Privacy Policy

eCoach ("we", "us", "our") is committed to protecting your privacy. This policy explains what personal data we collect, how we use it, how long we keep it and when we share it while you use eCoach, payments, support, optional integrations, AI tools and related services.

By using the Service, you confirm that you have read this policy. If you do not agree with it, please do not use the Service.

1. Data Controller

eCoach is the data controller for account, product, billing, security, support and platform-operation data. Coaches, clubs, academies, or teams may also act as independent controllers for player, staff, or youth data they choose to enter and manage through the Service. For the tracking data that a coach or club imports with the GPS and tracking file import, the coach or club is the controller and eCoach acts as its processor, as described in section 2.8. For privacy-related questions, contact us at info@ecoachapp.com.

2. Data We Collect

2.1 Account Information

• Name, email address, phone number, country, sign-in details and identifiers created during registration or sign-in.
• Optional profile details such as club, coaching licences, bio, avatar, language, theme and app preferences.
• Your role on the platform, such as coach, staff, player or academy director and the teams you join.
• A team badge image you upload, kept as a file and shown on the sheets you export.
• Trusted-device information, verification times and account-security records.

2.2 Coaching and Training Data

• Training ideas, sessions, tactical layouts, notes, schedules and status values that you create.
• Player roster details such as names, numbers, positions, birthdays, preferred foot, status and team records entered by coaches.
• Training logs, attendance records, player evaluations, session plans, exercise assignments and coach observations.
• Attachments, imported files, images, PDFs, shared links, notifications, comments and collaboration records created from your content.
• AI prompts, generated output and selected coaching context when you use AI-assisted features.
• Messages sent in the academy chat between an academy director and the coaches of that academy and between a head coach and their staff, with the sender and the time. Platform administrators can read them to investigate safety, abuse or policy reports.
• Replies to a team share (an acknowledgement and an optional short comment), visible to the person who sent the share and to the team's head coach. Platform administrators can read them to investigate reports.
• Staff members of a team see wellness check-ins, the medical details and medical files of players, GPS figures and data from connected devices only when the head coach grants them that access for that team. The head coach can withdraw it at any time.

2.3 Payment Data

• Subscription status, plan type, billing period, trial or promotion status, payment status and payment records.
• Stripe customer, invoice, payment and subscription identifiers.
• Billing contact details needed to process payment, tax, invoices, receipts, refunds, disputes, or support requests.
• We do not store your full credit card number, CVV, or bank details. Stripe handles payment details directly.

2.4 Third-Party Integrations

• If you connect Strava, we receive the permission details needed to read only the activity data you authorize.
• If you use AI features, your prompt, generated output and the coaching context needed for the request may be processed by our AI provider.
• We never receive or store your Strava password.

2.5 Technical Data

• Device and browser information, language preference, approximate region and basic request information.
• IP addresses, protected device identifiers, sign-in activity, failed verification attempts and security records.
• Cookie and local-storage identifiers needed for login, trusted-device checks, language, theme, layout, guide progress and app preferences.
• Error and service logs needed to operate, protect, fix and abuse-protect the Service.

2.6 Support and Communications

• Support requests, email or chat messages, categories, status, timestamps and replies.
• Screenshots, attachments, account details, billing identifiers, or other details you choose to provide when asking for help.

2.7 Visit and Journey Analytics

• Which pages you opened on our public website, in what order and when, plus how far you got in signing up.
• The campaign or website that brought you to us, taken from the link you followed.
• A random identifier stored in your browser, used only to group your own visits together. It is not a cookie and it is never shared.
• When you create an account, the visit that led to it is linked to that account, so an administrator can see the pages you viewed before signing up next to your name and email.
• This is used to understand which campaigns and pages actually work. Only administrators can see it, and it is deleted after 24 months.
• On the sign-in screen of the eCoach mobile app we record in the same way, with a random identifier, that the screen was shown, whether you then signed in and whether you asked for the getting-started email described in section 2.9.
• This measurement is part of how the Service operates: it uses no cookies, involves no third parties and never leaves eCoach, so it runs on every visit. Do Not Track and Global Privacy Control still fully apply to the optional third-party cookies and pixels described in section 6, which never load when your browser sends either signal.

2.8 GPS and Tracking File Import

This section covers the GPS and tracking file import of the Enterprise and Team plans. A member of the coaching staff picks an export file of a tracking system such as STATSports, Catapult or Polar. The file is read on the device of the person who imports it and is not uploaded to eCoach. Only the figures described below are saved. In the app they are visible to the head coach and to the staff members of that team whom the head coach has given access to health data. An imported session is deleted automatically 400 days after the session date. AI suggestions are written by our AI provider, which acts as a processor and receives figures without names.

