Sports tech analytics: Apple's quiet app, a $2.61bn market, and a teenager in Microsoft's database

Apple built a sports app that does almost nothing. Slate's June 2026 review argues that this is exactly the point. It is worth reading alongside the market forecasts now landing in the sports technology sector.

The app is called "Sports". It has no news headlines, no streaming guides and no algorithmic feed. Slate reports that when you download it you will see betting odds on the scoreboard, but a single toggle in settings turns them off permanently. What remains is team names, logos, records, game times and scores, plus a standings page. The writer notes there is almost no advertising, with occasional exceptions such as an Apple banner promoting Apple TV content.

The contrast with the rest of the category is the substance of the piece. Major League Baseball's official app, long a favourite of the reviewer, has "gradually surrounded baseball scores and video with window dressing that has made the app feel heavier". ESPN's app now prioritises its live TV offering and a self-contained vertical video scroll, with the score section sitting in "a vast sea of other buttons". The PGA Tour's app, in the reviewer's words, "is more of a billboard than anything else".

What the market numbers say

Against that product-level argument sits a much larger set of numbers. A MarketsandMarkets report distributed via Yahoo Finance on 22 September 2026 estimates the AI in sports market at $2.61 billion, growing at a compound annual growth rate of 16.7% to 2030. That is a forecast, not a measurement. The headline figure should be treated with the usual caution attached to vendor-sponsored market sizing.

The surrounding news flow in late September suggests where the money is actually moving. Sports Business Journal published a tech piece on 23 September about the data driving ticket sales and fan growth. Databricks announced a partnership with Cal Athletics on 24 September, framed as a return to its Berkeley roots. The Atlantic Council launched a Power of Sports Center the same day, according to Ministry of Sport.

Not all of it is flattering. The New York Post reported on 21 September that DraftKings used AI to target losing bettors, quoting an internal line that "the best investment would be a problem gambler". That story is a reminder that sports data analytics and betting analytics are frequently the same pipeline pointed at different customers.

Where the data actually lives

Two open-source projects published in August 2026 show a different layer of the stack: the one that decides who owns the numbers. Adaca Analytics, posted to GitHub on 8 September, is a self-hosted dashboard system for Google Analytics 4 and BigQuery that runs on Cloudflare Workers. Daily rollups from the GA4 Data API or a BigQuery export land in a D1 database the operator owns, while realtime data stays on Google. It ships with six dashboards and a four-step builder. Every number opens into a detail page with its own trend and breakdowns, precomputed so they load in one round trip.

The project is MIT licensed and comes from Adaca, a software consultancy. The setup requires creating a Google service account with Viewer access on a GA4 property, downloading its JSON key, and deploying via Cloudflare's Deploy button. This forks the repository, provisions D1 and KV, and deploys the Worker with its cron. There is no sign-in; the README tells operators to put Cloudflare Access or built-in Basic Auth in front of it.

That is a small project, but it points at a recurring question in sports analytics. Teams and media companies generate enormous behavioural datasets through tools they do not control. Self-hosting the dashboard layer is one answer. Owning the whole realtime backend is another.

Lark and the Firebase question

Lark, posted to GitHub on 13 August 2026, is a realtime database server written primarily in Rust on top of Glommio, with an edge component in Go for terminating WebSocket, WebTransport and REST HTTP connections. Its pitch is drop-in compatibility with Firebase Realtime Database SDKs, including the Firebase JS SDK. This allows a team to replace the realtime database while continuing to use Firebase Auth, Hosting and Storage.

The project's README is unusually careful about maturity. The 0.x version number, it says, "reflects the project's age, not known instability". The on-disk format is described as something the maintainers will not break without providing a migration path. Breaking changes in 0.x releases are described as rare, documented in the changelog, and accompanied by a migration path when stored data is affected. Lark Cloud runs the same codebase and hosts real customer data. The engine is tested against Firebase's own SDK test suite. Firebase is a trademark of Google, and the README states plainly that Lark is not affiliated with, endorsed by or sponsored by Google.

The examples folder includes a multiplayer whiteboard built on the client SDK in roughly 300 lines of vanilla TypeScript, and a port of Firebase's own quickstart social-blogging app with "a handful of lines changed".

The security counterexample

Not every sports and analytics story is about product design or market sizing. Tom's Hardware reported on 28 September 2026 that a teenager using the handle Faav accessed a Microsoft internal analytics platform called Titan. He reached 25,000 records of employee data and, by his own tally across tables, 17 trillion records in total. He was awarded $5,000 through Microsoft's bug bounty programme.

According to the report, Faav used an AI orchestrator bot he built, called Antares, to scan subdomains. It found an Azure Cloud host and a Swagger/OpenAPI file listing four routes. Three required Azure Active Directory authentication; one, named /v2/Query, did not, and accepted raw SQL. A 2023 login page recovered via the Wayback Machine included an Apache Superset configuration file describing 56 table definitions. The endpoint initially rejected queries for lack of a JWT. After ten days of failed attempts, Faav concluded from the server's responses that the token signature was not being checked. He then presented a token claiming administrator access.

AI and human intuition compounded here. Antares did ten days of work I didn't have to [...] Its persistence, plus one human hunch, is what made this find possible.

Faav told Tom's Hardware he had "spent the year hacking Microsoft off and on around school", and that he had also found bugs in Amazon, Google and Adobe products. The details matter beyond the bounty. An unauthenticated query endpoint accepting raw SQL, reachable after a subdomain scan, is the sort of surface that any analytics platform in sport or elsewhere can expose by accident.

Put the three strands together and the sector looks less uniform than the forecasts suggest. Apple's Sports app shows that restraint is a feature users notice. The market numbers show capital still flowing. Lark and Adaca Analytics show developers trying to keep ownership of the data layer. And the Microsoft case shows what happens when that layer is left open.