Privacy Policy

Full Scope Athlete (“FSA”, “we”, “us”) decides how and why your personal data is handled, which under GDPR makes us the data controller.

Operated by (pending: legal entity name, once incorporated), based in Aruba. Contact for privacy questions and requests: (pending: a published privacy contact email).

We collect only what is needed to help an athlete develop.

• Account / contact: email address, used for passwordless sign-in, to create your account and let you sign in.
• Athlete profile: name, position, birthdate (optional), to identify the athlete and apply the right age-based protections where a birthdate is given.
• Team + coach links: which team an athlete is on and which coach recorded what, to show the right data to the right people and keep teams separate.
• Measurements / progress: performance measurements a coach logs over time, the core purpose of tracking athlete development.
• Wellness self-reports: self-reported wellness entries, to support development and wellbeing tracking.
• Schedule: practices, events, session plans, to organize the team.
• Video (optional): video an athlete or coach chooses to upload, to support development.
• Consent records: when consent was given and by whom, to prove and honor consent, especially for minors.
• Usage analytics: how the product is used, to improve FSA, with personal identifiers stripped out (see Section 8).

We do not collect data we do not need, and we do not build hidden profiles.

Under GDPR we must have a lawful basis for each use. Ours are:

• Consent: for collecting a minor’s data (given by a guardian), and for optional features like video. You can withdraw consent at any time.
• Contract: to provide the FSA service you or your team signed up for.
• Legitimate interests: for keeping FSA secure, preventing abuse, and improving the product using PII-scrubbed analytics.
• Legal obligation: where we must keep certain records to comply with law.

Wellness self-reports may, depending on their content, count as health-related data, which GDPR treats as a special category needing extra protection. FSA treats wellness data as sensitive and relies on explicit consent for it.

• Your own team, only. FSA enforces strict per-team isolation at the database level (row-level security). A coach sees only their own team’s athletes.
• Coach notes are private by default. A coach’s notes about an athlete are not shared unless the coach explicitly shares them, and every share is recorded in a consent log.
• Guardians of an athlete under 18 can see that athlete’s data.
• No leaderboards, no peer ranking. Your data is never shown in a ranked or publicly compared way.
• Service providers. We use a small set of infrastructure providers to run FSA: Supabase (database and authentication), Vercel (hosting), Resend (sending account and invite emails), Sentry (error monitoring), and PostHog (product analytics, with personal identifiers stripped out). Each processes data only to run that part of the service for us.
• We never sell your data, and we never use it for advertising.
• Legal. We may disclose data if the law requires it, and we will limit any such disclosure to what is required.

Under GDPR (and mirrored for all users regardless of location), you have the right to:

• Access: get a copy of the personal data we hold about you.
• Correction: fix data that is wrong or incomplete.
• Erasure: ask us to delete your data (“right to be forgotten”).
• Portability: get your data in a portable format.
• Objection / restriction: object to, or ask us to pause, certain uses.
• Withdraw consent: where we rely on consent, withdraw it at any time.
• Complain: lodge a complaint with a data-protection authority.

How to exercise them: email (pending: a published privacy contact email). We will respond within one month, as GDPR requires. For an athlete under 18, a guardian can make these requests on the athlete’s behalf.

FSA is neutral by default and applies stricter protections automatically for minors.

• Guardian consent first. No minor data is stored until a parent or legal guardian’s consent is recorded.
• Stricter defaults. Minor accounts get more protective privacy settings automatically.
• Consent is logged, so it can be shown, honored, and withdrawn.
• Turning 18 → re-consent. When a minor turns 18, we ask them to re-confirm consent for themselves.
• Withdrawal. A guardian can withdraw consent at any time.

We keep personal data only as long as needed for the purpose it was collected, or as long as the athlete/team keeps their account active. When you ask us to delete data, or when an account is closed, we delete or anonymize it within 30 days, except where we must keep limited records to comply with law.

• Analytics are PII-scrubbed. We use PostHog, configured to identify people only once they are signed in, never to track you across other websites, and never for advertising.
• Cookies. A required session cookie from Supabase keeps you signed in. PostHog sets a similar cookie to recognize your own repeat visits within FSA. Neither is used for advertising or shared with ad networks.

We do not currently run a cookie-consent banner because these cookies are strictly necessary (sign-in) or first-party product analytics, not advertising or cross-site tracking. This will be revisited with counsel before any EU launch.

FSA is operated from Aruba and its infrastructure (Supabase, Vercel) runs in the United States. Where data about EU users is transferred outside the EU, we rely on GDPR-approved transfer safeguards (such as Standard Contractual Clauses) with our providers. (pending: the exact transfer mechanism, to be confirmed with counsel before an EU launch).

• Per-team isolation enforced at the database level, so teams cannot see each other’s data.
• Passwordless sign-in (magic link), no passwords to leak.
• Access limited to each user’s own role and team.
• Coach notes private by default; every share is logged.

No system is perfectly secure, but security is central to how FSA is built, precisely because it holds minors’ data.

We may update this policy. If a change is significant, we will notify you before it takes effect. The draft date at the top will change when we update it.

Privacy questions or to exercise your rights: (pending: a published privacy contact email).