Privacy Policy

What we collect

• Account data — email address, username, and anything you choose to add to your profile (avatar, bio, links). Passwords are hashed by our authentication provider; we never see them.
• Content you create — drills, workouts, packs, practice sessions, teams, comments, ratings, and any media you upload.
• Messages and reports — direct messages you send other coaches, and any reports or feedback you submit. Feedback includes the page you were on when you sent it.
• Purchase records— what you bought or sold, the amount, and Stripe’s transaction identifiers. Card numbers are handled entirely by Stripe and never reach our servers.
• Technical data — standard server logs (IP address, browser, timestamps) used to keep the service running, debug faults, and rate-limit abuse.
• Push subscriptions — only if you explicitly enable browser notifications.

Why we use it, and our lawful basis

Under the GDPR we must have a lawful basis for each use. Ours are:

• Contract (Art. 6(1)(b)) — running your account, storing and displaying your content, processing purchases and paying out sellers. Without this we cannot provide the service you signed up for.
• Legitimate interests (Art. 6(1)(f)) — keeping the platform secure and free of spam and abuse, moderating reported content, and diagnosing faults. We have weighed these against your rights and limited the data to what those purposes need.
• Consent (Art. 6(1)(a)) — browser push notifications, which are off unless you turn them on and can be withdrawn at any time without affecting anything else.
• Legal obligation (Art. 6(1)(c)) — retaining transaction records for tax and accounting.

Who we share it with

We do not sell your personal data. We share it only with providers who help us run HoopDrills, each handling it under contract and only on our instructions:

• Supabase — database, authentication, and file storage.
• Vercel — application hosting and delivery.
• Stripe — payment processing and seller payouts.

Embedded videos are served by YouTube, TikTok or Instagram, which may set their own cookies and see your IP address when a video loads. Those platforms’ own privacy policies apply to that. We may also disclose data where legally required, or to protect the rights and safety of our users.

What other users can see

Your username, avatar, bio, links, and any content you mark public are visible to everyone, including people who are not signed in. Content marked private is visible only to you. Your email address is never shown to other users.

Children

HoopDrills is for coaches and trainers aged 16 or over, and accounts are not intended for children. We do not knowingly collect data from children.

Coaches work with young players, so this matters here more than on most services: if you upload material in which a young player is identifiable, you are responsible for holding the consent of their parent or guardian, and you act as the controller of that material. If you believe a child has created an account, or that a child’s personal data has been posted without consent, email [TODO: your privacy email] and we will remove it promptly.

How long we keep it

Account and content data is kept while your account is open. If you delete your account we remove your profile and content, except records we must retain for legal or accounting reasons — notably purchase and payout records, which are typically kept for the period required by tax law. Server logs are kept for a short operational window and then discarded.

Your rights

Under the GDPR you have the right to:

• access the personal data we hold about you, and receive a copy;
• have inaccurate data corrected;
• have your data erased (“right to be forgotten”);
• restrict or object to processing based on our legitimate interests;
• receive your data in a portable, machine-readable format;
• withdraw consent at any time, where consent is the basis.

You can edit your profile and delete your content or your account in the app at any time. For anything else, email [TODO: your privacy email] — we will respond within one month, as the GDPR requires.

If you are unhappy with how we handle your data you may complain to the Czech supervisory authority, the Office for Personal Data Protection (Úřad pro ochranu osobních údajů, uoou.gov.cz), or to the authority in your own EU country.

Security

Access to your data is enforced at the database level, so users can only reach what they are entitled to, and traffic is encrypted in transit. No system is perfectly secure. If a breach is likely to result in a risk to your rights we will notify the supervisory authority within 72 hours and tell you directly where the risk is high, as the GDPR requires.

Transfers outside the EEA

Our hosting and payment providers are US-based, so your data is transferred outside the European Economic Area. Those transfers rely on the safeguards in each provider’s data processing terms — Standard Contractual Clauses and, where applicable, the EU–US Data Privacy Framework. You can ask us for details of the safeguards that apply at [TODO: your privacy email].

Changes and contact

If we make a material change to this policy we will give notice in the app or by email. Questions or requests: [TODO: your privacy email], [TODO: your legal entity or full name], [TODO: your registered address].