Privacy Policy

This Privacy Policy explains how Triple Impact Coaching, doing business as CBD ("we," "us," or "our"), collects, uses, discloses, and protects personal information through the CBD website and app — accounts, rosters, scheduling, payments, video, messaging, and related services (collectively, the "Service").

This Privacy Policy applies to personal information we process in connection with the Service.

It does not govern information handled independently by third-party websites or services you choose to visit, including a YouTube video a coach links to from within the Service — YouTube's own privacy policy governs that.

The separate liability waiver and media release a parent signs before a child participates in program activities governs the information collected there, not this policy.

Account information. When you create an account, we collect your name, email address, and password-related authentication information (we do not have access to your plain-text password). Your account has a role — parent, athlete, coach, or admin — that determines what you can see and do.

Athlete profile information. A parent or guardian creates and maintains their child's profile: name, date of birth, school, graduation year, jersey number, gender, and which guardian(s) are linked to them. An athlete under 13 never has their own login, email on file, or direct account — all activity for that athlete happens through a parent or guardian's account. An athlete 13 or older may optionally have their own login; we do not collect an email address or allow a login for an athlete under 13 under any circumstance.

Payment information. Payments for program registration (camps, clinics, private training, group workouts) and video/skill-module purchases or subscriptions are processed by Stripe. We receive transaction information such as payment status, amount, transaction ID, purchase date, and limited billing details (e.g., card brand and last four digits, where supplied by Stripe) — we do not directly receive or store your complete card number.

Waiver and release records. When a parent signs the liability waiver and media release for a program, we store who signed, when, and their acceptance of each document, so we can show that a current waiver is on file.

Video and skill content. A coach may upload a video file or link a YouTube video (including a private or unlisted one) to the skill library or a team's page, along with a title, description, and optional drill/score attached. If a video is marked required viewing, we record which athletes have watched it and when.

Messaging and communications. Direct messages between a coach/admin and a parent, one-way broadcasts from a coach/admin to a roster, and any reply to a broadcast. If you opt in, we may also send SMS text messages and push notifications, and we may send you account, payment, schedule, and program email.

Coach recognition records. A coach may award recognition points to an athlete on their roster, or set one athlete as a team's featured spotlight with an optional short note — both are visible to that team's families.

Information collected automatically. Like most web services, we and our infrastructure providers automatically collect IP address, browser and device type, operating system, approximate location inferred from IP address, pages viewed, timestamps, referring page, authentication/session events, and error/diagnostic/security logs.

We do not currently use analytics or advertising cookies. If that changes, we will update this section and put any required consent or opt-out controls in place first.

We use personal information to: create and secure accounts; process program registration and payment; run the calendar and scheduling; deliver, review, and approve video content; track required-viewing completion; enable in-app messaging, broadcasts, SMS, email, and push notifications; show waiver status; run leaderboards, recognition points, and the featured-player spotlight; respond to support requests; detect and prevent fraud, abuse, and security threats; maintain and improve the Service; enforce these Terms; and comply with legal obligations.

Service providers. Providers that help us operate the Service may process information on our behalf, including Supabase (authentication, database, and file storage), Stripe (payments), Vercel (hosting), Twilio (SMS), a transactional email provider, and a push-notification provider.

Coaches and admins. A coach can see the roster, waiver status, video-watch records, and messages for the teams and programs they run; an admin can see this across the whole organization. This is how the Service works — a coach who can't see their own roster can't run a program.

Legal and safety disclosures. We may disclose information when we reasonably believe it's necessary to comply with law or a valid legal request; protect the rights, safety, or property of users, athletes, Triple Impact Coaching, or others; investigate fraud or a security incident; or establish or defend a legal claim.

Business transfers. Information may be disclosed as part of a merger, financing, acquisition, or sale of some or all of the business. Where required, we'll give notice before personal information becomes subject to materially different privacy practices.

With your direction. We may disclose information when you ask or authorize us to.

We do not sell personal information for money, and we do not share it for cross-context behavioral advertising or use it to target third-party ads. We do not knowingly sell or share the personal information of anyone under 18. If either practice ever changes, we will update this policy and put any required notices or opt-outs in place first.

