Privacy Policy

1. Overview

CoachesVault (“CoachesVault,” “we,” “us,” or “our”) respects your privacy. This Privacy Policy explains what personal information we collect when you visit coachesvault.io or use the CoachesVault platform, how we use and protect it, and your rights regarding it.

By using the Platform, you consent to the data practices described in this Policy. If you do not agree, please do not use the Platform.

2. Information We Collect

Information you provide directly:

• Name, email address, and password when you create an account
• Role (coach or athlete) and profile information (sport, bio, profile photo)
• Booking information: session type, date, time, and any notes
• Payment information: you provide card details to Stripe directly — we never see or store full card numbers. We receive only transaction amounts and Stripe account identifiers.
• For coaches: Stripe Connect account information for payouts
• For minors (under 18): a parent or guardian’s email address, collected for consent and safety purposes
• Business expense records entered by coaches (amount, description, category, date)
• Communications you send us via the contact form or email

Information collected automatically:

• IP address, browser type, operating system, and device identifiers
• Pages visited, features used, and timestamps of activity
• Authentication session tokens stored in secure httpOnly cookies

3. How We Use Your Information

We use your information to:

• Create and maintain your account
• Process bookings and facilitate payments between coaches and athletes
• Send transactional emails (booking confirmations, receipts, password resets)
• Send SMS notifications to coaches when a booking is made (if enabled)
• Provide customer support
• Improve the Platform’s features and security
• Detect and prevent fraud, abuse, and security incidents
• Comply with legal obligations, including tax recordkeeping

We do not sell your personal information to third parties. We do not use your information for advertising or behavioral tracking.

4. Children & COPPA Compliance

The Platform is not directed to children under 13. We do not knowingly collect personal information from children under 13. If we learn that we have collected information from a child under 13 without verified parental consent, we will delete that information immediately.

For athletes between 13 and 17, we require a parent or guardian’s email at registration. We use that address to notify the guardian of the account creation. If you are a parent or guardian and believe your child has registered without your consent, contact us immediately at privacy@coachesvault.io and we will delete the account within 48 hours.

5. How We Share Your Information

We share information with third parties only as necessary to operate the Platform:

• Stripe, Inc.: for payment processing, coach payouts, and fraud prevention. Subject to Stripe’s Privacy Policy.
• Resend: for transactional email delivery (booking confirmations, receipts). We share your name and email address only as needed to send emails.
• Twilio: for SMS notifications to coaches. We share coach phone numbers only when SMS notifications are enabled.
• Supabase: for secure database storage and authentication infrastructure.
• Vercel: for Platform hosting and edge delivery.

All third-party providers are bound by data processing agreements and may only use your information to provide services to us. We do not permit them to use your data for their own marketing.

We may also disclose information: (a) if required by law or valid legal process; (b) to protect the rights, property, or safety of CoachesVault, our users, or others; (c) in connection with a merger, acquisition, or sale of assets, with notice to affected users.

6. Cookies & Tracking

We use authentication cookies only — secure, httpOnly session cookies that keep you logged in. These are strictly necessary for the Platform to function. We do not use tracking cookies, advertising cookies, or third-party analytics trackers.

Disabling cookies in your browser will prevent you from logging into your account.

7. Data Security

We take reasonable technical and organizational measures to protect your information, including:

• Encrypted data transmission via HTTPS/TLS on all connections
• Row-level security (RLS) on all database tables, so users can only access their own data
• Secure httpOnly cookies with SameSite protection for authentication
• No storage of raw payment card data — all card processing handled by Stripe
• Rate limiting and input validation on all API endpoints
• Access controls limiting internal access to user data

No system is 100% secure. In the event of a data breach that affects your personal information, we will notify you within 72 hours of becoming aware of it, as required by applicable law.

8. Data Retention

We retain your personal data for as long as your account is active or as needed to provide services. If you delete your account:

• Personal profile information (name, email, bio) is deleted within 30 days
• Financial and transaction records may be retained for up to 7 years to comply with tax and accounting laws
• Anonymized or aggregated data (not linked to you) may be retained indefinitely

9. Your Rights

Depending on your location, you may have the following rights regarding your personal information:

• Access: Request a copy of the personal data we hold about you
• Correction: Update inaccurate data via your account settings or by contacting us
• Deletion: Request deletion of your account and associated personal data
• Portability: Request your data in a portable format
• Opt-out of communications: Unsubscribe from non-transactional emails at any time
• California residents (CCPA): You have the right to know what personal information we collect, request deletion, and opt out of the sale of personal information. We do not sell personal information.

To exercise any of these rights, email us at privacy@coachesvault.io. We will respond within 30 days.

10. International Users

The Platform is operated from the United States. If you access the Platform from outside the United States, your information will be transferred to and processed in the United States. By using the Platform, you consent to this transfer. We apply the same data protections to all users regardless of location.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email to your registered address at least 14 days before the changes take effect. Your continued use of the Platform after the effective date constitutes acceptance of the updated Policy.

12. Contact

Privacy questions, requests, or concerns: privacy@coachesvault.io
General support: support@coachesvault.io