Privacy Notice

Who we are

Play2Play is a short-form video app for athletes. It is operated by Play2Play LLC, a New York limited liability company. Play2Play LLC decides what is collected here and why, which makes it the controller of your personal information. Where this notice says "we", that means Play2Play LLC and the service providers listed in section 3.

Postal address: Play2Play LLC, c/o Northwest Registered Agent LLC, 418 Broadway STE N, Albany, New York 12207, United States. That is our registered agent's address for written notices. Privacy requests: privacy@play2play.co. We will verify the account holder, and, for a user under 18, a parent or guardian who establishes the relationship, before we act on a request. We aim to respond within 45 days. General support remains support@play2play.co.

This notice covers the website at play2play.co and the Play2Play iOS app. It describes what the app does, in the words we would use to explain it to a parent, and it is not legal advice.

Where Play2Play is offered

Play2Play is offered to users in the United States. We do not currently offer the service to residents of the European Economic Area, the United Kingdom, Switzerland, Canada, Brazil, or Australia, and we do not market Play2Play there. If we detect that you are in one of those places we may refuse an account or limit features. If we later offer Play2Play in another country, we will publish the privacy addendum for that country, including, for the EEA and United Kingdom, lawful basis, the age of digital consent, international-transfer safeguards, and an EU or UK representative, before we invite users there.

1. What we collect

In short: What you type in, what the app records as you use it, and what we fetch or receive from a handful of other places. Most of what you give us ends up visible to the whole internet. See section 3.

1.1 What you give us

• Your email address and a password, when you create an account. If you sign in with Apple or Google instead, we receive your name and email address from them rather than from you.
• Your real name and the username you choose.
• Your date of birth. It is used once, on your own phone or in your browser, to work out two things: the year you were born, and whether you are 13 to 17 or 18 and over. Only those two values are sent to us. The full date is never transmitted and is never stored. There is no date-of-birth field in our database.
• Profile details: display name, bio, profile and banner images, school, team or position, sport, graduating class, state or region, and whether you signed up as an athlete, a fan, or a coach.
• Your athletic stats, and a link to your public athletic profile page on another site if you want stats verified.
• Everything you post: videos, captions, images, comments, and direct messages.
• A push notification token, if you turn notifications on.
• Whether you accepted or declined analytics.
• If you joined through someone’s referral link, the code from that link and a record of which account referred you.

We do not ask for and do not store a payment card. Play2Play+ is bought through Apple, and Apple does not give us your card details. We do not collect a phone number anywhere.

Your name is stored twice. Once in the login record and once on your profile. Editing your profile changes the profile copy only. The login copy is written when you sign up and no screen in either app can change it, so a user who corrects their name still has the old one held in the login record. The same is true of the username copy. We are naming this because it is a fault in how we built it, not a design choice. Email privacy@play2play.co and we will correct the login copy by hand.

We strip embedded location and camera metadata from images within seconds of upload. When you upload a profile picture or a photo post, our server removes the GPS coordinates, camera details and other metadata your camera put in the file, keeping only what is needed to display it the right way up. For those few seconds the file is stored as you uploaded it and can be fetched by anyone who has its address. A new image our server cannot read is deleted rather than kept with its metadata. Images stored before this step existed were stripped on 6 October 2026. Videos are not covered: we do not strip metadata from video files. We do not use device GPS.

1.2 What the app records while you use it

All of this is linked to your account.

• Who watched what. When you watch a video to 90% we write a row recording that your account watched that post. We also record that a post was shown to you, up to 50 times per post, and we keep a list of up to 1,000 posts you have already been shown so the feed does not repeat itself. Put plainly: we hold a record of who watched whose video, and of what each person was shown.
• A ranking score for each post, and how many minutes of a creator’s videos have been watched.
• Counters that stop abuse: Coach messages sent today, stats submitted this minute, reports filed. These are keyed to your account, or to your IP address and the email you typed if you do not have one yet.
• Who you follow, who follows you, who you blocked, follow requests you sent or received, whether your account is private, and any report you file, including the reason and which post, profile, comment or direct message you reported.
• Your device push token and which platform you are on, captured when the app launches.

Security records. When something security-relevant happens we write it down with the IP address it came from. That includes administrative actions and every failed password sign-in that reaches our sign-in check.

A failed login record includes the email address or username that was typed, whether or not any account of that name exists. So we hold records containing the email addresses of people who have never signed up for Play2Play, whether a mistyped address or somebody else’s. These records have no expiry, nothing deletes them on a schedule, and they are not removed when an account is deleted.

Approximate location, and where it comes from. We never ask for your device location and the app never requests GPS. Every service that receives a request from you sees the network address it came from; section 3 lists them. What happens to location derived from that address at our error-monitoring provider:

• Our error-monitoring provider is set not to store your network address or any location derived from it. Error reports are not gated on your analytics answer. See section 1.3 and section 3.

That setting is applied by the provider when a report arrives, so it covers every version of the app. An error report received before 8 October 2026 may still hold a city, region and country worked out from a network address until it ages out under the provider's retention period.

Our analytics provider no longer derives your location. We have disabled its automatic capture of precise latitude and longitude, on the website, in the iOS app and from our servers, so it does not turn your network address into a latitude, longitude, postal code, city or region. If you accepted analytics it receives the time zone your device is set to, which your device reports, and nothing finer. Location values it derived before we switched this off remain on the analytics records made at the time.

1.3 What comes from somewhere other than you

We do not buy personal information and we do not receive it from data brokers. Four other sources:

• Your public athletic profile page. If you submit a stat with a link to it, our server loads that page and reads it. Section 2 explains what happens next, and section 3 names the sites.
• Apple and Google, as sign-in providers. If you use Sign in with Apple we request your full name and email address, and the name Apple supplies becomes your display name. Sign in with Google happens in your own browser, directly against Google.
• Our video provider makes something we never had, briefly. It produces a machine transcript of the audio of every video, your own voice turned into text, so the safety check can read what is said. We delete it as soon as that check has read it, usually within minutes of upload. Section 3 explains who could reach it before then.
• Our payments provider sends us purchase events, and we store the whole message it sends, exactly as it arrives.

2. What we use it for

In short: Running the app, checking every video, checking your age, answering Coach questions, verifying stats, and analytics if you agreed to it. No advertising of any kind.

• Creating your account, signing you in, and keeping it working.
• Showing your posts, stats and profile to other people, and building your feed. Your sport and what you interact with change what the feed shows you, and a score calculated nightly orders it.
• Checking every video that is uploaded, automatically, which cannot be turned off. Up to twelve still frames and up to about eight thousand characters of the audio transcript are sent to our AI provider solely to decide whether the upload is allowed under our Terms. Images are never checked. A photo post or a profile picture goes live with no automated check of any kind and is looked at only if someone reports it.
• Refusing to save text that contains a word on a fixed list we maintain. This runs in our database, on your profile, your captions and stat labels, your comments, and the direct messages you send. A refused save is not stored and not logged.
• Reviewing a direct message that someone reports. Anyone in a conversation can report a single message in it. When they do, an administrator can read that message and the five messages either side of it, whoever sent them. So a message you sent can be read by us because the other person reported it, and a message you did not report can be read because it sits beside one that was. This is automatic and there is no notice to either person. It is the only other thing in Play2Play that examines the contents of a direct message; the word list above is the first. Every such read is recorded, as section 5.2 says.
• Reviewing a reported comment, with the post it was written under.
• Checking the date of birth you give us against our minimum age of 13, in the app and again in our database. Neither check verifies anything. Both read the date you typed.
• The AI Coach. Any signed-in account can send 5 Coach messages a day; Play2Play+ raises that to 20. It is not a members-only feature. What is sent is set out in section 3.
• Stat verification, which is a Play2Play+ feature, except that an athlete without Play2Play+ can have one stat verified free. If you have Play2Play+, or are using that free check, and you have linked your public athletic profile page, we fetch that page and ask our AI provider whether your stat appears there and whether the page is yours.
• Sending notifications about your account, if you turned them on.
• Knowing whether your account has Play2Play+.
• Finding and fixing crashes and errors.
• Understanding which features get used, only if you accepted analytics.
• Using your content to show people what Play2Play is, unless you switch that off in Settings. Featuring you personally in an advert is a separate thing we ask for every time. See the Terms.
• Responding to reports, legal notices, and requests under this notice, and keeping the records the law requires us to keep about them.

We do not run advertising. No ad network, no advertising SDK, no advertising identifier, no personalisation, no advertiser or data broker receives anything from us, and we do not sell your information or share it for cross-context behavioural advertising. There is no such code in either app.

We do not use your content to train AI models. We have not enabled the settings at our AI provider that would permit training on what we send it, and its published policy states that data it retains is not used to train its models without express permission. What we send, why, and the settings we read are in section 3.

3. Who else gets it

In short: Eleven service providers, twelve outside sports websites, Apple and Google if you sign in with them, plus the entire internet for anything you post.

3.1 The public, which is the largest recipient

Your profile, your posts, your videos, your captions, your stats, your comments and the whole follower graph are public. "Public" here does not mean public to other Play2Play users. It means:

• No account is needed. The feed loads for someone who is not signed in. Profile pages are reachable from a username, and usernames are public, so profiles can be worked through one by one.
• Search engines can index it. We publish no instruction today telling any search engine to leave a profile alone. We will honor a documented request from a user under 18, or that user's parent or guardian, to ask search engines not to index a specific profile or post, and we will maintain that rule for any account we have marked as a minor once that marking exists in the product. Email privacy@play2play.co. We cannot erase copies a search engine has already stored.
• Your videos are not behind any lock. The video, its thumbnail, its animated preview, and its embed page all load for anyone with the link, with no sign-in and no token, and the video’s identifier is itself public. Another website can embed your video in its own page. We checked every video on Play2Play on 18 September 2026: all 64 of them loaded this way. The app already mints signed, time-limited playback tokens, and our video provider has a setting that refuses every one of those addresses without one. It is not yet switched on for live videos. We are switching it on for every video, and this bullet will change when it is.
• The machine transcript of your voice is no longer kept. Until 30 September 2026 a video carried a subtitle track holding what you said, transcribed, which anyone with the video’s address could fetch; on 18 September 2026, 59 of those 64 videos had one. On 30 September 2026 we deleted every one of those tracks, 59 across all 92 videos we store, with none failing. A transcript made for a new upload is now deleted as soon as the safety check has read it, usually within minutes. While that check runs, the track exists and someone who already has the video’s address could fetch it. It was never shown on screen in the app.
• Your profile picture is reachable by anyone, and its web address can be worked out from information that is already public.

Some things are not public: your email address, your password, your direct messages, your notifications, your own viewing history, whether your account is private, and your blocks and reports. "Not public" means other users cannot see them. It does not mean nobody can: an administrator can read a reported direct message and the messages around it, as section 2 sets out.

What we do not tell you here is how quickly this would be noticed, or by whom. Assume anything you post can be seen, saved, embedded elsewhere and indexed. Do not post anything you would not want a stranger to have.

Private account. There is a Private account switch in Settings, off by default at every age. When it is on, the database hides your profile, posts, stats, likes, reposts and follower lists from anyone who is not you or an approved follower, new followers have to send a request you approve, and your profile can be found in search only by its exact handle. It hides you inside the app. It does not pull back copies people already saved, and anyone who already has the address of one of your videos can keep playing it, because video addresses do not expire yet. We do not yet default a minor's account to private; that is a decision we have left to counsel, and the switch is there for you or your parent to use now.

3.2 Service providers

We share personal information with the companies that run parts of the service. They act on our instructions. The full list, what each one does, what each one receives, and how to ask one of them to delete a residual copy is at play2play.co/subprocessors. In summary:

• Supabase stores the accounts, the database and uploaded images, including direct messages. Messages are stored so the two participants and our server can read them; they are not end-to-end encrypted.
• Cloudflare hosts and streams video, produces the transcript, and counts viewing minutes.
• Vercel hosts the website and therefore sees every request and IP address.
• Anthropic is our AI provider. It receives Coach conversations together with your display name, sport, graduating class, account type and whether you are under 18; up to twelve still frames of your video; up to eight thousand characters of the transcript of your speech; and, for stat verification, the text of your linked athletic profile page with your name and username. What it keeps, for how long, and the cases where that runs to years are set out below.
• Trigger.dev runs background jobs. Audio moderation and stat verification both run there, so the transcript of your speech and the text scraped from your athletic profile page both pass through it while those jobs run.
• RevenueCat and Apple handle Play2Play+ purchases.
• Expo delivers push notifications. It receives your device token and the notification itself, whose text names the person who followed, liked or commented, which is a real name. Direct messages produce no push notification at all, so no message text reaches it.
• Sentry receives error reports. This is the one thing on this page that runs whether or not you accepted analytics, because it is what keeps the app working. It is a service-provider use, not advertising. What it receives is set out below.
• PostHog receives usage analytics, and only if you accepted.
• Stripe is not an active processor. It holds historic test records only, if any exist. Website charging is not offered.

What Anthropic keeps, and for how long. Anthropic’s published commercial retention policy, updated 1 July 2026, is that inputs and outputs are deleted within 30 days of being received or generated. That 30 days is not a ceiling. The same policy sets out four cases where content is kept longer: services whose retention the customer controls; a separate zero data retention agreement; retention needed to enforce Anthropic’s Usage Policy; and retention required for legal compliance. The policy is published at privacy.claude.com/en/articles/7996866. Our commercial terms with Anthropic say nothing about retention in either direction.

A trust and safety flag keeps content for years, not a month. Where Anthropic’s automated trust and safety systems flag content as violating their Usage Policy, that policy provides for the inputs and outputs to be kept for up to 2 years, and for the classification scores that flagged them to be kept for up to 7 years. Every video uploaded to Play2Play is sent through that system: up to twelve still frames, which routinely show your face, and up to eight thousand characters of the transcript of your voice. Most of the people uploading are under 18. Nothing tells us when content has been flagged, so we cannot tell you whether it has happened to yours.

Training, and zero data retention. Read in Anthropic’s console on 17 September 2026: our organisation’s data retention is set to 30 days, which is the default; sharing of user feedback is off, so no prompt or response is sent to Anthropic for model improvement; and we have not joined the Development Partner Program, which shares sessions including for model training. What we send is not used to train models. Zero data retention, under which Anthropic would keep nothing beyond the time needed to return a result, exists. It is not self-serve. We have decided to request it, and this paragraph will change when it is in place. Anthropic publishes a Data Processing Addendum at anthropic.com/legal/data-processing-addendum.

What Sentry receives. Error reports include technical details needed to fix a crash. They do not include your name, email, precise coordinates, or account identifier. That applies to the website, our servers, and versions of the iOS app released on the App Store after 8 October 2026: identifiers, usernames, email addresses, coordinates and the query part of web addresses are removed from each report before it is sent, request headers, cookies and bodies are not sent, and Sentry is set not to store your network address or any location derived from it. Earlier versions of the iOS app may still include an account identifier or a username inside the text of an error. Sentry removes the installation identifier, the device name and the network address from those reports as well, but it does not read inside the error text. Updating the app ends this.

What PostHog actually receives. We send it, and only it, five things about you: sport, state, graduating class, plan and account type. Those five are filtered in code, with your name, email address, date of birth, birth year and age band structurally excluded. PostHog's own code adds further technical properties we did not choose, such as your browser and device type, screen size, the address of the page you were on and the time zone your device is set to. We have disabled automatic capture of advertising click identifiers and precise latitude/longitude. Click identifiers are the tracking tags that ad platforms such as Facebook, Google, TikTok, Microsoft, X and LinkedIn attach to links. We run no advertising, but links people share have been through those platforms, so our code now removes those tags, including from inside page addresses, before an event is sent. Values captured before we switched this off remain on the analytics records made at the time.

Note also that graduating class narrows your age to about a year, and we do send it.

Session replay, on the website only. If you accepted analytics, PostHog records how you move around the site. Your inbox and your messages are excluded and that exclusion holds. What you type into forms is masked. Everything else on the screen is not: captions, comments, display names and other people’s content are captured as they appeared to you. There is no replay in the iOS app.

3.3 Twelve outside sports websites

If you link your public athletic profile for stat verification, our server fetches that page. The site you linked learns that a specific named athlete’s page is being fetched from our server, on a schedule that follows that athlete’s activity. Nothing else is sent, no name, no account, no payload, though the page address and the request itself carry that inference.

The sites we are able to fetch are: MaxPreps, Hudl, MileSplit, TFRRS, TopDrawerSoccer, Perfect Game, SwimCloud, Elite Prospects, TrackWrestling, OpenPowerlifting, USAPL (usapl.liftingdatabase.com) and AJGA. A link to anywhere else is refused.

3.4 Apple and Google as sign-in providers

If you sign in with Apple or Google, that exchange happens between your device and them. They see your credentials and your IP address. Apple supplies your full name and email address to us, and the name becomes your display name.

3.5 Everyone else

• If we are required to by law, or where we believe it is necessary to protect someone from harm, we may hand over information. Reports of apparent child sexual abuse material go to the National Center for Missing and Exploited Children, as the Terms and our Child Safety Policy explain.
• If Play2Play were ever sold or transferred, your information would go with it.

4. Your rights and choices, and how to use them

In short: You can see, correct, delete, and get a copy of what we hold, and appeal if we refuse. You can turn analytics and notifications off. We honor Global Privacy Control. There are three things you cannot do in the app today, and they are named here.

Your privacy rights

If you are a resident of California, Colorado, Connecticut, Virginia, Texas, or another state that grants consumer privacy rights, you may ask us to: tell you what personal information we have collected about you; correct it; delete it; or give you a copy in a portable form. You may also ask us not to sell or share your personal information and not to use sensitive personal information except as needed to provide Play2Play. We do not sell personal information and we do not share it for cross-context behavioural advertising, as those statutes use those words. California and Connecticut residents under 18, and a Connecticut parent of a user under 16, may also request removal of content they posted, as described in section 7.4.

Send requests to privacy@play2play.co. We will verify that you are the account holder, or a parent or guardian who establishes the relationship, or an authorised agent with proof of authority, and respond within 45 days. If we deny a request you may appeal by replying to our decision, and a person who did not make the first decision will look at it. We will not discriminate against you for exercising these rights. You do not have to live in one of those states to ask; we answer every request the same way.

Global Privacy Control

If your browser or device sends a Global Privacy Control or similar legally recognised opt-out preference signal, we treat that signal as a request to opt out of the sale and sharing of personal information, not to use it for cross-context behavioural advertising, and to limit sensitive personal information to what is necessary to run the service. We do not sell personal information and we do not run advertising, so the operational result is already no sale and no share. We still honor the signal. Analytics still run only after you press Accept. Error monitoring is a service-provider use that keeps the app working; it is not advertising and is not turned off by that signal. Neither our error-monitoring provider, for reports received from 8 October 2026, nor our analytics provider keeps location derived from your network address.

Your choices in the app

• Change what we hold: edit your profile in the app at any time.
• Delete your account: Settings, then Delete account. Section 5 says exactly what that removes and what it does not.
• Analytics: accept or decline when asked. On the website you can change it later in Settings, Cookie Preferences. If you decline, or have not answered, nothing is sent to our analytics provider. Error reports are not covered by this and run either way.
• Notifications: turn push notifications off in your iPhone’s Settings, under Play2Play.
• Private account: a switch in Settings. Section 3.1 says exactly what it hides and what it does not.
• Promotional use of your content: there is a switch in Settings. Featuring you personally in an advert is never covered by it. We ask you, and your parent or guardian if you are under 18, every time.
• Ask us anything else: email privacy@play2play.co, including for a copy of what we hold, or to correct or delete something. We may need to check you are the account holder first.

What you cannot do in the app today. We would rather name these than let you assume otherwise. Each of them can be done by emailing privacy@play2play.co, where a person does it by hand:

• You cannot delete an individual direct message. There is no such button and no such request path. Deleting your whole account is the only thing that removes a message, and until then it stays readable to the person you sent it to.
• You cannot change your birth year or age band, and neither can we through the app. They are locked after they are first written. Email us.
• You cannot correct the copy of your name held in the login record. See section 1.1.

5. Security and how long we keep things

In short: Written to be accurate rather than reassuring. Several things you might assume are in place are not, and they are listed.

5.1 What protects your information

Accounts and data are held in Supabase, with rules in the database, not in the app, deciding who can read what. Moderation records, security records and purchase payloads are readable only by our server. Everything travels over HTTPS. Our database and storage providers encrypt data at rest at the platform level. Passwords are never handled by our own code; they go to the managed authentication service, which stores a hash. On iOS, from app version 1.0.7 (released October 3, 2026), your session tokens are encrypted on the device with a key kept in the iOS keychain; earlier versions kept them unencrypted in the app’s own storage.

What one account can read about another. The database limits which parts of a profile a signed-in account is allowed to read at all, column by column. On 18 September 2026 a signed-in account could read 31 of the 51 columns we keep on a profile. Your birth year, your age band and your device push token are not among them, so somebody with an ordinary account can no longer work out which users here are minors, or get hold of the address their device receives notifications at. Four columns we intend to close are still readable: the ban timestamp, the promotional opt-out flag, and the two Play2Play+ membership fields. Installed iOS apps read those four when they launch, and the iOS app cannot be updated except through the App Store, so they are waiting on the next build.

Direct messages are readable by the people in the conversation, and by our server. No other account can read them. Adding somebody to a conversation is not something an account can do for itself: the only thing permitted to add a participant is the routine that opens a conversation, and that routine works out who you are from your sign-in rather than taking your word for it, refuses if either of you has blocked the other, requires the two of you to follow each other, and adds exactly the two of you. We say "and by our server" because that is true of everything on this page, and because of the fixed-word-list check in section 2, which is the one automated thing that looks at the words in a message.

Sign-in through our servers is limited to 5 attempts per five minutes for each pair of network address and email or username, and the website also asks for a bot check. The iOS app cannot produce that challenge and relies on the rate limit alone. There is no bot challenge on signup on either platform.

5.2 What is not in place

• No application-level encryption of any field. Direct messages are stored as ordinary text in an ordinary column. There is no end-to-end encryption of messages.
• A ban stops changes at once, but not reading. From the moment of a ban the account cannot post, comment, like, follow, message, report or change its profile, even from a session that has not yet expired; the database refuses every such change. Until that session lapses it can still read what any signed-in account can read, and it could still upload a file, which cannot become a post.
• Metadata is stripped from images within seconds of upload, but not from videos, as set out in section 1.1.
• Administrator access is a single flag. There are no roles and no tiers. Ban actions are logged, and so is every time the moderation queue serves the contents of a reported direct message; that record holds which messages were served and when, not the messages themselves. Nothing else an administrator reads is recorded.

No system is perfectly secure and we cannot promise ours will never be broken into. Use a password you do not use anywhere else.

5.3 How long we keep it

While you have an account, we keep your information. Nothing about a finished account expires on a timer. The scheduled clean-ups are: abuse counters, which delete themselves once their limit period ends (a day at most); accounts that never finished signing up, deleted after 24 hours; and the video file of an upload our check rejected, kept for 14 days so a mistaken rejection can be reversed, then deleted.

The moderation record we keep for every upload. Every video produces one, including the ones that pass. It holds the decision: allowed, rejected, or not checked. Not checked means the automated check could not be completed, for example because our AI provider was unreachable. A video that was not checked is held. It cannot be played and is not shown in the public feed until a person reviews it, and the record notes the delay and why. If that person removes the video, a second record says a person made that decision. Of the 56 records we held on 18 September 2026, 55 say allowed and 1 says rejected. It holds a short written explanation produced by the AI, an identifier for the video, the post it belonged to, the sport, and the time. The written explanation is machine-written and is not shown to creators. We do not keep the frames or the transcript themselves. These records are readable only by our server, and the list below says which of them outlive the post.

Deleting a post has not always removed the video. On 18 September 2026 we counted 26 videos still held by our video provider whose posts no longer exist. They were uploaded in June and July 2026, 20 of them would still have played, and each one still carries the identifier of the post it belonged to. We have put all 26 behind a token and confirmed the same day that they no longer play without one. They have not been deleted. Uploads that our automatic check rejects go down a different path: a rejected video stops playing at once, is kept by our video provider for 14 days in case the decision is reversed, and is then deleted.

When you delete your account in Settings, then Delete account, that removes your profile, your posts, your videos held by our video provider, your stats, your comments, your likes, your reposts, your follows in both directions, your direct messages and the conversations they were in, your notifications, your uploaded images, your seen-posts list, reports filed about you, and the login itself.

What stays after you delete your account:

• Security and administrative records, including failed logins with IP addresses and the email addresses or usernames typed into them.
• Moderation records for uploads whose post no longer exists, including the video identifier and the AI’s written explanation.
• If we could not delete something at one of our providers, a row recording that failure, containing your account identifiers, so the failure can be found and finished. We retry failed deletions at our video, analytics and payments providers daily until they succeed. Our error-monitoring provider is told only which provider failed and how many items, not who you are, unless that row itself could not be saved.
• Purchase events from our payments provider, including the whole message as they sent it. The link to your account is removed; the message is kept, because we must be able to show Apple what was granted.
• Support emails you sent us, and any message sent through the old contact form before it was replaced.
• Records we are required to keep about a child-safety report, a copyright notice, or a legal request, for as long as the law requires.
• Anything our AI provider has flagged. Content its trust and safety systems flagged as violating their Usage Policy is held for up to two years, and the scores that flagged it for up to seven, whether or not your account still exists. Section 3 sets this out.

Deletion is not a single transaction, so a failure partway through can leave an account alive with parts of its content already gone. Your videos are removed first; your images, analytics and purchase records at our providers are removed only after your profile is gone, so a failed attempt does not take those while your account stays alive. A failed video deletion is recorded and retried daily.

The transcript of your speech is deleted after the safety check. Our video provider makes it so the audio of an upload can be checked. Once the check has read it we delete it, whatever the check decided, usually within minutes of upload. If that deletion fails, a daily check of recent uploads finds the transcript and deletes it, so it is gone within about a day. Deleting a video also removes its transcript: we tested this on 17 September 2026 on a throwaway upload of our own, and the request for the caption afterwards returned not found. For a short period after a deletion the public playback address can still answer. We read that as caching at the delivery network rather than a surviving copy.

When you delete your account we send a deletion instruction to four providers that hold a copy: our video provider, our file storage, our analytics provider and our payments provider. If one of them fails we record it, and we retry the video, analytics and payments deletions daily until they succeed. Our deletion routine sends our error-monitoring provider no identifier. Earlier versions of the iOS app may have included one in the text of an error report (see section 3.2); email us and we will delete those reports. Other providers on our Providers page are not sent an automatic instruction, including our AI provider, our hosting and background-job providers, our push-notification provider and our card payments provider; for those, email privacy@play2play.co and we will send a deletion request to each one that holds a copy of your information, and tell you what each one said. Some providers keep a limited residual for security or legal reasons, and the Providers page says which. Purchase records from Apple remain with Apple.

If you want to know whether a particular record about you still exists after deletion, email us and we will check and tell you.

6. Children and teens

In short: You must be 13. Most of our users are under 18. Almost nothing in Play2Play behaves differently for a minor, and this section says exactly what does and what does not, and what a parent can ask us to do.

6.1 The minimum age, and state rules

You must be at least 13 to create a Play2Play account. We ask for your date of birth at signup, the app checks it, and our database checks it again when your profile is saved. Neither check verifies anything. Both read the date you typed, and someone who enters a false date is caught by neither. The database check is coarser than the one on your device: it holds only a year, so it can only refuse someone who could not possibly turn 13 this calendar year.

The band is worked out on the day you sign up and is recalculated daily. Because we keep only the year you were born, not the date, an account moves from 13-to-17 to 18-and-over on 1 January after the 18th birthday, never before it. To have it corrected sooner, email privacy@play2play.co.

Some states set a higher minimum age or require a parent's consent before an account may exist. Where a statute requires it, we will require that consent before the account is opened or kept, using a commercially reasonable method, and we will refuse or close accounts we are required to parent-verify and cannot.

