Privacy Policy

1. Scope

CoreBit Labs, LLC operates TactiFlag (“TactiFlag,” “we,” “us,” or “our”). This Privacy Policy applies to TactiFlag websites, applications, and related services (the “Service”). TactiFlag is designed for adult coaches and authorized team personnel. It is not designed for children to create accounts.

This Policy should be read with our Terms of Service. If your team, league, school, or organization has its own privacy notice, you are also responsible for following it.

2. Information we collect

Account and profile information

We collect information such as your name, email address, authentication details, account identifiers, and the versions of our legal documents you accepted. Authentication credentials are handled by our authentication provider; TactiFlag does not store your password in readable form.

Team and player information

Coaches may provide team names, formats, seasons, leagues, age groups, staff invitations, roster names or identifiers, jersey numbers, positions, player strengths, development priorities, preferred positions, and coaching observations. Because youth teams use TactiFlag, this content may describe minors even though minors do not hold accounts.

Coaching content

We collect the content needed to provide the Service, including play diagrams and routes, playbook organization, practices and drills, install status, games and results, opponent observations, Coach’s Brain memories, notebook entries, reminders when enabled, and other text a coach chooses to enter.

Sharing and collaboration information

We process assistant-coach email addresses, invitations, team roles, shared-play tokens, revocation status, and basic activity such as whether a shared link was viewed. A coach controls who receives a private team or player link.

AI requests and responses

When you deliberately request an AI feature, selected team, play, game, opponent, install, player-profile, and coaching-preference context may be sent to an AI provider to generate the requested result. TactiFlag’s Game Day request is designed to replace player names with neutral references, but text a coach types may still contain names or other information. Do not enter medical information or other highly sensitive personal information in an AI request.

Subscription and transaction information

If paid plans are enabled, we receive product, entitlement, purchase platform, renewal, cancellation, and transaction-status information from RevenueCat, Apple, Google, and/or a web payment provider. We do not receive full payment-card numbers from app stores or payment processors.

Device, log, and local information

Our hosting, database, authentication, and security providers may process IP address, browser or device type, operating system, request time, referring page, crash or diagnostic details, and similar technical information. The app uses local device storage for your signed-in session, editor preferences, active team, offline coaching data, and recovery from interrupted work. We do not currently use third-party advertising trackers.

3. Where information comes from

• Directly from you when you create an account, build coaching content, invite staff, or contact support.
• From another authorized coach who invites you or enters team information.
• Automatically from your device and our infrastructure when the Service is used.
• From app stores, RevenueCat, and payment providers when purchases are enabled.
• From AI providers when they return a response you requested.

4. How we use information

• Provide accounts, team workspaces, playbooks, practices, Game Day tools, collaboration, sharing, and offline recovery.
• Authenticate users, enforce team permissions, prevent fraud, and protect private coaching data.
• Generate AI-assisted results only when a coach requests the applicable feature.
• Deliver service messages, account recovery, invitations, support, and important policy notices.
• Administer subscriptions and determine Free or Pro access.
• Diagnose reliability problems and improve the Service’s performance, accessibility, and usability.
• Comply with law, resolve disputes, and enforce our Terms.

We do not use identifiable player profiles to train a TactiFlag-owned general-purpose AI model.

5. When we disclose information

We do not sell personal information, and we do not share it for cross-context behavioral advertising. We disclose information only as described below:

• Team members and link recipients. Team owners and accepted assistants can access information authorized for that team. People with an active sharing link can view the play and assignment made available by the coach.
• Service providers. We use providers for cloud database and authentication (Supabase), web hosting and serverless functions (Netlify), transactional email (such as Resend), requested AI processing (OpenRouter and the selected model provider), and—when enabled—subscription and payment administration (RevenueCat, Apple, Google, and a web payment provider). They process information for us under their applicable agreements and security controls.
• Legal and safety needs. We may disclose information when reasonably necessary to comply with law, respond to valid legal process, protect a person’s safety, prevent fraud or abuse, or defend legal rights.
• Business changes. Information may be transferred as part of a merger, financing, reorganization, acquisition, or sale of assets, subject to this Policy and applicable law.
• At your direction. We disclose information when you ask us to or give permission.

6. Youth players and children’s privacy

TactiFlag is an adult-directed coaching service. We do not permit children under 13—or anyone under 18—to create a TactiFlag account. We do not knowingly request personal information directly from a child.

An authorized adult coach may enter limited roster or development information about a youth player. That adult is responsible for having authority and any parent, guardian, school, league, or organizational consent required before submitting it. Coaches should enter only what is reasonably necessary and should use a first name, initials, or team identifier when possible.

If you are a parent or legal guardian and believe information about your child was submitted without proper authority, contact us. We will investigate, verify the request, and delete or correct information as required.

7. Your choices and controls

• Account details: update inaccurate information through the Service or contact us.
• Team access: team owners can remove assistants; coaches can revoke shared-play links.
• AI: AI features are optional. Do not request them if you do not want the selected context sent for AI processing.
• Local data: signing out clears access to the account, but some offline or preference data may remain on the device until app data is cleared or the app is removed.
• Communications: required account, security, billing, and legal messages cannot be opted out of while the account remains active. Optional marketing messages, if introduced, will include an unsubscribe control.
• Access, correction, export, or deletion: use the in-app Account & Privacy Center or our public account-deletion page. We may need to verify your identity and authority over a team or player record.

8. Retention and deletion

We retain account and coaching information while the account or applicable team workspace is active and as needed to provide the Service. Coaches can delete individual plays, notes, games, players, and other supported records. When an account is deleted, we remove or de-identify associated personal information from active systems unless retention is required for security, fraud prevention, billing, tax, dispute, or legal purposes.

Residual copies may remain in encrypted backups until those backups rotate, ordinarily within 90 days. Billing, security, and transaction records may be retained longer where reasonably necessary or required by law. Deleting an account does not itself cancel a subscription managed by Apple, Google, or another billing provider.

9. Security

We use administrative, technical, and organizational safeguards intended to protect information, including authenticated access, team-scoped permissions, encryption in transit, provider security controls, and restricted server credentials. No internet service is perfectly secure. Coaches also protect the team by using a unique password, safeguarding private links, removing former staff, and avoiding unnecessary sensitive information.

10. Processing locations

TactiFlag and its providers may process information in the United States and other countries. Those countries may have privacy laws different from where you live. When required, we use appropriate contractual or legal safeguards for international transfers.

11. Privacy rights

Depending on where you live, you may have rights to know about, access, correct, delete, or obtain a copy of personal information; restrict or object to certain processing; or appeal a privacy decision. You may exercise a request by contacting us. We will not discriminate against you for exercising a privacy right, and we may need to verify your identity and authority.

An authorized agent or parent/guardian may submit a request where permitted by law. If TactiFlag processes information solely for a team, school, league, or organization, we may direct the request to that organization.

12. Changes to this Policy

We may update this Policy as the Service or law changes. We will post the revised version and effective date. If a change materially affects how we use personal information, we will provide additional notice and request consent when required.

13. Contact us

For privacy questions, youth-player concerns, or a request to access, correct, export, or delete information, contact CoreBit Labs, LLC at corebitlabsllc@gmail.com. Please do not include a password, medical details, or other highly sensitive information in the email.