Privacy Policy

These points don't replace the full policy below.

• We collect what you give us to build your training plan. That includes your account details, athlete profile and training, nutrition and check-in logs. It also includes any videos, photos or voice notes you choose to save.
• Some of this is health-related. Examples are weight, body measurements, sleep, soreness, injuries and allergies. We use it only to run the Service for you.
• Pose analysis runs on your device. Your video doesn't leave your phone or computer unless you choose to save it.
• We don't sell or “share” your personal information for targeted advertising. We don't run ads, and the app has no third-party analytics or ad trackers.
• AI features use OpenAI's models (ChatGPT). Model training on our content is turned off in the account's data controls.
• Payments go through Stripe. We never see your full card number.
• Athlete Partners only see totals. They never see who signed up through them.
• You can ask us to see, correct, export or delete your data. Email support@440fb.com.
• Age: the Service is for people 13 and older. If you're under 18, a parent or guardian must agree and buy the subscription.

Information you give us

• Account: name, email address and password. Supabase handles sign-in and stores your password as a one-way hash, so we never see it in plain text.
• Athlete profile: position and secondary position, level (for example high school or college), graduation year, age, sex, height, weight, goal weight, body fat %, combine numbers (40-yard dash, vertical, broad jump, shuttle), goals, season phase, training days, available equipment, diet preference, allergies, injuries or limitations, and in-season game day.
• Training logs: workouts, sets, reps, weights, RPE, personal records, routines, sprint times and drills, jump and bar-speed tests, completed tasks, points, streaks and achievements.
• Health and wellness logs: weigh-ins, body measurements (chest, waist, arms, thighs), daily check-ins (sleep hours and quality, soreness, energy, stress, pain area, readiness), food and water logs, calories and macros.
• Videos, photos and audio: sprint and rep videos and voice-over notes you choose to save, plus meal photos you scan. These are stored in private storage that only your account can access.
• Playbook: plays you draw, tags and quiz results.
• Support: anything you send us when you email support@440fb.com.

Information collected automatically

• Cookies and local storage: sign-in session, your time zone, and referral attribution (see Section 5).
• Usage records: for example, how many AI scans you've run in the past hour (used for rate limits) and when records were created.
• Technical logs: our hosting and database providers (Cloudflare and Supabase) automatically process technical data, such as IP address, browser type and request logs, to deliver and secure the Service.

Information from others

• Stripe: your Stripe customer ID, plan, subscription status, renewal and cancellation dates, and payment, refund and dispute amounts and fees. Stripe collects your card and billing details directly under its own privacy policy.
• Athlete Partner links: if you arrive through a partner link or enter a code, we save which partner referred you, how (link, code or checkout) and when.

What we don't collect

We don't collect precise location, contacts, biometric identifiers (for example, we don't use face recognition), advertising IDs or third-party analytics data. Pose tracking estimates body joint positions in your browser to measure your movement. It isn't used to identify you.

• To run the Service. We use it to build and adjust your plan (training, speed, strength, nutrition targets and position drills), track your progress and records, and show your history.
• For AI and automated features, such as meal photo scanning and coaching cues (see Section 3).
• For billing. We use it to process subscriptions, confirm your access, handle refunds and keep financial records.
• For the partner program. We use it to credit Athlete Partners for referrals and to calculate their payouts.
• For support and communication. We use it to answer you, and to send account, billing, renewal and policy notices.
• For safety and security. We use it to prevent fraud and abuse, enforce our Terms and fix bugs.
• To meet legal obligations, such as tax and accounting.

We don't use your information for targeted advertising. We don't sell it, and we don't use it or let anyone else use it to train AI models.

Pose analysis happens on your device. When you analyze a sprint or rep video, your browser downloads a pose-tracking model from Google and jsDelivr servers and processes the video locally. The video isn't sent to us or to those servers for analysis. It's uploaded only if you choose to save it.

