Privacy Policy

1. Who we are

Harvu ("Harvu", "we", "us", or "our") operates the private sports coaching platform available at harvu.app and harvu.ai. We provide sports coaches with tools to document sessions, track athlete development, and communicate with players and their families.

Contact: team@harvu.app
Website: harvu.app / harvu.ai
Location: Vancouver, British Columbia, Canada

2. What this policy covers

This Privacy Policy explains how we collect, use, store, and protect personal information when you use Harvu as a coach, player, or parent. It applies to:

• Our website at harvu.app and harvu.ai
• Our web application
• Our Progressive Web App (PWA)
• All related services

3. Information we collect

3.1 Information you provide directly

Account information:

• Name and email address
• Date of birth (used for age verification and minor protections)
• Sport and team or organisation
• Profile photo (optional)
• Bio (optional)
• Location (optional)

Coaching content (coaches only):

• Session notes and observations
• Voice recordings submitted for transcription
• Video clips uploaded to sessions
• Practice accomplishment records
• Goals set for players
• Drill library entries

Communications:

• Messages sent through the platform
• Support requests sent to us

Payment information (coaches on Pro plan):

• Billing name and address
• Payment card details are processed by Stripe and never stored by Harvu

3.2 Information collected automatically

When you use Harvu we automatically collect:

• IP address
• Browser type and version
• Device type and operating system
• Pages visited and features used
• Time and date of activity
• Session duration

3.3 Information from third parties

Our service providers process data on our behalf:

• Supabase: authentication and database services
• Stripe: payment processing
• Deepgram: voice and video transcription
• Anthropic (Claude): AI-generated session summaries
• Resend: email delivery
• Vercel: hosting and infrastructure

We do not receive your payment card details from Stripe. We receive only a payment confirmation and the last four digits of your card for display purposes.

4. How we use your information

We use your information to:

a) Provide the service:

• Create and manage your account
• Connect coaches with their players
• Store and display session records
• Generate AI session summaries
• Deliver email notifications

b) Improve the service:

• Understand how features are used
• Fix bugs and technical issues
• Develop new features

c) Communicate with you:

• Send session notifications to players when coaches share content
• Send monthly parent reports
• Send platform updates and support responses

d) Process payments:

• Bill Pro plan subscriptions
• Process parent add-on fees

e) Legal compliance:

• Meet our obligations under COPPA, GDPR, PIPEDA, and other applicable laws
• Maintain consent records for minor users

We do not:

• Sell your personal information to anyone
• Show advertising inside the app
• Use your data to train AI models
• Share your data with third parties except as described in Section 5
• Use session content for any purpose other than delivering the service to you

5. How we share your information

5.1 With your consent

When a coach marks a session as "shared", the session summary and practice notes become visible to the player. Coaches control this on a per-session basis.

When a coach enables the parent add-on for a player, a monthly summary is made available to the parent email address on file.

5.2 Service providers

We share information with trusted service providers who help us operate Harvu. All service providers are bound by data processing agreements and may only use your data to provide services to us.

5.3 Legal requirements

We may disclose information if required to do so by law, court order, or governmental authority, or if we believe disclosure is necessary to protect our rights, your safety, or the safety of others.

5.4 Business transfers

If Harvu is acquired or merges with another company, your information may be transferred as part of that transaction. We will notify you before this occurs and give you the opportunity to delete your account.

We do not sell, rent, or trade your personal information.

6. Children's privacy (COPPA and GDPR)

6.1 Age restrictions

Harvu does not allow users under the age of 13 to create accounts. If we learn that a user is under 13, we will immediately delete their account and all associated data.

For users aged 13 to 15 (or up to the applicable digital age of consent in their country), we require verified parental consent before the account is activated. For users aged 16 to 17, we recommend parental consent depending on the user's country of residence.

6.2 Information collected from minors

For users under 18 we collect only what is necessary to provide the service:

• Name, email address, and sport
• Session records from their coach
• Date of birth (to verify age)

We do not display advertising to minor users. We do not share minor user data with advertisers or data brokers. We do not collect more information from minors than is necessary for the coaching service.

6.3 Parental rights (COPPA)

Parents and guardians of users under 13 have the following rights:

• Right to review: Request a copy of all personal information we hold about your child by emailing team@harvu.app
• Right to delete: Request deletion of your child's account and all associated data by emailing team@harvu.app. We will complete deletion within 30 days.
• Right to refuse: Withdraw consent and refuse further collection or use of your child's information at any time.
• Right to notification: We will notify you of any material changes to how we handle your child's information.

