Privacy Policy

1. What we collect

We collect only what we need to run the platform for you and your organization.

• Account data

  Name, email, phone (optional), password hash, authentication provider (email, Google, Apple), organization membership, and role (federation admin, club/league admin, coach, player, guardian).

• Profile data

  Display name, avatar, jersey number, position, team, biography, and any recruiting or NIL profile fields you choose to complete.

• Youth-player data

  For registered minors we may process name, date of birth or age band, team, jersey number, guardian contact, medical/emergency notes provided by a guardian, and participation records. This data is treated with heightened protection (see Children's privacy).

• Health & wellness data (Training Center)

  If you use the Training Center, we process wellness and performance data that you enter yourself: sleep duration, heart-rate variability (HRV), hydration, a readiness score derived from those entries, declared training sessions, workouts (self-set, or assigned by your coach), and fitness-test results. Under the GDPR this is health data and receives the heightened protection described below. We do not read from Apple Health, Google Fit or any wearable — every value in the Training Center is one you or your coach typed in.

• Video & highlights

  Match and practice footage from our cameras/drones, auto-generated highlight clips, uploaded clips, jersey-number recognition (OCR) results, and per-player tracking metadata used to assemble clips.

• Payment data

  Registration and subscription payments are processed by Stripe. We store transaction metadata (amount, status, plan, last four digits, billing name) but never the full card number — card data is handled directly by Stripe.

• Usage & device data

  Log data, IP address, device/browser type, feature interactions, and diagnostics used for security, debugging, and improving the product.

• Communications

  Chat messages, support tickets, and email you send to us or through the platform.

2. How we use it

• Provide the service

  Create accounts, manage rosters, schedule seasons and events, run registration and payments, and deliver chat.

• Generate highlights

  Record games, auto-clip plays, apply jersey OCR and player tracking, and let coaches review and publish highlights.

• AI features (Luna & video-AI)

  Power the private Luna assistant and automated video analysis. When you chat with Luna, your messages — together with the account and team context needed to answer them: your name, role, schedule, roster, game statistics, and video metadata — are transmitted via our backend to our AI providers, Anthropic (Claude) and OpenRouter (which routes requests to model providers such as Google), solely to generate the response. When you run AI video analysis, frames from the uploaded video and the team roster (player names, jersey numbers, positions) are transmitted to the same providers, solely to generate the analysis. These providers act as our processors under data-processing agreements that require at least equivalent protection to this policy, and they do not use your data to train their models. See our AI governance overview in the Trust Center.

• Training Center

  Show you your own recovery and performance trend, calculate your Quantum Athlete Score, and let coaches in your organization support your training. We never use health or wellness data for advertising, and we never sell it.

• Billing

  Process subscriptions and registration fees and prevent fraud.

• Communicate

  Send transactional email (receipts, reminders, approvals) via Resend and in-app notifications.

• Safety & security

  Detect abuse, enforce our Terms, and protect minors and other users.

• Improve the product

  Understand usage and fix problems. The web app uses Mixpanel for product analytics — only after you opt in via the cookie banner, never for accounts we know belong to minors, and never when your browser sends a Global Privacy Control or Do Not Track signal — and Sentry for error monitoring. We do not sell personal data.

Our apps — web and mobile — ask for your explicit permission in-app before your first message to Luna or your first AI video analysis ("AI consent") — nothing is sent to our AI providers until you agree. You can withdraw this consent at any time by contacting support or simply by no longer using Luna.

3. Legal bases (GDPR)

Where the EU/UK GDPR applies, we rely on the following legal bases:

• Contract

  To provide the platform to you and your organization under our Terms of Service.

• Consent

  For optional analytics cookies, certain marketing communications, publishing highlights, and — for minors — verifiable guardian consent.

• Explicit consent — health data (Art. 9)

  Sleep, HRV, hydration and readiness entries in the Training Center are special-category data. Providing them is optional: we process them only because you chose to enter them, and you can delete any entry at any time. Our Training Accountability programme adds a separate, time-boxed consent grant that you make yourself for ongoing coach monitoring, and for a minor that grant does not take effect until a linked guardian co-signs it. We are still formalising a recorded explicit-consent step at the point of entry.

• Legitimate interests

  For security, fraud prevention, product improvement, and running the service, balanced against your rights.

• Legal obligation

  To meet tax, accounting, and safety obligations.

4. Sharing & subprocessors

We share data with vetted service providers (subprocessors) that process it on our behalf under contract. We do not sell your data.

• Firebase / Google Cloud

  Authentication, database (Firestore), file storage, and hosting of backend functions.

• Vercel

  Hosting and delivery of the web application.

• Stripe

  Payment and subscription processing.

• Mux

  Video ingest, encoding, storage, and streaming for highlights and clips.