Voice dictation in the food logger uses your browser's built-in speech recognition. Depending on your browser, your browser maker (such as Google or Apple) may process the audio. We only receive the resulting text.

AI features are powered by OpenAI's models through a ChatGPT account we operate. When you use them, we send only what the feature needs:

• Meal scanning: we send the meal photo or nutrition label you scan, or the food description you type. With it we send your position, level, season phase, primary goal and daily nutrition targets, so the tip is relevant to you.
• Coaching cues: we send your position, level and season phase, the measurements from the analysis (for example split times or angles) and the rules-engine feedback. We don't send your video, name or email.

Requests travel over an encrypted Cloudflare tunnel to an AI relay server we operate, which sends them to OpenAI. The relay doesn't keep your requests. It deletes its temporary files after each request, and its logs record only technical details, such as timing and whether an image was included. We've turned off model training on our content in the ChatGPT account's data controls, so OpenAI doesn't use these requests to train its models. OpenAI processes the requests under its own privacy policy and may keep them for a limited time, for example for safety and legal reasons.

We don't sell your personal information. We share it only as described below.

Service providers that process data for us

• Supabase: sign-in, database and private file storage.
• Cloudflare: website hosting, delivery and security.
• Stripe: payments, subscriptions, receipts and the customer portal.
• OpenAI: AI meal scanning and coaching cues (see Section 3).
• Open Food Facts: food search and barcode lookups. We send only the search text or barcode.
• Email providers: sending account emails (such as sign-up confirmation) and handling support email.

Other recipients

• Athlete Partners: they see totals only, such as clicks, sign-ups, sales and their earnings. They never see your name, email or training data.
• YouTube: some exercise demos are YouTube videos. We show a static thumbnail until you tap play. Then the video loads from YouTube's privacy-enhanced (youtube-nocookie.com) player, and YouTube's privacy policy applies.
• Legal and safety: we may share information if the law requires it, or to protect the rights, safety or property of our users, the public or 440 Football.
• Business transfers: if we're involved in a merger, acquisition or sale of assets, your information may be transferred. We'll notify you before it becomes subject to a different privacy policy.
• With your permission: for example, if you share your own progress card.

We use only the cookies and browser storage we need to run the Service. We don't use advertising or third-party analytics cookies.

• Supabase auth cookies (sb-…): keep you signed in. They last for the length of your session and are renewed while you use the Service.
• tz: your time zone, so “today” in your plan matches your local day. It lasts 1 year.
• f440_ref: the Athlete Partner code from a link you opened. The first link wins. It lasts up to 60 days.
• f440_vid: a random ID that counts unique partner-link visitors. It's not linked to your name, and we don't store your IP address or browser details with it. It lasts 1 year.
• Local storage: unsaved workout drafts, quiz streak backup and display preferences. It stays until cleared.

YouTube may set its own cookies, but only after you play an embedded video. You can block or delete cookies in your browser settings. If you block sign-in cookies, you won't be able to stay signed in.

• Account and training data: we keep it while your account is open. If you delete your account, we delete your profile, logs, videos, photos and voice notes within 30 days. Copies in routine backups expire on our providers' backup schedule, within 30 days.
• You can delete individual items yourself, such as a meal, saved analysis, video or set, at any time in the app.
• Billing and partner records: we keep subscription, payment, refund and payout records for as long as tax and accounting law requires, generally 7 years. Partner sales records keep amounts but unlink your account when it's deleted.
• Referral click counts: we keep them as totals for partner reporting.
• Support emails: we keep them for 24 months after the conversation ends.

We use reasonable safeguards, including encryption in transit (HTTPS), database rules that limit each account to its own data, private storage for videos and photos, and server-only access to payment and partner records. No system is perfectly secure. If a data breach affects you, we'll notify you as the law requires.

Everyone can:

• Access and export a copy of your data.
• Correct your profile in the app, or ask us to fix anything else.
• Delete individual items in the app, or ask us to delete your whole account.
• Cancel your subscription at any time (see the Terms). Cancelling doesn't delete your data, so ask for deletion if you want that too.
• Opt out of any non-essential emails using the link in the email or by contacting us.