• What is stored for each player in a session: duration, total distance, high-speed distance, sprint distance, sprint count, accelerations, decelerations, top speed and the load value of the tracking system, linked to the roster player. With them we store the session date, its type, an optional title, the tracking system and who imported it. No positions, routes or maps are stored. Columns that are not mapped and rows that are skipped never leave the device.
• What else is stored for the team: the column mapping of each tracking system (column titles and units), a fingerprint of each imported file (a hash used to refuse the same file twice, not the file), the spelling of a player name as written in the file once it has been matched to a roster player and the record of who gave the confirmation of the club and when.
• How long it is kept: a session with its figures, its file fingerprint and its saved AI suggestions is deleted automatically 400 days after the session date, or earlier when the head coach deletes it. A remembered name spelling is deleted when no import has used it for 400 days. The column mapping and the confirmation record are kept until the head coach deletes the GPS data of the team or until the team or the account is deleted. Permanently deleting a player deletes the figures and name spellings of that player; a saved AI suggestion stays with its session and no longer shows the name. If the plan no longer includes this feature, the data is hidden and stays stored until it is deleted as described here. The head coach can still delete it. Backups follow section 7.
• Who can see it: in the app, only the head coach and the staff members of that team whom the head coach has given access to health data. Players, parents, academy directors and other teams cannot see it. It is not included in player reports or share links. Staff members with this access can download a session as a CSV or PDF file and the club or coach is responsible for what happens to a downloaded file. eCoach administrators have technical access to workspaces for support, security and legal reasons.
• Roles: the club or coach decides to track its players and to import the data and is the controller of this data. eCoach stores and processes it on their behalf as a processor and does not use it for purposes of its own. eCoach remains the controller of the account data of the coaches and staff who use the feature.
• Purposes and lawful basis: the data is used to show the coaching staff the training load of the squad and of each player, comparisons with the squad and with the recent weeks of the same player, written observations and, on request, AI suggestions. As controller, the club or coach chooses the lawful basis (for example its legitimate interest in planning training, a contract with the player or consent) and must inform the players. eCoach processes the data to provide the service agreed with the club or coach. Before the first import the head coach confirms in the app that the club is allowed to process the data.
• AI suggestions: they are written only when the head coach asks for them. We then send our AI provider (OpenAI, see section 5), which acts as a processor, the sport, the session type, the name of the tracking system, squad figures (average, lowest and highest value), position group averages and figures of single players, with each player under a neutral label such as P3. Names, shirt numbers, dates of birth, session dates and titles, the name of the club or team and heart rate are not sent. eCoach keeps the link between each label and the player, so these figures remain personal data. Names are put back only on the screen of the coaching staff. The answer is saved with the session.
• No automated decisions: the observations and the AI suggestions are information for the coaching staff. They are not medical advice, they do not assess health or injuries and eCoach takes no decision about a player based on them. Every decision stays with the coach.
• Minors: players do not use this feature themselves. When players are under 18, the club or coach must inform the player and a parent or guardian in clear language and obtain consent where the law requires it. eCoach does not check the age of players for this feature.
• Rights of players and parents: you can ask for access, correction, deletion or restriction and you can object. Please contact your club or coach first, because they decide on the request as controller. The head coach can delete a session, all GPS data of the team or a player; a wrong figure is corrected by deleting the session and importing a corrected file. You can also write to us at the address in section 13: we will pass your request to the club or coach and help them answer it. You can complain to a data protection authority, in Greece the Hellenic Data Protection Authority (www.dpa.gr).
• Heart rate: importing heart rate is not available. Heart rate columns in a file are not saved.

2.9 Getting-started Email from the App

• When you leave your email address on the sign-in screen of the eCoach mobile app, we use it only to send you one getting-started email with the steps to create your account. Nothing else is sent to that address and it is not used for any other purpose.
• What we store about the request: a keyed hash of the address (a one-way code made with a secret key held on our server), the language of the app, the time of the request and the outcome, such as sent or failed. When a limit holds a request back, we only add it to a daily total and store no record of it. To limit requests per network we also keep a keyed hash of the IP address for up to 25 hours. We never store the address itself in plain text.
• We use the hash only to apply limits per address and per day and to protect the Service and the reputation of our sender from abuse. We also keep daily totals without any personal data to understand how the feature is used.
• Legal basis: for the email itself, taking steps at your request before you create an account. For the limits that protect the Service and other people's inboxes from abuse, legitimate interest.
• The email is sent by our mail provider, Mailgun, which acts as our processor and receives the address and the content of the email in order to deliver it. We do not store the address in our own database or logs. The provider keeps its own delivery logs for a limited period.
• Request records are deleted automatically after 90 days. Daily totals without personal data are kept for 400 days.
• Because we keep only a hash, we may ask you to confirm the address so we can find a record when you use your rights described in section 8. Leaving the address is optional and you can use the sign-in screen without doing so.

