Privacy Policy for Replay Sports App

Replay Sports App ("we," "our," or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our mobile application.

Personal Information

We collect the following personal information:

• Account Information: Name, email address, password (encrypted), phone number, date of birth.
• Profile Information: User role (coach, player, parent, recruiter), team affiliations, profile picture, bio, social handles (Instagram, Twitter/X, TikTok).
• Athlete Recruiting Profile (if you opt into the recruiting pool): Sport, position, height, weight, GPA, graduation year, state, divisions of interest, coach endorsements, achievements, and the contact methods you choose to share with recruiters.
• Recruiter Profile: Organization, school, role/title, sports recruited, state, LinkedIn URL, institutional email.
• Parental Consent Records (for players aged 13–17 opting into recruiting features): Parent or guardian name, email, IP address, and timestamp of consent — retained as an audit trail.
• LinkedIn Verification Data (recruiters only, optional): When a recruiter verifies via LinkedIn OAuth, we receive their LinkedIn profile name, headline, and profile URL solely to confirm identity. We do not post on your behalf or access your connections.
• Authentication Data: Sign-in details from Google or Apple if you sign in with them. With Sign in with Apple you can hide your email address, in which case we receive an Apple relay address instead.

Content You Create

• Videos: Training videos, game footage you upload or record.
• Live Game Streams: Live video and audio of games streamed through GameDay by a team's head coach, an adult the coach delegates, or a subscribed parent (a personal stream of their own child's game), plus clips trimmed from that footage.
• Game Stats: Box scores, play-by-play events, and pitch counts logged during games, associated with player profiles. Players are identified by name and jersey number as entered on the team roster or on an opponent lineup typed by the coach.
• Team Branding: Team logos and colors uploaded by coaches.
• Photos: Your profile picture and any action shot you add for your Showcase or home screen header. Our own software, not a third party, cuts the athlete out of these pictures for those headers.
• Notes: Timestamped notes and comments on videos.
• Drawings: Annotations and drawings on videos.
• Messages: Direct messages, team chats, team announcements, and group conversations.
• Events: Calendar events, schedules, and workout plans.
• Achievements: Performance tracking and accomplishments.
• Recruiter Notes: Private notes a recruiter keeps on athletes they have saved. Only that recruiter can see them.

Automatically Collected Information

• Device Information: Device type, operating system, app version.
• Usage Data: Features used, videos watched, time spent in app.
• Push Notification Tokens: For sending notifications (only when permission granted).

Advertising and Install Measurement

• The app includes the Meta (Facebook) SDK so we can tell which of our ads lead people to the app. It reports to Meta when the app is installed or opened, and when you sign up, start a free trial, or buy a subscription, along with basic device information.
• iOS asks whether you allow tracking. If you allow it, Meta may link these events to your device's advertising identifier. If you don't, the app tells Meta that tracking isn't allowed and no advertising identifier is shared.
• You can change your answer at any time in iOS Settings > Privacy & Security > Tracking.
• We never send your videos, messages, notes, or profile details to Meta.

Subscription & Payment Data

• Subscription status and plan type, including Player Monthly, Parent 1 Child Monthly, Parent Multiple Children Monthly (up to 4 linked athletes), Recruiter Monthly, and the team and facility plans sold on our website.
• Purchase dates and expiration dates.
• Each parent account may link a maximum of 4 athletes regardless of plan type.
• In-app subscriptions are paid through Apple. Team and facility plans bought on our website are paid through Stripe, and we keep the billing email and Stripe's customer and subscription references for them. We never receive or store your full card or bank details.

Showcase Visitor Information

Public Replay Sports Showcase pages collect limited anonymous visitor analytics. We do not collect personally identifiable information about Showcase visitors.

• Approximate Location: City, region, and country derived from Cloudflare edge metadata. We do not store visitor IP addresses.
• Referrer Hostname Only: We record the referring hostname, not the full referring URL.
• Browser and Device Context: Browser type and operating system.
• Section Interaction Data: Anonymous information about which Showcase sections were viewed or interacted with.
• Owner Reporting: This information is provided to the Showcase owner only in aggregated summary form.

