PRIVACY POLICY

This Privacy Policy for Basketball Orbit and the BballOrbit Practice Planner ("we," "us," or "our") explains how we collect, use, store, share, and protect personal information when you use our websites, digital products, newsletter, and the Basketball Orbit Practice Planner app, including Orbit AI features (together, the "Services").

This Privacy Policy applies when you:

• Visit https://www.bballorbit.com or any website of ours that links to this Privacy Policy
• Use the BballOrbit Practice Planner at app.bballorbit.com or any related app domain
• Create an account, sign in with email or Google, save practice plans, use the Drill Library, create custom drills, export PDFs, use Orbit AI, or use future features such as Drill Creator, Season Plan, Team View, templates, and media uploads
• Subscribe to our newsletter, download free resources, purchase digital products, purchase or manage a Practice Planner subscription, contact support, or participate in affiliate or referral campaigns

Controller. The controller responsible for the processing described in this Privacy Policy is Christian Bernhard, Hitzhofener Strasse 5b, 85080 Gaimersheim, Germany, email: [email protected].

Important note for coaches. The Practice Planner is designed for coaches and practice planning. Please avoid entering unnecessary personal information about players, especially minors. Do not enter health, injury, disciplinary, school, or other sensitive information about players unless you have a lawful basis and it is strictly necessary for your own coaching records.

SUMMARY OF KEY POINTS

This summary highlights key points. More detail is provided in the table of contents below.

TABLE OF CONTENTS

1. WHAT INFORMATION DO WE COLLECT?

Information you provide to us

We collect personal information that you voluntarily provide when you use our Services, create an account, subscribe to communications, make purchases, contact us, upload content, or use app features.

Depending on how you use the Services, this may include:

• Contact information: name, email address, and information you include in messages to us.
• Account and authentication data: email address, login method, account identifiers, password reset data, session information, and authentication provider information.
• Profile data: display name, profile image or avatar, and profile settings you choose to provide.
• Practice Planner content: practice plan titles, dates, age group, level, player count, goals, notes, segments, durations, selected drills, coaching cues, custom instructions, templates, favorites, sharing settings, and PDF export settings.
• Custom drill and future feature content: custom drills, drill descriptions, constraints, tags, training objectives, media references, Season Plan content, Team View settings, or related coaching workflow data if you use those features.
• Media uploads: images, audio, video, or other files you choose to upload if media upload features are available to your plan.
• AI feature input: prompts, additional instructions, plan context, generated AI output, feedback, and AI usage metadata when you choose to use Orbit AI or related AI features.
• Support and feedback data: support requests, bug reports, feature requests, troubleshooting information, and any files or screenshots you choose to send.
• Purchase and subscription information: order status, subscription status, plan, billing cycle, renewal or expiration dates, refund status, license identifiers, coupon or referral attribution, and limited payment-related records received from payment providers.
• Newsletter and marketing preferences: email address, subscription status, consent records, tags, interests, email engagement, and unsubscribe data.

Sensitive information. We do not ask for or intentionally require sensitive personal information, such as health data, injury information, religious or political views, government identifiers, biometric information, or detailed information about minors. Please do not include such information in notes, prompts, support messages, or uploads unless you have a lawful basis and it is strictly necessary for your own use of the Services. If you choose to provide sensitive information, we may process it only as needed to provide the requested feature or handle your request.

Information collected from third parties

We may receive limited information from third parties when you choose to use integrations or external services:

• Google Sign-In: email address, name, profile image, account identifier, and authentication information depending on your Google account settings.
• Freemius: subscription, purchase, license, customer portal, refund, affiliate attribution, coupon, tax, billing, and invoice-related information for Practice Planner subscriptions.
• Kit / ConvertKit and Stripe: newsletter subscription, purchase, payment status, checkout, digital product delivery, and order-related information for separate PDF or digital product sales.
• Analytics, advertising, and consent tools: consent status, cookie preferences, campaign source, referral information, and event data where such tools are enabled and legally permitted.

Information automatically collected

We automatically collect certain technical and usage information when you visit or use the Services. This may include IP address, browser type, device characteristics, operating system, language preferences, referring URLs, pages viewed, timestamps, log data, error reports, security events, and other technical data needed for delivery, diagnostics, security, fraud prevention, analytics, and service improvement.

When you use the Practice Planner, we may also process app usage events such as feature usage, AI credit usage, PDF export usage, storage usage, subscription status checks, webhook status, and similar operational data needed to provide and protect the app.

