legal

Data Processing

What you agree to when you create a Hoopstack account: the processing we carry out to run the service, who else touches the information, and what you can ask us to do about it.

Updated August 17, 2026

Need help, or want to reach a person? Support

What this document is

• This is the processing you agree to when you create a Hoopstack account.
• It describes what we do with information, why, and who else is involved. The full detail — every category we hold, how long we hold it, and your rights — is in the Privacy Policy, and this document does not replace it.
• Where the two documents describe the same thing, the Privacy Policy is the fuller statement and the one to rely on.
• Hoopstack is operated by Hoopstack LLC. Questions about processing, and any request about your data, go to privacy@hoopstack.ai.

What we process, and why

• Running your account. Creating it, signing you in, confirming your address, resetting your password, and showing you the parts of the product your role gives you.
• Delivering the product. Rosters, evaluations, self-assessments, development plans, workouts, schedules, attendance, team messages and uploaded documents are the service; holding and displaying them to the right people is what Hoopstack does.
• Generating development plans. A coach's evaluation answers, a player's self-assessment answers and the coach's plan inputs are sent to a large language model to draft a plan. See 'Automated processing' below.
• Sending transactional e-mail. Address confirmations, password resets and invitations. We do not send marketing e-mail.
• Keeping the service working. Sign-in sessions, error reports when something fails, and — for actions taken in our administrative panel — a record of the action and the originating IP address.

We do not sell personal information, we do not use it for advertising, and we do not load advertising trackers, marketing analytics or tag managers.

The information itself

• The categories we hold are listed in full under 'What we collect' in the Privacy Policy. In short: account details, player details recorded by a coach or club, evaluations and plans, activity in the product, uploaded documents, consent records, and the technical records needed to run and secure the service.
• Passwords are held only as a hash and are never recoverable, by us or by anyone else.

If you are recording someone else's information

• Coaches and organizations enter information about players, including children. When you do that, you are describing another person, and often a minor.
• Enter what a coach genuinely needs. A player profile works without a date of birth, a jersey number, a height or a class year; every one of those fields is optional.
• A player under 13 should exist as a profile created by an adult, with the consent of a parent or guardian, and not as a self-registered account. The product enforces the account half of that rule: it refuses to send that child an invitation, or to attach a login to their profile, until a parent or guardian has consented. It does not check consent before you record a profile — that part is on the adults setting Hoopstack up.
• Anything you type into a note, a message or an uploaded document is held as you wrote it. We do not inspect it, and we cannot tell you what is inside a document you uploaded.

Automated processing

• Development plans are drafted by a large language model provided by OpenAI, called from our own server through its developer API.
• What is sent: the coach's evaluation answers about a player, the player's own self-assessment answers, and the coach's development-plan inputs. Because those answers are about the player, information about a young athlete leaves our systems.
• What is not sent: e-mail addresses, passwords, uploaded documents, messages or calendar data.
• Nothing about a player is decided solely by the model. A generated plan is not shown to the player or their parent until a coach has read it and approved it; without that approval it stays unpublished.
• We do not use your information to train any model of our own.

Who else processes it

• Hosting: a virtual private server in the United States, with Cloudflare in front of it.
• Transactional e-mail: mailingapi.com, which receives the recipient's name and address.
• File storage: documents uploaded by a coach or club are stored with Cloudflare R2, an S3-compatible object store.
• Development plans: OpenAI, as described above.
• These providers act on our instructions and are not permitted to use the information for their own purposes.
• Our servers are in the United States. Wherever you reach Hoopstack from, your information is transferred to and processed there.

Keeping it, and deleting it

• Account and player information is kept while the account or profile is active.
• You can delete your account from inside the mobile app, without contacting us. What that destroys, what it leaves with the organization, and the one case where it closes an organization, are all set out under 'Deleting an account' in the Privacy Policy.
• Backups today are manual copies kept on the same server as the database. Information already inside one of those copies is not automatically removed when you delete something. An off-site, scheduled backup is committed in our infrastructure but is not yet running in production, and we will describe its effect on deletion here once it is.

Security

• Traffic between the app and our servers is encrypted in transit.
• Our database is not reachable from the internet; it is accessible only to the application itself, over an internal network.
• Access to a player's information is restricted to the coaches assigned to that player's team, the organization that owns the team, the player, and a parent who has recorded consent.
• No security system is perfect, and we cannot guarantee absolute security of the information we hold.

Children

• Hoopstack holds information about young athletes, so children have their own notice: the Children's Privacy Notice describes what we hold about a child, how a parent consents, and how a parent reviews or deletes it.

Changing your mind

• The processing described here is what makes the product work. It cannot be switched off item by item while you go on using Hoopstack — stopping it means closing your account, which you can do yourself at any time.
• You can still ask us for a copy of what we hold about you, a correction, or the deletion of a player profile that has no account attached. Write to privacy@hoopstack.ai.
• We will not ask you to justify a request, and using one of these rights costs nothing and changes nothing else about your account.

Changes to this document

• If we change how we process information, we update this page and the date at the top of it.
• If a change is significant, we will ask you to agree to it again rather than rely on your having read this page.