Privacy Policy

1. Who is responsible

The data controller for account data and website usage is Coplanio, the operator of coplanio.app. Contact for anything in this policy: support@coplanio.app.

For the records a club keeps in the service — its players, their guardians, its coaching staff — the club (the organization) is the data controller and Coplanio processes that data on its instructions, under the Data Processing Agreement. Questions about how a club uses your data, or requests to see or correct it, should go to the club first; we help the club answer them.

2. Data we collect as controller

When you create an account and use the service we process:

• Account data: your name, email address, a hashed password (we never see the password itself), your roles and organization memberships, and the moment you accepted these terms.
• What you do in the application: the organizations, teams, sessions, exercises and other records you create or change, and an audit trail of important changes (who changed what, when) that the club's administrators can consult.
• Technical data: server logs with IP address, browser type, requested pages and timestamps, kept for security and troubleshooting.
• Support communications: what you send us when you write to support.
• Cookies and local storage: we use a small number of first-party cookies and set no analytics or advertising cookies. Two are strictly necessary to sign you in — a session cookie, and a security cookie (a PKCE code verifier) that the sign-in, sign-up and password-reset flows set even before you have an account and that is removed once you sign in. To remember your choices we also set preference cookies for your active organization, your language, and whether you dismissed the setup checklist. The 'Add to Home Screen' hint remembers on your device that you dismissed it (local storage, never sent to us).

3. Data we process on behalf of clubs

A club may record, and we then store and display for it:

• Players: first and last name, date of birth, position, preferred foot, status, free-text notes entered by coaches, attendance at sessions, training load and perceived exertion, assessment results, and involvement in matches.
• Guardians (parents or legal representatives): email address and portal access to the records of their child.
• Coaching staff and members: name, email, role and team assignments, invitations.

4. Children and young players

Most players recorded in the service are minors. Their records are entered by the club, which must have the authority to do so — including the consent of a parent or guardian where the law requires it — and which is responsible for informing players and guardians. Account holders must be at least 16 years old; the service is not directed at children, and we do not knowingly collect account data from them.

If you believe a child's data is processed in the service without proper authority, write to support@coplanio.app and we will look into it with the club.

5. Purposes and legal bases

We process account and usage data:

• to provide the service you signed up for — creating and securing your account, running your organization, sending account emails such as a password reset (performance of a contract, GDPR Art. 6(1)(b));
• to keep the service secure and prevent abuse — logs, rate limits, access control, the audit trail (our legitimate interest, Art. 6(1)(f));
• to understand and improve how the service is used, in aggregate (legitimate interest, Art. 6(1)(f));
• to comply with legal obligations, for example responding to a lawful request from an authority (Art. 6(1)(c));
• on the basis of your consent where we ask for it, which you may withdraw at any time (Art. 6(1)(a)).

6. AI features

The exercise generator and the session planner are switched off at present: while they are off, nothing you or your club enter is sent to an AI model provider.

When one of them is switched on and you use it, the following is sent to our AI model provider to produce a draft: the text you type, the team's name, age group and level, and your exercise catalogue (names, objectives, categories, durations, tags). No player record is included. The provider processes this only to return the response, under its data processing terms. Drafts are stored in your library only when you save them.

7. Who else receives data (sub-processors)

We do not sell personal data and we do not share it with advertisers. The following providers process data for us, each bound by a data processing agreement:

• Supabase, Inc. — database, authentication, file storage, server-side functions (including the search index of the reference library) and account emails. Data is stored in the London region (eu-west-2, United Kingdom), a jurisdiction covered by an EU adequacy decision.
• Vercel, Inc. — application hosting and content delivery for coplanio.app (United States; transfers covered by the EU–US Data Privacy Framework and standard contractual clauses).
• Anthropic, PBC — the AI model behind the exercise generator and the session planner (United States; standard contractual clauses). Both features are switched off at present, so it receives nothing from your use of the service; when one is switched on, it receives only what is described in the AI section: the text you type, the team's name, age group and level, and your exercise catalogue.

8. International transfers

Your data is stored in the United Kingdom, which the European Commission has recognised as providing adequate protection. Where a provider processes data in the United States (hosting, the AI model), the transfer is covered by the EU–US Data Privacy Framework or by the European Commission's standard contractual clauses.

9. How long we keep data

Account data is kept for as long as your account exists. A club's records are kept for as long as the organization exists; records the club deletes are marked as deleted and disappear from the application immediately; they are permanently removed when the organization is deleted or on request. Server logs are kept for a short period for security purposes.

Images uploaded to a club (photos attached to exercises and matches) are removed from storage as soon as someone deletes them in the application. An image attached to an exercise or match that the club deletes is hidden with it, and is removed from storage when that record is permanently removed — when the organization is deleted, or earlier on request. The records and images a person added to a club belong to the club: when that person's account is deleted they stay with the club, no longer linked to the person; when the organization is deleted, its images are deleted with its records.

When you ask us to delete your account or an organization, we delete your account data — for an organization, its records and images — within 30 days of verifying the request, except where the law requires us to keep something longer. Write to support@coplanio.app.

10. Security

Every organization's data is isolated at the database level: a member of one club cannot read another club's records. Access inside a club follows roles and team assignments. Data is encrypted in transit and at rest by our providers, passwords are stored only as hashes, and important changes are recorded in an audit trail. No system is perfectly secure; if a breach affects your data we will inform you and, where required, the supervisory authority.

11. Your rights

Under the GDPR you may ask us to:

• access the personal data we hold about you and receive a copy;
• correct inaccurate data or complete incomplete data;
• delete your data, or restrict how we use it, in the cases the law provides;
• receive the data you gave us in a portable format;
• object to processing based on our legitimate interests;
• withdraw a consent you gave, without affecting what happened before.

12. How to exercise your rights and complain

Write to support@coplanio.app; we answer within one month. If your request concerns records kept by a club, we will involve the club, which is the controller for them. You also have the right to lodge a complaint with a supervisory authority — in Romania, the Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP, dataprotection.ro) — or with the authority of the country where you live.

13. Changes to this policy

We may update this policy when the service or the law changes. The version and effective date are shown at the top of the page, and we will notify registered users of material changes.