Privacy policy

SessionPlan provides online tools for football and soccer coaches to create drills, plan training sessions, manage squads and build lineups. SessionPlan is the controller of personal information described in this policy.

Questions or requests about privacy can be sent to privacy@sessionplan.app.

• Account information: your email address, account identifier, sign-in method and, if you use Google sign-in, the basic profile information Google makes available for authentication.
• Coaching content: squads, player names and numbers, team details and badges, drills, diagrams, sessions, lineups, notes, coaching points and other information you choose to create or upload.
• Subscription information: your plan, billing status, Stripe customer and subscription references, and transaction records. Payment-card details are collected and handled by Stripe, not stored by SessionPlan.
• Technical information: IP address, browser and device information, request logs, security events and diagnostic information generated when you use the website or app.
• Analytics information: page views, broad campaign attribution and a small set of product events. We do not send names, email addresses, account details or coaching content to Google Analytics.
• ChatGPT/Codex plugin: the structured drill data submitted to SessionPlan, optional anonymous OpenAI user and conversation identifiers converted into pseudonymous keys, a coarse client type, creation outcomes and error categories, and visits, save actions and account attribution for plugin drills. We do not collect whole conversations or original prompts for analytics, precise location, or IP addresses in this plugin analytics stream. Authentication tokens and drill-link secrets are excluded from analytics.
• Information you send us: the content of privacy, support or other communications and the contact details needed to reply.

• Provide, synchronise and secure the service; authenticate users; recover accounts; and keep content available across devices. We do this to perform our contract with you.
• Administer subscriptions, take payment and keep required financial records. We do this to perform our contract and meet legal obligations.
• Prevent abuse, investigate faults, protect users and improve the reliability of SessionPlan. We do this where necessary for our legitimate interests in operating a safe and effective service.
• Measure website journeys and product use with Google Analytics. We use analytics cookies only with your consent. You can accept, reject or change this choice at any time through “Analytics settings” in the site footer.
• Operate the ChatGPT/Codex plugin, prevent anonymous creation abuse, and measure whether plugin drills lead to visits, new accounts, saved drills, returning users and subscriptions. This minimal first-party operational and acquisition stream is separate from consent-based Google Analytics. We use it for our legitimate interests in operating, securing and improving the service. When you connect an account or save a guest drill, we associate the drill and source with that SessionPlan account.
• Respond to enquiries and exercise or defend legal claims. The basis is our legitimate interests or compliance with a legal obligation, depending on the circumstances.

We do not sell personal information or use it for automated decisions that produce legal or similarly significant effects.

SessionPlan uses storage that is necessary for sign-in, security, preferences and offline operation. The website records your analytics choice for about six months. If you accept analytics cookies, it also stores first-touch campaign information for up to 90 days and Google Analytics may set its own measurement cookies. Rejecting analytics cookies does not prevent you from using SessionPlan.

The web app keeps previously loaded coaching content and account state in your browser so it can work during poor connectivity. Signing out does not necessarily remove that local data. You can remove site data using your browser controls, but doing so may delete unsynchronised work.

We use service providers to operate SessionPlan. They process information only for the relevant service and under their own contractual and security commitments:

• Supabase for authentication, databases, synchronisation and file storage.
• Stripe for checkout, subscription billing and customer billing tools.
• Google for optional sign-in and, when you consent, Google Analytics.
• Cloudflare for website delivery, network security and related request logs.
• OpenAI when you choose to use the SessionPlan plugin in ChatGPT or Codex: tool requests come to SessionPlan and results, including drill links, return to that service. OpenAI handles your conversation under its own privacy policy.

We may also disclose information when required by law, to protect rights and safety, or as part of a business reorganisation. We do not give advertisers access to your coaching content.

Your saved coaching content is private by default. If you publish or share a drill or lineup, anyone with the resulting link may be able to view it and recipients can pass that link on. Do not include confidential, sensitive or unnecessary personal information in shared content. Disable sharing or delete the item when you no longer want it available; copies already saved by other people or search and network caches may remain for a limited time.

Plugin guest drills can be opened without an account. They are unlisted and excluded from search indexing and the public drill library. Anyone with the drill link can view it and claim it first, so protect the link and avoid confidential content. Saving it requires authentication; it becomes a private account drill and anonymous viewing ends. Connected plugin accounts create private drills directly.

Our providers may process information outside the United Kingdom. Where data-protection law requires it, we use recognised safeguards such as adequacy regulations or approved contractual protections. Contact us if you would like more information about the safeguards relevant to your information.

We keep account and coaching information while your account is active and for as long as reasonably necessary to provide the service. Deleted items may remain temporarily in backups, security records and synchronisation systems before being removed. Billing and transaction records may be retained for longer where tax, accounting or legal rules require it. Google Analytics information is retained according to our configured Google Analytics retention settings. Plugin operational events and pseudonymous identifiers are retained for 90 days. Unclaimed plugin drills expire after 30 days, extended to 30 days from a visit or an account-limit-blocked save; daily cleanup removes expired drafts. Authentication handoffs expire after 24 hours and rate-limit buckets after two days. Claimed-drill receipts and account source attribution are retained while the associated drill or account exists, without retaining an extra guest payload.

If you ask us to delete your account, we will delete or anonymise personal information unless we need to retain specific records for legal, security or dispute-resolution purposes.

Depending on where you live, you may have rights to access, correct, delete, restrict or object to our use of your personal information, and to receive a portable copy. Where processing relies on consent, you may withdraw it at any time without affecting earlier processing. You may also complain to your local data-protection authority. In the UK, this is the Information Commissioner’s Office.

You can revoke a plugin account connection through your SessionPlan account controls, stop using the plugin, delete saved drills, change your Google Analytics choice, and contact us about first-party plugin data. Anonymous identifiers are pseudonymous and may not be attributable to an individual unless they can provide the relevant drill link. We never use these identifiers to establish ownership.

Email privacy@sessionplan.app to make a request. We may need to verify your identity before acting on it.

SessionPlan accounts are intended for coaches and other adults, not for children to create or manage themselves. Coaches and clubs are responsible for having an appropriate lawful basis and providing any required notices before adding information about players, particularly children. Use the minimum information needed for coaching and do not record medical, safeguarding or other sensitive details in SessionPlan.

We use technical and organisational measures designed to protect personal information, including access controls, encrypted network connections and account-scoped data access. No online service can guarantee absolute security, so please use a strong, unique password and protect access to your devices and shared links.

We may update this policy as SessionPlan or the law changes. We will post the new version here, revise the date above and provide a more prominent notice when a change materially affects your rights or how we use personal information.