Privacy Policy

1. Introduction

LaxAi (“we,” “our,” or “us”) operates the LaxAi lacrosse coaching platform at laxai.app. This Privacy Policy explains how we collect, use, share, and protect your personal information when you use our services.

By creating an account, you agree to the terms of this Privacy Policy. If you do not agree, please do not use our services.

2. Age Requirements

LaxAi is intended for users aged 13 and older. We do not knowingly collect personal information from children under 13. If we discover that we have collected information from a child under 13, we will promptly delete that information.

Users between 13 and 17 years of age may use LaxAi with the understanding that their parent or guardian can contact us at any time to review, modify, or delete their child's data.

3. Information We Collect

Account Information

• Email address and display name
• Age bracket (month/year of birth for age verification, exact date not stored)
• Location (state/province)
• Role (coach or player) and experience level

Coaching & Training Data

• Saved video bookmarks and collections
• Practice plans you create
• Training session logs (for players), which may include self-reported athletic data such as perceived effort, sleep, or soreness
• Skill preferences and goals
• Team memberships and roster data

Usage Data

• Feature usage patterns (which drills you browse, how you build practice plans)
• Page views and navigation, measured with cookieless, anonymous analytics (we do not use Google Analytics or any cross-site advertising tracker)
• Device type and browser information

What We Do NOT Collect

• Exact date of birth (only month/year for age verification)
• Social Security numbers or government IDs
• HIPAA-covered medical records, diagnoses, or treatment information
• Financial information (payments processed by Stripe)
• Photos or videos of users

4. How We Use Your Information

• Provide and improve the LaxAi coaching platform
• Personalize content recommendations (drill suggestions, practice plans)
• Generate AI-powered coaching insights
• Facilitate team collaboration between coaches and players
• Process subscription payments
• Send service-related communications
• Detect and prevent fraud or abuse

5. Third-Party Services

We use the following third-party services to operate LaxAi:

We also use operational vendors (CI/CD, monitoring, content pipeline tooling) that do not receive personal information about our users.

6. Cookies, Local Storage & Tracking Technologies

LaxAi uses only the storage needed to run the app and to measure usage anonymously. We do not use advertising, marketing, or cross-site tracking cookies, and we do not use Google Analytics.

Essential storage (always on)

These are required for the app to function and cannot be turned off:

• Authentication: Firebase Authentication stores your sign-in session in the browser (IndexedDB / local storage) so you stay logged in.
• Payments: When you start a subscription, Stripe sets cookies on its own checkout to process the payment and prevent fraud.
• App preferences: First-party localStorage/sessionStorage keys (for example, laxai_* values) remember UI choices such as your role view, dismissed prompts, and onboarding progress.
• Attribution: If you arrive from a link with campaign tags (UTM parameters), we store them first-party so we can understand which channels bring coaches and players to LaxAi. This is not shared with ad networks.

Optional analytics & error monitoring

• Vercel Web Analytics:Cookieless, anonymous page-view and navigation measurement. No cookies, no cross-site tracking. You can turn it off anytime in Profile → Privacy & Data.
• Sentry: Error and performance monitoring. Personal identifiers are scrubbed before transmission; only error context (stack traces, browser type, anonymized user ID) is sent.

You can turn analytics off at any time in Profile → Privacy & Data. We also honor the Global Privacy Control (GPC) browser signal. Because we run no advertising or cross-site tracking, there is nothing to consent to before you browse — we disclose what we collect and give you a working opt-out. If we ever introduce advertising cookies, we will ask for your opt-in first (and will not enable them for known users under 18 without opt-in).

7. Data Sharing

We do not sell, rent, or trade your personal information.

Your data may be visible to:

• Team members: Coaches on your team can see your profile, training logs, and progress (if you are a player on their team)
• Community features: Notes or video contributions you choose to share publicly
• Service providers: Third-party services listed above, solely to operate the platform
• Legal requirements: If required by law, subpoena, or court order

8. Data Retention

We retain your data only as long as needed to provide the Service. You can delete your account at any time from your profile settings; we will purge primary data within 30 days and encrypted backups within 90 days.

• Account data: Retained until you delete your account
• Behavioral events: Automatically deleted after 3 years
• Training logs: Retained until you delete your account
• Payment records: Retained as required by tax and financial regulations (typically 7 years)
• Deleted content: Removed from active systems within 30 days of account or content deletion
• Encrypted backups: Rolling 90-day retention; deleted data is purged from backups within that window

9. Your Rights

You have the right to:

• Access your data: Export all your data from your profile settings
• Delete your account: Permanently delete your account and all data from your profile settings
• Correct your data: Update your profile information at any time
• Opt out of analytics: Turn analytics off anytime in Profile → Privacy & Data; we also honor Global Privacy Control (GPC) browser signals
• Parent/guardian rights:Parents of users aged 13-17 may contact us to review, correct, or delete their child's data

10. Data Security

• Encryption in transit: All connections use HTTPS (TLS 1.2+)
• Encryption at rest: Data stored in Google Cloud Firestore with default encryption
• Authentication: Firebase Authentication with secure password hashing
• Access controls: Role-based access controls limit who can see your data
• Admin access: Logged and audited

11. Data Breach Notification

In the event of a data breach that may affect your personal information, we will notify affected users within 7 days of discovery via email and in-app notification, in compliance with the NY SHIELD Act and Ed Law 2-D requirements.

12. For Schools, Leagues, and Youth Organizations

If your school, district, league, or club uses LaxAi under a contract, additional protections apply — including those required by New York Education Law Section 2-D for schools and districts. We provide:

• Data Privacy Agreement (DPA) templates upon request
• Parents' Bill of Rights
• Current sub-processor list (see Section 5)
• Data Security and Privacy Plan
• COPPA-aligned operational practices summary — we do not knowingly collect data from users under 13
• Custom governing-law selection in the DPA on request (e.g., the state where your organization is based)
• Confirmation that user-submitted private content (practice plans, custom drills, plays, training logs) is not used to train AI models and is not sold or sublicensed

Contact us at privacy@laxai.app to request these documents or to begin a board-level compliance review.

13. California Residents

Under the California Consumer Privacy Act, as amended by the California Privacy Rights Act (CCPA/CPRA), and the Student Online Personal Information Protection Act (SOPIPA), California residents have additional rights including the right to know what data we collect, the right to deletion, the right to correction, and the right to opt out of the sale or sharing of personal information.

Do Not Sell or Share My Personal Information: We do not sell your personal information, and we do not share it for cross-context behavioral advertising. There is nothing to opt out of in that respect, but we still honor the Global Privacy Control (GPC) browser signal as a valid opt-out request. For known users under 18, we do not sell or share personal information without opt-in — and today we do not sell or share it at all.

14. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes via email or in-app notification. Continued use of LaxAi after changes constitutes acceptance of the updated policy.

15. Contact Us

For privacy-related questions, data requests, or to exercise your rights: