Privacy Policy

1. Who we are and what this policy covers

This Privacy Policy applies to the marketing website at www.coachlytics.app, the coach application at my.coachlytics.app, and the public athlete self-entry and attendance check-in forms (together, the "Services").

We process two very different kinds of personal information:

• Coach and visitor data — information we collect for our own purposes (accounts, billing, support, and operating the marketing site). We decide how this data is used and are directly responsible to coaches and visitors.
• Student-athlete data — information we process only on behalf of a school. The school owns and controls this data. Students do not create accounts in Coachlytics; they interact with the Services only through scoped self-entry and check-in forms at a school's direction.

2. Student-athlete data

This section describes how we handle data about student-athletes. Schools, parents, and district privacy officers should read it first.

Schools own student data

All student-athlete data entered into the Services — by a coach, by CSV import, or by a student through a self-entry form — is and remains the property of the school. We acquire no ownership rights in student data and use it only to provide the Services at the school's direction. If your school or district has signed a Student Data Privacy Agreement ("DPA") with Coachlytics, the DPA controls with respect to student data.

Coachlytics is designed to support schools' obligations under the Family Educational Rights and Privacy Act (FERPA) and applicable state student-privacy laws. We do not represent that use of Coachlytics automatically makes a school FERPA compliant; your school remains responsible for its compliance program.

What student data we process

Depending on how your school uses the Services, we may process:

• Identifiers — student ID, name, and similar roster identifiers
• Demographics used for scoring — sex and bodyweight (including bodyweight recorded at test time)
• Enrollment context — roster, sport, grade level, and program membership
• Testing results — raw performance measurements, exempt/missing flags, and test dates
• Derived metrics — 1–99 standard scores, category scores, projected one-rep-max values, levels, badges, and progress indicators computed from entered results
• Attendance records — session attendance and self check-in timestamps
• Application metadata — timestamps, entry source (coach entry, import, self-entry form), and similar operational fields tied to student records

How student data enters the system

Student data may enter the Services through:

• Direct entry or edits by authorized coaching staff
• CSV import initiated by authorized coaching staff
• The public athlete self-entry form, scoped to a single coach, where the student supplies Student ID and Last Name validated server-side — no roster information is displayed and students cannot browse other athletes' data
• Attendance self check-in or kiosk check-in, scoped to a specific session token

Public forms do not write directly from the browser to our database; all submissions are validated and processed server-side.

Our commitments on student data

• We never sell student data.
• We never use student data for targeted advertising, and we show no advertising of any kind to students.
• We never use student data for marketing-purpose data mining or profiling.
• We use student data only to provide, maintain, and improve the Services.

Parent, guardian, and student rights

Requests to access, correct, or delete student records should be directed to the school, which controls the underlying education records. If we receive a direct request, we will refer the requester to the school and support the school's response within 30 days where a DPA is in place.

3. Coach and account data

When you create and use a coach account, we collect:

• Name and email address
• School or program name and organization context
• Password (stored hashed through our authentication provider; we do not store plaintext passwords)
• Billing information processed by Stripe when you subscribe (card and payment details are handled by Stripe, not stored in Coachlytics)
• Product usage and audit metadata needed to operate your account

We use coach account data to:

• Provide, secure, and maintain the Services
• Process subscriptions and send billing-related communications
• Respond to support requests
• Send service announcements and product updates related to your account

We do not sell coach account data and do not share it for third-party advertising.

4. Website visitors, cookies, and analytics

On www.coachlytics.app, we do not set advertising or cross-site tracking cookies. The marketing site does not require login and does not use third-party product-analytics SDKs such as Google Analytics, PostHog, or Plausible.

On my.coachlytics.app, we use cookies to keep coaches signed in (Supabase authentication session cookies). We also store first-party preferences locally in your browser (for example, theme and sidebar layout).

