Privacy Policy

Draft date: October 9, 2026. Version privacy-2026-10-09-draft. This page matches the data flows in AUDIT.md.

1. Who this covers

The account holder must be 18 or older. Athletes are profiles under that adult account. This policy covers the parent or guardian who creates the account and the athlete profiles they add.

2. Data that stays on the device

• Video files. The video is not uploaded. Frame extraction happens in the browser.
• Athlete profiles. Nickname or first name, birth year, sport, team, position, and an optional photo for athletes 13 and older. These live in local storage on the device. Sending a profile to a different account is not available.
• Analyses, drills, plans, and badges. Scores and training history stay on the device unless you export them.

We do not store your password on the device. We do not keep your email address in local storage after sign-in. A session token stays on the device so you can stay signed in.

3. Data we collect to create an account

• Email address and a password. The password is stored only as a bcrypt hash. We do not keep the password itself.
• Date of birth, used once to check that you are 18 or older. We then store only that you are an adult and the birth year. We do not store the month or day.
• The fact that you accepted the Terms, Privacy Policy, and Safety Notice, with the time, the document versions, and a hash of the IP address. We do not store the raw IP address.
• Display name, if you give one.

4. Data sent for an analysis

When you ask for an analysis, the browser sends:

• Still JPEG frames from the video. Faces are blurred on the device before upload unless you turn that off in Settings.
• Joint angles and positions from the body. Face landmarks (MediaPipe indexes 0 through 10, including the nose) are removed before upload.
• Sport, action, an age band (under 13, 13 to 15, 16 to 17, or 18 and older), and the coach name you picked.

Our servers pass those frames and joint numbers to Anthropic to write the coaching. We do not save the frames or the joint data in our database. We do not write them to our application logs.

Anthropic says API inputs may be kept for up to 30 days for safety review and are not used to train their models. A zero-data-retention agreement is not confirmed for this product. Until it is, do not assume frames are deleted the moment the analysis returns.

5. Data on our servers

Our database is Upstash Redis, reached through the app hosted on Vercel.

• Account record: email hash, password hash, adult flag, birth year, name, plan, Stripe customer id, and token version.
• Legal logs: acceptance of Terms, Privacy Policy, and Safety Notice; renewal consent (plan, price id, the sentence you checked, time, IP hash). These are kept after account deletion. See the retention section.
• Trend rows, only for athletes 18 or older, and only if you have not opted out and your browser is not sending Global Privacy Control. A row has sport, action, scores, skill band, a coarse region from your time zone, and plan type. It does not have a name, email, or photo. Minors are not included.
• Account stats: how many athlete profiles you have and which sports, with no athlete names, ages, or scores. There is no outside CRM vendor. Older copies of the app tried to call a CRM route that did not exist.
• Email queue: messages we owe you (welcome, subscription confirmation, deletion confirmation, and under-13 consent if that feature is ever turned on). No email vendor is connected, so these messages are stored as unsent until the owner picks a vendor.
• Feedback and error reports. Feedback can include an optional email you type. Error reports include the error text, page path, and a browser label. They do not include video, frames, or your account email.
• Usage counters for the free weekly limit, paid monthly limit, and the daily cap on AI calls.

6. Who receives data

• Anthropic (Claude), for analysis. Inputs may be retained up to 30 days for safety and are not used for training unless a zero-data-retention agreement is confirmed. It is not confirmed. Anthropic privacy policy
• Vercel, which hosts the site and the API. Platform logs can include request metadata such as IP address and URL. Our code does not log frames or request bodies. Vercel privacy policy
• Stripe, which processes subscriptions. Stripe receives the account email, name, payment method, and billing address you enter at checkout. Stripe privacy policy
• Upstash, which stores the Redis records listed above. Upstash privacy

There is no advertising network, no Google Analytics, no Meta pixel, and no email marketing vendor connected. The pose model is downloaded from a public content network and runs on your device. That download does not include your video.

We do not sell personal information. We do not share it for cross-context advertising. We do not put sponsored products on athlete profiles. We do not use your videos, frames, or scores to train our own models.

7. How long we keep it

• Account data: while the account is active, then 30 days after you ask us to delete it, so a mistaken delete can be reviewed. The delete button removes the account immediately from the database. The 30 days is the outside window for backups and vendor mail queues.
• Consent and renewal records: at least 3 years, because auto-renewal rules expect a record of the agreement. Longer if a lawyer tells us we must.
• Stripe records: for as long as Stripe keeps them.
• Trend rows: aggregated numbers with no account id. Deleting an account does not erase old trend rows, because they are not tied to you.
• Anthropic inputs: up to 30 days under Anthropic's current API policy, unless zero data retention is later confirmed.
• Unsent email queue: deleted when the account is deleted.

8. Children under 13

You cannot create an account if you are under 18. Athlete profiles for anyone under 13 are blocked. The app shows: "Profiles for athletes under 13 are coming soon with parent verification."

A consent flow exists in the code and stays off until an attorney signs off. If it is turned on later, a parent on a paid Individual or Family plan would see a direct notice, give separate consent for coaching and for coach sharing, and get a confirmation with a way to revoke. Revoking coaching consent deletes that profile. Revoking coach sharing turns sharing off.

Parents can review, export, and delete athlete information from Settings, and can refuse further collection by deleting the profile or the account. Contact info@perfectformathletes.com.

9. Teens 13 to 17

A teen can have a profile only under an adult account. Trend data is off for these profiles. The Team roster stays on that adult's device and opens after the Coach Terms are accepted. Sending a profile to a different account is not available. The coaching prompt avoids max-effort, weighted, and high-risk progressions. The account holder can export or delete the profile.

10. State privacy rights

If you live in California, Colorado, Connecticut, Virginia, Utah, Texas, Oregon, or another state with a consumer privacy law, you can ask us to:

• Tell you what personal information we have about the account
• Correct it
• Delete it, subject to the records we must keep
• Get a copy (Settings, Export My Data, plus the server record included in that file)
• Opt out of sale or sharing for advertising. We do not sell or share for advertising. The request is still honored.
• Appeal a refusal by emailing the same address

We will not discriminate against you for using these rights. We do not offer a financial incentive tied to your data.

11. Global Privacy Control and Do Not Track

If your browser sends Global Privacy Control (Sec-GPC or navigator.globalPrivacyControl), we treat that as an opt-out of trend data and of any future sale or share. Settings shows "GPC signal honored." Do Not Track is treated the same way when the browser exposes it as a privacy opt-out we can read. You can also turn trend data off yourself on Your Privacy Choices.

12. Security and breach notice

• The site is served over HTTPS.
• Passwords use bcrypt with cost 12. Older unsalted hashes are upgraded the next time that person signs in.
• Session tokens expire after 7 days. Changing the password or deleting the account invalidates older tokens.
• Sign-in, sign-up, and analysis are rate limited.
• Stripe webhooks are checked with Stripe's signature and are processed once.

If we learn of a breach of personal information, we will notify affected account holders and any regulator the law requires, without unreasonable delay, at the email on the account and at info@perfectformathletes.com.

13. Contact

Privacy questions, deletion requests, and appeals: info@perfectformathletes.com

Perfect Form Athletes is operated by PFA LLC, Georgia.