Privacy Policy

Effective Date: September 5, 2026

Virtual Coach, Inc. ("Virtual Coach," "we," "us," or "our") operates the Virtual Coach mobile application, website, early access forms, APIs, and related services (collectively, the "Service"). This Privacy Policy explains how we collect, use, disclose, retain, and protect personal information when people use the Service.

Virtual Coach is an AI-assisted basketball training platform. The Service may allow players to create accounts, complete onboarding surveys, record basketball drill videos, upload videos for AI analysis, receive AI-generated coaching summaries and skill reports, track training progress, participate in limited social features, and receive operational notifications.

Because Virtual Coach may be used by young athletes, we apply age-based protections. Users under 11 are not permitted to create player accounts. Users under 13 may use eligible parts of the Service only after a parent or legal guardian completes our parental consent process. Users ages 13 through 17 receive youth-appropriate notices and privacy defaults. Parents and guardians should review this Policy carefully before allowing a child to use the Service.

This Policy is intended to support transparent app store, privacy, and child-safety review. It does not limit any rights you may have under applicable law.

1. Who This Policy Covers

This Policy applies to personal information we collect from or about:

• Players who create or use Virtual Coach accounts.
• Parents or legal guardians who create parent accounts, provide consent, or manage child accounts.
• Website visitors and people who join our early access waitlist.
• People who contact us for support, privacy requests, security reports, or app review inquiries.

If you use a third-party service, app store, identity provider, or device operating system in connection with Virtual Coach, that third party may process information under its own terms and privacy policy. We describe the major categories of those providers below.

2. Information We Collect

2.1 Account, Identity, and Profile Information

When you create or update an account, we may collect:

• Name, display name, username, email address, phone number, locale, and account type.
• Date of birth and age group. We use date of birth to determine whether the user is under 11, under 13, a teen, or an adult. Authentication tokens use age group rather than date of birth where possible.
• Authentication identifiers, login method, session records, token family identifiers, and account security metadata.
• Parent-child relationship records, parent account details, guardian relationship information, and linked-account status.
• Consent records, including whether consent was required, which consent scopes were granted, who granted consent, timestamps, and audit events.

2.2 Onboarding, Training, and Progress Information

We collect information you provide or generate while using training features, including:

• Survey answers about skill level, goals, training habits, position preferences, equipment, and training context.
• Assessment records, drill completions, program progress, badges, points, streaks, and player metrics.
• Learning assessment reports, skill scores, AI coach summaries, recommendations, and progress comparisons over time.
• Local sync records and queued changes needed to keep app and server state consistent.

2.3 Video, Camera, and Upload Information

Video analysis is a core feature of Virtual Coach. Depending on your settings, consent status, and feature use, we may collect:

• Basketball drill videos that you choose to upload from the app.
• Video metadata such as drill key, attempt identifier, assessment identifier, duration, file size, content type, upload status, and timestamps.
• Derived video processing artifacts, such as normalized video files, extracted frames or prompts, scoring artifacts, and AI result files used to generate reports.
• Camera permission status and device capability information needed to record or process videos.

The app should access the camera only when you start a recording or use a camera feature. A recorded video may remain on your device until you choose to upload or sync it. Upload features for users under 13 require the applicable parent consent scope.

2.4 AI Analysis Information

When a video is submitted for AI analysis, we may process the video and related drill metadata to generate:

• Skill scores, overall scores, and movement or mechanics observations.
• AI-generated coaching summaries, reports, and recommended next steps.
• Quality-control and troubleshooting artifacts needed to evaluate whether an analysis job completed correctly.

AI output may be inaccurate, incomplete, or not suited to a particular athlete's needs. Virtual Coach does not use AI output to make legal, employment, educational, credit, insurance, or similarly significant decisions about users.

