1. The short version
Coachzilla collects the minimum data needed to let coaches run their businesses and let clients buy from them. We don't sell your data. We share it only with the people you've chosen to work with (your coach; your clients) and with the infrastructure providers we use to deliver the Service.
This policy is a defensible draft pending counsel review. It is not legal advice.
2. Our role — controller vs. service provider
Coachzilla acts in two different roles depending on the data:
- For coach account data (the coach's own name, email, business details, subscription billing) we are a controller — we determine why and how the data is used.
- For client and athlete data (information about the people a coach serves) we act as a service provider / processor on behalf of the coach. The coach is the primary controller of that data; we process it on the coach's behalf to deliver the Service and don't repurpose it.
Where this matters: privacy-rights requests about client/athlete data may need to be routed through the coach. Email us and we'll help direct the request.
3. What we collect
Account info. Name, phone number, email address. Coaches also provide a sport and an optional title. Clients provide a name and (for athletes that aren't them) athlete name and date of birth.
Authentication. For coaches: email and password (passwords are hashed by Supabase Auth; we never see them). Optional Sign in with Apple or Google identity tokens. For clients: phone number for one-time passcode (OTP) authentication. Session timestamps and security-relevant events.
Photos. Optional. Coach profile photos and athlete photos uploaded by the client who manages the athlete profile.
Messages. Athlete-thread messages between coaches and clients, broadcasts, and session recaps the coach writes. Stored so they remain searchable in the app.
Schedule and attendance. Sessions you create or attend, who attended, when.
Payments. Amount, date, payer, payee, package purchased, the last four digits and brand of the card used. Card numbers themselves are stored by Stripe, never by Coachzilla. We store Stripe identifiers (payment IDs, subscription IDs, customer IDs) so we can look up your records.
Push tokens. When you grant push-notification permission on iOS, we store a token tied to your device so we can send notifications.
Coach activity logs. A coach-side activity feed records actions like "Sarah added Aria to the roster" so coaches have an audit trail of their own business. Visible to that coach only.
Technical / diagnostic data. Device type, OS version, app version, IP address (server-side only), crash and error reports. We use this to keep the Service working and to investigate abuse.
4. What we don't collect
- We don't track your precise location.
- We don't collect contacts, calendar entries, microphone, or camera data unless you explicitly upload a photo or use the one-way calendar export (.ics).
- We don't run third-party advertising trackers, behavioral ad networks, or cross-context behavioral advertising inside the apps.
- We don't sell personal information.
5. How we use it
To run the Service:
- Provide the in-app experience for coaches and clients.
- Process payments and surface receipts.
- Deliver push notifications about sessions, payments, and messages.
- Respond to support requests.
- Detect and prevent abuse and fraud.
- Improve the Service (product analytics, bug fixes).
- Meet legal obligations.
We do not sell personal data. We do not share it with third-party advertising networks. We do not use it to train external AI models.
6. Categories of personal information (CCPA / CPRA)
This table maps the personal information we collect to the categories defined under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA). The same shape works as a reference for other US state privacy laws that use similar categories.
| Category | Examples collected | Sources | Purposes / Recipients |
|---|---|---|---|
| Identifiers | Name, email, phone, IP, device ID, Stripe customer ID, Apple/Google subject ID | You; SSO providers; iOS device | Operate the Service, authenticate, contact you, process payments. Shared with Stripe, Supabase, Apple, Expo, Twilio (text-message delivery), our email service. |
| Customer records (Cal. Civ. Code §1798.80(e)) | Same as Identifiers, plus payment method last-4/brand and billing history | You; Stripe | Process payments, show receipts, comply with tax/accounting rules. |
| Protected classifications | Age (derived from date of birth for athletes — used to compute "Age 14" style display only) | Client-entered athlete profile | Display age band to the coach for context. Not used for advertising or profiling. |
| Commercial information | Packages purchased, sessions booked, attendance records | In-app activity | Operate the coach/client relationship. Visible only to the coach and the client involved. |
| Internet or network activity | App version, OS version, error/crash reports, basic request logs | Your device | Diagnose bugs, prevent abuse. Shared with Sentry (error tracking) and PostHog (product analytics). |
| Geolocation data | Coarse geolocation derived from IP only (no precise GPS) | Server-side request logs | Fraud detection only. |
| Audio / visual | Athlete and coach profile photos (when uploaded) | You | Display in-app to the coach and client. Stored by Supabase Storage. |
| Professional / employment information | Coach sport and optional title | Coach | Personalize the coach's profile and the client's view of who their coach is. |
| Sensitive personal information (CPRA) | Account credentials (username + password); precise geolocation NOT collected | You | Authentication only. Use limited to purposes enumerated in §7027(m) of the CCPA regulations — see Section 7 below. |
| Biometric | Not collected | — | — |
| Education information | Not collected | — | — |
| Inferences | "Active" status (derived from recent attendance); no behavioral profiling | In-app activity | Show the coach which athletes have been attending. Not used for advertising. |
Retention period for each category is described in Section 13. 12-month lookback: this table reflects categories collected in the preceding 12 months.