2. HOW DO WE USE YOUR INFORMATION?

We use personal information for the following purposes:

• To provide the website and app. This includes account creation, login, profile management, practice planning, drill library access, favorites, PDF export, templates, custom drills, sharing links, and related functionality.
• To provide Orbit AI and future AI-assisted features. This includes processing relevant plan context and prompts to generate suggestions, coaching cues, drill ideas, plan optimizations, or season-planning support.
• To process subscriptions and purchases. This includes checkout, subscription management, invoices, renewals, refunds, license verification, access control, customer portal links, coupon handling, and affiliate attribution.
• To deliver digital products and free resources. This includes email delivery of PDFs, order confirmations, and download access.
• To provide customer support. This includes responding to support requests, troubleshooting, resolving billing questions, and handling feedback.
• To manage newsletters and communications. This includes sending emails you requested, managing unsubscribe requests, and sending product updates where permitted.
• To enforce usage limits and subscriptions. This includes tracking AI credits, PDF export counts, practice plan limits, custom drill limits, media storage, and feature entitlements.
• To keep the Services secure. This includes fraud prevention, abuse prevention, rate limiting, authentication security, access control, incident detection, and protection against misuse.
• To improve the Services. This includes analytics, diagnostics, product improvement, performance monitoring, and understanding which features are useful.
• To comply with legal obligations. This includes tax, accounting, consumer protection, refund, and record-keeping obligations.
• To establish, exercise, or defend legal claims.

3. WHAT LEGAL BASES DO WE RELY ON?

If you are located in the European Economic Area, the United Kingdom, or Switzerland, we process personal information only when we have a valid legal basis.

• Performance of a contract. We process account, app, practice-plan, subscription, purchase, digital delivery, support, and billing-related data where necessary to provide the Services you request or to take steps before entering into a contract.
• Consent. We rely on consent for newsletters, certain marketing communications, and non-essential cookies, analytics, or advertising technologies where consent is required. You may withdraw consent at any time with effect for the future.
• Legitimate interests. We may process data for security, fraud prevention, diagnostics, product improvement, support, abuse prevention, affiliate attribution, and legal claims where our interests are not overridden by your rights and freedoms.
• Legal obligations. We process information where needed to comply with tax, accounting, commercial, consumer protection, refund, or other legal requirements.
• Vital interests. In exceptional cases, we may process information where necessary to protect the vital interests of a person.

4. WHEN AND WITH WHOM DO WE SHARE PERSONAL INFORMATION?

We share personal information only where necessary to operate the Services, provide requested functionality, process purchases, comply with law, protect rights, or work with trusted service providers.

We may share information with:

• Service providers and processors that provide hosting, authentication, database, storage, payments, email, analytics, consent management, AI, support, or security services.
• Payment and commerce providers such as Freemius, Stripe, and Kit / ConvertKit where needed for checkout, payment processing, subscription management, invoices, refunds, license management, delivery, fraud prevention, tax, and accounting.
• AI providers when you choose to use AI features and the provider needs relevant prompts, instructions, or plan context to generate the requested output.
• Affiliate partners only to the limited extent necessary for referral and commission tracking if you purchase through an affiliate link or affiliate coupon. Affiliates do not receive full payment card details from us.
• Professional advisers, authorities, courts, or other parties where required by law, legal process, consumer rights, tax obligations, or protection of our rights.
• Business counterparties in connection with a merger, acquisition, financing, restructuring, or sale of assets, subject to appropriate safeguards.

We do not sell personal information.

5. SERVICE PROVIDERS AND PROCESSORS

We use third-party services to operate the Services. Depending on which features you use, these may include:

