Privacy

What we collect

Your account. Signing in happens through Google or Apple, whichever you choose. They tell us your email address, your name if they have one for you, and an identifier for your account; Google also passes your profile picture. We never see your password for either.

If you sign in with Apple you can choose Hide My Email, and then the address we hold is the forwarding one Apple gives us (“@privaterelay.appleid.com”) rather than your own. We cannot see the address behind it, and you can stop the forwarding from your Apple ID settings at any time. Apple sends us your name only the first time you sign in, and never again.

What you make. The plays, playbooks, formations and tags you create, including the titles, frame names and coaching points you type. A play is stored as the diagram data itself, not as a picture.

Counts on shared work. If you share a play, we count how many times its page was opened and how many times it was added to someone’s playbook. These are numbers only — we do not record who viewed your play.

Ordinary server records. Our hosting and database providers keep short-lived technical logs, which include IP addresses, as every web service does.

Visits, if you allow it. Google Analytics records which pages were opened, roughly where in the world from, and what kind of device — the same shape of thing a visitor counter has always collected. It never sees the plays you draw, what you type into them, or your email address. It runs on the website and in the iPad app, and only after you have agreed.

If you write to us

The feedback form keeps your message, and the address you give if you choose to leave one. Leave it blank and the message reaches us with nothing attached to it. We use what you send only to answer you and to fix what you reported.

What we store in your browser

A sign-in cookie, so you stay signed in. Your light or dark theme choice. A copy of the built-in tag list, so the editor opens quickly. Your answer to the analytics question, so you are only asked once. If you use CoachBox without an account, whatever you draw stays in your browser and never reaches us at all.

If you allow analytics, Google sets two cookies to tell one visit from the next. There are no advertising cookies and nothing follows you to other sites.

Analytics, and how to change your mind

Say no and nothing is loaded — not a cookie, not a script, not a request to Google. Say yes now and no later and we clear those cookies straight away; Google’s script cannot be unloaded from a page that is already open, so it stops at your next one.

This is per browser, because it is remembered in the browser. Clearing your site data clears the answer too, and you will be asked again.

Who else is involved

Google and Apple handle signing in — whichever you chose sees that you signed in, and nothing else about what you do here. Google also counts visits through Google Analytics, and only with your agreement. Supabase hosts the database and manages accounts; your data is stored in the European Union. Our hosting provider serves the site. That is the entire list. We do not sell your data, and we do not share it with anyone for their own purposes.

Sharing, and what it means

Every play starts private. Nothing is visible to anyone else until you choose to share it, and you can stop sharing at any time — the old link then leads nowhere.

If you share anonymously, your name is not shown on the page and is not sent to anyone reading it. Be aware of the limit of that promise: the play is still linked to your account in our database, so we can tell whose it is, and we would have to disclose it if legally required.

If you make a play public, other coaches can copy it into their own playbooks. Those copies belong to them. Making the original private again, or deleting it, does not remove copies other people already took — the same as handing someone a printed sheet.

Please do not put personal data in a diagram

Coaches often work with young players. Plays are meant for numbers and positions, not names, contact details or anything about a child. If you publish a play, treat everything on it as public, because it is.

How long we keep it

Your plays stay until you delete them. Delete your account and we remove your account record, your plays, your playbooks and your formations. Copies other coaches already made of your public plays remain theirs, without your name attached.

Your rights

You can ask for a copy of your data, correct it, delete it, or object to how we use it. Ask through the feedback page and we will act within 30 days. Closing an account is a request for now; you can delete any individual play, playbook or formation yourself at any time.

Depending on where you live, you may also have the right to complain to your data protection authority.

Children

CoachBox is for coaches, and is not intended for children. We do not knowingly collect data from anyone under 16. If you believe a child has created an account, tell us through the feedback page and we will remove it.

Changes

If we change this in a way that matters, we will update the date at the top and, if you have an account, tell you by email before it takes effect.