ShotStep Privacy Policy

Effective date: September 3, 2026
Last updated: September 3, 2026
Operator: Harbor Muse LLC

1. Who this policy covers

This policy explains how Harbor Muse LLC (“ShotStep,” “we,” “us,” or “our”) handles information through the ShotStep mobile app, shotstep.com, and related support and account-deletion services. The service is intended for people in the United States.

ShotStep is only for people aged 18 or older. You may not create or use a ShotStep account if you are under 18.

2. Information we collect

Account and profile information

During signup, we collect your email address and the information needed to send and verify email sign-in codes before checking adult eligibility and creating an account. To protect this step and limit abuse, ShotStep temporarily keeps protected forms of the email address and code, verification-attempt and resend information, and expiration times.

If signup continues, we collect your account role and account name. A coach may provide a club or facility and website and can choose how their name appears to connected players. On iOS and Android, ShotStep stores sign-in information and an unfinished setup draft using device-protected storage.

Adult eligibility information

On iOS, ordinary account creation does not ask you to provide and ShotStep does not collect your date of birth, exact age, or age range. If Apple requires its Declared Age Range feature for regulatory reasons, ShotStep uses the Apple-provided response only to decide whether account creation may continue.

The currently distributed Android app requests access to a Google Play age-range result so ShotStep can apply its adults-only rule. This is a temporary platform difference while the Android app is brought into line with iOS. We do not retain the detailed Android age range.

When Apple or Google supplies a required eligibility result, we immediately discard the detailed response, range, source, method, parental state, and install identifier. A successful account keeps the eligibility basis and time checked, plus a generic 18-or-older result only when the platform supplied one. Otherwise, account creation continues under ShotStep's adults-only policy without a stored age result. For an under-18 result, we create no account or profile and delete the related temporary ShotStep signup records. An unresolved result also creates no account or profile; its temporary records expire automatically. We keep no age result or age-applicant record for either outcome. Email-provider delivery records may remain as described in Section 5.

Invitations and coaching relationships

When a coach invites a player, we use information such as the invited email address, names, an optional invitation message, and the invitation link or code. An invited person can privately review and decline one valid invitation without creating an account or relationship. The coach sees only that the invitation was declined, not an age result or reason. If the invitation is accepted, we keep the coach-player relationship and share the relationship-safe names and coaching records needed for those two people to work together.

Except when a legal obligation requires different handling, an invitation that is declined, expired, or cancelled without creating an account or coaching relationship may be removed only after at least 30 days have passed since it ended and at least seven days have passed since an in-app notice was recorded. A late notice delays when the invitation may be removed.

When a legal obligation applies, we may remove the invitation from normal account records sooner and retain only the information needed for that obligation. Accepted invitations become part of the coaching relationship record. Service-provider records and temporary backups may follow different schedules.

Lesson, assignment, and practice information

We collect the coaching information people put into ShotStep, such as lesson details, goals, notes, assignments, tasks, repetitions, due dates, completion history, and practice records. Coaches may also keep private notes and reminders that are not shown to players.

Notifications and device information

To show and remember notification settings, we collect a random identifier for each app installation, the device platform, permission status, and your notification choices. If push notifications are enabled, we also keep the information needed to send them and understand whether delivery succeeded. The Expo Push Service and Apple’s or Google’s notification service may process delivery information.

The random installation identifier is not an advertising ID. A fresh installation replaces it.

Product analytics

We collect limited, account-linked information about use of key coaching features to understand and improve ShotStep. It does not include names, email addresses, coaching text, precise location, advertising identifiers, or screen recordings.

When aggregate reporting is enabled, PostHog receives only summary statistics based on at least ten qualifying people. We do not send PostHog account, relationship, lesson, assignment, task, or device identifiers, exact event times, or coaching content.

Diagnostics, website, and deletion-request information

Sentry may receive limited app, device, operating-system, and error information used to diagnose problems. We configure diagnostics not to include names, email addresses, coaching content, authentication secrets, or ShotStep account and installation identifiers.

Our website and service providers may process ordinary request and security information, such as network address, browser type, requested page, and request time. The public account-deletion route uses the submitted account email and a fresh email code. To prevent automated abuse, we use network and request information for short-lived rate limiting.

