Privacy Policy

Effective Date: June 23, 2026

Virtual Coach, Inc. ("Virtual Coach," "we," "us," or "our") operates the Virtual Coach mobile application, website, early access forms, APIs, and related services (collectively, the "Service"). This Privacy Policy explains how we collect, use, disclose, retain, and protect personal information when people use the Service.

Virtual Coach is an AI-assisted basketball training platform. The Service may allow players to create accounts, complete onboarding surveys, record basketball drill videos, upload videos for AI analysis, receive AI-generated coaching summaries and skill reports, track training progress, participate in limited social features, and receive operational notifications.

Because Virtual Coach may be used by young athletes, we apply age-based protections. Users under 11 are not permitted to create player accounts. Users under 13 may use eligible parts of the Service only after a parent or legal guardian completes our parental consent process. Users ages 13 through 17 receive youth-appropriate notices and privacy defaults. Parents and guardians should review this Policy carefully before allowing a child to use the Service.

This Policy is intended to support transparent app store, privacy, and child-safety review. It does not limit any rights you may have under applicable law.

1. Who This Policy Covers

This Policy applies to personal information we collect from or about:

• Players who create or use Virtual Coach accounts.
• Parents or legal guardians who create parent accounts, provide consent, or manage child accounts.
• Website visitors and people who join our early access or beta waitlist.
• People who contact us for support, privacy requests, security reports, or app review inquiries.

If you use a third-party service, app store, identity provider, device operating system, or AI model provider in connection with Virtual Coach, that third party may process information under its own terms and privacy policy. We describe the major categories of those providers below.

2. Information We Collect

2.1 Account, Identity, and Profile Information

When you create or update an account, we may collect:

• Name, display name, username, email address, phone number, locale, and account type.
• Date of birth and age group. We use date of birth to determine whether the user is under 11, under 13, a teen, or an adult. Authentication tokens use age group rather than date of birth where possible.
• Authentication identifiers, login method, session records, token family identifiers, and account security metadata.
• Parent-child relationship records, parent account details, guardian relationship information, and linked-account status.
• Consent records, including whether consent was required, which consent scopes were granted, who granted consent, timestamps, and audit events.

2.2 Onboarding, Training, and Progress Information

We collect information you provide or generate while using training features, including:

• Survey answers about skill level, goals, training habits, position preferences, equipment, and training context.
• Assessment records, drill completions, program progress, badges, points, streaks, and player metrics.
• Learning assessment reports, skill scores, AI coach summaries, recommendations, and progress comparisons over time.
• Local sync records and queued changes needed to keep app and server state consistent.

2.3 Video, Camera, and Upload Information

Video analysis is a core feature of Virtual Coach. Depending on your settings, consent status, and feature use, we may collect:

• Basketball drill videos that you choose to upload from the app.
• Video metadata such as drill key, attempt identifier, assessment identifier, duration, file size, content type, upload status, and timestamps.
• Derived video processing artifacts, such as normalized video files, extracted frames or prompts, scoring artifacts, and AI result files used to generate reports.
• Camera permission status and device capability information needed to record or process videos.

The app should access the camera only when you start a recording or use a camera feature. A recorded video may remain on your device until you choose to upload or sync it. Upload features for users under 13 require the applicable parent consent scope.

2.4 AI Analysis Information

When a video is submitted for AI analysis, we may process the video and related drill metadata to generate:

• Skill scores, overall scores, and movement or mechanics observations.
• AI-generated coaching summaries, reports, and recommended next steps.
• Quality-control and troubleshooting artifacts needed to evaluate whether an analysis job completed correctly.

AI output may be inaccurate, incomplete, or not suited to a particular athlete's needs. Virtual Coach does not use AI output to make legal, employment, educational, credit, insurance, or similarly significant decisions about users.

2.5 Social, Leaderboard, and Player Card Information

If you use social or competitive features, we may process limited profile and activity information such as display name, player card fields, badges, points, ranking, completion counts, and public-facing stats. For users under 13, these features are governed by a separate social consent scope and may be disabled unless a parent or guardian allows them.

