Track Tools Pro Privacy Policy

Effective Date: July 6, 2026

Track Tools Pro ("Company," "we," "our," or "us") is committed to protecting the privacy of our users, particularly the coaches and student-athletes who use our platform. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our website at tracktoolspro.com, mobile applications, and related services (collectively, the "Services").

This Privacy Policy is designed to comply with applicable U.S. privacy laws, including the California Consumer Privacy Act ("CCPA") as amended by the California Privacy Rights Act ("CPRA"), the Virginia Consumer Data Protection Act ("VCDPA"), the Colorado Privacy Act ("CPA"), the Connecticut Data Privacy Act ("CTDPA"), the Children's Online Privacy Protection Act ("COPPA"), and the Family Educational Rights and Privacy Act ("FERPA").

BY USING THE SERVICES, YOU CONSENT TO THE DATA PRACTICES DESCRIBED IN THIS PRIVACY POLICY. IF YOU DO NOT AGREE WITH THESE PRACTICES, PLEASE DO NOT USE THE SERVICES.

1. Information We Collect

We collect information in several ways: directly from you, automatically when you use the Services, and from third parties.

1.1 Information You Provide Directly

Account Registration Data:

• Name, email address, and password
• Team name and affiliation (school, club, or organization)
• Role (Coach, Administrator, Athlete, or Parent/Guardian)
• Phone number (optional; used for account recovery and, only with your consent, SMS text messages such as team invitations)

Athlete Profile Data:

• Date of birth, gender, height, and weight
• Event groups and specializations (for example: Sprints, Distance, Throws, Jumps)
• Personal bests (PRs), season bests, and historical performance records
• Grade/year in school and graduation year

Training and Performance Data:

• Daily training logs, workout details, and session notes
• Workout splits, times, distances, and volumes
• Competition results and meet performances
• Training plans and periodization schedules

Wellness and Health-Adjacent Data:

• Perceived exertion (RPE) ratings
• Soreness and fatigue indicators
• Sleep quality and duration (self-reported)
• Injury status and recovery notes
• Wellness survey responses entered into the Pulse Dashboard

Availability and Scheduling Data:

• Weekly availability entries (recurring busy blocks such as classes, work, or other commitments) that athletes share with their coaches for practice scheduling

Multimedia Content:

• Videos uploaded for Motion Lens biomechanical analysis
• Photos and images associated with training logs or profiles
• Voice recordings you optionally submit for transcription into text (processed to generate the transcription and not retained as audio)

Messaging Data:

• Messages sent within team channels, event group channels, and direct messages
• Threaded replies to messages
• Emoji reactions on messages
• Polls created within message channels (questions, options, and votes)
• Files and images shared as message attachments (stored on AWS S3)
• Read receipts indicating when messages have been viewed
• @mention data identifying users or groups referenced in messages

Payment Information:

• Billing name, address, and payment card details (processed and stored by Stripe; we do not store payment card numbers)

1.2 Information Collected Automatically

When you access or use the Services, we automatically collect certain information:

• Device Information: Device type, operating system, unique device identifiers, browser type and version
• Usage Information: Pages viewed, features used, time spent on pages, click patterns, and navigation paths
• Log Data: IP address, access times, referring URLs, and error logs
• Location Information: General geographic location inferred from IP address (we do not collect precise GPS location)

1.3 Information from Third Parties

We may receive information about you from third parties, including:

• Roster Data: At a coach's direction, we may import athlete rosters and performance results from spreadsheets or from data the coach pastes from sources such as MileSplit or Athletic.net
• School Systems: If your school integrates with our platform, we may receive student directory information
• Garmin Connect: When athletes connect their Garmin accounts, we receive activity data including workout details, heart rate, pace, elevation, distance, duration, and calories burned. We also perform a historical backfill of the last 30 days of activities upon connection.

