legal

Privacy Policy

Hoopstack is a basketball development tool used by coaches, clubs and parents. It holds information about young athletes, so this policy is specific about what we collect, who we send it to, how long we keep it, and what happens when an account is deleted.

Updated August 4, 2026

Need help, or want to reach a person? Support

Who we are

• Hoopstack is operated by Hoopstack LLC.
• Questions about this policy, and requests about your data, go to privacy@hoopstack.ai. That address reaches us, and it is the channel to use for anything in this policy.

Who has an account, and who is described

• Account holders are coaches, organization owners, parents and players.
• Hoopstack is sold to and set up by adults. A player under 13 should exist only as a profile created by an adult, with the consent of a parent or guardian, and not as a self-registered account.
• This is a rule we place on the adults who set up Hoopstack, not a check the product runs when a profile is created: recording a player's profile does not require a parent's consent to already be on record. What the product does enforce — refusing to create or attach a login for a player under 13 without that consent — is described in the Children's Privacy Notice and in our Terms of Service.
• A player profile can exist with no account attached to it at all. In that case we hold information about that player, but that person has no login.

What we collect

• Account details: name, e-mail address, phone number, and a password we never store in readable form.
• Player details recorded by a coach or club: name, date of birth, jersey number, playing position, height, class year and competition level.
• Evaluations: a coach's assessment of a player, and a player's own self-assessment, both entered as structured form answers.
• Development plans generated from those evaluations, and coach notes attached to a player.
• Activity: workouts assigned and completed, calendar events and attendance, and messages sent in team threads.
• Documents uploaded by coaches or clubs, which may contain anything the uploader puts in them.
• Consent records: which parent consented to what, when, and against which version of the consent text.
• Technical data needed to run the service: sign-in sessions, error reports when something fails, and — for actions taken in our administrative panel — a record of the action and the originating IP address.

Why we hold it

• To provide the product: evaluations, development plans, workouts, schedules, messaging and documents are the service itself.
• To let a parent see their own child's information, once consent is recorded.
• To send transactional e-mail: confirming an address, resetting a password, and issuing invitations.
• To keep the service working and diagnose failures.
• We do not sell personal information. We do not use it for advertising, and we do not load advertising trackers, marketing analytics or tag managers.

Artificial intelligence, and what is sent to it

• Development plans are generated by a large language model provided by OpenAI.
• What is sent: the coach's evaluation answers about a player, the player's own self-assessment answers, and the coach's development-plan inputs.
• Because those answers are about the player, information about a young athlete leaves our systems and is processed by OpenAI in order to produce the plan.
• What is not sent: e-mail addresses, passwords, uploaded documents, messages, or calendar data.
• The plan is generated through OpenAI's developer API, which we call from our own server. Nobody types a player's information into a chatbot, and we do not use it to train any model of our own.
• A generated plan is not shown to the player or their parent until a coach has read it and approved it. Nothing about a player is decided solely by the model: the coach's approval is a real step in the product, and without it the plan stays unpublished.

Who else processes it

• Hosting: a virtual private server in the United States, with Cloudflare in front of it.
• Transactional e-mail: mailingapi.com, which receives the recipient's name and address.
• File storage: if a coach or club uploads a document, it is stored with Cloudflare R2, an S3-compatible object store. That is the destination uploads are sent to; nothing else is placed there.
• Backups: today, a backup is a manual copy kept on the same server as the database, and no outside party holds it. We are building an off-site, encrypted backup to Cloudflare R2, but it is not yet running — see 'How long we keep it' below.
• These providers act on our instructions. They are not permitted to use the information for their own purposes.

Where it is held

• Our servers are in the United States.
• Wherever you reach Hoopstack from, your information is transferred to and processed in the United States.
• Our processors are named above. Where one of them handles your information outside the country you are in, it does so on our instructions and under a written agreement with us.

How long we keep it

• Account and player information is kept while the account or profile is active.
• Today, backups are taken by hand before a significant change is made to production, and are stored on the same server as the database. This protects against a bad deploy or migration, not against the loss of that server.
• We are also building an always-on, off-site backup schedule. It is committed in our infrastructure, but it is not yet running in production.
• Once that schedule is running, we will state here how many days a deleted item can persist inside a backup before it ages out. We are not giving that number today, because the schedule that would define it is not yet in operation.

