Privacy Policy

1. Introduction

This Privacy Policy describes how BaseCount ("we", "us") collects, uses, and protects your personal information when you use our mobile application and related services. By using BaseCount, you agree to the collection and use of information in accordance with this policy.

2. Information We Collect

We collect the following categories of information:

• Account information: email address, name, user type (coach, parent, athlete, gym owner), and competition level
• Video content: the routines you upload, which are kept privately in your account on the paid plans (Section 7), and the still frames taken from them for AI analysis. Faces in them are not blurred
• Upload consent: each time you upload a video, your confirmation that you have permission from the people in it (and, for anyone under 18, their parent or guardian), with the date and time and the version of the wording you agreed to
• Video details: the date and place a video was filmed, when the file records them (read on your device from the file's header, never from the picture), what the announcer said at the start of the routine, and, for a pasted link, the video's public title. These are used to suggest a title and notes for the routine, which you can change
• Athlete metadata: name, age, position, and photo (when provided)
• Performance data: AI-generated scores, skill assessments, and coaching recommendations
• Coaching chat messages and interaction history
• Coach assignments: when a coach assigns a drill to an athlete on their gym's roster, what was assigned, the due date, and whether and when it was filmed. An athlete is on a gym's roster only when a parent or guardian, or the account that added the athlete, has entered that gym's family code
• Date of birth (to determine whether COPPA applies) and, for users under 13, a parent or guardian's email address
• Device information: device type, operating system and app version
• Usage analytics, while you are signed in: which screens you open and for how long, which buttons and controls you tap (by the control's name, such as "Share score report"), how many minutes the app is actively in use, the hour of day on your device, and product actions such as starting or finishing an analysis, sending a coach message, sharing a score or opening the upgrade page. Each record carries your role, your plan and an age band (under 13, 13–17, 18 or over) — never your date of birth. These logs never contain the content of your videos, anything you type, your chat messages, or web addresses. For accounts under 18 we record only screens and time in use, not taps or other actions

3. How We Use Your Information

We use the information we collect to:

• Provide AI-powered cheerleading analysis and performance scoring
• Generate personalized coaching recommendations and feedback
• Improve the quality and accuracy of our analysis services, using anonymized data unless you opt out (Section 8)
• Communicate account-related matters, updates, and support responses
• Suggest drills from our fixed drill library that match what an analysis of your own routine found. Drills are matched by the words in the feedback, on your device; nothing is sent anywhere to choose them
• Show a gym's owner how the gym's average scores compare with other BaseCount gyms, as a percentile by level. These comparisons are anonymised: they are computed from routines the gym's own coaches analysed, shown only when at least five gyms can be compared, and never name another gym or any athlete. Coaches holding a seat, athletes and parents do not see them
• Review chat transcripts and prompt logs when needed to investigate abuse, safety concerns, or a support request you have made
• Understand which parts of the app are used and where people get stuck, from usage analytics (Section 2), so we know what to improve. Usage analytics are not used for advertising, not sold, and not shared with anyone outside BaseCount

4. Third-Party AI Processing

Analysis is produced by third-party AI services: Google Gemini scores the routine and Anthropic Claude powers the coach and support chat. These services process data according to their own privacy policies.

For videos you upload from your device, still frames sampled across the routine (up to fifty, at reduced resolution) are sent to Google Gemini for scoring. Faces in those frames are not blurred: the people in the video, including children, can be seen by the AI service. That is why every upload asks you to confirm that you have their permission, or their parent's or guardian's. Google processes the frames to return the analysis, under its own terms for its AI service. The chat services receive the text of your messages and the written analysis, never footage.

To suggest a title for an uploaded routine, the first minute of its sound track — audio only, no pictures — may be sent to Google Gemini to transcribe the announcer. It is asked to ignore song lyrics and crowd noise, and the audio is not retained by the service after the transcription. If the video was filmed with a location, the coordinates are sent to OpenStreetMap's Nominatim service to turn them into a town name; nothing else is sent with them.

If you instead analyze a video by pasting a public video link (for example, a YouTube URL), no file is uploaded from your device at all — the AI service accesses that public video directly by reference, and it is analysed as published. That path is for public footage only. A YouTube video is replayed from YouTube itself, inside YouTube's privacy-enhanced player, and is never copied to our storage; a link directly to a video file may be copied into your account's private video library (Section 7).

