Privacy Policy

This Privacy Policy applies to all users of the Chalk Talk HQ platform, including:

• Head Coaches and Administrators — who create organization accounts and manage team content
• Assistant Coaches and Staff — who join organizations via Staff Access Codes
• Athletes — who join teams via Athlete Access Codes and access Athlete Study Mode; may include minors
• Visitors — who browse public-facing pages of the Service without an account

2.1 Information You Provide Directly

• Coach/Staff accounts: Full name, email address, password (stored as a one-way cryptographic hash using bcrypt), and organization name
• Athlete accounts: Name and Athlete Access Code at the time of joining. Athletes do not provide email addresses or passwords by default
• Team/Roster data: Athlete names, jersey numbers, positions, grade level, and any notes entered by coaches
• Play and playbook content: Play diagrams (canvas data), thumbnail images, play names, formations, descriptions, and coaching notes
• Film and video content: Video clips and voice-over audio recordings that coaches upload directly or link from a third-party platform (YouTube, Vimeo, or Hudl) for drills, plays, and film review. This content may depict athletes, including minors, during team activities. Uploaded video and audio files are stored using our storage provider, Vercel Blob (see Section 5.2).
• Quiz content: Quiz names, descriptions, questions, answer choices, and correct answers
• Quiz attempt data: Athlete responses, scores, and timestamps when athletes complete quizzes
• Team settings: Team name, branding colors, and configuration preferences

2.2 Information Collected Automatically

• Session data: We use server-side session cookies (HTTP-only, secure) to maintain your logged-in state. Sessions expire after a period of inactivity.
• Log data: Server logs may record IP addresses, browser type, operating system, referring URLs, pages visited, and timestamps. This information is used for security monitoring, debugging, and service improvement.
• Usage data: We may collect anonymized or aggregated information about how the platform is used (e.g., feature adoption rates) to improve the Service.

2.3 Information We Do Not Collect

We do not collect:

• Payment card numbers (processed directly by Stripe, our payment processor — see Section 5.2)
• Government ID numbers or social security numbers
• Biometric data
• Health or medical records
• Location data beyond what may be inferred from IP address

We use collected information for the following purposes:

• Providing the Service: To create and manage accounts, store and display your plays and playbooks, grade quizzes, and operate all platform features
• Video and film review: To store, host, and play back film clips, play videos, drill videos, and voice-over recordings that coaches upload or link, and to make them available to the athletes they are assigned or shared with
• Authentication and security: To verify your identity, manage sessions, and protect against unauthorized access
• AI features: To power AI quiz generation, AI-assisted practice plan generation, voice-to-play transcription, and whiteboard/photo import by sending relevant playbook content, audio, or images to our AI service provider (OpenAI)
• Transactional communications: To send password reset emails, account verification, and essential service notifications via our email provider (Resend)
• Customer support: To respond to your questions, requests, and reports
• Service improvement: To analyze usage patterns, diagnose bugs, and improve features — using anonymized or aggregated data where possible
• Legal compliance: To comply with applicable laws, respond to lawful requests, and enforce our Terms of Service

We do not sell your personal information to third parties. We do not use your data for targeted advertising.

We recognize that youth sports programs often involve athletes under the age of 13. We are committed to handling the data of minor athletes responsibly.

Minimal Data Collection for Athletes. Athlete accounts are designed to collect only what is necessary: the athlete's name (as entered at join time) and quiz attempt records. Athletes do not create email-linked accounts by default.

Video and Image Content. A photo, video, or voice recording that depicts or identifies a specific child is personal information under COPPA, in the same way a name or quiz score is. When a coach uploads or links video that shows minor athletes — for film review, drill instruction, or play video — that video is subject to the same consent and data-handling obligations described in this Section, not only the name and quiz data described above.

