Privacy Policy — NextFooty

1. Overview

NextFooty (“we,” “us,” or “our”) is committed to protecting your personal information. This Privacy Policy explains what data we collect, how we use it, who we share it with, and what rights you have over it.

This policy applies to all users of the NextFooty website and application (the “Service”). By using the Service, you agree to the collection and use of your data as described here.

2. What We Collect

2a. Information You Provide Directly

When you create an account and complete your player profile, we collect:

Account credentials: Username and hashed password (we never store your password in plain text), or a Google account identifier if you sign in with Google
Contact information: Email address
Player profile: Full name, age, gender, primary and secondary position, preferred foot, age group
Playing background: Current playing level (recreational through professional), league/club, target level, graduation year
Training preferences: Sessions per week, session duration, focus areas, available equipment
Academic information (optional): GPA and scale, ACT score, SAT score — provided voluntarily and used only to personalize AI-drafted recruiting emails
Video content: Highlight clips you upload for coaching review (up to 50 MB per file)
Recruiting questions: Questions you submit alongside video clips for coach review
Program interest notes: Text you enter when drafting recruiting emails

2b. Information Generated by Your Use

As you use the Service, we automatically generate and store:

Training activity: Which sessions you complete, which drills you log, and the dates of each
RRS history: Your weekly Readiness & Reliability Score snapshots and pillar breakdowns (consistency, volume, coverage, progression)
Training plans: Your weekly and multi-week personalized training plans

2c. Automatically Collected Technical Data

Session cookie: An encrypted session cookie that keeps you logged in. It stores only your username and expiration time — not browsing behavior.
Server logs: Standard web server logs (IP address, request path, timestamp) retained for security monitoring. We do not use IP addresses to build advertising profiles.

3. How We Use Your Data

Purpose	Data Used
Generate your training plan	Position, level, focus areas, sessions per week, equipment, training history
Calculate your RRS score	Completion log, training plan, dates of activity
Deliver coaching feedback on your reel	Video clips, review question, username
Draft recruiting emails via AI	Name, position, level, graduation year, academic scores (if provided), program interest notes — sent to Anthropic's API
Send password reset emails	Email address, username — sent via Resend
Send weekly training summaries (future)	Email address, RRS data, session summary — sent via Resend
Prevent abuse	Username, IP address, request timestamps — for rate limiting

We do not use your data for advertising, and we do not sell your personal information to any third party.

4. Third-Party Services We Use

We share limited data with the following third-party providers to operate the Service. Each is bound by their own privacy policy.

Supabase

Role: Database and file storage provider. Stores all user account data, training plans, completion logs, RRS history, and uploaded video clips. Data is hosted on infrastructure within the United States.

supabase.com/privacy

Anthropic

Role: AI model provider. When you use the recruiting email drafting feature, your name, position, level, graduation year, and any academic scores you've entered are sent to Anthropic's API to generate a draft. Anthropic does not use API inputs from business customers to train their models.

anthropic.com/privacy

Resend

Role: Email delivery provider. Used to send password reset emails and (in future) weekly training summary emails. Your email address and username are shared with Resend when we send you an email.

resend.com/privacy

Google (OAuth)

Role: Authentication provider (optional). If you choose “Continue with Google,” Google shares your name, email address, and a unique identifier with us. We use this to create or log in to your account. We do not receive your Google password.

policies.google.com/privacy

Railway

Role: Application hosting provider. The NextFooty application runs on Railway's infrastructure. Railway receives standard web traffic (IP addresses, request logs) as part of normal hosting operations.

railway.app/legal/privacy

5. Your Video Clips

Video clips you upload are stored in Supabase Storage. They are accessible only to:

You (via a time-limited signed URL generated on your device)
Our coaching staff, when you explicitly submit a clip for review

Clips are not made public, shared with coaches listed in the Coach Finder, or used for any purpose other than providing you coaching feedback. If you delete a clip or delete your account, the file is removed from storage.

6. Academic Data

Providing your GPA, ACT score, or SAT score is entirely optional. If you provide this information, it is stored in your profile and used only to personalize AI-drafted recruiting emails when you request them. It is not sold, shared with third parties for marketing, or used for any purpose beyond the recruiting email feature.

7. Data Retention

Active accounts: We retain your data for as long as your account is active.
Deleted accounts: When you delete your account, we delete your profile, training data, completion log, and all uploaded video clips within 30 days.
Password reset tokens: Expire after 1 hour and are cleared from the database upon use or expiry.
Server logs: Retained for up to 90 days for security purposes, then deleted.

8. Your Rights

You have the right to:

Access: Request a copy of the personal data we hold about you
Correction: Update your profile information at any time via your Profile page
Deletion: Delete your account and all associated data from the “Danger Zone” section of your Profile page, or by contacting us
Portability: Request your training data and profile in a machine-readable format
Opt-out of emails: Password reset emails are transactional and cannot be opted out of while your account is active. If we introduce marketing or summary emails, you will be able to unsubscribe.

To exercise any of these rights, contact us at [YOUR CONTACT EMAIL]. We will respond within 30 days.

9. Children's Privacy

NextFooty is not directed at children under 13. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has provided us with personal information, please contact us and we will delete it promptly.

Users between 13 and 17 should review this policy with a parent or guardian before using the Service.

10. Security

We take security seriously. Measures we have in place include:

Passwords are hashed using PBKDF2 with SHA-256 and a unique salt per user (600,000 iterations)
All connections use HTTPS/TLS encryption in transit
Session cookies are encrypted and HTTP-only
Database access is restricted; unauthenticated requests cannot read user data
Video file access uses time-limited signed URLs (1-hour expiry)
Rate limiting is applied to all sensitive endpoints (login, signup, password reset, AI drafting)

No system is 100% secure. If you discover a security vulnerability, please contact us at [YOUR CONTACT EMAIL] before disclosing it publicly.

11. Changes to This Policy

We may update this Privacy Policy to reflect changes to our data practices or for legal reasons. We will update the “Last updated” date at the top of this page and, for material changes, notify you by email (if on file) or by a notice within the Service.

12. Contact Us

For any questions about this Privacy Policy or to exercise your data rights:

[YOUR CONTACT EMAIL]

We aim to respond to all privacy inquiries within 30 days.