2.6 Device, Technical, Diagnostics, and Security Information

We may collect technical information needed to operate and secure the Service, including:

• Device type, operating system, app version, browser type, IP address, request metadata, and general region inferred from network information.
• Crash logs, performance data, server logs, structured observability events, and fraud or abuse signals.
• Push notification registration metadata. For push tokens, our backend is designed to store a cryptographic hash and limited token suffix rather than returning raw push tokens from API responses.
• Security-sensitive events such as login attempts, token rotation, consent changes, upload requests, and account deletion requests.

We do not require precise GPS location for the core Service. If a future feature requests precise location, we will provide any required in-app notice and permission request before collecting it.

2.7 Early Access, Website, and Support Information

If you use an early access form, contact form, or support channel, we may collect your name, email address, referrer, user agent, IP address, timestamp, message content, and related correspondence. Early access submissions may be stored with a deterministic record keyed to normalized email so duplicate submissions can be handled without creating unnecessary records.

3. How We Use Information

We use personal information for the following purposes:

• Provide, maintain, personalize, and improve the Service.
• Create accounts, authenticate users, rotate and revoke sessions, secure APIs, and prevent unauthorized access.
• Determine age group, block under-11 accounts, provide teen notices, manage parent accounts, and enforce under-13 consent requirements.
• Process surveys, drill completions, assessments, videos, reports, training plans, player progress, and app sync.
• Upload videos to cloud storage, enqueue analysis jobs, normalize videos, perform AI-assisted scoring, and deliver reports.
• Operate social features, leaderboards, player cards, badges, and notifications when enabled.
• Send transactional messages, service notices, consent confirmations, security alerts, and support responses.
• Debug, monitor, protect, and improve our systems, including through logs, audits, redaction, abuse prevention, and service analytics.
• Comply with legal obligations, app store requirements, privacy requests, child-safety obligations, and enforce our Terms of Service.

4. AI and Automated Processing

4.1 What AI Does

Virtual Coach uses AI-assisted systems to analyze basketball drill videos and generate training feedback. This may include video normalization, scoring prompts, AI model calls, structured scoring output, written coaching summaries, and recommended drills or focus areas.

4.2 Human Oversight and Limitations

AI-generated feedback is supplemental training information, not medical advice, physical therapy, professional coaching, recruiting evaluation, or a guarantee of athletic performance. You should use judgment, involve a coach, parent, or healthcare professional when appropriate, and stop any activity that feels unsafe.

4.3 AI Providers and Service Providers

We may use cloud infrastructure and AI model providers to process videos and generate reports. These providers process information for our service purposes and under our instructions. We disclose in this Policy that uploaded videos and derived artifacts may be shared with AI processing providers when needed to provide the video analysis feature.

4.4 Model Improvement

We may use aggregated, de-identified, or otherwise privacy-protected information to evaluate and improve product quality, model prompts, scoring rubrics, and service performance. We do not use identifiable under-13 video content for optional AI model improvement unless the parent or guardian has provided the required consent. If you withdraw optional AI-improvement consent, we will stop using identifiable information covered by that consent for future optional improvement datasets.

4.5 Meaningful Decisions

Virtual Coach does not use AI to make decisions that produce legal or similarly significant effects. If you believe an AI-generated report is wrong or harmful, you or your parent or guardian may contact us to request review, correction, deletion, or account-level action.

5. How We Share Information

We do not sell personal information. We do not share personal information for cross-context behavioral advertising. We share information only as described below.

5.1 Cloud, Hosting, and Infrastructure Providers

We use trusted service providers for cloud hosting, secure storage, databases, video processing, analytics, logging, monitoring, security, and related infrastructure. These providers process information only as needed to provide, secure, monitor, troubleshoot, and improve the Service.

5.2 AI Processing Providers

When you submit a video for AI analysis, we may share the video, drill metadata, prompts, extracted frames, normalized media, or derived artifacts with AI model providers or processing services solely to generate, test, secure, or improve the analysis feature as described in this Policy.

5.3 App Stores, Device Platforms, and Push Services

If you install the app through the Apple App Store or Google Play, those platforms may process information under their own policies. If you enable push notifications, device platform and push notification providers may process routing information needed to deliver notifications.