3. Legal Basis for Processing

• Consent, when you provide optional data, connect optional services, use optional AI features, or agree to non-essential processing where required.
• Contract performance, when we need data to create your account, provide the Service, process subscriptions, support teams and deliver requested features. It also covers steps you request before creating an account (section 2.9).
• Legitimate interest, when we protect the Service, prevent fraud or abuse, fix errors, improve reliability, keep security records and measure how the Service is visited and used, as described in section 2.7.
• Legal obligation, when we must keep or disclose data for tax, accounting, consumer, dispute, security, or regulatory reasons.
• Vital, safeguarding, or public-interest grounds only if exceptionally required by applicable law.

4. How We Use Your Data

• Provide, operate, maintain, personalize and secure the Service.
• Confirm your identity, manage your account, apply team roles and verify trusted devices.
• Process subscription payments, invoices, refunds, disputes and billing support through Stripe.
• Enable collaboration between coaches, staff and players, including notifications and shares.
• Support AI-assisted coaching ideas using the prompts and context you provide.
• Create the files, links and coach-facing reports you request.
• Send essential service emails such as verification, password reset, billing, security, support and important product notices.
• Detect, prevent, investigate and respond to security issues, misuse, fraud, abuse, or policy violations.
• Improve the Service using aggregated, de-identified, or anonymized information where practical.

5. Third-Party Data Processors

We only share data with processors that help us operate the Service under appropriate contractual safeguards.

6. Cookies and Local Storage

eCoach uses essential cookies and local browser storage for login, trusted-device checks, language, theme, layout, guide progress, saved preferences and security controls. These are always on. On our public pages we also use optional analytics and advertising cookies and pixels (Google Analytics, Meta, TikTok, LinkedIn) to measure traffic and our marketing campaigns, but only after you opt in through the cookie banner. You can change or withdraw your choice there at any time. If you block essential storage, parts of the Service may not work correctly.

7. Data Retention

• Active accounts: we keep account, team, coaching and billing records for as long as the account remains active.
• Deleted accounts: after a valid deletion request, we aim to delete or anonymize personal data within 30 days unless we need longer retention for legal, billing, dispute, security, backup, or legitimate business reasons.
• Billing records: invoices, payment events, refund or dispute records and tax/accounting records may be retained for the period required by law.
• Security records: trusted-device records, IP/security logs and security activity records are retained only as long as reasonably needed for security, abuse prevention, accountability and legal defense.
• Academy chat: messages are deleted automatically 24 months after they are sent, and a conversation left with no messages is deleted with them.
• GPS and tracking imports: an imported session is deleted automatically 400 days after the session date and a remembered name spelling 400 days after its last use, as described in section 2.8.
• Backups and provider logs may remain for a limited period before secure rotation or deletion.

8. Your Rights

If you are in the European Economic Area, you may have the following rights under applicable data protection law:

• Access the personal data we hold about you.
• Correct inaccurate or incomplete data.
• Request deletion of data when applicable.
• Request restricted processing in specific cases.
• Receive your data in a structured, commonly used, machine-readable format where portability applies.
• Object to certain processing based on legitimate interest.
• Withdraw consent for future processing when consent is the legal basis.
• Complain to your local data-protection authority if you believe your rights have been violated.

To exercise any of these rights, contact us at info@ecoachapp.com.

We may need to verify your identity and authority before responding, especially when a request concerns team, player, youth, billing, security, or shared-workspace data.

9. International Data Transfers

Some providers may process data outside the EEA. Where this happens, we rely on approved transfer mechanisms such as Standard Contractual Clauses or other recognized safeguards.

10. Data Security

• Data sent between your browser and our services is encrypted.
• Passwords are not stored as plain text.
• Access controls help make sure people only see data they are allowed to see.
• Trusted-device checks, session controls and security records help detect unauthorized access.
• Payment data is processed by Stripe instead of being stored directly in our systems.
• Sensitive operations are limited to protected systems and authorized personnel.
• No internet service can be guaranteed perfectly secure and you remain responsible for protecting your password, devices, team codes, files and shared links.

11. Children and Youth Data

eCoach is built for coaches and sports staff. We do not knowingly collect personal data directly from children under 16 without appropriate consent. Player data for youth teams is entered and managed by coaches, clubs, or guardians acting through the Service. The person or organization entering youth data remains responsible for providing any required notices, collecting valid consent or another lawful basis, limiting unnecessary sensitive data and handling parent/guardian requests where required.

12. Changes to This Policy

We may update this policy from time to time. When changes are important, we will update the date shown here and may also notify you by email or in the app.