7. Sensitive personal information
The only Sensitive Personal Information (as defined by the CPRA) that Coachzilla processes is your account credentials (username/email + password). We use this category solely for the purposes enumerated in §7027(m) of the CCPA regulations — performing the services you've requested, providing security and fraud-prevention, ensuring quality and safety of the Service — and not for any other purpose.
Because we limit use of Sensitive Personal Information to these enumerated purposes, you do not have a separate "Limit the Use of My Sensitive Personal Information" right to exercise. If we ever expand our use of Sensitive Personal Information beyond these purposes, we will update this Policy and provide a separate opt-out mechanism.
11. The coach ↔ client data model
Coachzilla is built so that a guardian's identity belongs to the guardian. Coaches manage their own prospect data in per-coach silos. When a guardian links to a coach via the invite-code flow, identity fields (name, phone, email, date of birth, photo) become guardian-owned. Coaches can no longer edit those fields from their app — only the guardian can. This is enforced at the database layer with row-level security.
This means:
- A client's profile data flows guardian → coach on canonical link, never the other way.
- A coach who enters prospect contact info that is later claimed by a guardian loses edit access to that contact info — the guardian's version becomes the source of truth.
- A coach cannot impersonate or modify a client's identity.
12. Children's privacy (COPPA)
Coachzilla is a general-audience service and is not directed to children under 13. We do not knowingly collect personal information directly from children under 13.
Many athletes coached on Coachzilla are minors. Athlete profiles for minors are created and managed by the parent or guardian account, not by the minor. Consistent with the FTC's Children's Online Privacy Protection Act ("COPPA") FAQ guidance, information provided by a parent about their child is not "collected from a child"; the parent is the one providing it on the child's behalf.
Parent / guardian rights. The parent or guardian who manages an athlete profile may, at any time:
- Review the information stored about their child in the Coachzilla app.
- Correct any information they entered, directly from the app.
- Delete the athlete profile from the app (or email us if they need help removing it).
- Refuse to permit further collection or use of their child's information (which we accomplish by removing the athlete profile).
If you believe a child under 13 has created an account on Coachzilla in violation of these rules, please email privacy@getcoachzilla.com and we will investigate and remove the account.
13. Account closure and data retention
You can close your account from the app. When you do:
- Your personally identifiable information (name, email, phone, photo) is scrubbed within 30 days of closure.
- Your authentication record is removed; you can no longer sign in.
- Your historical relationship records are preserved so the counterparty keeps an accurate business record:
- Payments you made or received.
- Messages you sent or received.
- Sessions you booked or held.
- Packages you bought or sold.
This is deliberate: a coach should not be able to nuke your payment history by closing their account, and you should not be able to nuke their business records by closing yours.
Retention periods.
- Active accounts — retained until the account is closed.
- Closed account PII — scrubbed within 30 days.
- Closed account counterparty records (payments, messages, attendance, packages) — retained as long as the counterparty's account remains open, then handled per the counterparty's own closure.
- Authentication and security event logs — 12 months.
- Stripe payment records — retained by Stripe per Stripe's policy; we retain Stripe identifiers as long as needed to look up records.
- Transactional email logs (Resend) — up to 90 days.
- Error / crash reports (Sentry) — up to 90 days.
- Product analytics (PostHog) — up to 24 months.
- Records required by law (e.g. tax, accounting) — retained for the period required by applicable law.
If you want a copy of your data before closing your account, email privacy@getcoachzilla.com and we'll export it.
14. Security
We use industry-standard practices:
- Database row-level security (RLS) restricts data visibility to the parties who should see it.
- TLS in transit and encryption at rest.
- Stripe handles all card data; we never see raw card numbers.
- Server-side validation for all writes.
- Authentication via Supabase Auth (passwords are hashed, never stored in plaintext).