1.4 Information About Prospective Student-Athletes (Recruits)

For college and club programs, the Services include recruiting management features. Coaches may store information about prospective student-athletes ("Recruits"), who may not themselves hold Track Tools Pro accounts. Recruit information may include: name, gender, graduation year, email address, phone number, city/state, high school or club, parent/guardian name and email, GPA and test scores, athletic performance marks, and links to highlight videos.

We collect Recruit information from the following sources:

• Directly from coaches who enter or import it
• From Recruits themselves, when they submit a team's public recruiting questionnaire or use a personalized update link a coach sends them
• From publicly available results data that a coach pastes into the platform at their direction

Recruits (or their parents/guardians) may request deletion of their information through the deletion option on their personalized update link or by emailing support@tracktoolspro.com. Deletion requests are honored within 30 days. In addition, automated retention processes anonymize Recruit records approximately two years after the Recruit's graduation year.

2. How We Use Your Information

We use the information we collect for the following purposes:

2.1 Service Delivery and Core Functionality

• To create and manage your account
• To enable coaches to manage team rosters and view athlete data
• To calculate training loads, paces, and performance analytics (including ACWR)
• To generate graphs, charts, and visualizations of athlete progress
• To process videos through Motion Lens for biomechanical analysis
• To power AI features such as training suggestions, AI Chat, and Tempo agent assistance
• To display wellness indicators and injury risk flags on the Pulse Dashboard
• To facilitate team messaging, including channel conversations, direct messages, threaded replies, emoji reactions, polls, and file sharing

2.2 Communications

• To send transactional emails (account verification, password resets, billing receipts)
• To send service-related announcements and updates
• To respond to your inquiries and support requests
• To send push notifications for messaging activity, including new messages, @mentions, replies to your messages, and emoji reactions on your messages (you may disable push notifications in your device settings at any time)
• To send SMS text messages you have opted in to receive, such as team invitation links, account setup help, and important account notifications (message frequency varies; message and data rates may apply; reply STOP to cancel or HELP for help at any time)
• To send promotional communications (with your consent, where required)

2.3 Safety, Security, and Compliance

• To detect and prevent fraud, abuse, and security incidents
• To enforce our Terms of Use and protect user safety
• To comply with legal obligations and respond to lawful requests

2.4 Improvement and Analytics

• To analyze usage patterns and improve the Services
• To develop new features and functionality
• To create aggregated statistics for research and benchmarking

3. Third-Party Services and Data Sharing

We share your information only as described in this Privacy Policy. We do NOT sell your personal information.

3.1 Service Providers

We engage trusted third-party service providers to perform functions on our behalf. These providers are contractually obligated to protect your data and may only use it to provide services to us.

Stripe (Payment Processing)

We use Stripe for payment processing, analytics, and fraud prevention. Payment information is transmitted directly to Stripe's PCI-DSS compliant servers and is never stored on our systems. Stripe may collect personal data including transactional data and device information for fraud detection and service improvement. Stripe's privacy practices are governed by their privacy policy at https://stripe.com/privacy.

Google Cloud Platform (Application and Database Hosting)

Our application servers run on Google Cloud Run, and your data, including training logs, performance records, and account information, is stored in Google Cloud SQL PostgreSQL databases located in the United States. All data is encrypted at rest and in transit using TLS encryption. Google Cloud maintains SOC 1/2/3, ISO 27001/27017/27018, and PCI-DSS certifications. Learn more at https://cloud.google.com/privacy.

Cloudflare R2 (Encrypted Database Backups)

Encrypted backups of our database are stored on Cloudflare R2 object storage. Backups are encrypted before upload using modern file encryption, so Cloudflare cannot read their contents. Cloudflare's privacy practices are available at https://www.cloudflare.com/privacypolicy.

Amazon Web Services - S3 (File Storage)

Media files, including profile pictures, Motion Lens videos, and files shared as message attachments, are stored on Amazon Web Services (AWS) S3 infrastructure located in the United States. All files are encrypted in transit using TLS encryption. AWS maintains SOC 1/2/3, ISO 27001/27017/27018, and PCI-DSS certifications. Learn more at https://aws.amazon.com/privacy.