2.5 Social, Leaderboard, and Player Card Information

If you use social or competitive features, we may process limited profile and activity information such as display name, player card fields, badges, points, ranking, completion counts, and public-facing stats. For users under 13, these features are governed by a separate social consent scope and may be disabled unless a parent or guardian allows them.

2.6 Device, Technical, Diagnostics, and Security Information

We may collect technical information needed to operate and secure the Service, including:

• Device type, operating system, app version, browser type, IP address, request metadata, and general region inferred from network information.
• Crash logs, performance data, server logs, structured observability events, and fraud or abuse signals.
• Push notification registration metadata. For push tokens, our backend is designed to store a cryptographic hash and limited token suffix rather than returning raw push tokens from API responses.
• Security-sensitive events such as login attempts, token rotation, consent changes, upload requests, and account deletion requests.

We do not require precise GPS location for the core Service. If a future feature requests precise location, we will provide any required in-app notice and permission request before collecting it.

2.7 Product Analytics, Diagnostics, Session Replay, and Feature Controls

We collect limited operational diagnostics from app launch, including before registration and for users of any age, to detect failures, troubleshoot access, and protect the Service. These diagnostics go to Virtual Coach service logs and to a contracted diagnostics provider, including when an app failure prevents a request from reaching our service. This limited diagnostic collection does not depend on optional recording permission. It includes predefined app and sign-in steps, outcomes, error codes, status codes, timings, app/build version, device category, temporary diagnostic, event, and attempt identifiers, and bounded, sanitized exception messages and stack traces. It does not include form values, credentials, contact details, dates of birth, referral codes, screen recordings, or original request and response bodies. We do not use these diagnostics for advertising or behavioral profiling, and the provider receives them without a Virtual Coach account identifier.

Optional troubleshooting recordings are separate from operational diagnostics and required account data consent. Only users confirmed to be 18 or older can choose to allow masked recordings of app screens and interactions through an optional registration switch that is off by default, or through Settings. Recording is off by default and does not start until that choice is made. Declining does not prevent registration or access to the Service. We do not record users under 18 or users whose age is unknown, and we do not record activity retroactively from before consent.

Original client IP addresses are retained in our first-party operational logs for security and troubleshooting, but are not sent as properties to the analytics or recording provider. Temporary diagnostic session identifiers and request trace identifiers help us reconstruct related technical events without sending the original IP address to that provider.

Operational diagnostics may also include a limited, redacted description of request and response structure, not the original payloads. A predefined set of non-sensitive technical values, such as sign-in method, error and HTTP status codes, and success or pending-state flags, may be retained. Other scalar values are replaced with type markers, unapproved field names are anonymized, and depth, array, and size limits restrict the structure retained. Binary content is excluded. Failure diagnostics may include a bounded exception message and stack trace. Before transmission, recognized credentials, contact details, identifiers, URL query parameters, and other secret-like values are removed or replaced while technical function, file, and line information is retained where available. This helps us identify missing or malformed fields and failure locations without collecting private values entered or returned. A small, temporary on-device buffer lets us retry delivery after connection failures or app restarts. Buffered events and an unfinished sign-in attempt marker expire after 15 minutes; delivered events are removed from the buffer. Service-log retention is separate from this temporary buffer.

When applicable consent is present and analytics is enabled, our contracted analytics and troubleshooting providers may process:

• Route and screen activity, app-flow steps, onboarding, survey, assessment, drill, recording, upload, report, and other feature lifecycle events.
• Device and runtime context such as app surface, platform, device operating system, browser or WebView context, app version, build number, and build version.
• Bounded person or account properties used for consented analytics and feature targeting, such as Virtual Coach user identifier, account type, age group, linked-child status, locale, onboarding step, app environment, platform, and app/build versions.
• Feature flag evaluations and rollout diagnostics used to enable, disable, test, or safely roll out product functionality.
• Structured client logs, API failure events, error reports, unhandled browser errors, render errors, and selected handled exceptions with redacted route, app, and device context.
• Optional screen and interaction recordings, also called session replay, help us understand a technical failure. Personal information and input values are masked before transmission, private screens and sensitive areas are blocked, and console output, network headers, and original request or response bodies are excluded. Ordinary interface text remains visible so recordings can be used to diagnose the app experience. A recording may still be associated with an account.