Parental/Guardian Consent Responsibility. Under COPPA (Children's Online Privacy Protection Act), operators of websites directed to children under 13 must obtain verifiable parental consent before collecting personal information. Because Chalk Talk HQ is a business-to-business platform used by coaches who manage team rosters, we rely on coaches and organizations to:

• Obtain appropriate parental or guardian consent before adding minor athletes to the platform
• Inform parents about the types of information collected through the Service, including any video or voice recordings depicting their child
• Obtain consent covering video and image capture and sharing specifically, where they upload or link video that depicts minor athletes
• Respond to parental requests to review or delete athlete data

Parental Rights. Parents or guardians of minor athletes may contact us at privacy@chalktalkhq.com to:

• Review the personal information we hold about their child
• Request correction of inaccurate information
• Request deletion of their child's personal information
• Withdraw consent for further data collection (which may require account deactivation)
• Request removal of a specific video or voice recording depicting their child

We will respond to verified parental requests within 30 days.

Video Link Safety. Video attached to a play, drill, or film clip may be uploaded directly or linked from a third-party platform; pasted links are technically restricted to YouTube, Vimeo, and Hudl. We do not pre-screen, review, or monitor the content hosted at any linked or uploaded video URL. If you believe a video on the Service involving a minor is inappropriate, unsafe, or was posted without proper consent, contact us immediately at privacy@chalktalkhq.com with "Minor Athlete Video" in the subject line — we will review and remove it. See also our Terms of Service, Section 6, "Linked and Uploaded Video Content."

FERPA. Coaches using Chalk Talk HQ in a school or educational setting should be aware that student education records may be subject to the Family Educational Rights and Privacy Act (FERPA). Coaches and schools are responsible for ensuring their use of the Service complies with FERPA obligations.

We share your information only in the following circumstances:

5.1 Within Your Organization

Coaches within the same organization can view team content, rosters, plays, quiz results, and film clips. Athletes in Study Mode can view only published playbooks, film clips assigned to them or their team, and their own quiz results.

5.2 Third-Party Service Providers

We share data with the following service providers who help us operate the Service:

• OpenAI (AI Features): When you use an AI Feature — quiz generation, AI-assisted practice plan generation, voice-to-play transcription, or whiteboard/photo import — relevant content (which may include play names, descriptions, formations, audio recordings, or images, depending on the feature) is sent to OpenAI to generate the requested output. OpenAI may process and temporarily retain this data per its API usage policies. We recommend reviewing OpenAI's Privacy Policy. We use the API in a manner that opts out of training on your data where available.
• Vercel Blob (Video/Audio Storage): Video clips and voice-over audio recordings you upload directly (rather than linking from YouTube, Vimeo, or Hudl) are stored using Vercel's blob storage service. See Vercel's Privacy Policy.
• Stripe (Payment Processing): If you subscribe to a paid Plan, your payment information is collected and processed directly by Stripe; we do not receive or store your full card number. Stripe may receive your name, email address, and billing information as necessary to process payment. See Stripe's Privacy Policy.
• Resend (Email Delivery): Coach email addresses are shared with Resend solely to deliver transactional emails such as password resets and account notifications. See Resend's Privacy Policy.
• Hosting and Infrastructure Providers: Our application and databases are hosted on cloud infrastructure providers (such as Netlify, Vercel, or similar). All stored data resides on servers maintained by these providers, which are located in the United States. These providers process data as data processors under our direction.

All third-party processors are required to handle your data only as necessary to provide their services and in accordance with applicable data protection laws.

5.3 Legal Requirements

We may disclose your information if required to do so by law, court order, subpoena, or governmental authority, or if we believe in good faith that disclosure is necessary to: (a) comply with a legal obligation; (b) protect the rights, property, or safety of Chalk Talk HQ, our users, or the public; (c) prevent fraud or security threats; or (d) enforce our Terms of Service.

5.4 Business Transfers

In the event of a merger, acquisition, sale of assets, or reorganization, your information may be transferred to the acquiring entity. We will notify you via email or prominent notice on the Service prior to any such transfer and any changes to the Privacy Policy that may result.

5.5 With Your Consent

We may share your information for any other purpose with your explicit prior consent.

Session Cookies. We use a single server-side HTTP-only session cookie to maintain your authenticated session. This cookie is essential to the operation of the Service and cannot be disabled while using the platform. It contains a session identifier — not personal data — and expires when you sign out or after a period of inactivity.