SendGrid (Email Delivery)

We use SendGrid (a Twilio company) to deliver transactional and marketing emails. SendGrid processes email addresses and message content to deliver communications. SendGrid may use tracking technologies (pixels) to measure email engagement, including opens and clicks. You can opt out of email tracking by adjusting your email client settings to block images or by contacting us. SendGrid's privacy practices are available at https://www.twilio.com/legal/privacy.

Garmin Connect (Fitness Data Integration)

Athletes may optionally connect their Garmin devices to Track Tools Pro via Garmin Connect. When connected, we receive activity data from Garmin including workout metrics (heart rate, pace, elevation, distance, duration, calories). This data is used solely to populate training logs and provide coaches visibility into athlete activities. Athletes can disconnect their Garmin account at any time through their account settings. Garmin's privacy practices are available at https://www.garmin.com/legal/privacy-statement.

Sentry (Error Monitoring)

We use Sentry to monitor application errors and crashes across our web and mobile applications. When an error occurs, Sentry automatically collects diagnostic information to help us identify and fix issues. This may include error messages and stack traces, device type and operating system, browser type and version, general geographic location (country/region level inferred from IP address), and the sequence of actions leading to the error. Sentry does not collect passwords, payment information, or the content of your training data. We do not enable session replay features that would record your screen. IP addresses are anonymized and error data is retained for 90 days. Sentry's privacy practices are available at https://sentry.io/privacy.

Google Analytics (Conversion Tracking)

We use Google Analytics and Google Tag Manager for conversion tracking and marketing analytics. Google may collect device information, browser type, pages viewed, and interaction data. Google's analytics services may use cookies or similar technologies to measure user engagement. Google's privacy practices are governed by their privacy policy at https://policies.google.com/privacy.

Cloudflare Web Analytics (Usage Analytics)

We use Cloudflare Web Analytics to understand aggregate usage patterns. Cloudflare's analytics are privacy-focused and do not use cookies or track individual users across sites. Cloudflare's privacy practices are available at https://www.cloudflare.com/privacypolicy.

MapTiler and Google Maps (Map Services)

We use MapTiler (web application) and Google Maps (mobile application) to display map tiles for training route visualization and location features. These services may receive your IP address and general location information when map tiles are loaded. MapTiler's privacy practices are available at https://www.maptiler.com/privacy-policy. Google Maps privacy practices are governed by Google's privacy policy at https://policies.google.com/privacy.

Expo and Firebase Cloud Messaging (Push Notifications)

Mobile push notifications are delivered through Expo's push notification service, which uses Firebase Cloud Messaging (Google) on Android and Apple Push Notification service on iOS. These services process device push tokens and notification payloads in order to deliver notifications to your device. Expo's privacy practices are available at https://expo.dev/privacy.

Google reCAPTCHA Enterprise (Abuse Prevention)

We use Google reCAPTCHA Enterprise to protect account sign-up and public recruiting forms from automated abuse. reCAPTCHA collects device and interaction signals (such as IP address and browser characteristics) to distinguish humans from bots. Its use is subject to Google's privacy policy at https://policies.google.com/privacy.

Weather Services (Google Weather API and OpenWeatherMap)

To display weather forecasts for practices and team locations, we send the approximate geographic coordinates of team-configured locations to the Google Weather API and OpenWeatherMap. No personal identifiers are included in these requests. OpenWeatherMap's privacy practices are available at https://openweather.co.uk/privacy-policy.

3.2 Artificial Intelligence Providers

YOUR PERSONAL ATHLETIC DATA IS NOT USED TO TRAIN THE UNDERLYING AI MODELS.

We use third-party AI services to power features like Motion Lens video analysis, AI Chat, and Tempo agent workflows. When you use these features, relevant data is transmitted to our AI providers for processing.

