How we handle student data

At a glance

• School owned, not ours — The school owns athlete data. Coachlytics is the processor — we do not take ownership.
• No selling, no ads — Student data is used only to provide the service. We do not sell it or use it for advertising.
• Programs stay isolated — Schools stay isolated from each other. One program cannot see another’s athletes.
• Self-entry never lists a roster — The public athlete form never lists or searches a roster. A no-match returns a generic message only.
• Collect only what scoring needs — We collect what scoring and reporting need — not addresses, parent phones, or medical records.

Ownership and the processor relationship

All student-athlete data entered into Coachlytics — by a coach, by CSV import, or by a student through a self-entry form — is and remains the property of the school. Horsepower Solutions, LLC (Coachlytics) acquires no ownership rights in student data.

We act as a processor: we use student data only to provide the service at the school's direction. Coaches hold accounts; student-athletes do not create accounts. Students interact with the product only through scoped self-entry and attendance check-in forms when a school chooses to use them.

Programs stay isolated

Each school program's data is isolated from every other program. One coach or organization cannot see another's athletes, results, or rosters. Access controls in the application are backed by database row-level security so isolation holds even if application code is wrong.

No selling, no advertising

Student-athlete data is used only to provide the service — scoring, reporting, attendance, and related coaching workflows. We do not sell student data. We do not use it for advertising or sell it to advertisers.

What we collect — and what we do not

We collect what scoring and reporting need. Depending on how a school uses the product, that may include student ID and name, sex and bodyweight for standards, roster and program context, testing results and dates, derived scores and badges, and attendance records.

We deliberately do not collect:

• Home addresses
• Parent or guardian phone numbers
• Medical or health records beyond simple injury/exempt flags coaches set for testing

Coachlytics is not a medical record. Injury and exempt flags exist so coaches can skip or mark tests — not to store clinical history.

Public self-entry never lists a roster

The public athlete form is token-scoped and narrow. It never lists or searches a roster. When Student ID and last name do not match, the form returns a generic message only — nothing that hints at who is or is not on the roster.

Subprocessors

We use vetted service providers to run the platform. They process data only on our instructions. The current list:

• Supabase — Database, authentication, and row-level security. Privacy information
• Vercel — Application hosting. Privacy information
• Stripe — Payment processing and billing (coach account data only). Privacy information
• Resend — Transactional email (coach and staff addresses; typical templates exclude student scores). Privacy information
• Kit — Marketing email to coaches who opt in (email, first name, and tags only; no student data). Privacy information
• Sentry — Error monitoring when enabled in production (scrubbed; no session replay). Privacy information (when enabled in production)

The full contractual wording, notice rules, and related disclosures live in the Privacy Policy (section on subprocessors) and the Student Data Privacy Agreement.

Binding terms

This page is an explainer for coaches, athletic directors, and procurement. Binding terms are:

• Privacy Policy — how we handle coach and student data
• Student Data Privacy Agreement — school DPA / processor terms