5. Children's Privacy (COPPA Compliance)

This app may be used to analyze cheerleading routines of athletes under 13. We comply with the Children’s Online Privacy Protection Act (COPPA) and take the following measures:

• We ask for a date of birth at sign-up. Anyone under 13 must also provide a parent or guardian's email address
• We email that parent or guardian a unique confirmation link, valid for 14 days. Until they click it and confirm, the child's account cannot analyze videos or use the coach chat
• We record the date and time, IP address, and browser used to confirm as our record of verifiable consent. The child can resend the email from Settings if it expires
• After confirming, the parent or guardian receives a written confirmation email with a link to withdraw consent at any time; withdrawing immediately switches off AI features for the account
• Parental consent covers everything the account does, including storing the child's videos in the account under Section 7 and any face recognition consented to under Section 6
• Parents and guardians may review their child's data (Settings → Download my data), delete it (Settings → Delete My Account), turn off research use of anonymized data, and refuse further collection at any time
• We never send notifications to an account under 13. Reminders and weekly recaps that the account switches on are emailed to the parent or guardian who gave consent, and only after consent is confirmed (see Section 12)
• Contact us at support@basecount.app for any COPPA-related requests, including revoking consent

6. Faces in Your Videos

• Faces are not blurred. Frames from videos you upload are sent for AI analysis as they are, faces included. You may only upload a video if the people in it — or, for anyone under 18, their parent or guardian — have agreed, and the app asks you to confirm that every time, before anything is sent
• The AI service is asked to describe athletes by position, uniform and number only, never by their facial features, and BaseCount does not use the frames to identify anyone
• Face recognition — matching a consented athlete across videos — is paused. No face is detected, measured or matched in your videos while it is paused. If it returns, this section will say so first, and it will run only for athletes whose parent, guardian or adult self has given explicit, timestamped consent in the app
• Face descriptors already saved with that consent stay stored, only for the athlete it covers, and are not used while recognition is paused
• That consent can be revoked at any time from the athlete’s card, which immediately deletes the stored face descriptor

7. Data Storage & Retention

Account data, analyses and chat are stored on Supabase with encryption at rest. Video files are stored on Cloudflare Stream, our video hosting provider, encrypted at rest, in a private library that has no public links: every playback link is signed, tied to your account, and expires within hours. Your videos are visible to you, to household members you have chosen to link, and — only when you ask for support or we investigate a report of abuse — to BaseCount staff. When you film a drill a coach assigned, the coaches at that gym see that it was filmed and a summary of the result (its title, date, score and written summary), not the video. They are never used for advertising, never sold, and never used to train AI models.

Retention periods vary by plan:

• Video files: 30 days (Individual plan), 90 days (Gym plan); the Free plan keeps the score and the analysis but not the video. When a video reaches the end of its retention period, or you delete the routine, it is removed from Cloudflare Stream within 24 hours and the routine keeps its score and notes
• AI prompt logs: automatically deleted after 90 days. Logs from users who have opted out of research use are tagged and excluded from model improvement, but are kept for the same 90 days for abuse prevention
• Coaching chat transcripts: kept until you delete the conversation or your account. BaseCount administrators can read transcripts to provide support you have requested and to review abuse or safety reports
• Feedback and support conversations: when you send feedback while signed in and talk it through with the support assistant, the feedback and the whole conversation are kept together with your account, along with each change to its status, so BaseCount administrators can read what you asked for and act on it. They are deleted with your account
• Parental consent records: kept for the life of the account as our COPPA verification record
• Usage analytics: automatically deleted after 180 days
• Account data: retained until account deletion is requested

8. Your Rights

You have the right to:

• Access, correct, or delete your personal data
• Download a full export of your data as a JSON file: Settings → Download my data. It includes your profile, athlete profiles, analysis sessions, custom rubrics, chat conversations and messages, feedback, support tickets, subscription records and parental-consent records
• Opt out of research use of your anonymized data: Settings → "Use my anonymized data to improve coaching models". By default we may use de-identified analysis and chat data to improve our coaching models; turning the toggle off stops that for all data collected from then on
• Turn off usage analytics: Settings → "Usage analytics". From then on nothing about how you use the app is recorded; what was recorded before is deleted after 180 days, or at once if you delete your account
• Revoke face recognition consent at any time
• Cancel or change a paid subscription yourself: Settings → Manage billing / cancel opens our Stripe-hosted billing portal. Cancellation takes effect at the end of the current billing period
• Delete your account (Settings → Delete My Account, or via support)