• Supabase. We use Supabase for app authentication, database, Row Level Security, Edge Functions, storage, and backend infrastructure. Supabase may process account data, saved app content, usage counters, storage data, authentication logs, and technical data.
• Freemius. We use Freemius for Practice Planner subscriptions, checkout, license and subscription management, customer portal, invoices, taxes, VAT where applicable, refunds, coupons, and affiliate attribution.
• Kit / ConvertKit. We use Kit / ConvertKit for newsletter subscriptions, email forms, subscriber management, free resource delivery, and, where applicable, ConvertKit Commerce for separate digital product sales.
• Stripe. Stripe may process payments for separate digital product purchases made through ConvertKit Commerce or other non-subscription checkout flows. We do not store full card details on our servers.
• Google. We may use Google services for optional Google Sign-In, Google Analytics, Google Tag Manager, Google AdSense, and the Gemini API or related Google AI services for Orbit AI features.
• CookieYes or similar consent tools. We may use a consent management tool to record and manage cookie and tracking preferences.
• Resend. We may use Resend or a similar provider for transactional emails, including account, support, security, and deletion verification emails.
• Cloudflare. We use Cloudflare for website delivery and security, including Turnstile on the website contact form. Turnstile processes technical browser and network signals to distinguish people from automated submissions. We verify its token on our server before accepting a message. See Cloudflare's Turnstile Privacy Addendum. Contact messages are stored in Supabase and a notification is sent to our support address through Resend. Short-lived abuse counters use a hashed network identifier; the contact queue does not store the plain IP address.
• GitHub Pages. Parts of the public website may be hosted through GitHub Pages, which may process technical request data such as IP addresses and browser metadata for delivery and security.

These providers may process information in accordance with their own privacy notices, data processing terms, and applicable laws. Where legally required, we use data processing agreements or other appropriate safeguards.

6. PAYMENTS, SUBSCRIPTIONS, AFFILIATES, AND DIGITAL PRODUCT SALES

Practice Planner subscriptions via Freemius

Paid Practice Planner subscriptions are processed through Freemius. Freemius may act as the merchant of record for subscription purchases and may process personal information needed for checkout, tax calculation, VAT handling, fraud prevention, payment, invoices, subscription management, customer portal access, refunds, chargebacks, license verification, and related communications.

We may receive and store limited subscription-related information from Freemius, such as your email address, Freemius customer or user ID, license ID, subscription ID, plan, billing cycle, renewal or expiration date, subscription status, refund status, coupon code, and affiliate attribution. We use this information to grant or remove access to paid features, show billing status in your account, enforce subscription limits, handle support, and comply with legal obligations.

You may be redirected to, or interact with, a Freemius checkout, overlay, or customer portal to complete payments, manage billing details, view invoices, change plans, or cancel a subscription. We do not store full payment card details on our own servers.

If you delete your Practice Planner account and a Freemius subscription or app access record is linked to that account, we handle subscription and access cancellation as part of the deletion workflow. Freemius may retain billing, invoice, tax, accounting, refund, fraud-prevention, chargeback, or dispute records where legally required or permitted.

Affiliate links and coupon codes

If you purchase through an affiliate link or use an affiliate coupon, Freemius may process referral, coupon, and attribution data. We and the relevant affiliate may receive limited information necessary to track the referral and calculate commissions. This does not include full payment card details.

Separate digital product sales via Kit / ConvertKit and Stripe

Separate PDF resources, playbooks, or other digital products may be sold or delivered through Kit / ConvertKit Commerce and Stripe. In those cases, your name, email address, purchase details, payment status, and delivery information may be processed by Kit / ConvertKit and Stripe to complete the transaction, deliver the files, send receipts, prevent fraud, and comply with legal obligations.

The legal basis for purchase-related processing is usually contract performance and legal obligations. We may also retain order records for accounting and tax purposes for the statutory retention period.

7. PRACTICE PLANNER, ORBIT AI, MEDIA, AND SHARED LINKS

Practice Planner account and content

If you create a Practice Planner account, we store the information needed to provide your account and app workflow. This includes saved practice plans, plan metadata, segments, notes, selected drills, custom drills, templates, AI outputs, usage counters, subscription status, sharing settings, PDF export status, and related app content.

Existing content may remain stored after a downgrade, cancellation, or expiration unless you delete it or request deletion. Paid feature limits may apply after a downgrade, but we do not automatically delete your practice plans solely because you move from Pro to Free.

Shared practice links

If you enable a shared practice link, anyone with that link may be able to view the shared content until you disable sharing, change the sharing settings, or delete the relevant practice. Do not share confidential or personal information through shared links unless you have the right to do so.

Orbit AI and AI-assisted features

Orbit AI is optional. When you use it, we process the relevant practice-plan context, prompts, additional instructions, generated outputs, feature type, AI credit usage, and technical metadata needed to generate the requested result, enforce usage limits, prevent abuse, troubleshoot errors, and improve reliability.

AI requests may be sent to third-party AI providers, currently Google Gemini API or another provider used for a specific AI feature. AI outputs may be inaccurate or incomplete. You should review AI-generated content before using it in practice planning. Please do not include sensitive, confidential, health-related, or player-identifying information in AI prompts unless it is necessary and lawful.

