Privacy Policy (DRAFT)
HeadRep by [Company Legal Name] · Effective [date] · Draft for counsel review, not legal advice.
The short version (for athletes)
- Your journal, debriefs, voice recordings and check-in answers stay on your phone. We can't read them.
- We never sell your data, never show ads, and never share your private stuff with coaches or parents.
- Coaches on your team only see that you're on the team. Not how you feel or what you wrote.
- Our AI helps with goals if you use it. It's AI, not a person, and the companies that run it can't use your info to train their models.
- You can see, download or delete your data anytime in Profile (the avatar on Today).
- Age 10 to 12? A parent has to say yes first. Until then, HeadRep works only on your phone and sends us nothing.
- If you're ever in crisis, tap Need help now? That's 988 (the Suicide & Crisis Lifeline), 911, or someone you trust.
1. Who we are
[Company Legal Name] ("we") makes HeadRep, a mental-performance training app for young athletes. Contact: privacy@headrep.com, [phone], [mailing address].
2. Who can use the app
HeadRep is for athletes 10 and older, and for the coaches and parents who support them. Children 10 to 12 can use it only after a parent or legal guardian has given verified consent (section 3). HeadRep is not for children under 10; if we learn a child under 10 has used it, we delete their data. We ask every new user's age with a neutral question and use app-store age signals where the law requires them. If we learn that a child 10 to 12 is using an account without a parent's verified consent, we delete that account and its data. Parents or guardians can contact us anytime at privacy@headrep.com.
3. Children 10 to 12 (our COPPA notice)
This section is for parents and guardians. It explains what we collect from children 10 to 12, how we use and share it, and how you control it, under the US Children's Online Privacy Protection Act (COPPA), which covers children under 13, and the FTC's COPPA Rule.
Operator. [Company Legal Name], [mailing address], [phone], privacy@headrep.com. We are the only operator collecting personal information from children through HeadRep.
3.1 Before you consent: nothing leaves the phone
When a child says they're 10 to 12, HeadRep asks them to hand the phone to a parent. Until a parent's consent is verified, the app creates no account and sends us nothing; any training, goals or journal entries stay on the child's phone.
To ask for your consent, we collect only your name and email and your child's first name. We use them only to give you this notice and get your consent. If we don't receive your signed consent form within 14 days, we delete them automatically.
3.2 How we verify consent
You read our notice on your child's phone, make your choices (section 3.4), and enter your name and email. You then sign a one-page consent form with a code on it and send us a photo or scan (privacy@headrep.com) or give it to your child's coach to pass to us. We check the signed form against your request before we turn on your child's account. [Counsel: confirm the signed-form method and whether to add a vendor method (e.g., PRIVO, k-ID) for families who can't print.]
3.3 What we collect from your child, and why
Only after your consent, and only what the app needs:
| What | Why |
|---|---|
| A random account ID | To run the account and keep it secure. It doesn't identify your child to anyone else. |
| First name, age range ("10 to 12"), sport, level, focus areas, cue word | To build their training plan and personalize the guided sessions |
| Which exercises they finish and when, how long, and a 0–100% effort score | To run points, streaks and progress, and to make points fair |
| The days they checked in (not their answers) | To award check-in points |
| Goals they write, and the days they check them off | To show their goals on any phone they sign in on |
| Weekly points, and whether they choose to appear on the team board | For the team board, if you allow team sharing |
| Their team, if they join one with a team code | To link them to their team's license |
| Your consent choices and the date and version of the notice you agreed to | To honor your choices and show we did |
| IP address and basic device information in our hosting provider's logs | Only for security and to keep the service working (support for internal operations), never for ads or profiling |
We do not collect from your child: journal entries, debriefs, check-in answers (mood, energy, confidence), voice recordings of their declarations, Apple Health data (sleep, Mindful Minutes), their team calendar, their pre-game playlist link, or their trusted adult's name and number. These stay on the phone and we can't see them. We don't collect your child's email address, phone number, photo, location, contacts or birth date.
We don't ask a child for more information than an activity needs, and no part of HeadRep depends on a child giving more.
3.4 Who sees it, and your separate choices
- HeadRep staff who need it to run the service, with access logged.
- Our service providers, under contracts that let them use the data only to run HeadRep for us and to keep it secure: [Supabase] (hosting and database) and [Expo] (app delivery and updates). [List any others before launch.]
- Teammates, only if you choose "Team sharing." They see your child's first name and weekly points on the team list and team board. Nothing else. You can consent to HeadRep while saying no to team sharing; your child can still join a team and train.
- Points & streaks (points, streaks and game-day reminders) are a separate choice. Saying no doesn't limit any exercise.
- Coaches and team admins see only that your child holds a seat on the team's license.
- Nobody else. We don't sell children's data, show ads, use advertising IDs, track children across apps or websites, build marketing profiles, or offer chat, messaging, public profiles or feeds. [Decide before launch: whether the AI Goals Coach and product analytics are available to accounts for ages 10 to 12. This draft assumes both are off for accounts for ages 10 to 12.]
- We may disclose information if the law requires it or to protect a child's safety.
3.5 Your rights as a parent
At any time, you can:
- Review what we hold about your child: Profile → Parent controls → See what HeadRep stores (or email us).
- Change your choices. Turning team sharing or points off takes effect immediately. Turning one on asks for the email you gave us.
- Refuse further collection, withdraw consent and delete your child's account and everything we store: Profile → Parent controls → Withdraw consent and delete everything, or email privacy@headrep.com, or tell your child's coach. We may ask you to confirm you're the parent before acting on an email request.
We answer email requests within [10 business days]. Withdrawing consent stops all collection right away.