We use your information to:

• Provide Services: Enable video playback, team management, messaging, and scheduling.
• Live Game Streaming: Deliver GameDay streams (delayed roughly one minute behind the field) and live game stats to viewers who have the game's share link (and PIN, if one is set).
• Improve Performance: Optimize video streaming, fix bugs, enhance user experience.
• Send Notifications: Alert you about messages, events and event reminders, notes on your videos, team activities, recruiter review decisions, and the upcoming deletion of a stream you started.
• Measure Our Advertising: Count which of our ads lead to installs, sign-ups, free trials, and subscriptions (see Advertising and Install Measurement).
• Team Management: Connect coaches, players, and parents within teams.
• Recruiting: Connect opted-in athletes with verified college recruiters and coaches; help recruiters discover, save, and reach out to prospects.
• Analytics: Understand how users interact with the app to improve features.
• Support: Respond to your questions and technical issues.
• Safety & Moderation: Monitor content to enforce our Terms of Service and protect users.
• Legal Compliance: Respond to legal requests and prevent illegal activity.

We use the following third-party services that may collect your data:

• Firebase (Google)
• Mux
• Google OAuth
• Apple
• Expo
• Sentry
• Cloudflare
• Google Gemini API
• RevenueCat
• Stripe
• Resend
• Meta
• LinkedIn

Purposes and data shared:

• Firebase (Google): Authentication, database, cloud storage, analytics, archived video storage, and the viewer-facing game pages, game metadata, and stats for GameDay streams. Data shared: email, name, user ID, app usage data, and the content you store in the app.
• Mux: Video hosting, streaming, and playback, including clips saved from game footage to player video libraries and game stream recordings processed for replays. Data shared: videos you upload, viewing statistics.
• Google OAuth: Sign in with Google account. Data shared: email, name, profile picture (only with your permission).
• Apple: Sign in with Apple and in-app subscription payments. Data shared: your Apple sign-in details (an Apple relay address if you hide your email) and purchase records.
• Expo: App development platform, push notifications. Data shared: push notification tokens.
• Sentry: Crash reporting and error monitoring. Data shared: error logs, device info, user ID (if available).
• Cloudflare: Content delivery, Showcase page hosting, edge-based geolocation, and live game stream storage and delivery (Cloudflare R2). Data shared: game footage streamed through GameDay. When someone opens a stream link, Cloudflare may log standard access data (IP address, device type, and time) as part of serving the video; IP addresses may also be processed at the edge to derive approximate location, but are not stored by us.
• Google Gemini API: AI features you choose to use: trading card image generation, bio text polishing, AI Coach video analysis, and reading a photo of a roster to add its players to a team. Data shared: the photos, text, and videos you submit to those features. A roster photo is used only to read the players' names, numbers, and positions, and we do not keep the photo.
• RevenueCat: Subscription management and purchase verification. Data shared: user ID, subscription status, and purchase history.
• Stripe: Payments for team and facility plans bought on our website, and the billing portal where the plan owner manages or cancels the plan. Data shared: the billing email and the plan chosen; you enter your card details with Stripe, not with us.
• Resend: Delivers the app's emails, such as team invitations and plan confirmations. Data shared: the recipient's email address and the email's content.
• Meta: Measures our ads (see Advertising and Install Measurement). Data shared: app install, open, sign-up, free trial, and subscription events with basic device information, plus your device's advertising identifier only if you allow tracking.
• LinkedIn: Optional OAuth-based identity verification for recruiter accounts. Data shared: LinkedIn profile name, headline, and profile URL. We do not post on your behalf or access your connections.

Privacy policies:

• Firebase: https://firebase.google.com/support/privacy
• Mux: https://www.mux.com/privacy
• Google: https://policies.google.com/privacy
• Apple: https://www.apple.com/legal/privacy/
• Expo: https://expo.dev/privacy
• Sentry: https://sentry.io/privacy/
• Cloudflare: https://www.cloudflare.com/privacypolicy/
• Google Gemini API: https://policies.google.com/privacy
• RevenueCat: https://www.revenuecat.com/privacy
• Stripe: https://stripe.com/privacy
• Resend: https://resend.com/legal/privacy-policy
• Meta: https://www.facebook.com/privacy/policy/
• LinkedIn: https://www.linkedin.com/legal/privacy-policy

Where Your Data is Stored

• Videos: Stored securely on Mux servers (US-based). Archived videos are stored on Google Cloud Storage (US-based).
• Live Game Footage: Stored on Cloudflare R2 and deleted on the schedule under Data Retention.
• User Data: Stored on Firebase Cloud Firestore (US-based).
• Files: Stored on Firebase Cloud Storage (US-based).

Security Measures

• Encryption: All data transmitted using HTTPS/TLS encryption.
• Authentication: Secure Firebase authentication with encrypted passwords.
• Access Control: Role-based permissions (coaches, players, parents have different access levels).
• Rate Limiting: Protection against abuse and spam.
• Regular Updates: Security patches and updates applied regularly.