No Third-Party Tracking Cookies. We do not use advertising cookies, cross-site tracking technologies, social media pixels, or analytics services that drop third-party cookies on your device.

Local Storage. The Service may use browser local storage or session storage for client-side caching of non-sensitive UI state (such as filter preferences). This data does not leave your browser and is not transmitted to our servers.

Do Not Track. We currently do not respond to browser Do Not Track signals, as there is no established industry standard for such signals. However, we do not engage in the cross-site tracking that DNT signals are designed to prevent.

We retain your personal information for as long as your account is active or as needed to provide the Service, comply with legal obligations, resolve disputes, and enforce our agreements.

• Account data (name, email, hashed password): Retained for the life of the account plus a reasonable period to handle post-termination requests
• User Content (plays, playbooks, quizzes): Retained until you delete it or your account is terminated
• Quiz attempt records: Retained for the life of the organization account
• Server logs: Typically retained for 30–90 days for security and debugging purposes
• Backups: Data in backup systems may be retained for up to 90 days after deletion from primary systems

If you delete your account, we will delete or anonymize your personal information within 30 days, except where retention is required by law or for legitimate business purposes such as fraud prevention.

We implement commercially reasonable technical and organizational measures to protect your information from unauthorized access, disclosure, alteration, or destruction, including:

• Passwords are hashed using bcrypt with a strong work factor — we never store plaintext passwords
• Session cookies are HTTP-only and secure (transmitted only over HTTPS)
• All data in transit is encrypted using TLS/HTTPS
• Access to production systems and user data is restricted to authorized personnel

No method of transmission over the internet or electronic storage is 100% secure. While we strive to use commercially acceptable means to protect your data, we cannot guarantee absolute security. In the event of a data breach that affects your rights and freedoms, we will notify affected users as required by applicable law.

Depending on your location, you may have the following rights with respect to your personal information:

• Access: Request a copy of the personal information we hold about you
• Correction: Request correction of inaccurate or incomplete data
• Deletion: Request deletion of your personal information, subject to legal obligations
• Portability: Request a copy of your data in a structured, machine-readable format
• Restriction: Request that we restrict processing of your data in certain circumstances
• Objection: Object to certain types of data processing
• Withdraw Consent: Where processing is based on consent, withdraw that consent at any time

To exercise any of these rights, contact us at privacy@chalktalkhq.com. We will respond to verified requests within 30 days. We may need to verify your identity before processing requests.

California Residents (CCPA/CPRA). California residents have the right to know what personal information we collect, to request deletion, to opt out of "sales" (we do not sell your data), and to non-discrimination for exercising these rights. To make a CCPA request, contact privacy@chalktalkhq.com.

EEA/UK Residents (GDPR). If you are in the European Economic Area or United Kingdom, you have rights under GDPR including the right to lodge a complaint with your local data protection authority. Our legal bases for processing include: performance of a contract (account operation), legitimate interests (security, fraud prevention, service improvement), legal obligation (compliance), and consent (AI features, marketing).

Chalk Talk HQ is operated from the United States. If you are accessing the Service from outside the United States, please be aware that your information may be transferred to, stored, and processed in the U.S., where data protection laws may differ from those in your home jurisdiction.

For users in the EEA, UK, or Switzerland, data transfers to the U.S. are made in accordance with applicable legal mechanisms, including Standard Contractual Clauses or other approved transfer mechanisms where required.

The Service may contain links to third-party websites or services. This Privacy Policy does not apply to those third-party sites. We are not responsible for the privacy practices of third parties and encourage you to review the privacy policies of any third-party services you access.

We may update this Privacy Policy from time to time. When we make material changes, we will notify you by updating the effective date at the top of this page and, where required by law, by providing additional notice (such as an email notification or in-app banner).

Your continued use of the Service after any changes to this Privacy Policy constitutes your acceptance of the updated policy. If you do not agree to the updated policy, you must discontinue use of the Service and may request deletion of your account.

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact our privacy team:

For data protection inquiries specific to minor athletes, please include "Minor Athlete Privacy" in the subject line and provide the organization/team name and your relationship to the athlete (parent/guardian).

Also see our Terms of Service.