- Rate limiting and abuse detection on sensitive endpoints.
No system is perfectly secure. We will notify affected users in the event of a material data breach, as required by applicable law.
15. Your privacy rights
Depending on where you live, you may have one or more of the following rights regarding the personal information we hold about you:
- Right to know / access — what we collect, why, and who we share it with.
- Right to correct — fix inaccurate personal information.
- Right to delete — close your account and have your PII scrubbed (see Section 13).
- Right to portability — receive a copy of your data in a portable format.
- Right to opt out of sale or sharing — already on; we do not sell or share.
- Right to limit use of Sensitive Personal Information — our use is already limited (see Section 7).
- Right to opt out of profiling / automated decision-making — we do not engage in profiling that produces legal or similarly significant effects (see Section 17).
- Right to non-discrimination — we will not discriminate against you for exercising your rights.
- Right to appeal — if we deny a privacy-rights request, you may appeal the decision (see below).
To exercise any right, email privacy@getcoachzilla.com with your request and the email address on your Coachzilla account. We may need to verify your identity before fulfilling the request. We will respond within 45 days (or, where applicable law allows, up to 90 days with notice). You can also designate an authorized agent to make requests on your behalf with appropriate written authorization.
Appeals. If we deny your request, you may appeal by emailing the same address with "Appeal" in the subject line. We will respond within 60 days. If you remain dissatisfied, you can contact your state attorney general.
California "Shine the Light". California residents may request information about disclosures we have made to third parties for their direct marketing purposes during the preceding calendar year. We do not share personal information with third parties for their direct marketing purposes, so this request will return a "no disclosures" response.
State-specific: If you live in California, Colorado, Connecticut, Virginia, Utah, Texas, Oregon, Montana, Iowa, Indiana, Tennessee, Delaware, New Hampshire, New Jersey, Maryland, Minnesota, Nebraska, Rhode Island, Kentucky, or Florida, you may have additional rights under that state's comprehensive privacy law. The rights enumerated above are the superset; you may exercise whichever of them are granted by your state.
16. Universal Opt-Out signals (GPC)
On our web surfaces, we honor the Global Privacy Control (GPC) signal as an opt-out of sale, sharing, and targeted advertising under the privacy laws of California, Colorado, Connecticut, Oregon, Texas, New Jersey, and any other state that recognizes GPC. Because we do not sell, share, or engage in targeted advertising, the practical effect of a GPC signal is confirmatory — but we record the signal and treat any subsequent processing accordingly.
17. Automated decision-making
Coachzilla does not use automated decision-making, including profiling, that produces legal or similarly significant effects concerning you. Features like derived athlete "active" status (based on recent attendance) are informational only — they surface a fact to the coach and do not make decisions about access, pricing, or eligibility.
18. International data transfers
Coachzilla and our subprocessors operate servers located in the United States. We do not currently offer the Service outside the United States and do not engage in cross-border transfers of personal information as a routine matter. If you access the Service from outside the US, you consent to your information being processed in the US, which may have different data-protection rules than your country.
19. Text messages (SMS)
When you provide your mobile number in the Coachzilla app, you may receive text messages related to your account and your coaching relationship — including one-time passcodes for sign-in, session and schedule reminders and updates, broadcasts from your coach, and invitations to join a coach.
Message frequency varies based on your coach's activity and your settings. Message and data rates may apply. You can opt out of all coach messages at any time by replying STOP to any message, and reply HELP for help. Replying STOP does not stop your sign-in passcodes — those are sent through a separate verification service, so opting out can never lock you out of your own account.
You can also control this per coach without opting out of everything: the Coachzilla app's client profile has a Message Preferences section with independent Notifications, Text messages, and Email switches for each coach you work with. Turning a channel off for one coach does not affect any other coach.
We do not sell or share your mobile phone number, or your consent to receive text messages, with third parties or affiliates for their own marketing or promotional purposes. Mobile opt-in data is used solely to deliver the messages described above through our messaging providers (such as Twilio and Supabase).
20. Changes to this policy
We may update this Privacy Policy from time to time. If we make a material change to how we collect, use, or share your information, we will provide at least 30 days' notice via email or in-app banner before the change takes effect (except where an earlier change is required by law). The "Effective date" at the top of this page reflects the most recent version.
21. Contact
Questions about this Policy, or to exercise a privacy right:
- Privacy: privacy@getcoachzilla.com
- General support: support@getcoachzilla.com