Google (Gemini API)

For our paid API tier, Google does not use your prompts, inputs, or outputs to train its foundational AI models. Data is logged only for abuse monitoring and service integrity. Google's AI privacy practices are detailed at https://cloud.google.com/terms/data-processing-addendum.

xAI (Grok)

xAI does not use business data to train its AI models. Inputs and outputs from enterprise API usage are automatically deleted within 30 days. xAI's privacy policy is available at https://x.ai/legal/privacy-policy.

Groq (Audio Transcription)

When you use optional voice input, your audio recording is transmitted to Groq, which processes it solely to return a text transcription. We do not store the audio recording on our servers, and Groq does not use API data to train AI models. Groq's privacy policy is available at https://groq.com/privacy-policy.

Opting Out of AI Features: You may opt out of AI-powered analysis features by contacting us at support@tracktoolspro.com. Opting out will disable Motion Lens, AI Chat, Tempo agent features, and other AI-enhanced features for your account.

3.3 Sharing with Your Team

When an athlete joins a team, their training logs, wellness data (including sleep quality, fatigue, stress, mood, and soreness ratings), performance metrics, uploaded videos, login activity, and messages sent within team and event group channels become visible to all coaches and administrators of that team. Messages sent in direct message channels are visible only to the participants of that conversation. This visibility is applied at the team level and cannot be restricted on a per-athlete basis. This sharing is essential to the core functionality of the Services.

Automated Wellness Monitoring: The Services automatically calculate wellness trends and training load metrics based on data you enter. If these metrics indicate a concerning pattern (for example: declining wellness trend, elevated injury risk), coaches may receive automated alerts through the Pulse Dashboard. These flags are algorithmic estimates based on your self-reported data and are not medical diagnoses.

Activity Tracking: The Services record when you last accessed the platform and which platform you used (web, mobile app, or progressive web app). This information is visible to your coaches for team management purposes.

3.4 Legal Requirements and Safety

We may disclose your information if we believe in good faith that such disclosure is necessary to: (a) comply with applicable laws, regulations, legal processes, or governmental requests (for example: subpoenas, court orders); (b) enforce our Terms of Use; (c) protect the rights, property, or safety of Track Tools Pro, our users, or others; or (d) detect, prevent, or address fraud, security, or technical issues.

3.5 Business Transfers

If Track Tools Pro is involved in a merger, acquisition, asset sale, or bankruptcy, your information may be transferred as part of that transaction. We will provide notice before your information becomes subject to a different privacy policy.

3.6 Third-Party AI Agents You Connect (MCP)

Coaches may connect third-party AI assistants and agents (for example: Claude or other tools that support the Model Context Protocol) to their Track Tools Pro account. When a coach connects an agent, any data that agent retrieves through the connection, including roster, training, wellness, messaging, and recruiting data the coach's account can access, is transmitted to that agent and processed by its AI provider under that provider's own privacy policy. We do not control third-party agents or their providers, and this Privacy Policy does not apply to their handling of data. Coaches are responsible for ensuring that any such connection is authorized by their institution's policies and applicable law before enabling it.

3.7 SMS/Text Messaging (Twilio)

We use Twilio to deliver SMS text messages to users who have opted in to receive them, such as team invitation links and account notifications. Twilio processes phone numbers and message content solely to deliver these messages on our behalf. Twilio's privacy practices are available at twilio.com/legal/privacy.

No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Text messaging originator opt-in data and consent will not be shared with any third parties, excluding the aggregators and service providers (such as Twilio) that deliver messages on our behalf. You may opt out of text messages at any time by replying STOP to any message or emailing support@tracktoolspro.com.

