Privacy Policy

1. Data Controller

CoachAI is operated by Jason Stoudt ("we", "our", or "us"). For questions about data processing, contact our Data Protection contact at privacy@jasonstoudt.io.

2. Information We Collect

We collect the following categories of personal information:

Information You Provide

• Account Information: Name, email address, and password
• Team Data: Team names, player rosters (names, jersey numbers, positions), schedules, and game statistics
• Player Health Data: Medical notes and allergies for player safety (entered by coaches/guardians)
• Emergency Contacts: Names, phone numbers, and relationships for player emergency contacts
• Photos: Team and event photos uploaded by authorized users
• Phone Numbers: For SMS team invitations (provided by coaches)

Automatically Collected

• Usage Data: Features used, interaction patterns, and session duration (only with consent)
• Device Information: Browser type, operating system, and device identifiers (only with consent)
• Error Data: Application errors and performance data (only with consent)

3. Legal Basis for Processing (GDPR)

We process personal data under the following legal bases:

• Contract Performance: Account management, team features, and game tracking
• Consent: Analytics (PostHog), error tracking (Sentry), AI drill generation, marketing communications
• Legitimate Interest: Security monitoring, fraud prevention, and service improvement
• Legal Obligation: Tax records for payment processing, responding to lawful requests

You may withdraw consent at any time by updating your cookie preferences or contacting us. Withdrawal does not affect lawfulness of processing before withdrawal.

4. AI Features and Data Processing

CoachAI uses artificial intelligence to generate drill animations and coaching suggestions. When you use AI features:

• Player jersey numbers (not names) are sent to our AI provider, Anthropic (Claude), to generate personalized drill animations
• Your natural language drill descriptions are processed by Anthropic's API
• Anthropic does not use API data for model training (per their API data policy)
• AI-generated content is stored in your account for future reference

No player names, medical information, or emergency contact data is ever sent to AI providers.

5. Third-Party Services

We share data with the following service providers:

• Supabase (US): Database hosting and authentication
• Vercel (US): Application hosting and deployment
• Google (US): OAuth sign-in authentication (when you choose Google login)
• PostHog (US): Analytics and product insights (consent required)
• Sentry (US): Error tracking and performance monitoring (consent required)
• Twilio (US): SMS delivery for team invitations
• Anthropic (US): AI-powered drill generation (jersey numbers only)

6. International Data Transfers

Our service providers are based in the United States. If you are located in the EEA/UK, your data is transferred to the US under Standard Contractual Clauses (SCCs) or equivalent safeguards maintained by each provider. Contact us for copies of applicable transfer mechanisms.

7. Data Retention

• Active accounts: Data retained while your account is active
• Deleted accounts: Anonymized immediately; hard-deleted after 30 days
• Expired invitations: Purged after 30 days
• Read notifications: Purged after 90 days
• Game statistics: Retained for the duration of team membership
• SMS phone numbers: Removed from invite records after acceptance

8. Your Rights

All Users

• Access the personal information we hold about you
• Request correction of inaccurate data
• Request deletion of your data (Settings → Delete Account)
• Export your data in a portable JSON format (Settings → Export Data)
• Opt out of analytics tracking via cookie preferences

EEA/UK Residents (GDPR)

• Right to restrict processing
• Right to object to processing based on legitimate interest
• Right to withdraw consent at any time
• Right to lodge a complaint with your local supervisory authority

California Residents (CCPA/CPRA)

• Right to know what personal information is collected and how it is used
• Right to delete personal information
• Right to opt out of the sale or sharing of personal information
• Right to non-discrimination for exercising privacy rights

Do Not Sell or Share My Personal Information: CoachAI does not sell personal information. We share limited data with service providers solely for operating the service. To opt out of any data sharing, contact us at privacy@jasonstoudt.io.

CCPA Categories of Information Collected

• Identifiers: Name, email, phone number
• Internet activity: Usage data, feature interactions (with consent)
• Professional information: Coaching role, team management data
• Protected characteristics: Age confirmation (13+ verification)
• Health information: Medical notes, allergies (for player safety only)

9. Children's Privacy (COPPA)

CoachAI is designed for adult coaches, parents, and guardians. We do not permit children under 13 to create accounts. All player data for children under 13 must be entered and managed by a parent, guardian, or authorized coach who accepts responsibility under COPPA.

By entering a child's information into CoachAI, the parent/guardian consents to the collection and use of that information solely for team management purposes. Parents may review, modify, or delete their child's data at any time by contacting the team coach or emailing us at privacy@jasonstoudt.io.

10. Photos

Team and event photos may be uploaded by authorized team members. Photos of minors require parental/guardian consent. Photos are stored securely and only accessible to team members. Parents may request removal of any photo containing their child by contacting the team coach or emailing us.

11. Data Security

We implement appropriate technical and organizational security measures including encrypted connections (HTTPS/TLS), secure authentication, rate limiting, input validation, and access controls. Sensitive data such as medical notes and allergies is access-controlled and audited—only authorized team members (coaches and the player's parent/guardian) can view this information, and all access is logged for security monitoring. However, no method of transmission over the Internet is 100% secure.

12. Cookies and Tracking

We use cookies and similar technologies to enhance your experience. Analytics and error tracking cookies are only activated after you give explicit consent through our cookie consent banner. See our Cookie Policy for detailed information.

13. Automated Decision-Making

CoachAI uses automated processing to suggest player substitutions based on playing time data. These suggestions are advisory only and do not produce legal or similarly significant effects. Coaches make all final substitution decisions.

14. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy and changing the "Last updated" date. Your continued use after changes constitutes acceptance of the updated policy.

15. Contact Us

For questions about this Privacy Policy or to exercise your privacy rights, contact us at privacy@jasonstoudt.io.

If you are in the EEA/UK and are unsatisfied with our response, you have the right to lodge a complaint with your local data protection supervisory authority.