What We Can Access

To provide, maintain, and improve our services, we have technical access to:

• All Videos: Videos you upload, record, or share, including training footage and game recordings.
• All Messages: Direct messages, team chats, and group conversations.
• Notes & Drawings: Timestamped notes, comments, and annotations on videos.
• Events & Schedules: Calendar events, workout plans, and team schedules.
• Account Information: Profile details, team memberships, and usage data.

When We Access Your Data

We access your data only when necessary for:

• Technical Support: Troubleshooting issues you report or investigating bugs.
• Content Moderation: Reviewing reported content for Terms of Service violations.
• Safety & Trust: Preventing harassment, abuse, or illegal activity.
• Legal Obligations: Complying with valid legal requests, subpoenas, or court orders.
• Service Operations: Maintaining servers, performing backups, and ensuring system reliability.
• Security: Detecting and preventing fraud, spam, or security threats.

How We Protect Your Privacy

• No Routine Monitoring: We do not routinely read your messages or watch your videos.
• Manual Review: Messages and video notes pass a simple automatic filter that blocks obvious abuse and spam before they are sent. Beyond that, a person reviews content only when it is reported or a violation is suspected.
• Limited Access: Only authorized personnel can access user data, and only when necessary.
• Employee Training: Our team is trained on privacy best practices and data handling.
• Anonymization: When possible, we use anonymized or aggregated data for analysis.

• You retain ownership of all content you create and upload.
• We do not use your videos or messages for marketing or advertising.
• We do not share your private content with third parties except as required by law.
• You can delete your content at any time through the app.

How Long We Keep Your Data

• Account Data: Retained while your account is active.
• Videos: Retained while your account is active or until you delete them. Videos older than 180 days may be moved to archival storage. Starred videos and Showcase videos are retained in high-quality streaming.
• Live Game Footage: Team-game streams are kept for 60 days after the game ends and personal (parent) streams for 14 days. About two days before a stream is due for deletion, the account that started it receives a push notification and an in-app notice and can extend the stream once, by 7 more days. After that the video is permanently deleted from our servers. As a backstop, any stream file older than 90 days is deleted regardless of extensions. Clips saved from game footage to a video library before that deletion are kept as ordinary library videos. Anyone who appears in a stream, or their parent or guardian, can ask us to remove it sooner at support@replaysportsapp.com.
• Game Stats: Box scores, play-by-play, and pitch counts are retained with the game record while relevant to your team.
• Recruiter Notes: Deleted when the recruiter removes the athlete from their saved list or deletes their account.
• Messages: Retained while your account is active or until deleted by users.
• Events/Schedules: Retained while relevant to your team.
• Logs: Technical logs retained for 90 days for debugging.
• Showcase Visitor Data: Raw visitor analytics are automatically deleted after 90 days. Aggregated summaries may be retained beyond that period.
• Anonymized Data: After account deletion, anonymized content (e.g., team videos, shared messages) may be retained for the continued functioning of team features.

Account Deletion

When you delete your account:

• Your profile is anonymized (name changed to "Deleted User").
• Your email and phone number are permanently removed.
• Your profile picture is deleted from our servers.
• Videos you uploaded remain with your team but show "Deleted User" as uploader.
• Your messages remain visible to other participants but are anonymized.
• You cannot recover your account after deletion.
• Your Firebase authentication is permanently removed.
• For users under 18, parent/guardian or head coach approval is required.
• Cached data in backups may take up to 30 days to be fully removed.

You have the right to:

• Access: Request a copy of your personal data.
• Correction: Update or correct your information in the app.
• Deletion: Delete your account and associated data.
• Export: Request an export of your data by contacting support. We will provide your data within 30 days.
• Opt-Out: Disable push notifications in device settings, and turn tracking off in iOS Settings > Privacy & Security > Tracking.
• Withdraw Consent: Revoke permissions at any time.

Our app is not directed to children under 13 years of age. Children under 13 may only use the app through a parent or guardian-managed profile.

For Children Under 13:

• A parent or guardian must create and manage the child's profile.
• We collect limited information (name, age, position, jersey number) to provide team features.
• We record parental consent before creating a child profile.
• Parents can request deletion of their child's data at any time.
• We comply with COPPA (Children's Online Privacy Protection Act) for children under 13.

For Users 13-17:

• We require parental consent for account creation.
• Players aged 13–17 cannot opt into the recruiting pool until a parent or guardian has provided consent in the app. We store the consenting adult's name, email, IP address, and timestamp as an audit trail, and parents can revoke consent at any time.
• Parents/guardians are responsible for monitoring their child's use of the App.
• Parents: If you believe your child has provided personal information without your consent, please contact us immediately at support@replaysportsapp.com.