4. AI-Powered Features - Detailed Disclosure

In accordance with FTC guidance on AI transparency, we provide the following detailed disclosure about our AI-powered features:

4.1 What Data AI Features Process

• Motion Lens: Video files you upload, which may contain your image and athletic movements
• AI Chat and Tempo: Your questions and prompts, plus relevant context from your training history to provide personalized responses. For Tempo action workflows, this may include proposed action payloads and your approvals or denials.
• Analytics Features: Training logs, performance data, and wellness entries to identify patterns and generate insights

4.2 How AI Data Is Protected

• Data is transmitted to AI providers using encrypted connections (TLS 1.2+)
• AI providers are contractually prohibited from using your data to train general-purpose models
• AI inputs and outputs are not retained indefinitely by providers (30-day maximum for xAI)
• We do not share personally identifiable information with AI providers beyond what is necessary for processing

4.3 AI Interaction Logging

Track Tools Pro maintains logs of AI interactions (including your prompts, AI-generated responses, and Tempo action approvals/denials) for service quality, cost tracking, abuse prevention, and auditability. These logs are stored on our infrastructure and are retained for the duration of your account. When you delete your account, AI interaction logs associated with your account are deleted within 30 days, consistent with our standard account deletion process.

4.4 AI Limitations

AI-generated outputs may contain errors, inaccuracies, or inappropriate content. AI analysis is not a substitute for professional coaching judgment or medical advice. Always verify AI suggestions with qualified professionals before implementation.

5. Children's Privacy (COPPA and FERPA)

We take the privacy of children seriously and have implemented safeguards to comply with COPPA and FERPA.

5.1 Children Under 13

We do not knowingly collect personal information directly from children under 13 years of age. Children under 13 may only use the Services if: (a) they are invited by a coach affiliated with an educational institution; and (b) the school or coach has obtained verifiable parental consent or is acting as the parent's agent under the COPPA school consent exception, which permits schools to consent on behalf of parents when collection is solely for educational purposes with no commercial purpose beyond the educational context.

5.2 School Official Status (FERPA)

When used by educational institutions, Track Tools Pro acts as a School Official with a legitimate educational interest in student records under FERPA. In this capacity, we: (a) are under the direct control of the school regarding the use of education records; (b) use education records only for authorized educational purposes; (c) do not disclose education records to third parties except as permitted by FERPA; and (d) do not use student data for targeted advertising or commercial purposes unrelated to the educational service.

5.3 Student Data Commitments

We commit to the following regarding student data:

• We do NOT sell student personal information
• We do NOT use student data for targeted advertising
• We do NOT create advertising profiles of students
• We do NOT share student data with third parties for commercial purposes beyond educational service delivery

5.4 Parental Rights

Parents and legal guardians have the right to: (a) review the personal information we have collected about their child; (b) request correction of inaccurate information; (c) request deletion of their child's information; and (d) refuse to permit further collection or use of their child's information. To exercise these rights, contact us at support@tracktoolspro.com with verification of your parental relationship.

6. Your Privacy Rights

Depending on your location, you may have certain rights regarding your personal information under applicable privacy laws.

6.1 Rights for All Users

All users have the right to:

• Access: Request a copy of the personal information we hold about you
• Correction: Request correction of inaccurate personal information
• Deletion: Request deletion of your personal information, subject to certain exceptions
• Data Portability: Request your data in a commonly used, machine-readable format
• Opt-Out of Marketing: Unsubscribe from promotional communications at any time

6.2 California Residents (CCPA/CPRA)

If you are a California resident, you have additional rights under the CCPA/CPRA:

• Right to Know: Request disclosure of the categories and specific pieces of personal information we have collected, the sources, the purposes, and the categories of third parties with whom we share it
• Right to Delete: Request deletion of your personal information, subject to certain legal exceptions
• Right to Correct: Request correction of inaccurate personal information
• Right to Opt-Out of Sale/Sharing: We do NOT sell personal information or share it for cross-context behavioral advertising
• Right to Limit Use of Sensitive Information: Request limitation on use of sensitive personal information
• Right to Non-Discrimination: We will not discriminate against you for exercising your privacy rights

We will respond to verified consumer requests within 45 days. We recognize and honor Global Privacy Control (GPC) browser signals.

