Privacy Policy

1. Data Controller

CoachAI is operated by Jason Stoudt ("we", "our", or "us"). For questions about data processing, contact our Data Protection contact at privacy@putmein.co.

2. Information We Collect

We collect the following categories of personal information:

Information You Provide

• Account Information: Name, email address, and password
• Team Data: Team names, player rosters (names, jersey numbers, positions), schedules, and game statistics
• Player Health Data: Medical notes and allergies for player safety (entered by coaches/guardians)
• Emergency Contacts: Names, phone numbers, and relationships for player emergency contacts
• Photos: Team and event photos uploaded by authorized users
• Phone Numbers: For SMS team invitations (provided by coaches)
• Push Notification Tokens: Device push subscription tokens when you opt in to browser push notifications (used solely to deliver game reminders, schedule updates, and team announcements)

Automatically Collected

• Usage Data: Features used, interaction patterns, and session duration (only with consent)
• Device Information: Browser type, operating system, and device identifiers (only with consent)
• Error Data: Application errors and performance data (only with consent)

3. Legal Basis for Processing (GDPR)

We process personal data under the following legal bases:

• Contract Performance: Account management, team features, and game tracking
• Consent: Analytics (PostHog), error tracking (Sentry), AI drill generation, marketing communications
• Legitimate Interest: Security monitoring, fraud prevention, and service improvement
• Legal Obligation: Tax records for payment processing, responding to lawful requests

You may withdraw consent at any time by updating your cookie preferences or contacting us. Withdrawal does not affect lawfulness of processing before withdrawal.

4. AI Features and Data Processing

CoachAI uses artificial intelligence to generate drill animations and coaching suggestions. When you use AI features:

• Player jersey numbers (not names) are sent to our AI provider, Anthropic (Claude), to generate personalized drill animations
• Your natural language drill descriptions are processed by Anthropic's API
• Anthropic does not use API data for model training (per their API data policy)
• AI-generated content is stored in your account for future reference

No player names, medical information, or emergency contact data is ever sent to AI providers.

5. Third-Party Services

We share data with the following service providers:

• Supabase (US): Database hosting and authentication
• Vercel (US): Application hosting and deployment
• Google (US): OAuth sign-in authentication (when you choose Google login)
• PostHog (US): Analytics and product insights (consent required)
• Sentry (US): Error tracking and performance monitoring (consent required)
• Twilio (US): SMS delivery for team invitations
• Anthropic (US): AI-powered drill generation (jersey numbers only)

6. International Data Transfers

Our service providers are based in the United States. If you are located in the EEA/UK, your data is transferred to the US under Standard Contractual Clauses (SCCs) or equivalent safeguards maintained by each provider. Contact us for copies of applicable transfer mechanisms.

7. Data Retention

• Active accounts: Data retained while your account is active
• Deleted accounts: Anonymized immediately; hard-deleted after 30 days
• Expired invitations: Purged after 30 days
• Read notifications: Purged after 90 days
• Game statistics: Retained for the duration of team membership
• SMS phone numbers: Removed from invite records after acceptance

8. Your Rights

All Users

• Access the personal information we hold about you
• Request correction of inaccurate data
• Request deletion of your data (Settings → Delete Account)
• Export your data in a portable JSON format (Settings → Export Data)
• Opt out of analytics tracking via cookie preferences

EEA/UK Residents (GDPR)

• Right to restrict processing
• Right to object to processing based on legitimate interest
• Right to withdraw consent at any time
• Right to lodge a complaint with your local supervisory authority

California Residents (CCPA/CPRA)

• Right to know what personal information is collected and how it is used
• Right to delete personal information
• Right to opt out of the sale or sharing of personal information
• Right to non-discrimination for exercising privacy rights

Do Not Sell or Share My Personal Information: CoachAI does not sell personal information. We share limited data with service providers solely for operating the service. To opt out of any data sharing, contact us at privacy@putmein.co.

CCPA Categories of Information Collected

• Identifiers: Name, email, phone number
• Internet activity: Usage data, feature interactions (with consent)
• Professional information: Coaching role, team management data
• Protected characteristics: Age confirmation (18+ verification)
• Health information: Medical notes, allergies (for player safety only)

9. Children's Privacy (COPPA)

CoachAI is designed for adult coaches, parents, and guardians. All account holders must be at least 18 years old. We do not permit anyone under 18 to create an account. COPPA protections apply to children's data (players under 13) that is entered and managed by adult coaches, parents, or guardians who accept responsibility under COPPA.

By entering a child's information into CoachAI, the parent/guardian consents to the collection and use of that information solely for team management purposes. Parents may review, modify, or delete their child's data at any time by contacting the team coach or emailing us at privacy@putmein.co.

10. Club Features

CoachAI allows coaches and organizations to create and manage clubs. When you participate in club features:

• Club Membership: Your name and role are visible to other club members
• Club Messages: Messages you send in club channels are visible to other club members (or targeted teams)
• Join Requests: When you request to join a club, the club admins can see your name and email
• Data Retention: Club data follows the same retention policies as team data. When you delete your account, all club memberships, messages, and join requests are removed.

11. Photos

Team and event photos may be uploaded by authorized team members. Photos of minors require parental/guardian consent. Photos are stored securely and only accessible to team members. Parents may request removal of any photo containing their child by contacting the team coach or emailing us.

12. Data Security

We implement appropriate technical and organizational security measures including encrypted connections (HTTPS/TLS), secure authentication, rate limiting, input validation, and access controls. Sensitive data such as medical notes and allergies is access-controlled and audited—only authorized team members (coaches and the player's parent/guardian) can view this information, and all access is logged for security monitoring. However, no method of transmission over the Internet is 100% secure.

13. Cookies and Tracking

We use cookies and similar technologies to enhance your experience. Analytics and error tracking cookies are only activated after you give explicit consent through our cookie consent banner. See our Cookie Policy for detailed information.

14. Automated Decision-Making

CoachAI uses automated processing to suggest player substitutions based on playing time data. These suggestions are advisory only and do not produce legal or similarly significant effects. Coaches make all final substitution decisions.

15. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy and changing the "Last updated" date. Your continued use after changes constitutes acceptance of the updated policy.

16. Contact Us

For questions about this Privacy Policy or to exercise your privacy rights, contact us at privacy@putmein.co.

If you are in the EEA/UK and are unsatisfied with our response, you have the right to lodge a complaint with your local data protection supervisory authority.