is a group email: a fixtures secretary sends a message to the whole squad with every address in the To or CC field, and every recipient can see every other member's address. A single reply-all then shares every member's address with the whole list. [Spammers collect email addresses](https://aliasfleet.com/blog/how-do-spammers-get-your-email-address) from exactly these kinds of exposed lists, and a list that circulates among dozens of members reaches people outside the club sooner or later. [CC in Gmail shows every recipient's address to all other recipients, while BCC hides recipients from each other](https://clean.email/blog/email-providers/how-to-cc-in-gmail). A volunteer sender may not know the difference. A member can ask the club to use BCC for group mail, which costs the club nothing, but the member cannot enforce it, and one mistake by one volunteer undoes it. The address is already shared the moment it appears in a CC field. ## One alias per club The method is one email alias for each sports club joined, given to the club in place of the main address. The alias forwards to the main inbox, so fixture changes and training notices still arrive in the same place. If the club's list leaks, the damage is limited to that alias, and the member closes it. If the club starts sending sponsor offers or social mail the member did not agree to, the alias is paused or closed without touching the main inbox. If a phishing email arrives addressed to the club alias, the member knows at once which club's list it came from. That is the same principle as using a [different email for every website](https://aliasfleet.com/blog/different-email-for-every-website), applied to a club instead of a website. The same alias covers the club app: registration on the team app uses the club alias, not the main address. If the app later shares data with advertisers, the address it shares is the alias. An alias is a managed, persistent forwarding address under the member's control that stays active for as long as the membership lasts. [Email aliases work](https://aliasfleet.com/blog/how-email-aliases-actually-work) by forwarding mail sent to the alias on to a real inbox, and the member can reply from the alias so the main address never appears. An alias protects the email address, not the rest of the membership record. A club that leaks its list leaks names, phone numbers and any medical or emergency contact details it holds alongside the address, and an alias does nothing about those. An alias also does not stop a club from sharing data with a third party if the member agreed to it at registration. The alias makes the email address replaceable: a member who can replace the address the club holds does not have to trust the club's security, the app's privacy policy or the volunteers' mailing habits. ## Response to a club list leak When a club announces a leak, or when phishing mail arrives that names the club, the response has four parts. The club alias is checked on Have I Been Pwned, and the password is changed on the club account and on any other account that shares it. Phishing mail that uses club details such as team names or fixture dates is watched for, because that detail makes the message convincing. [How phishing uses a leaked email](https://aliasfleet.com/blog/how-phishing-uses-your-leaked-email) explains the pattern. The alias is closed if the leak is confirmed, and the club is given a fresh alias if the membership continues. A member who gave the club a main address has a harder job: the address cannot be closed without changing it on every other account that uses it. ## AliasFleet and sports clubs AliasFleet provides email aliases that forward to a real inbox. A member creates one alias per club, and the alias stays active for as long as the membership lasts. AliasFleet's free tier includes 10 active aliases, and the alias can be paused or closed from the dashboard at any time. AliasFleet does not stop a club app from collecting other data such as a date of birth or location, and it does not protect an address already given to the club before the alias was created. AliasFleet is available at [aliasfleet.com](https://aliasfleet.com), where a member creates one alias per club and manages it from the dashboard.