6.3 Virginia, Colorado, and Connecticut Residents

Residents of Virginia, Colorado, and Connecticut have similar rights to access, correct, delete, and obtain a portable copy of their personal data, as well as the right to opt out of targeted advertising, sale of personal data, and profiling. We will respond to requests within 45 days (Virginia/Connecticut) or 45 days with a possible 45-day extension (Colorado). You may appeal a denial by contacting support@tracktoolspro.com.

6.4 How to Exercise Your Rights

To exercise any of these rights, contact us at support@tracktoolspro.com or use the account settings features within the Services. We may need to verify your identity before processing your request. For minors, a parent or guardian must submit the request with verification of their relationship.

7. Cookies and Tracking Technologies

7.1 What We Use

We use cookies and similar technologies to provide, secure, and improve the Services:

• Essential Cookies: Required for basic functionality (authentication, security, session management)
• Functional Cookies: Remember your preferences and settings
• Analytics Cookies: Help us understand how users interact with the Services

7.2 Email Tracking

Emails sent through SendGrid may contain tracking pixels that record when emails are opened and which links are clicked. This helps us measure engagement and improve communications. You can disable this by configuring your email client to block remote images.

7.3 Your Choices

Most web browsers allow you to control cookies through settings. Blocking certain cookies may affect the functionality of the Services. We honor Do Not Track browser signals and Global Privacy Control (GPC) signals.

8. Data Security

We implement industry-standard security measures to protect your information:

• Encryption: All data is encrypted in transit using TLS
• Access Controls: Role-based access ensures only authorized personnel can access sensitive data
• Secure Infrastructure: Data is hosted on Google Cloud and AWS infrastructure with industry-standard security certifications
• Password Security: Passwords are hashed using bcrypt and never stored in plain text

However, no method of electronic transmission or storage is 100% secure. While we strive to protect your information, we cannot guarantee absolute security. In the event of a data breach affecting your personal information, we will notify you and applicable authorities as required by law.

9. Data Retention

We retain your information for as long as necessary to fulfill the purposes described in this Privacy Policy, unless a longer retention period is required or permitted by law:

Account Deletion: When you delete your account, we will delete or anonymize your personal information within 30 days, except for data we are required to retain for legal compliance. Teams may retain genuinely anonymized aggregate statistics (for example: team averages) for historical record-keeping purposes.

10. International Users

Track Tools Pro is based in the United States and the Services are intended for users located in the United States. If you access the Services from outside the United States, your information will be transferred to, stored, and processed in the United States where our servers are located. By using the Services, you consent to this transfer. We do not currently offer the Services to users in the European Economic Area (EEA) or other jurisdictions with data localization requirements.

11. Health Data and FTC Compliance

Certain data collected through the Services, including wellness indicators, fatigue metrics, sleep quality, and injury status, may qualify as health-related information under the FTC Health Breach Notification Rule. While Track Tools Pro is not a covered entity under HIPAA, we treat this data with heightened care:

• Wellness data is encrypted and access-controlled
• We do not share wellness data with third parties for marketing purposes
• In the event of a breach involving health-related data, we will notify affected users and the FTC as required by law

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. If we make material changes, we will notify you by: (a) posting a prominent notice on the Services; (b) sending an email to your registered email address; or (c) other appropriate means. Material changes will not take effect until at least 30 days after notice. Your continued use of the Services after the effective date constitutes your acceptance of the updated Privacy Policy. We encourage you to review this Privacy Policy periodically.

13. Contact Us

If you have questions about this Privacy Policy, wish to exercise your privacy rights, or have concerns about our data practices, contact us:

Track Tools Pro
Email: support@tracktoolspro.com
Website: https://www.tracktoolspro.com

For privacy-related requests, include "Privacy Request" in your subject line and provide sufficient information for us to verify your identity and process your request.

BY USING THE SERVICES, YOU ACKNOWLEDGE THAT YOU HAVE READ AND UNDERSTOOD THIS PRIVACY POLICY AND CONSENT TO THE COLLECTION, USE, AND DISCLOSURE OF YOUR INFORMATION AS DESCRIBED HEREIN.