Privacy Policy

We are accountable for the personal information in our care, identify the purpose of collection at or before the time of collection, ask for your consent, limit collection to what is necessary, limit use and disclosure to those purposes, keep information accurate and up to date, protect it with appropriate security safeguards, make our practices openly available, give you access to your information on request, and provide a way to challenge our compliance.

We collect personal information in the following ways:

Information you give us

• Account data: name, email, password (stored hashed), role (athlete, coach, parent, or club owner), and Google account ID if you sign in with Google.
• Profile data:avatar, sport, position, team, your city/province, bio, certifications, methodology, highlights. If you are a coach or club, the venue location you choose for your listing (including its coordinates) is stored on our servers to place you on the map and power distance-based search. If you are searching for a coach and grant location permission, your device location is used on your device only to sort and filter nearby results — it is not stored on our servers.
• Children's data (provided by a parent):when a parent adds a child to their account, we collect only a nickname or first name (not the child's full legal name) and a broad age band (for example, “9–11”) — enough to confirm the child is under 18 and match age-appropriate coaches — plus any optional sport, position, or team the parent chooses to add. We do not collect a child's exact date of birth, last name, or their own contact details.
• Booking data: session selections, schedules, messages exchanged with the other party, reviews you publish.
• Payment data: billing details are collected and stored by Stripe, our payment processor. We receive only non-sensitive metadata such as the last four digits of the card and the payment status.
• Communications: emails you send to support, content of in-app messages, and reports submitted through the abuse-reporting feature.
• Club event registration data: when you register for a club event, we collect the participant name(which may be a child's name, where a parent registers on the child's behalf), a contact email, and any optional phone number and commentsyou provide. We collect this to process your registration and, with your consent, to provide it to the Club so it can organise and run the event (see “How we share your information” below).

Information collected automatically

• Usage data: pages visited, features used, search queries, and approximate timestamps. We use Vercel Analytics, which collects anonymised metrics without setting tracking cookies.
• Performance data: Vercel Speed Insights records anonymised page performance metrics.
• Error data: if Sentry is enabled, we may capture technical details about errors that occur in your browser to help us fix bugs. Sensitive form input is masked.
• Device and connection data: IP address (used transiently for security and rate limiting), browser type, operating system, and referral URL.

Information from third parties

• Google OAuth: if you sign in with Google, we receive your name, email, and profile picture from Google.
• Stripe: we receive payment status, refunds, and payout confirmations from Stripe.

• To create and manage your account and Coach or Athlete profile;
• To facilitate bookings, payments, and payouts between Athletes and Coaches;
• To send transactional emails (booking confirmations, reminders, refunds, password resets);
• To detect fraud, abuse, and security threats;
• To improve the Platform's features, performance, and reliability;
• To personalise AI-assisted training suggestions when you use that feature;
• To meet our legal, accounting, and tax obligations.

Under PIPEDA, we collect and use your personal information based on your express or implied consent. By creating an account and using the Platform you consent to the collection and use described in this Policy. Where we rely on a legitimate business interest (for example, fraud prevention or service improvement), we limit our use to what a reasonable person would consider appropriate in the circumstances.

We do not sell or rent personal information. We share it only with the service providers listed below, and only to the extent needed to operate the Platform:

• Supabase— database, authentication, and file storage. Data is stored in their managed PostgreSQL instance.
• Stripe— processes all payments, refunds, and Coach payouts. Stripe is a PCI DSS Level 1 certified provider.
• Vercel— hosts the website and runs Analytics and Speed Insights.
• Resend— delivers transactional and notification emails.
• Anthropic— powers the LUMP AI assistant. Conversation content is sent to Anthropic for processing in real time.
• YouTube / Google— when the LUMP AI assistant suggests a drill, we look up a relevant demonstration video through YouTube's service.
• Google (Firebase Cloud Messaging)— on our native mobile apps, a device push token is shared with Google's messaging service to deliver notifications you have opted into.
• Cloudflare(if/when enabled) — bot and abuse protection on our sign-in and sign-up forms. This protection is currently disabled; if we enable it, limited connection data is shared with Cloudflare to verify you are not a bot.
• Sentry(when enabled) — error monitoring. Form values are masked by default.