• Resend

  Transactional and notification email delivery.

• OpenRouter / Anthropic

  Large-language-model inference for Luna and AI features. Anthropic (Claude) and OpenRouter — which routes requests to model providers such as Google — receive Luna chat messages and the account and team context described in section 2, solely to generate the response. When you run AI video analysis they also receive frames from the uploaded video and the team roster (player names, jersey numbers, positions), solely to generate the analysis. Both act as processors under data-processing agreements providing at least equivalent protection to this policy, and do not use your data to train their models.

• Cloudflare

  Network security, DNS, and content delivery.

• Mixpanel

  Product analytics for the web app (page views, feature usage). Runs only after you opt in via the cookie banner, is disabled for accounts we know belong to minors, and is not started when your browser sends a Global Privacy Control or Do Not Track signal.

• Sentry

  Error monitoring for the web app and backend (error reports and the technical context needed to fix them). Not used for behavioral profiling.

We may also disclose data to comply with law, enforce our Terms, or protect the rights and safety of users — especially minors. If we are ever involved in a merger or acquisition, we will notify you before your data becomes subject to a different privacy policy.

5. Children's privacy (COPPA / GDPR-K)

Youth sports means we knowingly process data about minors, and we take that seriously.

• Parental consent

  Our policy is that an account for a player under 13 (US COPPA), or under the applicable age of digital consent in the EU/EEA (GDPR-K, 13–16 depending on country), is set up by a parent or guardian, whose consent we record and who can withdraw it at any time. We are closing the remaining gaps: a child can still reach our self-service signup form, and a club can still register a young athlete before a guardian has been contacted. Where we hold a child's data without a recorded guardian decision, we do not publish it to public or unauthenticated surfaces, and you can have it deleted at any time by writing to privacy@quantumleagueai.com.

• Data minimization

  We collect the minimum data needed for participation. Sensitive fields (e.g. medical notes) are optional and guardian-supplied.

• Guardian controls

  Guardians can review, correct, or delete their child's data and withdraw consent — including consent to publish a child's image in highlights — by contacting us or using the privacy dashboard.

• No behavioral ads

  We do not use minors' data for behavioral advertising, and we do not require a child to disclose more than is reasonably necessary to participate.

• Sharing limits

  A minor's profile and clips are restricted by default; publishing a clip that involves a protected minor is gated on appropriate consent.

• Health & wellness data for minors

  A minor's Training Center entries — sleep, HRV, hydration, readiness, workouts and fitness tests — are never shown on public or unauthenticated pages, and are never used for advertising. Inside the platform they are visible to the athlete and to members of their own organization, which is how a coach reviews them; they are not visible to other organizations. We are working to narrow that to the athlete's own coaching staff rather than every member of the organization. Where a coach requests an ongoing monitoring grant under our Training Accountability programme, a minor's grant does not activate until a linked guardian co-signs it. Guardians can have these entries deleted at any time by writing to privacy@quantumleagueai.com.

6. Data retention

We keep personal data for as long as your account or organization is active, and afterward only as needed to meet legal, tax, safety, and dispute-resolution obligations. Video and highlights are retained per your organization's configured retention settings. When data is no longer needed we delete or anonymize it. Backups are purged on a rolling schedule.

Training Center health and wellness entries — sleep, HRV, hydration, readiness, workouts, training sessions and fitness-test results — are deleted when you delete them and when your account is erased. We do not keep them for aggregate or statistical use afterwards.

7. Your rights

Subject to your jurisdiction (GDPR, UK GDPR, CCPA/CPRA and others), you may have the right to:

• Access

  Request a copy of the personal data we hold about you.

• Export (portability)

  Receive your data in a portable format.

• Rectification

  Correct inaccurate or incomplete data.

• Deletion

  Request erasure of your data, subject to legal retention.

• Opt-out / object

  Object to processing based on legitimate interests, opt out of marketing, and withdraw consent.

You can exercise most of these directly from your privacy dashboard, or email privacy@quantumleagueai.com. We do not discriminate against you for exercising these rights. You also have the right to lodge a complaint with your local data protection authority.

8. International transfers

We operate globally, and our subprocessors may process data outside your country, including in the United States. Where we transfer personal data out of the EEA/UK, we rely on appropriate safeguards such as the EU Standard Contractual Clauses (SCCs) and equivalent UK mechanisms, together with supplementary measures where needed.

9. Security

We protect data with encryption in transit and at rest, role-based access control, least-privilege backend rules, and monitoring. No system is perfectly secure, but we work continuously to protect your data. See our Trust Center for our security and compliance posture.

10. Changes to this policy

We may update this policy as the platform evolves. We will revise the "Last updated" date and, for material changes, notify you in the app or by email.

11. Contact

Questions or requests? Contact: privacy@quantumleagueai.com