Minors in Game Streams:

• GameDay streams show minors playing sports in public venues. Streams are started only by adults: a team's head coach, an adult the coach delegates, or a subscribed parent streaming their own child's game. Players and minors never stream from their own accounts.
• The coach or parent who starts a stream is responsible for having whatever permission their league, school, or venue requires and for stopping a stream on request.
• Team-game streams are deleted 60 days after the game and personal streams after 14 days (extendable once by 7 days). If your child appears in a stream and you want it removed sooner, email support@replaysportsapp.com.

We DO NOT sell your personal information.

We may share your information:

• With Your Team: Other team members can see your name, role, and shared content, including team logos and colors uploaded by coaches.
• With Game Viewers: When your team streams a game through GameDay, anyone with the game's unguessable share link (and its PIN, if the coach sets one) can watch the delayed stream and see the score, game stats, player names, and team logos and colors for that game. A parent's personal stream is PIN-protected by default.
• With Linked Opposing Teams: When your coach accepts a link invitation from an opposing team, your team's player roster names and game stats for that game become visible to the linked team.
• With Verified Recruiters (only if you opt in as an athlete): Your recruiting profile, highlight videos, coach-tracked achievements, and the contact methods you choose to share become visible to recruiters who have completed our verification process. Opting out at any time removes you from search results.
• Recruiter Profiles: A recruiter's profile is visible only to that recruiter and our review team. A verified recruiter who chooses to be listed appears in the recruiter directory athletes can browse, showing their name, organization, title, sports, state, bio, and photo.
• With Service Providers: Third parties helping us operate the app (such as Firebase, Mux, Sentry, Cloudflare, Google Gemini API, RevenueCat, Stripe, and Resend).
• With Meta, for Ad Measurement: The install, sign-up, free trial, and subscription events described under Advertising and Install Measurement.
• For Legal Reasons: If required by law, court order, or government request.
• Business Transfer: If we merge with or are acquired by another company.

We will NEVER:

• Sell your data to third parties.
• Share your videos without your permission.
• Use your videos, messages, notes, or profile for advertising.

We do not use cookies in our mobile app. The app includes the Meta SDK for ad measurement, described under Advertising and Install Measurement: iOS asks before any tracking, and you can change your answer in Settings > Privacy & Security > Tracking. Other third-party services (such as Firebase Analytics, Mux, Sentry, and Cloudflare on public Showcase pages) may use similar technologies for analytics and performance monitoring. Our website does not use advertising pixels.

We may update this Privacy Policy from time to time. We will notify you of significant changes by:

• Posting the new policy in the app.
• Sending a notification through the app.
• Updating the "Last Updated" date.

Your continued use of the app after changes constitutes acceptance of the updated policy.

Our services are operated from the United States. If you access the app from outside the U.S., your data will be transferred to and processed in the United States. By using the App, you consent to the transfer of your data to the United States, which may have different data protection laws than your country. We take steps to ensure your data receives an adequate level of protection in accordance with applicable data protection laws, including the use of Standard Contractual Clauses where required.

Athlete Opt-In

• Athletes may opt into our recruiting pool, which makes their recruiting profile (the fields listed under "Athlete Recruiting Profile" in Information We Collect) searchable by verified recruiters using our Discover and Search tools.
• You can opt out at any time in Settings, which immediately removes you from search results.
• Your data is not sold to third parties.
• Coach-tracked achievements are logged by your coach on your behalf and appear on your public Showcase only if you choose to include them.

Recruiter Verification

• Recruiter accounts go through a verification step before unlocking search and outreach features.
• Verification uses LinkedIn OAuth (optional) plus manual admin review of organization affiliation, institutional email, and role to reduce fraud and protect athletes.
• Verification status is stored on the recruiter profile, and we notify the recruiter when their review is decided.

Recruiter Profiles and Notes

• A recruiter's profile, including their emails and the details used in their review, is visible only to that recruiter and our review team.
• A verified recruiter who chooses to be listed appears in the recruiter directory athletes can browse, showing their name, organization, title, sports, state, bio, and photo.
• Saved athletes, folders, and notes on a recruiter account are private to that recruiter and are not visible to athletes.

Parental Consent for Players 13–17

• Players aged 13–17 cannot opt into the recruiting pool until a parent or guardian has provided consent in the app.
• We store the consenting adult's name, email, IP address, and timestamp as an audit trail.
• Parents can revoke consent at any time, which removes the player from the recruiting pool.

Live Streams

• A team's head coach, or an adult the coach delegates, may film and live stream the team's games through GameDay. Video is captured on the streamer's device and streamed with a delay of roughly one minute.
• A parent with an active subscription may start a personal stream of their own child's game from their own account. Players and minors never stream from their own accounts.
• A stream is live video and audio of a youth sports game in a public place, uploaded in short segments to our video infrastructure and played back through a link. Audio is not filtered.
• Viewers do not need an account. Team streams are viewable by anyone with the game's unguessable share link, and the coach may require a 4-digit PIN. Personal streams are PIN-protected by default; the parent may share the link and PIN.
• Live streaming hours are limited each month: currently up to 10 hours per head coach across all of that coach's teams (2 hours for a team that no player or parent has joined yet) and 10 hours per parent account. Limits may change, and the feature may be limited or disabled at any time.

Storage and Deletion

• Video segments are stored on Cloudflare R2 and served through Cloudflare's network; recordings may also be processed by Mux for replays. Firebase (Google) holds game metadata, stats, and the viewer-facing game pages. Opening a stream link may log standard access data (IP address, device type, and time) with Cloudflare.
• Team-game streams are kept for 60 days after the game ends and personal streams for 14 days. About two days before deletion, the account that started the stream gets a push notification and an in-app notice and can extend the stream once, by 7 more days. After that the video is permanently deleted from our servers. Any stream file older than 90 days is deleted regardless.
• Clips trimmed from game footage may be saved to individual video libraries before deletion; saved clips are hosted and processed by Mux like other videos and follow our standard video retention rules.

Game Stats

• During a streamed game a coach or scorekeeper may enter play-by-play stats naming players by name and jersey number, as entered on the roster or on an opponent lineup typed by the coach. Stats are associated with player profiles and appear on the team's game page and box score to anyone with the game link, and in the app to team members.
• Opponent Team Linking: Opposing players may be listed by the name and number the coach types. An opposing team that links itself to the game in the app shares its real roster names with the other team for that game.

Team Branding

• Team names, logos, and colors uploaded by coaches are displayed to team members and on the stream page to viewers of the team's game streams.

Consent and Removal

• Streams show minors playing sports in public venues. The coach or parent who starts a stream is responsible for having whatever permission their league, school, or venue requires, for not streaming where filming is prohibited, and for stopping a stream on request.
• Links may be forwarded by viewers. A PIN reduces but does not eliminate that.
• Anyone who appears in a stream, or their parent or guardian, can ask us to remove it by emailing support@replaysportsapp.com.

If you have questions about this Privacy Policy or your data, contact us:

• Email: support@replaysportsapp.com
• App: Use the "Contact Support" link in Profile settings

If you are a California resident, you have additional rights under CCPA:

• Right to know what personal information is collected.
• Right to know if personal information is sold or disclosed.
• Right to opt-out of sale (we don't sell data).
• Right to opt out of sharing for advertising: the only advertising-related sharing is the Meta ad measurement described under Advertising and Install Measurement. Turning tracking off in iOS Settings > Privacy & Security > Tracking stops your advertising identifier from being shared.
• Right to deletion.
• Right to non-discrimination for exercising your rights.

To exercise these rights, contact us at support@replaysportsapp.com.

Legal Basis for Processing

We process your personal data based on the following legal grounds:

• Contractual Necessity: To provide the services you signed up for (account management, video hosting, messaging, team features).
• Consent: For optional features such as push notifications, analytics, tracking for ad measurement (the iOS tracking prompt), and processing children's data under COPPA.
• Legitimate Interest: For service improvement, security, fraud prevention, and bug fixing — balanced against your privacy rights.
• Legal Obligation: To comply with applicable laws, court orders, or government requests.

Your Rights Under GDPR

• Right to access your personal data.
• Right to rectification of inaccurate data.
• Right to erasure ("right to be forgotten").
• Right to restrict processing.
• Right to data portability.
• Right to object to processing.
• Right to withdraw consent.

Right to Erasure

If you exercise your right to erasure, we will delete your personal data. Content you have shared with teams (such as videos) may be retained in anonymized form where necessary for the functioning of team features, but all personally identifiable information will be removed.

Data Transfers

Your data is transferred to and processed in the United States. We rely on Standard Contractual Clauses approved by the European Commission to safeguard your data during international transfers.

To exercise these rights, contact us at support@replaysportsapp.com.

Effective Date: August 18, 2026

By using Replay Sports App, you acknowledge that you have read and understood this Privacy Policy.