When enabled in production, we use Sentry for error monitoring. Error reports are scrubbed to remove student names, IDs, scores, and similar sensitive fields before they leave our systems. Sentry session replay is disabled.

We do not use advertising or cross-site tracking cookies anywhere on Coachlytics. If we add analytics in the future, we will update this section before those tools go live. Any vendor that can access student data will be treated as a subprocessor and schools will be notified as required by our DPA.

5. How data is shared (subprocessors)

We use trusted service providers to run the Services. They process data only on our instructions and under contractual obligations appropriate to their role:

• Supabase — Database, authentication, and row-level security. Privacy information
• Vercel — Application hosting. Privacy information
• Stripe — Payment processing and billing (coach account data only). Privacy information
• Resend — Transactional email (coach and staff addresses; typical templates exclude student scores). Privacy information
• Kit — Marketing email to coaches who opt in (email, first name, and tags only; no student data). Privacy information
• Sentry — Error monitoring when enabled in production (scrubbed; no session replay). Privacy information (when enabled in production)

We do not allow a new subprocessor to process student data without equivalent contractual protections and appropriate notice to schools as described in our DPA.

We may also disclose information:

• When required by law, with notice to the affected school first where legally permitted
• In a health-or-safety emergency, consistent with FERPA's emergency exception
• In connection with a merger, acquisition, or sale of assets, where the successor must assume our student-data obligations

Coachlytics does not sell or share personal information as those terms are defined under applicable state privacy laws.

6. Security

We implement technical and organizational measures appropriate to the sensitivity of the data we process, including:

• Database-enforced row-level security scoping queries to the authenticated coach's organization
• Encryption in transit (HTTPS/TLS) for all connections
• Encryption at rest on our database provider's managed Postgres service (provider documentation)
• Individually authenticated coach accounts (no shared logins)
• Server-side-only writes for public athlete forms; privileged keys are never exposed to the browser
• Input validation at data entry

Our security practices are aligned with the NIST Cybersecurity Framework (self-attested; not a third-party certification).

No method of transmission or storage is completely secure. We cannot guarantee absolute security, but we work to protect data using measures aligned with how schools entrust us with student information.

7. Data retention and deletion

Student data

We retain student data only as long as needed to provide the Services to your school. Upon contract termination or a school's written deletion request, we delete or return student data within 60 days, subject to the school's DPA where one exists.

Coach account data

We retain coach account data while your account is active. If you cancel your account or submit a written deletion request, we delete coach account data within 60 days, except where we must retain limited records for legal, tax, or fraud- prevention purposes.

De-identified data

We may retain de-identified or aggregated information for product improvement and benchmarking. We do not re-identify de-identified data and do not publish benchmarking results in a way that identifies a specific school.

8. Children's privacy

Coachlytics is used by schools with student-athletes who are minors, including some under 13 in middle school programs. Students do not create accounts, are not marketed to, and see no advertising in the Services.

Student data is collected at the school's direction, under the school's authority, for the school's educational purposes — including strength and conditioning testing, attendance tracking, and related coaching workflows. The public self-entry and check-in forms collect only what those workflows require and validate identity without exposing roster information.

Parents and guardians should contact their school with questions about student records. For other questions, email support@coachlytics.app with the subject line "Privacy Inquiry".

9. State privacy laws

Horsepower Solutions, LLC is based in Iowa. Many state consumer-privacy laws exempt personal information governed by FERPA or collected in a school context. Coach account data may still be subject to certain state laws depending on where you live.

We do not maintain a 50-state rights matrix at this time. If you have questions about your rights regarding coach account data, email support@coachlytics.app with the subject line "Privacy Inquiry".

10. Changes to this policy

We may update this Privacy Policy from time to time. We will post the updated policy with a new "Last updated" date. For material changes, we will notify account-holding coaches by email or in-app notice before the changes take effect. Material changes affecting student data also follow the written-notice commitments in your school's DPA where one exists.

11. Contact us