You can withdraw optional recording permission in Settings at any time. Withdrawal stops new recording on that device immediately; declining or withdrawing does not turn off limited operational diagnostics needed for service reliability and security. Earlier recordings remain subject to the retention and privacy-rights sections of this Policy. We do not send analytics providers raw access tokens, refresh tokens, one-time passcodes, project tokens, email addresses, phone numbers, display names, dates of birth, referral codes, raw JWT claims, original request bodies, original response bodies, raw upload payloads, raw video files, or video analysis files through client analytics or recording.

2.8 Early Access, Website, and Support Information

If you use an early access form, contact form, or support channel, we may collect your name, email address, referrer, user agent, IP address, timestamp, message content, and related correspondence. Early access submissions may be stored with a deterministic record keyed to normalized email so duplicate submissions can be handled without creating unnecessary records.

2.9 Referral Information

Each registered user may receive a reusable referral code. When the user chooses to share from the app, we create a random short link and signed QR invitation that expire after 48 hours without embedding the permanent code in the URL or QR image. On iOS, the invitation page can copy the resolved manual code to the clipboard after the recipient explicitly taps the install button so the code can be pasted after App Store installation. If a new user chooses to use a code or temporary invitation, we store the referring account, the new account, the referral time, a lifetime referral count, and any earned Community Builder badge tier. Referrals are used for admission and rewards, not advertising profiles.

On iPhone and iPad, the app reads the clipboard only after you tap Paste. The camera is used for referrals only while you explicitly open the QR scanner. On Android, Google Play may return the random temporary share ID placed in the Play Store link after installation. We do not use advertising identifiers, device fingerprints, contacts, background clipboard access, or camera images to match referrals.

3. How We Use Information

We use personal information for the following purposes:

• Provide, maintain, personalize, and improve the Service.
• Create accounts, authenticate users, rotate and revoke sessions, secure APIs, and prevent unauthorized access.
• Determine age group, block under-11 accounts, provide teen notices, manage parent accounts, and enforce under-13 consent requirements.
• Process surveys, drill completions, assessments, videos, reports, training plans, player progress, and app sync.
• Upload videos to cloud storage, enqueue analysis jobs, normalize videos, perform AI-assisted scoring, and deliver reports.
• Operate social features, leaderboards, player cards, badges, and notifications when enabled.
• Send transactional messages, service notices, consent confirmations, security alerts, and support responses.
• Debug, monitor, protect, and improve our systems, including through logs, audits, redaction, abuse prevention, product analytics, error tracking, privacy-masked session replay, and service analytics.
• Evaluate feature flags, test feature availability, measure rollout outcomes, and diagnose whether app experiences work as intended.
• Comply with legal obligations, app store requirements, privacy requests, child-safety obligations, and enforce our Terms of Service.

4. AI and Automated Processing

4.1 What AI Does

Virtual Coach uses a proprietary AI service to analyze basketball drill videos and generate training feedback. This may include video normalization, scoring prompts, AI model calls, structured scoring output, written coaching summaries, and recommended drills or focus areas.

4.2 Human Oversight and Limitations

AI-generated feedback is supplemental training information, not medical advice, physical therapy, professional coaching, recruiting evaluation, or a guarantee of athletic performance. You should use judgment, involve a coach, parent, or healthcare professional when appropriate, and stop any activity that feels unsafe.

4.3 How Virtual Coach AI Processing Is Operated

Virtual Coach operates and controls the AI models, prompts, processing logic, and outputs used for video analysis. We use contracted cloud infrastructure processors to host and run that service on our behalf and under our instructions. Uploaded videos and derived artifacts are processed only when the required consent is active.