To exercise any of these rights, email team@harvu.app with the subject line "Parental Rights Request" and include the child's name and the email address used to register.

6.4 Consent record keeping

We maintain records of all parental consent including the date and time consent was given, the version of the consent text agreed to, and the parent's IP address and device information at the time of consent. These records are retained for legal compliance purposes.

7. Your rights

7.1 All users

• Right to access: Request a copy of the personal information we hold about you.
• Right to correction: Request correction of inaccurate information.
• Right to deletion: Request deletion of your account and personal data. Some data may be retained for legal compliance.
• Right to data portability: Request your session data in a portable format.

7.2 EU/EEA users (GDPR)

All of the above, plus:

• Right to restrict processing
• Right to object to processing
• Right to withdraw consent at any time
• Right to lodge a complaint with your national data protection authority

Legal bases for processing:

• Contract performance: to provide the coaching platform service
• Legitimate interest: to improve the service and prevent fraud
• Consent: for AI processing of voice and video content
• Legal obligation: for COPPA compliance and financial records

7.3 California users (CCPA/CPRA)

You have the right to know what personal information we collect and how we use it, to delete personal information, to opt-out of sale of personal information (we do not sell personal information), and to non-discrimination for exercising your rights.

7.4 Canadian users (PIPEDA)

You have the right to access your personal information, challenge its accuracy, withdraw consent (subject to legal or contractual restrictions), and file a complaint with the Office of the Privacy Commissioner of Canada at priv.gc.ca.

To exercise any rights email team@harvu.app. We will respond within 30 days.

8. Data retention

• Account data: Retained while account is active, plus 90 days after deletion request
• Session records: Retained while account is active, plus 90 days
• Voice and video recordings: Deleted after transcription is complete. We do not store raw recordings long-term.
• Payment records: 7 years (legal requirement)
• Parental consent records: Retained indefinitely for legal compliance, even after account deletion
• Unverified minor accounts: Deleted after 30 days if parental consent is not received

When you delete your account we will delete your personal data within 30 days except where retention is required by law.

9. Data security

We protect your data using:

• Encryption in transit (TLS/HTTPS)
• Encryption at rest for the database
• Row-level security — users can only access their own data
• Authentication via Supabase Auth
• Regular security reviews
• Access controls limiting which team members can access user data

Coaches can only see data for players they are connected to. Players can only see sessions their coach has marked as shared. Parents can only see the monthly reports for their own child.

If you believe your account has been compromised, contact team@harvu.app immediately.

10. International data transfers

Harvu is operated from Vancouver, British Columbia, Canada.

Canada has been recognized by the European Commission as providing adequate protection for personal data, which means data transfers from the EU/EEA to Canada are generally permitted without additional safeguards under GDPR.

Our service providers are primarily located in the United States. When your data is processed in the United States by our service providers (Supabase, Stripe, Deepgram, Anthropic, Resend, and Vercel), we ensure appropriate safeguards are in place through data processing agreements with each provider.

If you are located in the EU/EEA or UK and have concerns about international transfers, contact us at team@harvu.app.

11. Cookies

We use only essential cookies required for the service to function:

• Authentication cookies (session management via Supabase Auth)
• Security cookies (CSRF protection)

We do not use advertising cookies, third-party tracking cookies, or analytics cookies that track you across other websites.

12. Third-party links

Harvu may contain links to third-party websites. We are not responsible for the privacy practices of those websites and encourage you to review their privacy policies.

13. Changes to this policy

We will notify you of material changes to this Privacy Policy by email to the address on your account, a prominent notice on the app, and for users under 18, direct email to the parent or guardian on file.

Changes take effect 30 days after notification unless required by law. Your continued use of Harvu after the effective date constitutes acceptance of the updated policy.

14. Contact us

For privacy questions, requests, or complaints:

Email: team@harvu.app
Subject for data requests: "Privacy Request"
Subject for parental rights: "Parental Rights Request"
Website: harvu.app / harvu.ai
Location: Vancouver, BC, Canada

We will respond within 30 days.

EU/EEA users may contact their local data protection authority. UK users may contact the Information Commissioner's Office at ico.org.uk. Canadian users may contact the Office of the Privacy Commissioner of Canada at priv.gc.ca.