3. How we use information

We use information to:

• Create, secure, and support ShotStep accounts.
• Connect coaches and players and provide lesson, assignment, practice, and notification features.
• Send sign-in codes, invitation messages, service notices, and support replies.
• Understand whether important product workflows function and improve them.
• Find, diagnose, and prevent errors, abuse, and security problems.
• Process and complete account-deletion requests.
• Meet legal obligations and protect people, ShotStep, and others.

4. When information is shared

Between connected coaches and players

A connected coach and player can see the relationship-safe account name and shared lesson, assignment, task, completion, and practice information needed for their coaching relationship. Private coach notes remain visible only to that coach. Either participant may end an active relationship. Ending it stops new sharing and ordinary coach access to the player's active relationship data.

With service providers

We use service providers to operate ShotStep. They process information for us under their own service terms and privacy commitments:

• Supabase for authentication, databases, and server functions.
• Resend for account verification and sign-in codes, invitations, deletion-verification codes, and other operational service email.
• Expo Push Service, Apple Push Notification service, and Firebase Cloud Messaging for notifications.
• Sentry for sanitized error diagnostics.
• PostHog for thresholded, aggregate product statistics.
• Cloudflare for website hosting, delivery, and security.

For legal, safety, or business reasons

We may disclose information when reasonably necessary to follow the law, respond to valid legal process, protect rights or safety, investigate abuse, or complete a merger, financing, acquisition, or sale of company assets. If ownership changes, this policy continues to apply to the information unless you are told otherwise.

We do not sell personal information or share it for cross-context behavioral advertising.

5. How long we keep information

We keep account and coaching information while an account is active and as needed to provide ShotStep, meet legal obligations, prevent abuse, resolve disputes, and complete reliable deletion and backup processes.

We delete account-linked product events after 30 days or earlier during account deletion. We keep Sentry error reports for 30 days. Short-lived security records used for the public deletion form expire automatically. Statistics that no longer identify or link back to a person may be kept longer.

Before an account is created, ShotStep's protected signup challenge, verification-attempt, resend, and rate-limit records expire within 10 minutes. A single-use authorization created after email verification expires within two minutes. Expired records are removed by scheduled cleanup. We delete the related ShotStep signup records when we confirm an under-18 result or you cancel setup. If an unfinished authentication record remains after cancellation, we delete it through a separate cleanup process. Resend may retain email and delivery data for 30 days after sending a message.

When information is no longer needed, we delete or de-identify it. Some information may be kept longer when reasonably necessary for legal or security reasons, or while temporary backup copies complete their normal cycle.

6. Your choices and account deletion

You can:

• Review or update available profile and coach-name-sharing settings in the app.
• Control notification permission through the app and your device settings.
• Request account deletion through the app’s Settings screen or at shotstep.com/delete-account.
• Email privacy@shotstep.com with a privacy question or request.

We verify control of the account email before processing a deletion request. Sending or acknowledging a request does not mean deletion is complete; we will confirm when processing finishes. We aim to provide a human response within five business days and complete a verified request within 30 calendar days. Limited information may remain where required by law, for security, or temporarily in backups.

Deleting either a coach or player account permanently removes the shared lesson and practice records for every relationship involving that account. The other participant loses access to those records. Ending a coaching relationship without deleting an account does not remove the player's read-only history.

Privacy rights can depend on where you live. Contact us if you want to ask about access, correction, deletion, or another privacy right. We may need to verify your identity before acting on a request.

7. Security

We use administrative, technical, and organizational safeguards designed to protect information. These include passwordless authentication, access controls, limited diagnostic information, and separation of coaching records from error reports.

ShotStep uses device-protected storage for sign-in information and unfinished account setup.

Android app backup and device transfer are disabled, and protected iOS information is limited to the device. A fresh installation starts signed out with no unfinished setup.

No service or security method can guarantee that information will never be lost, misused, or accessed without permission.

8. Changes to this policy

We may update this policy as ShotStep changes. We will post the updated version and change the effective date. If a change materially affects how we use personal information, we will provide additional notice when reasonably appropriate.

9. Contact us

Privacy: privacy@shotstep.com
Support: support@shotstep.com
Legal: legal@shotstep.com