3.6 How long we keep it
| Data | Kept for | Then |
|---|---|---|
| Consent request (your name, email, child's first name) without a signed form | 14 days | Deleted automatically |
| Your child's account data | While the account is open | Deleted when you withdraw consent or the account is deleted; removed from backups within [30] days |
| Accounts no one uses | [12] months of inactivity | Deleted after we notify you |
| Your signed consent form | [Period counsel sets] | Stored outside the app's database, then destroyed |
We keep children's data only as long as reasonably necessary for the purposes above, never indefinitely. Our full Data Retention Policy explains why we keep each kind of data and when we delete it.
3.7 How we protect it
Encryption in transit and at rest; database rules that block anyone but the account from its data, and that refuse to store a 10 to 12 profile without verified parental consent; least-privilege staff access with logs; and a written Information Security Program with a named coordinator, an annual risk assessment and an incident plan.
3.8 Changes to this section
If we want to collect, use or share children's information in a materially different way, we'll ask for your consent again first.
4. What we collect
| Category | Examples | Where it lives |
|---|---|---|
| Account | Name, email or Apple sign-in ID, age range (we don't ask for a birth date or birth year) | Our servers |
| Profile | Sport, level, focus areas, team membership | Our servers |
| Training activity | Which exercises you finished, effort score, weekly points, check-in days | Our servers |
| Goals | Your Outcome, Measure and Process goals | Our servers (so the AI Goals Coach and sync can work) |
| Check-in answers | Mood, energy, confidence | Your device only (we only learn that you checked in, for points) |
| Journal, debriefs, script flips | What you write | Your device only |
| Declaration recordings | Your voice | Your device only; never analyzed to identify you |
| Trusted adult | Name and phone number you add | Your device only |
| Health data (optional) | Mindful Minutes written to Apple Health; sleep read from Apple Health (Health Connect on Android later) | Your device only. Sleep totals are kept in the app on your phone; we never copy Health data to our servers |
| Team calendar, pre-game playlist | The calendar link you paste and its events; your playlist link | Your device only |
| Parental consent (10 to 12) | Parent's name and email, your consent choices (section 3) | Our servers |
| Purchases | Subscription status (handled by Apple, Google, RevenueCat; team licenses by Stripe) | We never see full card numbers |
| Device and usage | App version, crashes, which screens are used (no advertising IDs) | Our analytics provider |
| Messages to support | What you send us | Our support inbox |
5. How we use it
- To run the app: your plan, exercises, points, streaks and goals
- To power AI features you choose to use (section 8)
- To keep accounts secure and the app working (debugging, fraud prevention)
- To improve the app using aggregated usage data
- To communicate about your account, and notifications you allow (quiet hours 9 pm–7 am)
- To meet legal obligations
6. What we never do
- Sell or rent personal data
- Use data for advertising, cross-app tracking or targeted ads
- Share journals, debriefs, check-in answers or recordings with coaches, teams, schools or parents
- Let AI providers train their models on your content
- Contact anyone on your behalf without you pressing a button
7. Who can see what
| Person | Can see |
|---|---|
| You | Everything |
| Teammates (same team code) | Your first name, team and weekly points on the team board (you can hide from the board anytime; 10 to 12, only if a parent allowed team sharing) |
| Team license admin | Seats used, names of who joined. Nothing else. |
| Parents | Purchase and billing they manage. For a child 10 to 12: what we store on our servers (Parent controls), never their journal, check-in answers or recordings, which stay on the phone. For teens: no training content. [pending legal review] |
| Us | Server-side data above, only staff who need it, with access logs |
8. AI features
- The AI Goals Coach (premium) and suggestions use [Anthropic's Claude] through our servers. You'll always know you're talking to AI, not a person.
- What it sees: your goals, sport, level and focus areas. It sees anything else (e.g., a journal entry) only if you choose to share it in that moment.
- What it can't do: under our agreement, the AI provider may not use your data to train its models. [Retention: confirm zero-data-retention terms before launch.]
- AI suggestions can be wrong. You always decide whether to use them.
9. Service providers
Each is bound by a contract to use data only for us:
- Hosting and database: [Supabase]
- AI: [Anthropic]
- Voice production: [ElevenLabs] (generates our narration; receives no user data)
- Purchases: [Apple], [Google], [RevenueCat], [Stripe]
- Analytics: [PostHog], with advertising features off
- Email and SMS: [provider]
- Crash reporting: [provider]
10. Health data
Check-in answers and Apple Health / Health Connect data are consumer health data in some states. We collect them only with your consent, keep check-in answers on your device, and never sell or share them. HealthKit data is never used for advertising. See our Consumer Health Data Privacy Policy at [link].
11. Keeping and deleting data
- Server data is kept while your account is active. Delete your account in Profile → Account → Delete my account; we erase server data within [30] days, except where the law requires us to keep it.
- On-device data is deleted when you delete it or remove the app.
- Inactive accounts are deleted after [24] months, with notice first.
12. Security
Encryption in transit and at rest. Access rules that block coaches and parents from private data at the database level. Least-privilege staff access. Breach notification as the law requires (including the FTC Health Breach Notification Rule where it applies).
13. Your rights
Depending on where you live (including Colorado, California, Washington, Virginia, Connecticut and others), you can access, correct, delete, download or limit use of your data, and withdraw consent at any time. Use Profile (including See what HeadRep stores) or email privacy@headrep.com. We answer within [45] days and won't treat you differently for using your rights. A parent or guardian may make requests for a minor; for children 10 to 12 (COPPA rights cover children under 13), see section 3.5. [Appeals process per state law.]
14. Changes
We'll notify you in the app before material changes take effect.
15. Contact
privacy@headrep.com · [mailing address]