Version 2026-10-21
Account information. Name, email address, role, the academy or player you are connected to, and the language you choose for the notes we write for you. A coach may also keep a phone number on their account, optional and theirs to change, so their academy has a second way to reach them; it is shown only to that academy's director and is never given to families or to any other institution. Passwords are handled by our authentication provider and are never visible to us.
The player's own details. The player's name, date of birth, team and position, and a photo if the academy adds one — entered by the academy or the family to enrol the player and place them on a team.
Training records. Sessions logged by coaches: dates, durations, session types, drill descriptions, and the coach's own written framing. Sessions logged by parents: play and recovery that happens outside the academy.
Voice recordings and their transcriptions. Coaches may log sessions and match observations by speaking rather than typing. Section 4 covers this in full, because it is the most sensitive thing we handle.
Match and participation records. Fixtures, appearances, minutes played, positions, attendance, and event responses.
Assessments and observations. Trimester and monthly reports, coach observations, notes written for families — including the notes Corpus, Engova's AI, writes about each training and game (section 4) — and parent-logged observations.
Wellbeing and recovery answers. From U13 up, after each game the player answers a short check-in in the family's account: how hard the game was (the session's perceived exertion, often called RPE), how tired, how sore and how stressed they feel, and how badly they slept, each on a 1-to-10 scale, and whether anything hurts, with an optional note that goes to the coach as a flag. Through the week, a parent can answer short recovery questions: sleep quality, eating, energy, rest days and, from U9 up, whether the player reflected on their practice. Both are part of the player's developmental record, which the parent holds (Terms, § 5). The family sees them, and so do the coaches and director of the team the game or week belongs to, who use them to look after the player's recovery and training load. The platform agent can read the game answers when a coach asks about a player, and our engine uses the weekly answers in its measure of recovery. They are never used for advertising.
Billing and registration. Where an academy charges its families through the platform: the plan and price each family pays, any discount or scholarship, and whether each payment went through. Card numbers go to Stripe directly and never reach us. Where an academy asks families to sign its papers online — a liability waiver or a medical consent, for example — we keep what was signed: the paper's words as signed, the name typed, the account that signed and when.
Our analysis of the above. From these records our engine derives measures — how training time sorts across the developmental categories we use, how environments classify, how it accumulates over time. These are computed and stored whether or not they are shown to anyone. They are the output of our own analytical model rather than information you or your academy gave us, and section 8 explains how that affects what an export contains.
Conversations with the agent. Families and coaches can both ask questions of the platform agent. The messages exchanged are stored so a conversation can be returned to — a parent's in the parent portal, a coach's alongside the groups they hold. A coach's conversation also stores the figures the answer referred to, so that reopening an old answer shows the numbers it was talking about. Section 7 says how long we keep them.
Messages in the chat. Families, coaches and the director can message each other inside the app: a team's family room, the academy's Announcements (the director writes, every family reads) and its coaches' room, groups of staff, and a direct conversation between a family and a member of staff. Parents cannot message other parents directly and cannot create rooms. We keep the messages, pictures and files sent there with the conversation they belong to; pictures and files are stored privately and opened only through links that expire.
Park rooms (Engova Streets). A family that checked in at a park joins that park's room, where families who checked in there — from any academy — arrange for their children to play. Only the adult's name is shown there, never a child's name or team, and no coach or director is in the room. A room can hold a "Who's coming?" card and polls.
Technical data. Device tokens for push notifications, and error reports when something breaks. Error reports are scrubbed of personal information before they leave the device.
What we do not collect. No biometric identifiers of any kind — no heart rate, no GPS tracking, no device-tracked sleep, no facial recognition, no fingerprints. Not from adults, and not from children. This is an architectural commitment, not a current setting.
Two optional features use Apple Health and the phone's location on the device itself:
Apple Health (a coach's Apple Watch). If a coach allows it, Engova's Apple Watch app records the trainings and games the coach runs as the coach's own workouts in Apple Health, and reads the coach's live heart rate only to show it on the watch while a session runs. It stays on the coach's devices and in Apple Health: Engova never receives or stores it, never uses it for advertising, and never shares it. A coach can turn it off in the watch app's Settings or in Apple Health.
Location on a parent's iPhone (Engova Streets). If a parent turns on park-time noticing, the iPhone app watches the areas around the parks already mapped in the app, using the phone's region and visit monitoring, and offers a pre-filled check-in to confirm or dismiss. Locations, region events and visits stay on the phone, and any visit away from a mapped park is discarded there. Engova receives nothing until the parent confirms. A confirmed check-in, like one typed by hand, records the park, the day, the arrival time and how long the visit lasted. Noticing can be turned off at any time in the iPhone's Settings, under ENGOVA, then Location.
To operate the platform: to record training, compute developmental measures, produce reports and the notes families read, carry messages between families and their academy's staff, keep the park rooms within their rules (section 4), send notifications — for example, that a note about your player's training is ready, or that a message has arrived — process the payments an academy collects through the platform, and keep the service running and secure.