5.4 Authentication and Third-Party Sign-In

If you use Google, Apple, or another supported sign-in provider, that provider may share account identifiers with us and may receive information about the sign-in event. Their handling of that information is governed by their own policies.

5.5 Parents, Guardians, and Linked Accounts

Parents or guardians with linked accounts may receive information about the child account, consent status, training activity, reports, and account controls as permitted by the Service and applicable law.

5.6 Social Features

If social features are enabled, limited profile, player card, badge, ranking, or activity information may be visible to other users. For under-13 users, social visibility requires the social consent scope and may be limited or disabled.

5.7 Legal, Safety, and Business Transfers

We may disclose information when we believe it is necessary to comply with law, respond to valid legal process, protect rights and safety, investigate abuse, enforce our Terms, or complete a merger, financing, acquisition, reorganization, or sale of assets with appropriate notice where required.

6. Children, Teens, COPPA, and Parent Controls

6.1 Under 11

Virtual Coach does not permit users under 11 to create player accounts. If we learn that a user under 11 created an account, we will take steps to close the account and delete or restrict associated personal information as required by law.

6.2 Under 13

For users under 13, Virtual Coach requires parental consent before the child can use online features that collect or disclose personal information beyond limited age-gating or account setup steps. Our consent model uses separate scopes:

• Data consent: profile data, survey answers, assessment progress, drill completions, and server sync.
• AI consent: uploading videos, storing uploaded videos, and receiving AI-generated video reports or feedback.
• Social consent: leaderboards, public-facing player cards, rankings, and related peer-visible features.

Under-13 users can browse local drill content and may record videos locally where supported, but server-side survey submission, video upload, AI report generation, and social features may be blocked without the applicable consent. Consent is enforced in authentication claims, client feature gates, and server route checks.

6.3 Parents' COPPA Rights

Parents and legal guardians of under-13 users may:

• Review the personal information we maintain about their child.
• Request correction or deletion of the child's personal information.
• Withdraw consent for data, AI, or social features.
• Refuse further collection or use of the child's personal information.
• Ask questions about third-party providers involved in child data processing.

If a required consent scope is revoked, related features may be disabled, queued sync may fail, and affected records may be deleted, restricted, or retained only where needed for legal, security, or compliance reasons.

6.4 Teens Ages 13 Through 17

Teen users receive an age-appropriate notice and privacy protections. COPPA parental consent applies to children under 13, but other laws, platform policies, team rules, or family preferences may require additional parent or guardian involvement for teens. Parents and guardians remain responsible for deciding whether the Service is appropriate for a teen athlete.

6.5 Marketing to Children

We do not knowingly sell children's personal information or use under-13 personal information for behavioral advertising. Marketing push notifications are designed to be off by default, and under-13 player push settings should not enable marketing notifications.

7. Data Retention and Deletion

We retain personal information for as long as necessary to provide the Service, comply with law, resolve disputes, enforce agreements, protect safety, operate backups, and maintain audit records. Retention periods vary by data type.

7.1 Account and Profile Data

We retain account, profile, consent, and relationship records while an account is active. When an account is deleted, our backend is designed to soft-delete account and user-content records by marking them with deletion metadata, excluding deleted credentials from active lookup, revoking push devices, and unlinking parent-child associations where applicable. We may retain limited records where needed for legal compliance, audit, security, dispute resolution, fraud prevention, or child-safety obligations.

7.2 Videos and AI Reports

Uploaded videos, analysis artifacts, and reports may be retained while the account is active so the Service can provide historical progress, report access, and troubleshooting. On account deletion or consent revocation, we take steps to remove or disable access to associated active records and schedule deletion or restriction according to our operational processes. Backup copies, logs, and disaster recovery copies may persist for a limited period before aging out.

7.3 Authentication, OTP, Upload, and Session Records

• One-time passcodes are intended to expire quickly, typically after approximately 5 minutes.
• Refresh tokens are intended to expire after approximately 30 days and use rotation and revocation controls.
• Video upload URLs are short-lived. Standard upload URLs are intended to expire after approximately 15 minutes; longer background-upload URLs may last up to approximately 6 hours when needed.
• Access tokens are short-lived and are designed to avoid storing sensitive date-of-birth data inside the token.

