Privacy policy

Who is responsible

Abundance Atlas, Inc. runs Atlas Chalk and is responsible for your personal information (the controller).

When a club, school or federation adds its staff or players, we handle that data for the club. Clubs, schools and federations can read our data processing agreement.

The short version

• Atlas Chalk is for football coaches. It stores your account, your program and your plays.
• There is no roster and no player ratings. If a high school or college coach invites players to the player portal, we keep the few things listed under Players, and nothing more.
• We do not sell your information. There are no advertising trackers. Our public pages count visits without cookies. The coach app sends how you use it to PostHog (see What we collect). The player portal and the analyst tagger send nothing.
• Payments go straight to Stripe. We never see your card number.
• You can ask for a copy of your data, or for us to delete it, at any time.

What we collect

Account. Your email address and a password. The password is stored as a hash by our authentication provider; we can't read it. If you continue with Google instead, Google tells us your name, email address and profile picture, and we keep no password.

Your program and playbook. Program name, level (youth, middle school, high school, college) and schemes; the plays you draw or save, with their names, diagrams, situations and tags; and your staff's own names for formations and concepts (“aliases”).

Billing. Your subscription status and how many coach and analyst seats you pay for, plus the customer and subscription identifiers Stripe gives us. Stripe holds your payment details.

Waitlist. If you join a waitlist on our site without creating an account, we keep only your email address, on a mailing list held by our email provider, to tell you when Atlas Chalk or a feature opens. Every email has an unsubscribe link, and you can ask us to remove you at any time.

Technical. A few cookies that the product needs (see Cookies). Our hosting provider records standard request logs, such as IP address, browser and time, to run and secure the service.

Visits to our public pages. On our home page, blog and other public pages, and the sign-up and sign-in pages (not the app, the player portal or the analyst tagger), our hosting provider counts page views: the page, any campaign tags in its link, the site that linked you, your country, and your browser, operating system and device type. The rest of the address, such as an invite link, isn't sent. It uses no cookies and doesn't keep your IP address. A visit is grouped by an anonymous identifier that is discarded within 24 hours, so it can't follow you from day to day or across other sites.

How you use the coach app. We use PostHog to see where new coaches stop. It runs on our public pages, on sign-up and sign-in, and in the coach app. It does not run in the player portal, the analyst tagger, or on a join link. It records the pages you open, the controls you click, and when you sign up (with the campaign tags of the first page you opened), confirm your email, create a program, save a play (with how many plays the program has), open a playbook, or export a call sheet (with its wristband size). It does not record the text on a control or the text you type. For a signed-in coach, it links these to your account identifier, a random code. It does not get your email address, your name, your plays or your playbook. It sends the page address without its query, except campaign tags. It does not record your screen. PostHog gets your IP address to find your country. We tell it not to keep the address. It keeps an anonymous identifier in your browser's local storage, not in a cookie.

The six events are signup_completed, email_confirmed, program_created, play_saved, playbook_opened and callsheet_exported.

Players

A high school or college coach can invite players to a player portal to study the plays the coach assigns, as flash cards. Youth and middle school programs can't invite players, because those teams include children under 13. Players join only from a link their coach sends.

For a player, we keep:

• their email address and password (stored as a hash), and the authenticator app they set up;
• the name their coach typed when inviting them (first name and last initial);
• which teams they're on;
• for each assigned play, whether they tapped “Knew it” or “Missed it”.

Only the player and their team's coaches see this. Players never see other players. Players see only the plays their coach assigned. Every player sign-in needs a code from an authenticator app, and our database enforces that. “Knew it” is the player's own answer, not a rating; nothing ranks or scores players.

Study results are deleted 365 days after the week they were assigned, or at once when a coach removes the player. A player can leave a team or delete their account from the portal, and that deletes their results immediately. An account that has belonged to no team for 90 days is deleted. A parent, guardian or school can ask us to delete a player's data at the address below.