We keep personal information only as long as reasonably necessary for the purposes above, including to meet legal, tax, and accounting requirements, resolve disputes, and enforce agreements.

Account and roster records: while the account is active and for a period after, to support re-enrollment and historical records.

Payment and transaction records: for the period required by tax, accounting, and financial law.

Waiver and media-release records: retained for a period appropriate to cover the applicable statute of limitations for a liability claim — this period varies by state and by the age of the athlete at the time of signing (a minor's limitations period can run well past age 18); we recommend having a lawyer confirm the right retention period for Washington rather than relying on a fixed default here.

Video-watch and messaging records: while the account is active, and for a limited period after to resolve disputes.

Support communications and system logs: about 2 years, unless a longer period is needed for security or a legal matter.

When information is no longer needed we delete, anonymize, or securely isolate it, subject to technical and legal limits. Backups may retain information temporarily until overwritten by our normal backup cycle.

We use reasonable administrative, technical, and organizational safeguards to protect personal information. No online service can guarantee absolute security. You're responsible for choosing a strong password and telling us if you suspect unauthorized access to your account.

Depending on where you live, you may have the right to request access to, correction of, or deletion of personal information we hold about you; request a portable copy; object to or restrict certain processing; opt out of sale or sharing (we don't do either — see Section 5); and receive equal service for exercising these rights.

A parent or guardian can exercise these rights on behalf of their athlete, including reviewing or requesting deletion of their child's profile information.

These rights aren't absolute — we may need to retain information to complete a transaction, keep waiver records, prevent fraud, or meet a legal obligation.

To submit a request, email arvin@coachbydesign.com with the subject "Privacy Request," describing the request and the account email involved. We may need to verify your identity first, and will respond within the period required by applicable law.

If the California Consumer Privacy Act, as amended, applies to us and your information, California residents may have rights to know, access, correct, and delete personal information; opt out of sale or sharing (we don't do either); and receive nondiscriminatory treatment. We collect, use, retain, and disclose the categories described above for the purposes described above. To exercise a California right, contact arvin@coachbydesign.com.

The Service is built around youth athletes, so unlike a typical consumer app, information about children is central to how it works — collected from a parent or guardian, not directly from the child.

An athlete under 13 never creates their own account, never has a login or email address on file, and never interacts with the Service directly — every registration, message, video view, and score for that athlete is entered and managed by their parent or guardian, who creates the athlete's profile and provides consent as part of creating that account and signing the waiver.

A parent or guardian can review, correct, or request deletion of their child's profile information at any time by contacting arvin@coachbydesign.com or, where available, directly in the app.

An athlete 13 or older may have their own limited login, used only to view their own schedule, videos, and scores.

This section is written to reflect COPPA's general framework for information collected from a parent about their own child rather than directly from a child, but it has not been reviewed by a lawyer for this specific app — that review should happen before you rely on it for a real business, especially if the mix of features here ever changes (for example, if athletes under 13 gain any form of direct interaction with the Service).

We send transactional and service messages about your account, registration, payment, schedule, and waiver status by email regardless of marketing preferences, since these are necessary to operate the Service.

SMS text messages and push notifications are sent only if you or your athlete's guardian has opted in. Message and data rates may apply to SMS. You can opt out of SMS at any time by replying STOP, and out of push notifications through your device settings; you can unsubscribe from any promotional email through the link in the message or by contacting us.

We use cookies and browser storage that are necessary to keep you signed in, maintain a secure session, and operate the Service. We do not currently use nonessential analytics or advertising cookies; if that changes, we will describe them here and put any required consent or opt-out controls in place first.

The Service may link to or embed content from external services, including a YouTube video a coach has linked. We don't control and aren't responsible for those services' privacy practices — review the relevant provider's own policy (e.g., Google's, for a YouTube embed) before relying on it.

The Service is operated from the United States. If you access it from another country, your information may be processed in the United States and other locations where our service providers operate, which may have different data-protection laws than where you live.

We may update this Privacy Policy as the Service, our providers, or applicable law changes. We'll post the updated version with a revised effective date, and give additional notice where a change materially affects how we use your information.

Triple Impact Coaching, doing business as CBD · Privacy and support email: arvin@coachbydesign.com