Privacy Policy

Version 2026-09-01

This is a working draft written for the product as built. It must be reviewed by qualified counsel, including for COPPA and state youth-privacy requirements, before launch.

1. Who we are

CoachPath provides software that independent sports trainers use to run their coaching business and share athlete progress with families. When a trainer uses CoachPath to manage their athletes, the trainer decides what information to collect about those athletes and how it is shared; CoachPath processes that information on the trainer's behalf. CoachPath is the controller of account information for trainers, parents, and athletes who sign in.

2. What we collect

Account information: name, email address, password hash, time zone, and sign-in activity.
Trainer business information: business name, biography, credentials, services, prices, locations, availability, and any photos or videos a trainer chooses to publish.
Athlete information entered by a trainer or guardian: name, preferred name, birth year, sport, position, skill level, goals, session notes, evaluations, metrics, assignments, photos, videos, and documents. Emergency contact and health or limitation notes are optional and are collected only when a trainer or guardian chooses to enter them.
Booking and payment information: sessions booked, attendance, and payment records. Card details are handled by our payment processor (Stripe) and never touch our servers.
Messages and notifications sent through the service.
Consent records: which terms, policies, and releases were accepted, when, by whom, and from what address.
Technical information: IP address and browser type, used for security, throttling, and audit logs.

3. Children

Athlete profiles usually describe minors. A parent or guardian creates and controls the account that relates to a minor. An athlete login for a minor can be created only by the guardian, is limited to viewing what the trainer shares and marking assignments complete, and can be turned off by the guardian at any time. We do not knowingly allow a child under 13 to create an independent account. We do not use athlete data for advertising, do not build profiles for marketing, and do not sell personal information.

4. How we use information

To provide the service: scheduling, bookings, progress records, messaging, and notifications.
To send transactional email such as confirmations, reminders, and account notices. Marketing email, if ever offered, is opt-in and separate.
To keep the service secure: throttling sign-in attempts, signed media links, audit logs.
To bill trainers for their subscription and, where a trainer enables it, to process session payments to the trainer.

5. Who can see what

A trainer sees the athletes in their own workspace and nothing from any other trainer.
A staff coach sees only the athletes assigned to them.
A guardian sees only their own children, and only the notes, media, and results the trainer has chosen to share. Private trainer notes are never visible to families.
An athlete with a login sees only their own shared records.
Nothing about an athlete appears on a public page unless a trainer publishes it after obtaining explicit guardian consent.

6. Service providers

We use infrastructure providers to host the database and media storage, an email provider to deliver transactional email, and Stripe for billing and payments. Each provider processes data only to provide its service to us. The specific providers are listed in the deployment documentation and will be named here before launch.

7. Retention, export, and deletion

Trainers can archive athletes and set a retention period after which archived records are deleted. Guardians can request an export of their child's records or deletion of their child's data from the portal; trainers can do the same for their workspace. Deletion requests are fulfilled within 30 days except where a record must be kept for billing, legal, or safety reasons, in which case the remaining data is minimized.

8. Security

Passwords are hashed with a modern key-derivation function. Sessions use secure, HTTP-only cookies. Media is stored privately and served only through short-lived, signed links after an authorization check. Access is enforced on the server for every request, and sensitive actions are audited.

9. Your choices and rights

You can update your account information, change notification preferences, revoke consents you have given, and request export or deletion from your account page. Where local law gives you additional rights, you can exercise them by contacting support@coach-path.com.

10. Changes and contact

When this policy changes materially, we will update the version above and ask you to review it on your next sign-in. Questions: support@coach-path.com.