Joining as a player needs a box ticked: the player is 18 or older, or a parent or guardian has read the join page and approves the account. We keep the time the box was ticked. We don't ask a player's age.

Game-day analysts

A high school or college program's head coach can add analysts, who tag snaps on a phone during games. Analysts may be students. They join only from a link the head coach sends, with the same box as players: 18 or older, or a parent or guardian approves.

For an analyst, we keep:

• their email address and password (stored as a hash), and the authenticator app they set up;
• the name the head coach typed when inviting them, and when the box was ticked;
• which programs they tag for;
• the snaps they tag: snap number, down, distance, spot, the play and the look they saw, the result;
• with each tag, a random id that the tagger makes once per browser for each account. It is not the phone's own identifier or its location, and two accounts on one phone get different ids. We use it only to notice one login used on two phones.

Only that program's coaches see an analyst's tags; analysts don't see each other's. Analysts see the program's play names, not its playbook. Every analyst sign-in needs a code from an authenticator app. While the phone has no signal, tags wait in the phone's browser storage until they send. The phone also keeps a copy of the tagger's pages so it opens with no signal; that copy is deleted when anyone signs out on that phone. A session that ends without signing out leaves the copy until the next sign-in or sign-out there. Nothing about an analyst goes to an AI model.

Tags are deleted 365 days after the game. When a coach confirms a snap, the confirmed snap is the program's own play-by-play and is not deleted with the tags. An account that has belonged to no program for 90 days is deleted, and a parent, guardian or school can ask us to delete an analyst's data at the address below.

What we never collect

There is no roster, and nowhere to store a player's age, birth date, phone number, position, jersey, skill rating, photo or film. Plays are diagrams of positions (X, Z, Q), not people. Please don't type player names into play names or notes.

How we use it

• To run the product: sign you in, save your playbook, print your play sheets.
• To bill you.
• To contact you about your account and your subscription. You can ask us to stop non-essential emails at any time.
• To keep the service secure and fix problems.
• To improve the platform baseline. Unless a coach turns off “Share anonymized results” in Settings, a program's play results are pooled with other programs' at the same level into anonymized, aggregated rates that name no program, play, game or opponent, and only where at least 3 programs contribute.

We don't sell personal information, and we don't share it for advertising. We don't use your playbook to train AI models.

Why we may use it

In the EU, EEA, UK and Switzerland, the law needs a reason for each use. Here is ours.

Who processes it

We use a small number of service providers, each only for the job listed:

Service providers and where they are

• Supabase: Database and sign-in. Country: United States.
• Vercel: Hosting, and counting visits to our public pages. Country: United States.
• PostHog: Product analytics. It receives the pages you open, the controls you click, your account identifier, your browser, device type and country. Never your email address, your plays, or anything from the player portal or the tagger. Country: United States.
• Stripe: Payments and subscriptions. Country: Not confirmed yet.
• Google sign-in: Continue with Google. It tells us your name, email address and picture. Country: Not confirmed yet.
• Resend: Delivers account email, such as the link that confirms your address, and holds the waitlist. It receives your email address and the message. Country: United States.
• TypeSafe: Suggests which standard formation or concept a staff's own term means. It receives only the term you typed, your program's level and our standard football names. Never your plays, your account or anything about players. Its stated policy is not to train on what it receives. Country: Not confirmed yet.
• GitHub: Keeps an encrypted weekly copy of our database for 30 days, so we can recover if our database provider fails. Only we hold the key, so GitHub can't read it. Country: United States.
• Meta: Measures our ads. It runs only on our public pages, only if you accept (or, outside the EU, EEA, UK and Switzerland, until you refuse). It receives the page you open, your browser, your IP address and a sign-up event. Never your email address, your name or anything from the coach app, player portal or tagger. Country: Not confirmed yet.

We'll also disclose information if the law requires it, or to protect the service and its users.

