Privacy Policy

Draft — last edited July 2026

This Privacy Policy describes what information Diamond & Iron collects, why, and how it's handled.

1. Information We Collect

Data	Why we collect it
Name and email	Account creation and login
Password (hashed, never stored in plain text)	Account security
Payment information	Handled entirely by Stripe — we never see or store your card number
Video submissions	Coaching review of hitting/pitching mechanics or lifting form
Training logs (sets, reps, weight)	Auto-adjusting your program week to week

2. How We Use Information

To provide the coaching service itself — reviewing your video, adjusting your program, and communicating with you about your account.
To process payment through Stripe.
To send account-related email: verification, password reset, and billing notices. [Add: if you plan to send marketing email, disclose that here and how to opt out.]

We do not sell athlete data or video to third parties.

3. Where Data Is Stored

Account and training data: a Postgres database [name your hosting provider once chosen].
Video files: Amazon S3 (or Cloudflare R2) [name your actual provider and region].
Payment data: Stripe, which is independently PCI-compliant — we never receive or store raw card numbers.

4. Who Can See Your Video

Video submissions are visible to your assigned coach(es) and to Diamond & Iron staff for service and quality purposes. Video is not made public, shared with other athletes, or used in marketing without your separate, explicit written consent.

5. Data Retention & Deletion

[Fill in: how long you keep video and account data after a subscription ends, and the process for someone to request deletion of their data.] You can request account deletion by contacting [your business email].

6. Cookies

We use a single essential cookie to keep you signed in (an httpOnly session cookie). We do not use tracking or advertising cookies. [Update this if you later add analytics.]

7. Children's Privacy

Diamond & Iron's coaching is often used by athletes under 18. If we knowingly collect personal information — including video — from a child under 13, we require verifiable parental consent before collection, in line with the U.S. Children's Online Privacy Protection Act (COPPA). Parents/guardians can contact [your business email] to review, or request deletion of, their child's information at any time.

Implementation gap: the current signup flow does not yet include a parental consent step. That needs to be built — and reviewed by a lawyer familiar with COPPA — before onboarding athletes known to be under 13.

8. Changes to This Policy

We'll update this page if what we collect or how we use it changes, and update the date at the top.

9. Contact

Questions about this policy or your data: [your business email address].

← Back to homepage