PRIVACY POLICY
Last updated: March 18, 2026 · Version 1.2
1. WHO WE ARE
GOATED Athletics (“we”, “us”, “our”) operates the GOATED Training platform at goated-training.com. We are committed to protecting the privacy and security of our users, including athletes, coaches, and parents. This policy explains what data we collect, why we collect it, and how we keep it safe.
2. DATA WE COLLECT
Account Information: When you sign up, we collect your name, email address, and an encrypted password.
Profile Information: Role (athlete or coach), sport preferences, position, jersey number, and optional profile picture.
Training Data: Lesson progress, quiz scores, practice logs, achievement badges, XP, streak counts, and leaderboard stats.
Team Data: Team membership, roster information, and team chat messages (coaches only create and manage teams).
Payment Information: Payments are processed entirely by Stripe. We never store your full card number, CVV, or billing address on our servers.
3. HOW WE USE YOUR DATA
We use your data exclusively to provide and improve the GOATED Training experience:
- Deliver personalized training content and track your progress
- Power leaderboards, achievements, and team features
- Process subscription payments via Stripe
- Send transactional emails (welcome messages, password resets)
- Respond to support and contact form inquiries
We never sell, rent, or share your personal data with advertisers or data brokers.
4. HOW WE PROTECT YOUR DATA
- Authentication: Passwords are hashed and managed by Supabase Auth. We never store plaintext passwords.
- Row Level Security (RLS): Every database table is protected by row-level security policies. Users can only read and modify their own data.
- Encryption in Transit: All data transmitted between your browser and our servers is encrypted using TLS/HTTPS.
- Encryption at Rest: Your data is stored in Supabase’s PostgreSQL database, which encrypts data at rest using AES-256.
- Rate Limiting: All API endpoints are rate-limited to prevent abuse.
- Input Sanitization: All user inputs are sanitized to prevent injection attacks (XSS, SQL injection).
- Security Headers: We enforce strict HTTP security headers including X-Frame-Options, Content-Type-Options, and Referrer-Policy.
5. THIRD-PARTY SERVICES
We use the following trusted services to operate GOATED Training:
- Supabase: Database hosting, authentication, and real-time features. Data is stored in secure, SOC 2 compliant infrastructure.
- Stripe: Payment processing. Stripe is PCI DSS Level 1 certified. We never handle or store your card details.
- Vercel: Application hosting with automatic HTTPS and DDoS protection.
- Resend: Transactional email delivery (welcome messages, password resets). We do not send marketing emails without consent.
6. YOUR RIGHTS
You have the right to:
- Access your personal data through your Profile and Settings pages
- Update your profile information at any time from Settings
- Delete your account and all associated data from Settings > Danger Zone
- Contact us to request a full data export or ask questions about your data
When you delete your account, all your personal data, progress, quiz history, practice logs, and team memberships are permanently removed.
7. CHILDREN’S PRIVACY
GOATED Training is designed for athletes of all ages, including children under 13. We comply with the Children’s Online Privacy Protection Act (COPPA) and take the following measures:
What we collect at signup: We collect a date of birth during registration to determine the user’s age tier. For users under 13, we also collect a parent or guardian’s email address.
Parental consent (under 13): Before activating an account for a child under 13, we send a consent email to the parent or guardian. The account remains restricted until the parent verifies consent by clicking a secure link. The consent email describes exactly what data is collected.
Data collected from children: The same categories listed in Section 2 above — account information, profile information, training data, and team data. We do not collect geolocation, photos, or video from children unless explicitly uploaded by the user.
No advertising or data sales: We do not serve targeted advertising to any user, and we never sell, rent, or share children’s data with advertisers or data brokers.
Parental rights: Parents and guardians may at any time:
- Review their child’s data through the Parent Portal
- Revoke consent, which restricts the child’s account
- Request complete deletion of their child’s data
- Contact us at support@goated-training.com for any data request
Teens (13–17): Users aged 13–17 may create accounts without prior parental consent. If a parent email is provided, we send an informational notification inviting the parent to create a free Parent account.
8. DATA RETENTION
We retain your data for as long as your account is active. If you delete your account, your data is permanently removed from our systems. Contact form submissions are retained for up to 12 months to ensure we can follow up on your inquiries.
9. CHANGES TO THIS POLICY
We may update this Privacy Policy from time to time. When we do, we will update the “Last updated” date at the top. We encourage you to review this page periodically.
10. CONTACT US
If you have any questions about this Privacy Policy or how we handle your data, please email us at support@goated-training.com.