Data that leaves your country

We store your data in the United States. If you live outside the US, your data goes there. Each provider and the safeguard for the transfer:

• Supabase: United States. Safeguard: Not confirmed yet.
• Vercel: United States. Safeguard: Not confirmed yet.
• PostHog: United States. Safeguard: Not confirmed yet.
• Stripe: Not confirmed yet. Safeguard: Not confirmed yet.
• Google sign-in: Not confirmed yet. Safeguard: Not confirmed yet.
• Resend: United States. Safeguard: Not confirmed yet.
• TypeSafe: Not confirmed yet. Safeguard: Not confirmed yet.
• GitHub: United States. Safeguard: Not confirmed yet.
• Meta: Not confirmed yet. Safeguard: Not confirmed yet.

Cookies

The items marked “needed” make the product work and run always. PostHog and the Meta pixel are the optional items. In the EU, EEA, UK and Switzerland they run only if you accept. Everywhere else they run until you refuse. Change your choice at any time: Cookie settings. Vercel Web Analytics stores nothing on your device. The Meta pixel measures our ads on the public pages only. Meta's own domain can set its own cookies (such as fr) when you are signed in to Facebook.

How long we keep it

We keep your account and playbook for as long as your account is open. When you delete your account, we close it at once and erase it, with your programs' data, 30 days later, except billing records we have to keep for tax and accounting. Your subscription keeps running until we erase the account, and we cancel it then. Backups roll off on their own schedule: 7 days for our database provider's daily backups, 30 days for our encrypted weekly copy.

Your choices and rights

You can ask us to show you the information we hold about you, correct it, export your playbook, or delete your account. Depending on where you live, including California and other US states, you may have these rights by law. We'll answer within 30 days and won't treat you differently for asking. You can download a copy of your data as one file from Settings, with Download my data. You can delete your account from Settings, with Delete my account. We close it at once and erase it, with the programs you own, 30 days later. Until then you can stop it by emailing admin@atlaschalk.app. If you live in the EU, EEA, UK, Switzerland, Australia or Mexico, read your region's section below.

EU and EEA

The GDPR applies. You can ask for access, correction, erasure and restriction. You can ask for a machine-readable copy (portability), object to a use, and withdraw consent at any time.

We answer within one month. If a request is complex, we tell you it needs up to two more months.

You can complain to the data protection authority where you live, where you work, or where the problem happened.

United Kingdom

The UK GDPR and the Data Protection Act 2018 apply. You have the same rights as in the EU and EEA, and we answer within the same one month.

You can complain to the Information Commissioner's Office (ICO).

Switzerland

The Federal Act on Data Protection (FADP) applies. You can ask for access, correction, deletion and a copy of your data. We answer access requests within 30 days.

You can complain to the Federal Data Protection and Information Commissioner (FDPIC).

Australia

We handle personal information under the Australian Privacy Principles. Your information goes to the overseas recipients listed under “Data that leaves your country”, mostly in the United States.

You can ask for access and correction. We answer within 30 days.

If you are not satisfied with our answer, you can complain to the Office of the Australian Information Commissioner (OAIC).

Mexico

You have ARCO rights (access, rectification, cancellation and opposition), and you can withdraw consent. Send the request to the address under “Contact”. We answer within 20 business days.

The authority is the Secretaría Anticorrupción y Buen Gobierno. Spanish text comes with the Spanish release.

Children

Atlas Chalk is for coaches, and the player portal is only for high school and college teams. It is not directed to children under 13, and we don't knowingly collect personal information from them. If you believe a child under 13 has given us personal information, contact us and we'll delete it.

Security

Data is encrypted in transit. Each program's data is walled off from every other program's at the database level, and access is limited to its members. Players must use an authenticator app to sign in. No system is perfectly secure; if a breach affects your information, we'll tell you as the law requires.

Changes to this policy

We'll post any change here and update the date at the top. If a change is significant, we'll also email account holders before it takes effect.

Contact

Questions or requests: admin@atlaschalk.app.

Abundance Atlas, Inc., 3919 Providence Rd S, Ste B PMB 1008, Waxhaw, NC 28173, USA