9. Data Sharing

We do NOT sell your personal data. We share data only with the following third parties:

• Cloudflare (Stream), which stores and serves your video files as described in Section 7. Cloudflare does not analyze your footage
• AI processing services (Google, Anthropic) as described in Section 4 — Google receives still frames from your uploads for scoring (faces not blurred) and up to one minute of their audio to transcribe the announcer; Anthropic receives chat text
• OpenStreetMap (Nominatim), which receives only the coordinates a video file records, to name the town it was filmed in
• YouTube, when you replay a routine analyzed from a YouTube link: the video plays in YouTube's privacy-enhanced player, which is subject to Google's privacy policy
• Payment processor (Stripe) for checkout, subscription management and the self-service billing portal
• Transactional email provider (Resend) to deliver the parental-consent email, account notices, and the notification emails you (or, for an account under 13, its parent) have switched on
• Our hosting and database providers (Vercel, Supabase), which store and process data on our behalf
• Your gym, only if you link an athlete to it with the gym's family code or accept the gym's invite: the gym's coaches see the athlete's name and level, the drills they assigned, whether each was filmed, and the result summary described in Section 7. Families linked to a gym, and its coaches, see the gym's season totals by team (for example, routines analysed and hit-zero full-outs); these are totals, never a ranking of athletes. You can remove the link on the Assignments screen at any time, which also removes that athlete's check-ins from the gym
• Your email, if a gym coach invites you to link an athlete to their gym. The coach types it in; we store it with the invite so the app can show you the invite when you sign in with that address, and the gym's coaches can see who they invited. Nothing is emailed. The address is removed from the invite when you accept it; an invite that is not accepted expires after 30 days and is then deleted. Depending on the gym's setting, a link made with the family code may wait for a coach to approve it; until then the coach sees only the athlete's name and level, and you see nothing of the gym

10. Security

We implement industry-standard security measures to protect your data, including:

• End-to-end encryption via HTTPS for all data in transit
• Encryption at rest for all stored data, including video
• Signed, expiring playback links for every stored video — there is no public URL to a routine
• Row-level security (RLS) on all database tables
• API rate limiting to prevent abuse
• Regular security audits

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify users of material changes via email and in-app notification. Your continued use of the app after such changes constitutes acceptance of the updated policy.

12. Notifications and Emails

Every reminder, recap and digest is off until you switch it on in Settings → Notifications. Nothing we send is required to use BaseCount, and none of it is advertising. Marketing email is separate and has its own unsubscribe link.

• What we send: a practice reminder at a time you choose (naming the drills from your last analysis), a weekly progress recap on Sunday evening, and, for parents and guardians in a household, a weekly digest of each linked athlete’s uploads, coach notes and next competition. Each appears in the app’s notification list (the bell), and by email only if you also switch email on
• When we send it: never during your quiet hours, which are 21:00–07:00 in your own time zone unless you change them, and never more than three a day
• Athletes aged 13 to 17: email only if they switch it on; never between 21:00 and 07:00, which they cannot shorten; and never between 08:00 and 15:00 on school days (Monday to Friday, September to May)
• Athletes under 13: nothing is sent to the child. What the account switches on is emailed to the parent or guardian who gave consent under Section 5, and nothing is sent until that consent is confirmed
• What an email contains: the athlete’s first name, upload counts, score changes, drill names, coach notes and competition dates from the account. It is sent through Resend (Section 9) and a record of each send — the kind, the date and the address — is kept with the account and deleted with it
• How to stop it: switch it off in Settings → Notifications, or use the unsubscribe link at the bottom of any notification email, which works without signing in. A parent without an account can stop a child’s emails from that link
• When an idea you shared ships: we may send you a short note saying so. It appears in your notification list, once on your Home screen and in your support history, and — only if we choose to email it — by email: to an adult’s account address, to a 13–17 account only if its email is switched on, and for an account under 13 only to the parent or guardian who gave consent, never to the child. It counts toward the three a day; because it is a reply we send by hand, it is not held for quiet hours

13. Contact

If you have any questions about this Privacy Policy, please contact us at: