Authentication, database, and file storage.

Receives: Account, profile, posts, comments, stats, and direct messages, plus your password hash. Messages are stored so the two participants and our server can read them; they are not end-to-end encrypted.

Deletion: Deleted with the account when our deletion routine runs. The Privacy Notice, section 5.3, lists what survives.

Video hosting, streaming, and per-video viewing analytics. Bot protection on web login and password reset. Machine transcripts of video audio. A United States company operating a global network.

Receives: Your uploaded videos and their audio, viewing counts, your profile identifier as the "creator" of each video, and your IP address.

Creates, briefly: A machine transcript of the audio of every video, your own voice as text, made so the safety check can read what is said. We delete it as soon as that check has read it, usually within minutes of upload, and it is never shown to viewers. Deleting the video also deletes it, which we tested on 17 September 2026.

Public addresses: Playback addresses for live videos currently resolve without a signed token: the video, its thumbnail, its preview and its embed page load for anyone with the link. The app already mints signed, time-limited tokens and the provider can be told to require one; we are switching that on for every live asset. Until it is on, this paragraph describes what is true. For a short period after a deletion the playback address can still answer, which we read as caching at the delivery network rather than a surviving copy.

Website and application hosting.

Receives: Every request to our website, including your IP address, and your password in the request body when you sign in on the web, before it is handed to the authentication service. It is not logged and not stored.

Powers the AI Coach, automated stat verification, and automated moderation of video. Images are not checked. A United States company.

Receives: AI Coach messages with your display name, sport, graduating class, an internal role label, and whether you are under 18. For stat verification, the text of your linked public athletic profile page with your submitted stat, your display name and your username. For moderation, up to twelve still frames from your video, which routinely show your face, and up to eight thousand characters of the machine transcript of your speech, sent solely to decide whether that upload is allowed.

Retention: 30 days for what we send and what comes back, under Anthropic’s published retention policy of 1 July 2026 (privacy.claude.com/en/articles/7996866). 30 days is not a ceiling. That policy keeps content longer in four cases: services whose retention the customer controls, a separate zero data retention agreement, retention needed to enforce Anthropic’s Usage Policy, and legal compliance. Our commercial terms with Anthropic say nothing about retention in either direction.

If content is flagged: Content that Anthropic’s automated trust and safety systems flag as violating their Usage Policy is kept for up to 2 years, and the classification scores that flagged it for up to 7 years. Every video upload goes through that system, and most uploaders are under 18. We cannot see that flag, so we cannot tell you whether it has happened to yours.

Training and zero data retention: We have disabled training and feedback sharing: user feedback sharing is off and we have not joined the Development Partner Program, both read in the Anthropic console on 17 September 2026. What we send is not used to train models. Zero Data Retention, under which Anthropic would keep nothing beyond the time needed to return a result, exists and is not self-serve. We have decided to request it, and this row will change when it is in place. Anthropic publishes a Data Processing Addendum at anthropic.com/legal/data-processing-addendum.

Biometric-statute states: We will not send identifiable face frames from an account we know is in Illinois, Texas, or another state with a biometric statute until a written consent flow for that processing exists. Today every upload is checked the same way; the Privacy Notice, section 7.2, says the same.

Runs our scheduled and background jobs, including audio moderation and stat verification.

Receives: Video, post and profile identifiers, sport, your athletic-profile link, and moderation reason text in job records and run logs. Because audio moderation and stat verification run here, the machine transcript of your speech and the text scraped from your athletic profile page both pass through this provider while those jobs run.

Retention: Job payloads are retained only as long as needed to run and debug the job, then deleted. The provider documents that period as one day.

Manages Play2Play+ subscriptions and entitlements.

Receives: Your account identifier, the same one that appears on your public profile, used directly as your subscriber identity, and your purchase and subscription status. It is set at every app launch, before any consent question is shown. We are changing this to a non-public subscriber key set only once you have an account.

We keep: The whole message RevenueCat sends us about a purchase, stored exactly as it arrives. A de-identified copy survives account deletion, with the link to your account removed, because we must be able to show Apple what was granted. Apple remains the seller.

Processes App Store purchases and handles billing, refunds, and cancellations as the seller. Also a sign-in provider.

Receives: Purchase details. Apple does not share your payment card details with us. If you use Sign in with Apple, we request your full name and email address from Apple, and the name Apple supplies becomes your display name. Purchase records remain with Apple after you delete your account.

Sign-in provider only. We do not use Google Analytics. It was removed on 10 September 2026 and receives nothing.

Receives: If you choose Sign in with Google, the exchange happens in your own browser directly against Google, which sees your Google credentials and your IP address. We receive your email address and name back from it.

Delivers push notifications to your device.

Receives: Your device push token, and the notification itself, a fixed title plus a body that names the person who followed, liked, or commented on your content, which is a real name. Somebody you have blocked cannot cause one of these: the like, the follow and the repost are refused in our database before any notification is made. Direct messages generate no push notification at all, so no message content reaches this provider.

Error and performance monitoring. This is a service-provider use to keep the app working, not advertising. Error capture is not gated on your analytics answer, on any platform; performance tracing is gated in the browser and the iOS app but not on our servers.

Receives: Technical diagnostics needed to fix a crash, such as the error, where in our code it happened, and the browser, device model and app version.

We do not send your name, email, account id, or precise coordinates, and Sentry is set not to store your network address or any location derived from it. This applies to the website, our servers, and versions of the iOS app released on the App Store after 8 October 2026. Earlier versions of the iOS app may still include an account identifier or a username inside the text of an error. Deletion of an account is not written to Sentry as an identity event. The one exception is when our own record of a failed deletion cannot be saved; then the report carries the identifiers so the failure is not lost.

Product analytics, and on the website only, session replay.

Receives: Your profile identifier, ten permitted events, and exactly five things about you: sport, state, graduating class, plan and account type. Your name, email address, date of birth, birth year and age band are excluded by a filter in our code, not merely by intention.

What PostHog adds by itself: Further technical properties of its own, such as browser, device type, screen size and the time zone your device is set to. We have disabled automatic capture of advertising click identifiers and precise latitude/longitude. Values captured before that change remain on the records made at the time.

Session replay: Web only: records how you move around the site. Your inbox and messages are excluded and that exclusion holds. Text you type into forms is masked. Everything else on screen is captured as it appeared to you, including captions, comments and display names. There is no replay in the iOS app.

Note that graduating class, which we do send, narrows your age to about a year.

Processed payments made on our website in the past. Website charging is not offered.

Receives: Nothing. Historic test records only, if any exist. The Refund Policy says how to reach us about one.