Legal
Privacy Policy
Effective date: [DATE_OF_LAUNCH] · Last updated: [DATE_OF_LAUNCH]
Sparkoach (“we”, “us”, “our”) operates a software-as-a-service platform that helps coaches log athlete training sessions and send progress reports to parents. This policy explains what personal information we collect, how we use it, and the choices you have.
What we collect
| Category | Examples | Source | Purpose |
|---|---|---|---|
| Coach account | Name, email, hashed password | You, on registration | Authentication, billing, support |
| Organization | Org name, slug, billing plan, Stripe customer ID | You + Stripe | Account ownership, billing |
| Athlete profile | First/last name, sport, date of birth (optional), parent name/email | You, on athlete create | Coaching workflow + report delivery |
| Training session data | Date, duration, skill ratings, effort, coach notes | You | Generating progress reports |
| Progress reports | AI-generated narrative, period, status, sent-at timestamp | Generated from your data | Parent communication |
| Usage telemetry | Page views, API request timing (no PII) | Auto-collected | Performance + reliability |
| Logs | Request method, path, status, duration | Auto-collected | Debugging, security incidents |
We do NOT collect: payment card numbers (handled by Stripe), athlete photos/video, geolocation, health data beyond skill ratings 1–5, or parent demographics.
How we use it
- To provide the service: display your roster, generate reports, deliver email.
- To send progress reports to parents: when you approve a report and click Send.
- To bill you: through Stripe; we receive a customer ID, not card data.
- To debug and improve: anonymous usage telemetry and logs.
We do NOT use your data to train AI models. Report-generation prompts are sent to our configured AI provider (default: Google Gemini; or Anthropic/Claude or OpenAI) under their no-training policy. Verify your provider’s current training policy at signup.
Third parties we share with
| Provider | What we share | Why |
|---|---|---|
| AI provider (configured via AI_PROVIDER — Google Gemini, Anthropic/Claude, or OpenAI) | Athlete first name, sport, derived session summaries (no DOB, no parent contact info) | Generate report narratives |
| Resend | Parent name + email, report content, account setup & password-reset links, session reminder emails | Deliver transactional email |
| Twilio (only if SMS reminders enabled) | Parent phone, short reminder text including athlete first name + session date | SMS reminders to parents |
| Stripe | Coach email, billing details | Payment processing |
| PostHog (only if configured) | Coach user ID, email, tenant ID, page-view + event metadata (no athlete PII) | Funnel + retention analytics |
| Our hosting (DigitalOcean) | All app data (encrypted at rest) | Server infrastructure |
We do NOT sell or rent your data. We do NOT share with advertisers.
Where data lives
- At rest: PostgreSQL on a DigitalOcean droplet, region [DATACENTER_REGION]. Daily encrypted backups retained 30 days.
- In transit: TLS 1.2+ between you, our servers, and all third parties.
- AI processing: the configured provider's API (Google, Anthropic, or OpenAI), called directly. Each operates US-based servers by default.
- Email delivery: Resend's US-based infrastructure.
Your rights
You can, at any time:
- Access all data we hold about you and your athletes via the in-app dashboard.
- Export your data as a single JSON file (Settings → Data export, admin role).
- Correct any data via the athlete edit form.
- Delete an athlete (soft delete) via the archive button.
- Permanently delete your account and all associated data by emailing [OWNER_EMAIL]. We will fulfill the request within 30 days.
If you are in the EU, UK, or California, you have additional rights under GDPR / UK GDPR / CCPA: portability, restriction, objection, and the right to lodge a complaint with your supervisory authority.
Retention
- Coach + athlete data: kept while your account is active. Deleted within 30 days of account closure (backups purged within 90 days).
- Sent reports: retained for 7 years (in case parents request historical records).
- Logs: 90 days.
- Telemetry: 13 months (aggregated thereafter).
Children's privacy
Sparkoach stores data about athletes who may be under 13. The legal basis is the contract between [ORG_NAME] and the coach (the controller), who has obtained parental consent through their own coaching agreement. Sparkoach does not directly collect data from athletes or parents — the coach inputs it.
If you are a parent and want your child’s data removed from Sparkoach, contact your coach directly OR email [OWNER_EMAIL] and we will remove it within 30 days.
Cookies
We use first-party session-essential cookies:
- __Secure-authjs.session-token — JWT session cookie (httpOnly, Secure, SameSite=Lax). Required for login. Expires after 30 days of inactivity.
- __Secure-authjs.csrf-token — short-lived CSRF protection.
If PostHog analytics is enabled, it also sets a first-party ph_* cookie for distinct-id tracking, used for funnel + retention analytics, never for advertising. No third-party tracking cookies. No advertising cookies.
Parent-shareable report links
When a coach sends a progress report, we generate a unique one-time link (a UUIDv4 token) and email it to the parent alongside a PDF attachment. The link:
- Is private — only the recipient should have it.
- Expires automatically 90 days after sending.
- Returns a 404 once expired.
- Reuses the same token if the coach re-sends the same report (so an earlier email still works).
Parents do not need an account to view their child’s report. The token is the credential.
Security
- Passwords hashed with bcrypt cost factor 12.
- JWT session tokens signed with a server-only secret.
- Every database query filtered by tenant boundary to prevent cross-account data leaks.
- TLS 1.2+ enforced; HSTS preload.
- Annual penetration test.
Changes to this policy
We will notify coaches by email at least 14 days before any material change. Continued use after the effective date constitutes acceptance.
Contact
Questions or requests — Email: [OWNER_EMAIL] · Org: [ORG_NAME] · Mailing: [MAILING_ADDRESS]