Deleting an account, and exactly what that does

• You can delete your account from inside the mobile app, from the profile menu, without contacting us.
• Your personal details are destroyed: name, e-mail address, password, and the profile fields belonging to you.
• Your user record itself is kept as a tombstone with every personal field erased. This is so that club records which reference an author do not lose their shape.
• If you are a player, your own information is destroyed, and the roster entry left behind is anonymised so the team's history still makes sense.
• Content belonging to the club is not deleted with you: teams, uploaded documents, message threads, calendar events and the messages you sent stay with the organization.
• There is one exception. If you are the only owner of an organization, and no one else is left in it, deleting your account closes that organization too — its teams, its roster, the evaluations and development plans recorded there, its documents, threads and calendar events are deleted with it. A player who has their own Hoopstack account keeps it; only their place on that roster goes. A player who was only ever a roster entry created by a coach is deleted along with the rest.
• This is not silent: the app names the organization and what closing it destroys, and asks you to confirm, before you confirm the deletion itself.
• Deletion cannot be undone. Today, information already inside an existing backup — a manual copy taken by hand before a significant production change — is not automatically removed from it. Once our off-site backup schedule is running, deleted information will instead age out of backups on that schedule, and we will describe that here.

Children's information

• Hoopstack holds information about young athletes, so this has its own notice.
• See the Children's Privacy Notice at /childrens-privacy for what we collect about a child, how a parent consents, and how a parent can review or delete it.

Your choices

• You can see and correct your own account details in the product.
• You can delete your account from inside the app at any time.
• A parent who has consented can see the information we hold about their child.
• For anything the product does not let you do yourself — a copy of what we hold about you, a correction we have no form for, or the deletion of a player profile that has no account attached — write to privacy@hoopstack.ai and we will carry it out.
• We will not ask you to justify a request, and using one of these rights costs nothing and changes nothing else about your account.

California privacy rights

• If you are a California resident and would like to obtain information about how Hoopstack LLC has shared your personal information with third parties, you may submit a request to privacy@hoopstack.ai.
• If you are a California resident and wish to opt out of the disclosure of your personal information to third parties for their direct marketing purposes, you may contact us at the same address.
• We do not sell personal information, and we do not disclose it for anyone's direct marketing purposes.
• The categories we collect are the ones listed under 'What we collect' above: identifiers such as name, e-mail address and phone number; information about a young athlete recorded by a coach or club; content you create in the product; and technical records needed to run and secure the service.
• We do not sell or share personal information for cross-context behavioural advertising, so this site carries no 'Do Not Sell or Share My Personal Information' link. There is nothing behind such a link to switch off.

Privacy rights in other US states

• If you are a resident of another US state with a comprehensive privacy law, you may have specific rights under that state's law, including the right to opt out of the sharing of your personal information.
• Contact us at privacy@hoopstack.ai and we will explain the rights that apply to the personal data Hoopstack LLC holds about you, and carry out any request you are entitled to make.
• We handle these requests the same way wherever you live, rather than only for residents of states whose laws name them.

Security

• Passwords are stored only as a hash and are never recoverable.
• Traffic between the app and our servers is encrypted in transit.
• Our database is not reachable from the internet; it is accessible only to the application itself over an internal network.
• Today's manual backup copy does not leave the server at all. Once our off-site backup is running, it will be encrypted before it leaves the server.
• Access to a player's information is restricted to the coaches assigned to that player's team, the organization that owns the team, the player, and a parent who has recorded consent.
• No security system is perfect, and we cannot guarantee absolute security of the information we hold.

Storage on your device and in your browser

• We remember that you are signed in so you do not have to log in on every page.
• If you open an invitation and need to sign up first, we may briefly remember that invitation so the process can continue.
• We may use operational error monitoring to diagnose failures. It is not used to build advertising profiles or to track you across other sites.
• If we ever add optional analytics or marketing tools, we will add consent controls before loading them where that is required.
• The cookies described above are set by us and are necessary for the service to work. We do not set advertising or tracking cookies.

Changes

• If we change this policy we will update the date at the top of this page.
• If a change materially affects information about a child, we will seek parental consent again rather than rely on the consent already recorded.