4.4 Infrastructure and Model Use

Virtual Coach operates its AI service for approved analysis features. Contracted cloud infrastructure processors may host and run the service on our behalf and under our instructions. We do not use uploaded videos to train shared models.

4.5 Meaningful Decisions

Virtual Coach does not use AI to make decisions that produce legal or similarly significant effects. If you believe an AI-generated report is wrong or harmful, you or your parent or guardian may contact us to request review, correction, deletion, or account-level action.

5. How We Share Information

We do not sell personal information. We do not share personal information for cross-context behavioral advertising. We share information only as described below.

5.1 Cloud, Hosting, and Infrastructure Providers

We use contracted service providers for cloud hosting, secure storage, databases, video processing, analytics, logging, monitoring, security, and related infrastructure. These processors handle information on our behalf and under our instructions only as needed to provide, secure, monitor, troubleshoot, and improve the Service.

5.2 Analytics, Diagnostics, and Monitoring Providers

We share the limited operational diagnostics described in section 2.7 with our contracted diagnostics provider independently of optional recording permission. When applicable consent is present, we may also share app activity, device context, analytics events, structured logs, error reports, feature flag data, and privacy-masked session replay data with analytics, diagnostics, monitoring, and feature-management providers when enabled. These providers process information for our service purposes and under our instructions. We do not use these providers to sell personal information or for cross-context behavioral advertising.

5.3 Virtual Coach AI Processing

When AI consent is active and you submit a video for analysis, Virtual Coach's proprietary AI service processes the video, drill metadata, prompts, extracted frames, normalized media, and derived artifacts solely to provide, test, secure, or improve the analysis feature as described in this Policy. Contracted cloud infrastructure processors may handle those materials on our behalf and under our instructions. If a parent or guardian does not provide AI consent for a child, Virtual Coach does not process that child's data through AI analysis.

5.4 App Stores, Device Platforms, and Push Services

If you install the app through the Apple App Store or Google Play, those platforms may process information under their own policies. If you enable push notifications, device platform and push notification providers may process routing information needed to deliver notifications.

5.5 Authentication and Third-Party Sign-In

If you use Google, Apple, or another supported sign-in provider, that provider may share account identifiers with us and may receive information about the sign-in event. Their handling of that information is governed by their own policies.

5.6 Parents, Guardians, and Linked Accounts

Parents or guardians with linked accounts may receive information about the child account, consent status, training activity, reports, and account controls as permitted by the Service and applicable law.

5.7 Social Features

If social features are enabled, limited profile, player card, badge, ranking, or activity information may be visible to other users. For under-13 users, social visibility requires the social consent scope and may be limited or disabled.

5.8 Legal, Safety, and Business Transfers

We may disclose information when we believe it is necessary to comply with law, respond to valid legal process, protect rights and safety, investigate abuse, enforce our Terms, or complete a merger, financing, acquisition, reorganization, or sale of assets with appropriate notice where required.

6. Children, Teens, COPPA, and Parent Controls

6.1 Under 11

Virtual Coach does not permit users under 11 to create player accounts. If we learn that a user under 11 created an account, we will take steps to close the account and delete or restrict associated personal information as required by law.

6.2 Under 13

For users under 13, Virtual Coach requires parental consent before the child can use online features that collect or disclose personal information beyond limited age-gating or account setup steps. Our consent model uses separate scopes:

• Data consent: profile data, survey answers, assessment progress, drill completions, and server sync. This does not authorize screen or interaction recordings of a child. Limited operational diagnostics described in section 2.7 remain separate from optional recording permission.
• AI consent: uploading videos, storing uploaded videos, and receiving AI-generated video reports or feedback.
• Social consent: leaderboards, public-facing player cards, rankings, and related peer-visible features.

Under-13 users can browse local drill content and may record videos locally where supported, but server-side survey submission, video upload, AI report generation, and social features may be blocked without the applicable consent. Consent is enforced in authentication claims, client feature gates, and server route checks.