Florida. If Play2Play is a social media platform under Florida law, we cannot provide an account to anyone under 14, and a parent or guardian must consent before anyone 14 or 15 holds an account. We will apply those rules to Florida users. A typed date of birth is not parental consent. Where the law requires it we will use a commercially reasonable method to confirm age and, for 14- and 15-year-old Florida users, to confirm a parent's consent.

6.2 If you tell us you are under 13

Signup happens in two steps, and your account is created in the first one. When you enter your email and password, an account and an empty profile already exist. The age check happens in the second step, when you set your username and enter your date of birth.

So if you tell us you are under 13 you are stopped and cannot finish signing up or use the app, though the email address, password, name and username from the first step have already been saved. An account that has not finished signing up is deleted automatically after 24 hours, together with those details. Your age is not saved, because that is the write we refused.

If that happened to you or to your child, email privacy@play2play.co and we will delete it. We do not knowingly let anyone under 13 use Play2Play. If we learn that an account belongs to a child under 13, we delete the account and the personal information we hold about it, subject only to records we must keep for security, payment, or legal reasons. If you believe someone under 13 has an account, tell us at that address and we will look into it and remove it. There is no automated process behind this and no button in the app that does it. A person reads your email and removes the account by hand through our database console, so allow a few days, and email again if you have not heard back.

6.3 Parents and guardians

If you are the parent or guardian of a user under 18, email privacy@play2play.co to see what we hold about your child, correct it, delete the account, ask us to keep your child's profile out of search engines, or make a removal request under section 7.4. We will ask you to establish your relationship to the account before we act, and we will confirm to you in writing when it is done.

We do not currently collect verifiable parental consent at signup. Where a statute requires it before an account of a certain age may exist, we will require it before that account is opened or kept. Our Terms ask a user under 18 to represent that a parent or guardian knows they are using Play2Play and permits it. That is a representation, not a mechanism. We are building a parent-facing control; it is not in the app today, and until it is there is no parental control, no supervision feature, and no parent-facing screen anywhere in Play2Play.

6.4 What is different if you are 13 to 17

One thing. The AI Coach is told it is talking to a minor, which stops it asking your age and bars it from asking about your weight, body composition, medications, medical history or life stage, and from recommending weight-loss diets, restriction or performance supplements. Those rules are applied before a reply is shown. They can still fail. We do not keep Coach replies, so we cannot audit them afterwards. Do not rely on the Coach for training load, diet, injury, or mental health. If a reply looks wrong, close the chat and tell a parent or a qualified coach. We may add human review or tighter limits for some ages.

An account with no age band recorded is treated as under 18 for these rules, not as an adult. Only an account recorded as 18 and over gets the adult version.

6.5 What is not different, and you should know it

Everything in this list applies to every account at every age:

• Your profile, posts, videos and stats are public to the whole internet by default, as described in section 3.1. The Private account switch exists, and it is off by default for a 14-year-old exactly as it is for an adult.
• Minors appear in the public feed and in rankings exactly as adults do.
• Messages between adults and under-18s are turned off. Two people must follow each other to message, and on top of that an account that may be under 18 cannot start or continue a conversation with an account that is 18 or over, in either direction. Age comes from the birth year given at sign-up; a birth year that means the person could still be 17 counts as under 18. An account that has not finished setting up, and so has given no age, cannot message anyone or be messaged. A conversation between an adult and an under-18 that existed before 13 October 2026 can still be read, but nothing can be added to it. Each account can also send at most 20 messages a minute and 500 a day.
• There is no restriction on who may follow or view a minor. There is no adult verification beyond the birth year someone enters, and apart from messaging there is no separation between adult and minor accounts. An account that signed up as a "coach" receives exactly what any other account receives; the label changes how the profile is drawn, whether it appears under a sport filter in search, and what the Coach is told about you, and nothing else.
• Reporting covers posts, profiles, comments and direct messages. A direct message is reported one message at a time, and the reviewer sees the five messages either side of it for context. For contact that has moved off Play2Play, or anything you would rather tell a person directly, email safety@play2play.co. The Terms, section 11, and our Child Safety Policy say what happens next.
• There is no way to take down a single direct message. A reviewer who agrees with a report about a message can ban the sender or do nothing; the message itself stays where it is, as section 5.3 explains.
• The moderation check on video sound looks for grooming, sexual solicitation, and attempts to move someone off the app. It runs on every video from every user, not only minors’.
• Video uploads from a 13-to-17 account are moderated the same way as adult uploads, with still frames and a transcript sent to our AI provider, because the community includes minors and the check cannot be optional. A parent who does not want a child’s likeness processed that way should not permit the account to upload video. There is no upload lock a parent can set today.
• Your name, email address, date of birth, birth year and age band are never sent to our analytics provider. Your graduating class is, and it narrows your age to about a year.