7.4 Early Access and Support Records

Early access waitlist records are retained until we no longer need them for launch, beta, product communication, duplicate suppression, or compliance, unless you ask us to delete them earlier. Support records are retained as needed to resolve requests, maintain service history, and protect legal rights.

7.5 Logs, Audit Events, and Backups

Security logs, consent audit events, deletion records, diagnostics, and backups may be retained for limited periods even after account deletion where necessary for security, legal compliance, child-safety accountability, disaster recovery, or fraud prevention. We use reasonable measures to restrict access and avoid retaining more information than necessary.

7.6 De-Identified or Aggregated Information

We may retain de-identified, aggregated, or anonymized information that no longer reasonably identifies you or your child for analytics, product improvement, AI quality evaluation, safety, and research purposes.

8. Your Choices and Privacy Rights

8.1 Account Controls

You may be able to update profile information, manage notifications, manage social visibility, delete content, withdraw optional consents, or delete your account in the app or by contacting us. Some child account controls may require parent or guardian action.

8.2 Access, Correction, Deletion, and Portability

Depending on where you live, you may have rights to request access to personal information, correction of inaccurate information, deletion of personal information, restriction of processing, portability of information, objection to certain processing, or withdrawal of consent. We may need to verify your identity or authority before processing a request.

8.3 GDPR, UK GDPR, and EEA/UK/Swiss Users

For users in the European Economic Area, United Kingdom, or Switzerland, our legal bases may include performance of a contract, consent, legitimate interests, compliance with legal obligations, and protection of vital interests where relevant. You may have GDPR rights including access, rectification, erasure, restriction, portability, objection, withdrawal of consent, and rights related to automated decision-making. You may also lodge a complaint with your local supervisory authority.

8.4 US State Privacy Rights

Residents of California and certain other US states may have rights to know, access, correct, delete, and obtain a copy of personal information, and to opt out of sale, sharing, or targeted advertising. We do not sell personal information or share it for cross-context behavioral advertising. We do not discriminate against users for exercising privacy rights.

8.5 How to Submit a Request

To exercise privacy rights or ask a privacy question, contact us through the current support or account channels made available in the Service. Please include enough information for us to understand and verify the request. Parents or guardians requesting action for a child account should identify the child account and their relationship to the child.

9. Security

We use administrative, technical, and organizational safeguards designed to protect personal information. These may include encrypted transport, access controls, token rotation, route-level consent enforcement, hashed or redacted sensitive tokens, short-lived upload credentials, audit events, log redaction, secure cloud storage practices, and least-privilege access where practical.

No system is completely secure. You are responsible for keeping your device, operating system, app, and account access secure. If you believe your account or a child's account has been compromised, contact us promptly.

10. International Data Transfers

Virtual Coach is operated from the United States and may use service providers in the United States or other countries. If we transfer personal information from the EEA, UK, Switzerland, or another jurisdiction with cross-border transfer requirements, we will rely on appropriate safeguards where required, such as contractual protections, service provider commitments, adequacy mechanisms, or other legally recognized transfer tools.

11. App Store and Data Safety Disclosures

Our Apple App Store privacy labels, Google Play Data safety form, in-app notices, permission prompts, and this Privacy Policy should describe the same data practices. Because the Service may collect account information, contact information, date of birth or age group, video content, user-generated content, app activity, diagnostics, device information, and AI-derived training data, our app store disclosures should be kept current when features or providers change.

12. Cookies and Website Tracking

Our website may use cookies, local storage, or similar technologies to operate the site, remember preferences, measure performance, protect forms from abuse, and understand usage. You can control cookies through your browser settings. The static marketing site should not be used to collect more personal information than necessary for the requested website function, such as an early access signup.

13. Changes to This Policy

We may update this Policy from time to time. If we make material changes, we will provide notice by updating the effective date, posting a notice, sending a message, or using another method required by law. Continued use of the Service after a policy update means the updated Policy applies to future use.

14. Contact Us

If you have questions, requests, or concerns about this Privacy Policy or Virtual Coach privacy practices, contact us through the current support or account channels made available in the Service.