6.3 Parents' COPPA Rights

Parents and legal guardians of under-13 users may:

• Review the personal information we maintain about their child.
• Request correction or deletion of the child's personal information.
• Withdraw consent for data, AI, or social features.
• Refuse further collection or use of the child's personal information.
• Ask questions about third-party providers involved in child data processing.

If a required consent scope is revoked, related features may be disabled, queued sync may fail, and affected records may be deleted, restricted, or retained only where needed for legal, security, or compliance reasons.

6.4 Teens Ages 13 Through 17

Teen users receive an age-appropriate notice and privacy protections. COPPA parental consent applies to children under 13, but other laws, platform policies, team rules, or family preferences may require additional parent or guardian involvement for teens. Parents and guardians remain responsible for deciding whether the Service is appropriate for a teen athlete.

6.5 Marketing to Children

We do not knowingly sell children's personal information or use under-13 personal information for behavioral advertising. Marketing push notifications are designed to be off by default, and under-13 player push settings should not enable marketing notifications.

7. Data Retention and Deletion

We retain personal information for as long as necessary to provide the Service, comply with law, resolve disputes, enforce agreements, protect safety, operate backups, and maintain audit records. Retention periods vary by data type.

7.1 Account and Profile Data

We retain account, profile, consent, and relationship records while an account is active. When an account is deleted, our backend is designed to soft-delete account and user-content records by marking them with deletion metadata, excluding deleted credentials from active lookup, revoking push devices, and unlinking parent-child associations where applicable. We may retain limited records where needed for legal compliance, audit, security, dispute resolution, fraud prevention, or child-safety obligations.

7.2 Videos and AI Reports

Uploaded videos, analysis artifacts, and reports may be retained while the account is active so the Service can provide historical progress, report access, and troubleshooting. On account deletion or consent revocation, we take steps to remove or disable access to associated active records and schedule deletion or restriction according to our operational processes. Backup copies, logs, and disaster recovery copies may persist for a limited period before aging out.

7.3 Authentication, OTP, Upload, and Session Records

• One-time passcodes are intended to expire quickly, typically after approximately 5 minutes.
• Refresh tokens are intended to expire after approximately 30 days and use rotation and revocation controls.
• Video upload URLs are short-lived. Standard upload URLs are intended to expire after approximately 15 minutes; longer background-upload URLs may last up to approximately 6 hours when needed.
• Access tokens are short-lived and are designed to avoid storing sensitive date-of-birth data inside the token.

7.4 Early Access and Support Records

Early access waitlist records are retained until we no longer need them for launch, early access communication, duplicate suppression, or compliance, unless you ask us to delete them earlier. Support records are retained as needed to resolve requests, maintain service history, and protect legal rights.

7.5 Logs, Audit Events, and Backups

Security logs, consent audit events, deletion records, diagnostics, and backups may be retained for limited periods even after account deletion where necessary for security, legal compliance, child-safety accountability, disaster recovery, or fraud prevention. We use reasonable measures to restrict access and avoid retaining more information than necessary.

Our first-party operational request and application-console logs are configured for 30-day retention. Redacted request and response structures in those logs follow that period. Diagnostics and optional troubleshooting recordings held by contracted providers are subject to their configured retention and our deletion workflows. Separate consent audit events, deletion records, and backups may have different limited retention periods where necessary for legal compliance, security, child-safety accountability, or disaster recovery. Access is restricted, and we avoid retaining more information than necessary.

7.6 De-Identified or Aggregated Information

We may retain de-identified, aggregated, or anonymized information that no longer reasonably identifies you or your child for analytics, product improvement, AI quality evaluation, safety, and research purposes.

8. Your Choices and Privacy Rights

8.1 Account Controls

You may be able to update profile information, manage notifications, manage social visibility, delete content, withdraw optional consents, or delete your account in the app or by contacting us. Some child account controls may require parent or guardian action.