7. US state privacy rights

In short: The same facts as above, grouped the way US state privacy laws group them, plus the removal rights that apply to some users under 18. How to exercise any of them is in section 4.

7.1 Categories of information

• Identifiers and contact details: yes. Email address, name, username, profile identifier, IP address, device push token.
• Protected characteristics such as age: yes. Birth year and whether you are under 18.
• Commercial information: yes. Play2Play+ purchase and subscription records, including the full message our payments provider sends us.
• Internet or network activity: yes. Which posts you were shown, which you watched to the end, and what you did in the app.
• Audio, electronic or visual information: yes. The videos and images you upload, the audio in them, and the machine transcript of that audio.
• Geolocation: our error-monitoring provider is set not to store your network address or any location derived from it, and our analytics provider no longer derives location from your network address; it receives only the time zone your device is set to. We do not collect GPS or device location and the app never asks for it. Embedded coordinates are removed from images you upload within seconds of upload; videos are not covered. Section 1.2 has the detail.
• Sensitive personal information: yes, briefly. Your date of birth is used once on your own device and never stored by us. What we keep is the year and whether you are a minor. We use sensitive personal information only as needed to provide Play2Play.
• Biometric information: see 7.2.
• Professional or employment information: no.
• Education information: no. We stopped collecting it on 4 August 2026, and on 24 August 2026 we deleted everything we held. The grade-point-average field and the academic records table were dropped from our database and no longer exist.

7.2 Biometric information, stated carefully

We do not create, request or store a faceprint, a voiceprint, a facial-geometry template or any other biometric template, and nothing in Play2Play identifies or matches a person by their face or voice.

What does happen is in section 2: still frames from your video, which may show your face, and an automatic transcript of your recorded speech, are sent to our AI provider solely for safety review of that upload. We do not use those frames or that transcript to identify you across photos or videos, to build a recognition system, or to train a model.

Residents of Illinois, Texas, and other states with biometric statutes. We will not send identifiable face frames from an account we know is in those states until we have a written policy and a written consent flow for that processing. When that routing ships, video from those states will be reviewed by a person or by a method that does not transmit raw face images. Today every upload is checked the same way, and we are saying so rather than implying otherwise. Our Providers page carries the same commitment.

7.3 Selling, sharing and advertising

We do not sell personal information, we do not share it for cross-context behavioural advertising, and we run no advertising. We do disclose personal information to the providers in section 3 so they can do their jobs, and they act on our instructions. Section 4 explains how we treat a Global Privacy Control signal.

7.4 Removal of content posted by a user under 18

Two states give people under 18 a right to have content they posted taken down. We act on the request wherever you live.

• California. If you are a California resident under 18 and registered with Play2Play, you can ask us to remove content you posted. Email privacy@play2play.co with "Minor content removal" in the subject line, from the email address on the account, and tell us what to remove.
• Connecticut. If you are a Connecticut resident under 18, the same applies. If you are the parent or guardian of a Connecticut user under 16, you can make the request for them, and we will ask you to establish your relationship to the account first.

What we will do: remove the content from public view on Play2Play, and delete the underlying video from our video provider where one exists. We aim to do it within 45 days and usually within a few days.

What we cannot do, said plainly rather than buried: we cannot reach copies that other people have already downloaded, embedded or saved, and we cannot remove something from a search engine’s own index. You would have to ask the search engine, and we will at your request ask search engines not to index your profile or post going forward. Section 5.3 explains which records survive deletion. If the content is a direct message, removing it means deleting the account, because there is no other mechanism.

This is handled by a person reading email. There is no button.

8. Changes to this notice

In short: Changes get posted here with a new date. Material changes are surfaced in the app first.

When this notice changes, the updated version is posted on this page with a new date. Material changes to what we collect, who receives it, or how public content is used will be surfaced in the app before they take effect, and will not bind a user under 18 until a parent or guardian, or the user once they are 18, continues to use Play2Play after that notice. Housekeeping changes take effect when posted. We do not run a mailing list, so we cannot promise to email you individually about every change.

9. How to contact us

In short: Privacy requests go to privacy@play2play.co. Support is support@play2play.co. A person reads both.

• Privacy requests (access, correction, deletion, a portable copy, Global Privacy Control, parent requests, removal requests under section 7.4, a report that someone under 13 has an account): privacy@play2play.co.
• Child safety (grooming, sexual content involving a minor, off-platform contact): safety@play2play.co.
• Everything else, including a moderation decision you want a person to look at: support@play2play.co.

Postal address for written notices: Play2Play LLC, c/o Northwest Registered Agent LLC, 418 Broadway STE N, Albany, New York 12207, United States. Play2Play is operated by Play2Play LLC, and every address above reaches us.