To make a request, email support@440fb.com from your account email address. We may need to verify your identity first. We'll respond within 45 days, or sooner where the law requires. Parents and guardians can make these requests for their teen.

If you're a California resident, the California Consumer Privacy Act, as amended by the CPRA, gives you these rights:

• Right to know what personal information we collect, use and disclose, and to get a copy.
• Right to delete personal information we collected from you, subject to legal exceptions.
• Right to correct inaccurate personal information.
• Right to opt out of sale or sharing. We don't sell personal information or “share” it for cross-context behavioral advertising, and we haven't done so in the past 12 months. We have no actual knowledge of selling or sharing information about consumers under 16.
• Right to limit use of sensitive personal information. We use sensitive personal information (account login credentials, and health information such as injuries, body measurements and wellness check-ins) only to provide the Service you request and for other purposes the CCPA permits. We don't use it to infer characteristics about you.
• Right not to be discriminated against for using these rights.

Categories we collected in the past 12 months

• Identifiers (name, email, account ID, Stripe customer ID, random visitor ID). Collected from you, Stripe and your browser. Used for accounts, billing and referral counting. Disclosed to Supabase, Stripe and Cloudflare.
• Customer records (Cal. Civ. Code § 1798.80: name, email, billing records). Collected from you and Stripe. Used for billing and support. Disclosed to Supabase and Stripe.
• Characteristics of protected classifications (age, sex). Collected from you. Used to personalize your plan (for example nutrition estimates). Disclosed to Supabase.
• Commercial information (plan, subscription and payment history). Collected from Stripe. Used for billing, access and partner payouts. Disclosed to Supabase and Stripe.
• Internet or network activity (session and request logs, referral clicks). Collected from your browser. Used for security, sign-in and partner attribution. Disclosed to Cloudflare and Supabase.
• Audio, visual or similar (videos, voice notes and meal photos you save or scan). Collected from you. Used to run the features you use. Disclosed to Supabase, and to OpenAI for meal photos only.
• Sensitive personal information (login credentials; health data such as injuries, pain area, weight, body fat, measurements, sleep, check-ins and allergies). Collected from you. Used to provide the Service. Disclosed to Supabase, and to OpenAI for limited fields (see Section 3).
• Inferences (readiness scores, training level, projected progress). Derived from your logs. Used to personalize your plan. Disclosed to Supabase.

How to use your rights

Email support@440fb.com with the subject line “California privacy request.” We'll verify your request by matching it to your account email. You can use an authorized agent, who must show us your signed permission.

“Shine the Light” (Cal. Civ. Code § 1798.83): we don't share personal information with third parties for their own direct marketing. For retention, see Section 6.

Some states, including Washington under its My Health My Data Act, have laws protecting “consumer health data.” Much of what you log, such as weight, body measurements, injuries, sleep and soreness, may count as consumer health data. We collect it only to provide the training features you request. We don't sell it, and we share it only with the service providers listed above. You can request access to it or deletion of it at support@440fb.com.

• 440 Football is for people 13 and older. We don't knowingly collect personal information from children under 13. If we learn we have, we'll delete it.
• Ages 13 to 17: teens may use the Service only with a parent's or guardian's permission, and a parent or guardian must buy the subscription. Parents and guardians can ask to review or delete their teen's data at support@440fb.com.
• California minors: if you're under 18 and live in California, you can ask us to remove content you posted (Cal. Bus. & Prof. Code § 22581). Nothing you add to 440 Football is public.

We're based in the United States, and our providers process data in the United States. The Service is intended for users in the United States. If you use it from another country, your information will be transferred to the United States.

If we update this policy, we'll change the “Last updated” date. For material changes, we'll notify you by email or in the app before they take effect.

Lumon Studios
Email: support@440fb.com