We do not sell personal data. We do not share it with advertisers. We do not use children's data to build advertising profiles, and we do not use it to train anyone's general-purpose language models — see section 4.
We use the following companies to run the platform. Each is bound by an agreement limiting them to processing data on our instructions.
This list is part of the policy. If we add a provider that receives personal data, we update it and notify account holders under section 12.
Coaches can log a session or a match observation by speaking. Those recordings are often about named children. We treat them accordingly.
We do not store the audio. A recording stays on the coach's own device until the log it belongs to has been safely recorded — so that losing signal cannot lose what he said — and it is deleted as soon as that is done. It passes through our servers only to reach the transcriber, and is never saved there or written to our database. Our transcription provider holds a copy briefly for its own abuse monitoring — currently up to thirty days — and then deletes it.
The transcription is stored alongside the session it belongs to, as the academy's record of how it designed and delivered that training. The coach's raw words are the academy's material, not part of a player's exportable record — what reaches a family is the assessment their coach writes for them, not the working description of the drill.
The transcription is processed by a language model to derive the structural classification of the session — what kind of training it was, what developmental stimulus it carried. The model returns that classification; it does not make judgments about the player.
Conversations with the agent are also processed by a language model in order to respond. A parent's conversation is scoped to the players on their own family account: nothing another family has logged, and no other child's assessment, enters it. A coach's is scoped to the groups they hold — the same boundary their own screens enforce, applied by the database rather than by the agent, so a question about a group they do not hold is refused rather than answered.
Notes written for families. When an academy turns it on, Corpus, Engova's AI, writes the note a family reads about each training and game, from the coach's record of that day and in the voice the academy chose. Every player's name is removed from the record before the model reads it, and each note is checked before any family sees it: it names no player and says nothing the record does not hold. A family that chose Spanish reads it in Spanish.
The park rooms are read by AI — and nothing else in the chat is. Corpus, Engova's AI, reads the text of each message sent in a park room, after it is sent, against the four rules every family agrees to when it joins (Terms, section 4). It never reads a picture, and it never reads a message in an academy's rooms or in a direct conversation. It receives the message's words alone — no name and no account information. A message that clearly breaks a rule is hidden for everyone and its author is told which rule; a reading that is not clear acts on nothing. Each reading — whether it found a breach, and the words it pointed to — is kept with the message for Engova's review. Every hide, warning, suspension and ban is a record Engova can review, and the family may ask for a second look; an act Engova overturns restores the message.
Talking to the agent out loud. Coaches and directors can also talk to the platform agent out loud. That conversation's audio goes from their device directly to our voice provider, which listens and speaks the agent's answers; it never passes through our servers and we never store it. The provider keeps it for its own abuse monitoring for up to thirty days, then deletes it. We keep a written record of what was said, as part of the conversation, for as long as conversations with the agent are kept (section 7).
Your data is not used to train general-purpose models. Anthropic's commercial terms prohibit it outright. OpenAI does not train on anything sent through its API unless the account holder opts in to share it, and we have not.
This is the section most worth reading closely, because the answer is different for each party.
An academy sees its own contribution and nothing else. Its coaches and directors see the sessions it ran, the players enrolled with it, and the assessments its own coaches wrote. This is enforced in the database, not merely in the interface. An academy cannot see another academy's data, even when both work with the same player.
A parent sees their own player's whole picture. That includes contributions from every academy the player is enrolled at, combined into one view, alongside anything the parent has logged themselves. This combined view exists for the family only. No academy has it.
An academy's front desk sees what registering a family takes. Where an academy has a front desk, its staff see that academy's players and the contact and billing details of their families, to register and reach them. A family's billing status is seen by its academy's director and front desk; it never appears on the player's record. When the director or a team's coach shares one of the academy's payments in the chat, that team's coaches and the director see which families have paid it; the director may also share a family's own bill in a direct conversation with that family, which only they and the director read.
Other families see nothing of a player's record. A parent sees their own player. Not their teammates, not the rest of the age group.
In the chat, families see what is written to them. In a team's family room the families of that team read each other's messages under the adult's name; on a payment shared there, each family sees how many families have paid — never which — and the names of the families who said they are going. In a park room, families from any academy who checked in at that park read each other's messages under the adult's name only — never a child's name or team.
No outside institution sees an identified player without the parent's consent. No club, scout, recruiter, college program, or outside platform receives access to an identified player's record unless that player's parent has affirmatively consented, for that player, to that access — revocable at any time. Silence is not consent, and neither is continued use of the platform.
De-identified aggregates. We may produce combined statistical views describing the quality of developmental environments across a geographic area, assembled with identifying information removed, and we may license those to institutions. These describe regions and conditions, never individuals. We do not attempt to re-identify anyone within them and do not permit others to.