8.2 Access, Correction, Deletion, and Portability

Depending on where you live, you may have rights to request access to personal information, correction of inaccurate information, deletion of personal information, restriction of processing, portability of information, objection to certain processing, or withdrawal of consent. We may need to verify your identity or authority before processing a request.

8.3 GDPR, UK GDPR, and EEA/UK/Swiss Users

For users in the European Economic Area, United Kingdom, or Switzerland, our legal bases may include performance of a contract, consent, legitimate interests, compliance with legal obligations, and protection of vital interests where relevant. You may have GDPR rights including access, rectification, erasure, restriction, portability, objection, withdrawal of consent, and rights related to automated decision-making. You may also lodge a complaint with your local supervisory authority.

8.4 US State Privacy Rights

Residents of California and certain other US states may have rights to know, access, correct, delete, and obtain a copy of personal information, and to opt out of sale, sharing, or targeted advertising. We do not sell personal information or share it for cross-context behavioral advertising. We do not discriminate against users for exercising privacy rights.

8.5 How to Submit a Request

To exercise privacy rights or ask a privacy question, contact us through the current support or account channels made available in the Service. Please include enough information for us to understand and verify the request. Parents or guardians requesting action for a child account should identify the child account and their relationship to the child.

9. Security

We use administrative, technical, and organizational safeguards designed to protect personal information. These may include encrypted transport, access controls, token rotation, route-level consent enforcement, hashed or redacted sensitive tokens, short-lived upload credentials, audit events, log redaction, secure cloud storage practices, and least-privilege access where practical.

No system is completely secure. You are responsible for keeping your device, operating system, app, and account access secure. If you believe your account or a child's account has been compromised, contact us promptly.

10. International Data Transfers

Virtual Coach is operated from the United States and may use service providers in the United States or other countries. If we transfer personal information from the EEA, UK, Switzerland, or another jurisdiction with cross-border transfer requirements, we will rely on appropriate safeguards where required, such as contractual protections, service provider commitments, adequacy mechanisms, or other legally recognized transfer tools.

11. App Store and Data Safety Disclosures

Our Apple App Store privacy labels, Google Play Data safety form, in-app notices, permission prompts, and this Privacy Policy should describe the same data practices. Because the Service may collect account information, contact information, date of birth or age group, video content, user-generated content, app activity, diagnostics, device information, identifiers where applicable, session replay interaction data, feature flag data, error reports, and AI-derived training data, our app store disclosures should be kept current when features or providers change.

12. Cookies and Website Tracking

Our website and app may use cookies, local storage, software development kits, or similar technologies to operate the Service, remember preferences, measure performance, protect forms from abuse, understand usage, support feature flags, diagnose errors, and improve user flows. You can control cookies through your browser settings, and mobile operating systems may provide additional controls for app permissions and tracking settings. The static marketing site should not be used to collect more personal information than necessary for the requested website function, such as an early access signup.

13. Changes to This Policy

We may update this Policy from time to time. If we make material changes, we will provide notice by updating the effective date, posting a notice, sending a message, or using another method required by law. Continued use of the Service after a policy update means the updated Policy applies to future use.

Current Implementation Disclosure Status

Virtual Coach AI processing occurs only when current consent and account eligibility allow it. Contracted cloud infrastructure processors may process data on behalf of Virtual Coach and under our instructions.

An account-erasure request is accepted for processing, then remains pending until every required internal, local, asynchronous, and external owner supplies verified deletion or a bounded retention result.

Peer visibility is optional and consent-gated. Blocking removes both peers from each other's social surfaces, and peer or AI-output safety reports follow controlled evidence and support-delivery paths.

14. Contact Us

If you have questions, requests, or concerns about this Privacy Policy or Virtual Coach privacy practices, contact us through the current support or account channels made available in the Service.