We do not use Orbit AI to make legal, employment, credit, insurance, medical, or similarly significant decisions about you.

Media uploads

If media upload features are available to your plan, you may upload images, audio, video, or other files for coaching purposes. You are responsible for ensuring that you have the necessary rights, permissions, and legal basis to upload and use such media, especially if it shows or identifies players, minors, parents, coaches, or other third parties.

Media may be stored through Supabase Storage or another storage provider and may be processed to display, stream, download, or manage the file in the app. We may track file size and storage usage to enforce plan limits and prevent abuse.

8. COOKIES, CONSENT, ANALYTICS, AND ADVERTISING

We use essential cookies, local storage, and similar technologies where needed to provide requested functionality, such as login sessions, authentication, security, checkout, consent storage, and app preferences.

We may also use analytics, measurement, and advertising technologies such as Google Analytics, Google Tag Manager, Google AdSense, or similar tools. Where required by law, non-essential cookies and tracking technologies are activated only after you have given consent. You can withdraw or change consent using the cookie preferences or consent tool made available on the Services.

Google Analytics and Google Tag Manager

We may use Google Analytics and Google Tag Manager to understand how our website and app are used, measure performance, and improve functionality. Depending on your consent settings, Google may process information such as pages viewed, interactions, browser and device data, approximate location derived from IP address, and event data. For more information, please refer to Google's Privacy Policy.

Google AdSense

We may use Google AdSense to display advertising on the public website. Where legally required, advertising cookies and similar technologies are used only after your consent. You can manage personalized advertising settings through Google's Ad Settings.

Cookie preferences

If a cookie preference tool is available on the Services, you can use it to manage non-essential cookies. Some essential technologies cannot be disabled because they are necessary for security, login, checkout, or requested app functionality.

9. NEWSLETTER AND EMAIL COMMUNICATIONS

If you subscribe to our newsletter or request free resources, we process your email address, consent information, tags, subscription status, and email engagement data to send the requested emails, downloads, updates, and marketing communications. Processing is based on your consent where required. You can unsubscribe at any time using the unsubscribe link in any marketing email.

We may also send non-marketing transactional emails related to your account, purchases, subscriptions, support requests, security, invoices, refunds, payment issues, or important service changes. These emails are necessary to provide the Services or comply with legal obligations and may not always include an unsubscribe option.

10. INTERNATIONAL DATA TRANSFERS

Some service providers may process personal information in countries outside your country of residence, including outside the European Economic Area, the United Kingdom, or Switzerland. This may include the United States and other countries where our providers or their subprocessors operate.

Where personal information is transferred internationally, we rely on appropriate transfer mechanisms where required, such as adequacy decisions, the EU-US Data Privacy Framework where applicable, Standard Contractual Clauses approved by the European Commission, the UK International Data Transfer Addendum, or other lawful safeguards.

11. HOW DO WE PROTECT YOUR INFORMATION?

We use technical and organizational measures designed to protect personal information, including encrypted transport via HTTPS, access controls, authentication, role-based database rules where applicable, provider-side security measures, and limited access to personal information on a need-to-know basis.

No internet service can be guaranteed to be completely secure. You are responsible for keeping your login credentials confidential and for using strong, unique passwords or secure sign-in methods.

12. HOW LONG DO WE KEEP YOUR INFORMATION?

We keep personal information only for as long as needed for the purposes described in this Privacy Policy, unless a longer retention period is required or permitted by law.

• Account, profile, practice-plan, custom drill, template, and app content: generally until you delete the content, delete your account, or request deletion, unless retention is required for legal, security, backup, or legitimate operational reasons.
• Shared links: until you disable sharing, delete the relevant practice, or delete your account, subject to technical caching and backups.
• Media uploads: generally until you delete the media, delete your account, or request deletion, unless retention is required for legal, security, backup, or abuse-prevention reasons.
• Orbit AI prompts, generated outputs, and AI usage metadata: generally up to 12 months for troubleshooting, abuse prevention, usage enforcement, and product reliability, unless a shorter or longer period is required by law, deletion request, or security incident.
• Subscription, license, billing status, webhook, and usage records: for as long as needed to provide subscriptions, handle disputes, maintain access records, comply with accounting or tax requirements, and debug billing issues.
• Order, invoice, and accounting records: for the statutory retention period, usually up to 10 years under applicable German commercial and tax law.
• Newsletter subscription data: until you unsubscribe or withdraw consent, subject to limited suppression records needed to respect opt-out requests.
• Support messages: generally up to 24 months after the last substantive communication, unless longer retention is necessary for legal claims, security, or unresolved issues.
• Deletion requests: when an account deletion is completed, we keep only a minimal deletion record for audit, security, and operational purposes. This record does not retain the plain email address in the deletion job.
• Technical logs: for as long as necessary for security, delivery, diagnostics, and abuse prevention, generally no longer than 30 days unless a longer period is needed to investigate an incident or comply with law.
• Backups: deleted information may remain in encrypted or protected backups for a limited period until backups are overwritten or deleted according to our backup cycle.

13. DO WE COLLECT INFORMATION FROM MINORS?

The Services are intended for coaches and other users who are at least 16 years old, or the higher minimum age required by local law. We do not knowingly collect personal information directly from children under 16 without the required consent.

Coaches are responsible for ensuring that they have the necessary rights and permissions before entering information about players, especially minors, into practice plans, notes, shared links, AI prompts, custom drills, team features, or media uploads. Please avoid entering identifiable information about minors unless it is necessary and lawful.

If we learn that we have collected personal information from a child unlawfully, we will take reasonable steps to delete it.

14. WHAT ARE YOUR PRIVACY RIGHTS?

Depending on your location and applicable law, you may have rights to:

• request access to personal information we process about you;
• request correction of inaccurate or incomplete information;
• request deletion of your personal information;
• request restriction of processing;
• object to certain processing based on legitimate interests;
• receive a copy of information you provided in a portable format;
• withdraw consent where processing is based on consent; and
• lodge a complaint with a supervisory authority.

You may exercise your rights by contacting us at [email protected]. If you want to delete a Practice Planner account, you can also use the in-app flow under Profile → Account & Data → Delete Account, or submit a verified request through our Data Deletion page. Website deletion requests require email verification before deletion starts.

If you are in Bavaria, Germany, the competent supervisory authority for private-sector organizations is generally the Bayerisches Landesamt für Datenschutzaufsicht (BayLDA). You may also contact another competent data protection authority.

15. CONTROLS FOR DO-NOT-TRACK FEATURES

Some browsers offer "Do Not Track" signals. Because there is no uniform standard for recognizing or implementing these signals, we do not currently respond to them in a standardized way. Where required, your choices for non-essential cookies are handled through the consent tools made available on the Services.

16. US STATE PRIVACY RIGHTS

If you are a resident of certain US states, you may have additional rights under applicable state privacy laws, including rights to know, access, correct, delete, obtain a copy of, or opt out of certain processing of your personal information.

Categories of Personal Information We Collect

We do not sell personal information. If you consent to advertising cookies, certain identifiers and internet or network activity information may be disclosed to advertising partners in a way that may be considered "sharing" under some US state privacy laws. You can opt out by adjusting your cookie or consent settings where available.

17. DO WE MAKE UPDATES TO THIS POLICY?

Yes. We may update this Privacy Policy from time to time to reflect legal, technical, or operational changes. The updated version will be indicated by a revised date at the top of this page. If changes are material, we may provide additional notice where required by law.

18. HOW CAN YOU CONTACT US?

If you have questions or comments about this Privacy Policy, you may contact:

19. HOW CAN YOU REVIEW, UPDATE, OR DELETE YOUR DATA?

You may review or update certain account information directly in the Practice Planner account area where available. If you can still log in to the Practice Planner, you can delete your account under Profile → Account & Data → Delete Account. You may also request access to, correction of, deletion of, restriction of, or portability of your personal information by contacting us at [email protected].

For website-based account and data deletion requests, visit our Data Deletion page. The website form asks for your email address and sends a verification link. Deletion starts only after you confirm through that email link, and the form does not reveal whether an account exists.

Account deletion may include Practice Planner account and profile data, saved practice plans, practice sections, app content and notes, app usage data where applicable, app storage files where applicable, email subscriber records where possible, and support or contact records linked to the verified email where possible. We keep a minimal deletion record for audit and security purposes without retaining the plain email address in the deletion job.

Some information may remain where legally required or necessary, including payment, invoice, tax, accounting, refund, fraud-prevention, dispute, legal-claim, security-log, and backup records. Freemius may retain billing or invoice records for Practice Planner subscriptions where legally required.

To unsubscribe from marketing emails, use the unsubscribe link in the relevant email. To manage non-essential cookies, use the available cookie preferences or consent tool.