We may also disclose information when required by law, in response to a valid court order, or to protect the rights, safety, or property of Level Up My Play, our users, or the public.

Between Athletes and Coaches, certain information is shared as part of the booking flow: a Coach sees the Athlete's name and contact details once a booking is confirmed, and the Athlete sees the Coach's public profile.

Club events:when you register for a club event, the registration details you provide (participant name — which may be a child's name where a parent registers on their behalf — contact email, and any optional phone number and comments) are disclosed to the Club that hosts the event, so it can organise and run it. You consent to this disclosure at the time of registration. The Club is an independent operator and is responsible for how it handles that information once we deliver it; it may use it only to run the event and not for marketing, resale, or any unrelated purpose.

Some of our service providers (Stripe, Vercel, Anthropic, YouTube/Google, Google Firebase Cloud Messaging, Cloudflare (if/when enabled), Sentry, Resend) process or store data outside Canada, primarily in the United States. By using the Platform you acknowledge that your personal information may be processed in jurisdictions whose privacy laws differ from those of Canada. We choose providers that offer industry standard contractual and security safeguards.

We use essential cookies (for authentication and session management). We do not use third-party advertising cookies. Vercel Analytics is cookie-less by design. You can disable non-essential cookies through your browser settings, but doing so may impair core features such as login. For a full breakdown of every cookie and the local storage we use, see our Cookie Policy.

• Account and profile data— kept while your account is active. When you delete your account, we delete or anonymise it within 30 days, except where retention is required by law.
• Booking and payment records— retained for at least 7 years to meet Canadian tax and accounting requirements.
• Reviews— remain on the Coach's profile after account deletion, anonymised to remove your identifying information.
• Logs and analytics— aggregated or rolled up after 90 days.

We protect personal information using a combination of administrative, technical, and physical safeguards, including TLS encryption in transit, password hashing, role-based database access controls (Supabase Row-Level Security), restricted admin access, audit logging, and security headers. No system is perfectly secure, and we cannot guarantee absolute security. If you believe your account has been compromised, contact us immediately.

If a privacy breach creates a real risk of significant harm to you, we will notify you and the Office of the Privacy Commissioner of Canada as required by PIPEDA, and keep records of breaches as required by law.

You have the right to:

• Access the personal information we hold about you;
• Correct any inaccurate or incomplete information;
• Withdraw consent for the use of your information at any time, subject to legal or contractual restrictions;
• Request deletion of your account and personal information, subject to retention requirements;
• Lodge a complaint with the Office of the Privacy Commissioner of Canada at priv.gc.ca.

To exercise any of these rights, email us at [email protected]. We will respond within 30 days.

The Platform is not directed to children under 13. We do not knowingly collect personal information from anyone under 13. Anyone under 18 may use the Platform only through an account managed by a parent or legal guardian, who is the account holder and consents on the minor's behalf. If you believe a minor has given us personal information without proper consent, contact us at [email protected] and we will take prompt action to delete it.

We practise data minimization for managed children: we store only a nickname or first name and a broad age band (for example, “9–11”) — not a full legal name and not an exact date of birth. The age band is used only to confirm the child is under 18 and to match age-appropriate coaches. Everything legal and financial — the Terms, payment, messages, and reports — is handled under the parent's account, and notifications about a child's bookings go to the parent.

If a parent registers a child for a club event, the parent provides and consents to sharing the child's participant namewith the Club so the child can take part. This is the parent's decision, made under the parent's account; the Club receives only the participant name and the parent's contact details, and notifications about the registration go to the parent.

We may update this Privacy Policy from time to time. When we do, we will update the “Last updated” date at the top of this page. Material changes will be communicated by email or through a notice on the Platform.

For privacy questions, access requests, or complaints, contact our Privacy Officer at [email protected]. For general support, email [email protected].