Legal

Privacy Policy

Last updated: Draft prepared August 24, 2026 — pending legal review, not yet in effect

1. Overview

This Privacy Policy explains what information Finalshot collects through this website and the Finalvision console (together, the "Service"), why we collect it, and what choices you have. It applies to visitors, whitelisted account holders (coaches and staff), and anyone who contacts us through the feedback tool.

The Service does not have open sign-up. Every account is added by an administrator before the person can register, and each program's data is accessible only to that program's accounts and to Finalshot administrators.

Needs from legal: the registered business name and entity type to use throughout this document (currently referred to as "Finalshot").

2. Information We Collect

Account information

To register, an email address must already be on our access whitelist. When you register, we store your email address and a password. Passwords are hashed by our authentication provider before storage — we do not store passwords in plain text and cannot read them. We also store your assigned team and role (for example, coach or admin) and whether your account is active.

Team and program data

Coaches and staff can enter information about their program into the console, which may include athlete names, rosters, match results, rotations, and rally-level statistics. This information is entered by the program's own staff, not collected by us directly from athletes, and is visible only to that program's accounts and to administrators.

Video and movement data

Finalvision processes match footage to estimate player pose and track player and ball position, and to convert those positions into real court coordinates. This processing is performed on footage supplied by the program using the Service.

Needs from legal: pose estimation and movement tracking derived from video of individuals may be treated as biometric or "special category" data under some laws (for example, Illinois' BIPA, Texas' CUBI, Washington's My Health My Data Act, and the EU/UK GDPR). This section should be reviewed against every jurisdiction we operate in before publishing, and may need a separate consent or notice flow, a defined retention period for footage, and specific language here rather than the general description above.

Feature requests and feedback

The feedback tool available to signed-in users records the email address of the account that submitted it and the message itself. We use this only to understand what to build next and do not use it for marketing.

Automatically collected information

We use a small number of cookies required to keep you signed in and to protect password-reset links. We do not use advertising cookies.

We use Vercel Analytics to see aggregate traffic to this site — which pages get visited and roughly how much traffic each gets. It does not use cookies and does not build a profile of you individually; it counts visits, not visitors.

3. How We Use Information

To create and secure your account, and to enforce the access whitelist.
To operate the console: storing, displaying, and processing the data your program enters.
To run the video and movement analysis described above.
To respond to feedback and support requests.
To maintain the security and integrity of the Service, including detecting misuse.

We do not sell personal information, and we do not share it for third-party advertising.

4. Who We Share Information With

We use third-party infrastructure providers to run the Service, currently including Vercel (hosting) and Supabase (authentication and database). These providers process data on our behalf and under their own security commitments; they do not have an independent right to use it.

We do not share program or athlete data with other programs. Administrators can see whitelist and account status across programs in order to manage access.

Needs from legal: confirm whether a formal data processing agreement is in place with each subprocessor, and whether this list needs to stay current on the page (some laws require that).

5. Data Retention and Deletion

We keep account and program data for as long as the account is active. When an administrator revokes someone's access, that person's account is deleted, not merely disabled. Program data entered into the console is retained until the program or an administrator asks us to remove it.

Needs from legal: a defined retention period for raw video/footage specifically (separate from the analysis derived from it), and whether deletion requests must be honored within a specific timeframe under applicable law.

6. Children's Information

The Service is intended for use by coaches, staff, and administrators, who must be adults. Accounts are not created by or for athletes directly. However, program data entered by a coach may describe athletes who are minors (for example, a high school roster).

Needs from legal: whether this arrangement (an adult program entering data that describes minors, rather than collecting it from minors directly) satisfies COPPA and any applicable state student-data or scholastic-records laws, and whether an additional agreement with each program is required before they submit data about minors.

7. Your Rights and Choices

You can review and update your account details after signing in. To request a copy, correction, or deletion of your personal information, contact us using the details below. An administrator can also remove your access at any time, which deletes your account.

Needs from legal: specific rights language for any jurisdiction we serve (for example, GDPR, CCPA/CPRA), including a defined response timeframe and an appeals process if required.

8. Security

Access to program data is restricted to that program's own accounts and to administrators. The database enforces this at the data layer, not only in the application. Passwords are hashed, not stored in plain text, and administrator actions that grant or remove access are limited to a small, explicitly configured list of accounts.

No method of storage or transmission is completely secure, and we cannot guarantee absolute security.

9. Changes to This Policy

We may update this policy as the Service changes. If we make a material change, we will update the date above and, where appropriate, notify account holders.

10. Contact Us

Questions about this policy, or requests regarding your information, can be sent to:

Needs from legal: a real contact email or mailing address to publish here before this page goes live. Placeholder used in the meantime: privacy@[domain].