Privacy Policy

Who we are

First Pitch ("we", "us") provides youth-baseball practice planning, lineup tools, field information, and player-development tracking. We are based in the United States and offer the service to users in the United States. You can reach us about privacy at privacy@firstpitch.app.

Children under 13 (COPPA)

Children do not create their own accounts. A parent, legal guardian, or a coach acting with parental permission adds a child to a team. Before a child profile becomes active we require verifiable parental consent from the parent's own email. See how consent works.

• We collect the minimum needed to run training: name, jersey number, age band, and optional development metrics a coach or parent enters.
• We never show behavioral ads to children and never build advertising profiles.
• We never make a child's profile, metrics, or video public without explicit coach and parent action.
• A parent can review, export, or delete their child's data at any time. See Your data rights.
• We do not condition a child's participation on disclosing more than is reasonably necessary.

What we collect

• Account data: email and role (coach / parent / player / admin). We use passwordless magic-link sign-in, so we never store passwords.
• Team & player data: rosters, lineups, practice plans, pitch counts, goals, missions, and metrics you enter.
• Usage data: if enabled, privacy-friendly, cookieless analytics (Plausible) with no personal identifiers, and only on our public marketing pages. We never load third-party analytics or advertising scripts in the signed-in app, where a child's data may appear.
• Operational logs: error and security logs that exclude children's personal identifiers wherever feasible.

How we use it

To run the features you ask for: compile safe practices, enforce pitch-count and arm-care rules, build lineups, track progress, and send transactional email (magic links, coach notices). We do not sell or rent personal data, ever.

AI processing

AI is used to draft text, summarize, and search a curated safety corpus, never to diagnose injuries, predict recruitment, or rank children. We do not send children's personal identifiers to third-party model providers, and we do not allow your team's data to train third-party models without an explicit opt-in. Details on the AI boundaries page.

Automated decisions & profiling

We do not make decisions that produce legal or similarly significant effects about you or a child based solely on automated processing. AI features assist a coach's judgment; a human always decides. We never profile children for advertising, and we never rank or score children publicly.

Sharing & service providers

We share data only with service providers (sub-processors) that help us operate, each bound by contract to protect it and use it only for our service. Depending on your settings, these may include:

• Hosting & storage: Vercel (application hosting/CDN) and Vercel KV / Upstash (database).
• Transactional email: Resend (magic-link and coach notices).
• Analytics (optional): Plausible. Privacy-friendly, cookieless, no personal identifiers.
• AI features (optional): OpenAI, used only to draft and summarize text; we do not send children's personal identifiers.
• Billing (optional): Stripe, if you subscribe to a paid plan.
• Error monitoring (optional): Sentry or a webhook, with children's identifiers excluded wherever feasible.

We may disclose information if required by law or to protect the safety of a child. We do not sell or share personal information for cross-context behavioral advertising. Email privacy@firstpitch.app for the current list of sub-processors.

Retention & deletion

We keep personal data only as long as we need it for the purposes above, then delete or anonymize it. As a guide:

• Account, team & player data: while the account or team is active; removed within 30 days of a verified deletion request.
• Sign-in (magic-link) tokens: expire within 15 minutes and are then unusable.
• Parental-consent records: kept for the life of the child's profile plus a reasonable period to evidence that consent was given.
• Security & audit logs: a limited period (typically up to 12 months), then deleted or aggregated.
• Backups: purged on a rolling cycle after deletion from the live service.

Request export or deletion anytime from Your data rights. We honor verified deletion requests within 30 days, except where law requires longer retention.

Your privacy rights

You can access, correct, export, or delete your personal data at any time. Depending on your state, U.S. privacy laws, such as the California Consumer Privacy Act (CCPA/CPRA) and comparable laws in Virginia, Colorado, Connecticut, and other states, may also give you the right to:

• Know & access what personal information we collect and get a copy.
• Correct inaccurate personal information.
• Delete your personal information.
• Port your data in a portable, machine-readable format.
• Opt out of the sale or sharing of personal information and of targeted advertising.

We extend these controls to all users regardless of state, and we will not discriminate against you for using them. Because we do not sell or share personal information and do not run targeted advertising, there is nothing to opt out of, but you can still exercise every other right. Start at Your data rights or email privacy@firstpitch.app.

California residents (CCPA/CPRA)

California residents have the rights listed above, plus the right to limit the use of sensitive personal information. We collect only the minimum needed to run training and do not use sensitive personal information beyond providing the service. In the prior 12 months we did not sell or share personal information, and we never sell or share the personal information of anyone we know to be under 16.

Security

We use encryption in transit, passwordless sign-in, scoped access controls, audit logging, and a hardened content-security policy. No system is perfectly secure, but we design to minimize what we collect and who can see it.

Changes

If we make material changes we will update this page and, where appropriate, notify account holders. Continued use after an update means you accept the revised policy.

Cookies

We use only a strictly-necessary sign-in cookie to keep you logged in, plus optional cookieless analytics. We do not use advertising or cross-site tracking cookies. Full detail is on our Cookie Policy.

Contact

First Pitch is responsible for the personal data processed through this service, and can be reached at privacy@firstpitch.app for any question, concern, or request about your data or a child's data. See also our Terms of Service, Cookie Policy, and Platform policy.