Players are minors. Several regimes apply, and they converge on the same architecture:
We do not knowingly collect personal information directly from a child under 13 without their parent's consent.
Where a parent has not set up an account. A player may be enrolled and logged before their parent has an account, or without them ever creating one. In that case the academy acts under the authority a parent grants it when they enroll their child — the same basis on which a school may keep records about a student.
That authority is narrow. It covers logging and analyzing the training the academy delivers, for the developmental purpose the family enrolled for. It does not extend to any other use. It does not make the record the academy's. And it does not reduce the rights in section 8, which a parent holds whether or not they have ever logged in.
We tell them the record exists. A parent without an account is entitled to know that a record about their child is being kept, what it contains in general terms, that they may have a copy, and that they may ask for it to be deleted. That notice is delivered at enrollment through the academy, and directly by us wherever we hold contact details for the family.
A developmental record is longitudinal by design. Its value is that it accumulates — a record covering a decade says something no snapshot can. So for as long as anyone is still connected to a record, we keep it, and we do not expire it on a timer.
While someone is connected. A record stays as long as the player is enrolled at any academy on the platform, or a parent holds an account for them, or there is activity on it. There is no time limit, because the purpose has none.
When no one is connected. If a player has no active enrollment anywhere, no parent account, and no activity for three years, the record becomes dormant. At that point we contact the parent — or the player themselves, if they have reached the age of majority — to tell them the record exists, offer them a copy, and ask whether they want it kept or deleted. If we receive no answer within a reasonable period, we delete it.
We contact rather than delete silently: a family should have the chance to keep the record before it goes.
De-identified aggregates are unaffected. Once information has been de-identified and combined into the statistical views described in section 5, it no longer describes any individual, and deleting a personal record does not reach back into it.
Operational audit logs — up to 90 days. These record changes to important tables for security and incident recovery, and they contain copies of the data that changed, including developmental records. They purge automatically on a rolling basis, and a deletion request under section 8 covers them too.
Conversations with the agent — 180 days, counted from the last time the conversation was used rather than from the day it was started. A conversation holds the question, the answer, and the figures the answer referred to; deleting it removes no underlying record, and the same question can be asked again. They purge automatically on a daily schedule, and a parent can delete any of their own conversations from the portal at any time.
Messages in the chat — kept with their conversation, pictures and files included. A family that leaves an academy keeps its history there; a member of staff who leaves keeps nothing. Hiding a message does not erase it from the room: it keeps its place and reads a sentence instead. When Corpus or two families hid a park room message, its original words and picture are kept with the record of that act, so a second look can restore them; a message its author deleted keeps only its place. Deleting an account removes the messages it sent (section 8).
Voice transcriptions — retained with the session they describe. An automatic expiry is planned; until it is in place, they stay with that session.
Notes written for families — kept with the training or game they describe, and rewritten if the coach's record of it changes.
Deleted data — removed from live systems on request, and from backups as those backups age out on their normal cycle.
You may access your data, correct it, export a machine-readable copy, delete it, and withdraw any consent you previously gave.
Export is free, and never conditioned on a subscription. We provide one free export per semester, as a machine-readable file reflecting the record as it stands when the file is generated. Requests beyond that, or repetitive or excessive requests, may be declined or charged at cost.
An export contains the record of what happened: sessions with their dates, durations and academies, attendance, match participation, the assessments and notes your player's coaches wrote, and anything you logged yourself.
It does not contain our analysis of that record — the developmental categories we sort training into, the environment classifications, the measures our engine derives, or anything internal to the model. Those are our analytical framework rather than facts about your player. See Terms of Service, section 5.
Exercise these with us directly, at privacy@engova.app. You do not need your academy's permission and do not have to go through them. An academy cannot withhold, delay, or condition a family's access to their own player's record.
You do not need an account. If your child is enrolled at an academy using the platform but you have never set up an account, write to us anyway. We will verify that you are the player's parent, and then every right above applies to you unchanged.
We respond within 30 days.
When a player reaches the age of majority, these rights pass from their parent to them.
Encrypted connections throughout. Row-level security policies in the database, so access limits are enforced where the data lives rather than in the interface. Role-based access control. Passwords and payment details handled by specialist providers and never stored by us.
No system is perfectly secure, and we do not claim otherwise.
If personal data is exposed in a way that creates a real risk to anyone affected, we will notify the affected account holders and the relevant authorities without undue delay, and tell you what happened, what was involved, and what we are doing about it. Where children's data is involved, we notify the parents directly.
Data is processed and stored in the United States. Where someone uses the platform from outside the U.S., using it involves transferring their data there, under the safeguards our agreements with our providers require.
We will notify every account holder — parents included, not only academy administrators — of any material change: a new category of data, a new provider receiving personal data, a new purpose, or any change to sections 5 or 8.
Questions, or to exercise any right in section 8: privacy@engova.app