Privacy
Policy

Who We Are and Scope of This Policy

This Privacy Policy explains how CGMax FFTP — Flag Football Tracker Pro ("FFTP," "we," "our," or "us"), operated by ITCC LLC, handles information in connection with your use of the FFTP web application (the "App") accessible at our website.

By using the App, you acknowledge you have read and understood this Privacy Policy. If you do not agree, please do not use the App.

Information We Collect — and What We Do Not Collect

FFTP is designed with a minimal data footprint. Here is exactly what happens with information when you use the App:

▾ What is stored locally on your device (not transmitted to us)

• Team name and coach name you enter during setup
• Player roster: first names and last initials only (e.g., "Jaxon B.") — never full last names
• Jersey numbers
• Game scores, per-player statistics, and rotation play counts
• Season history, MVP records, and quarter-by-quarter data
• Your app tier selection (Lite or Pro), stored as a local flag — no personal data is transmitted for the Lite tier
• Your selected team colors and app preferences
• Multiple team profiles (team names and roster associations for coaches managing more than one team)
• Per-game attendance records (which players were present or absent for each game)
• Penalty flag counts per game (stored in the game summary, not transmitted)
• Tournament records (bracket format, team names, scores, and champion — stored locally in ff_tournaments)
• Saved plays from the Play Designer (canvas drawings stored as serialized data in ff_plays, up to 20 plays)
• In-game auto-save state (localStorage key: ff_live_game_v1): To prevent data loss when you switch apps or your screen turns off during a live game, the App automatically saves a snapshot of the active game state to localStorage. This snapshot is deleted when the game ends normally (saved to Season History) or when you start a new game. It is retained for up to 24 hours and is used solely to offer a "resume game" prompt on next app open.
• Pro tier status (localStorage keys: ff_pro_v1, ff_license_key): If you have activated a valid Pro license key, the App stores a flag locally indicating your Pro tier is active, along with your license key for re-validation purposes. License key validation is performed by transmitting your key to ITCC LLC's secure backend (hosted on Vercel) where it is checked against your subscription record in our license database (hosted on Supabase). See Section 5 for details on these third-party processors.

Coach Account & Cloud Sync data transmitted to ITCC LLC's backend (Lite & Pro tiers — all users):

Lite account (free, basic sync — one team only):

• Your email address — used to identify your account and send the magic link sign-in email
• Team roster names (first name + last initial format, e.g., "Jaxon B.") and team name
• Team colors and preferences
• Notes and settings associated with your team

Pro account (full sync — all teams): All of the above, plus:

• Season history: game scores, per-player statistics, MVP records, and game dates
• Multiple team profiles and all associated data

This data is stored in ITCC LLC's Supabase database associated with your authenticated user account. It is protected by Row Level Security — only you can access your own data. Cloud sync data persists until you delete your account or request deletion.

Optional: Stat Coach / Co-Coach Realtime Broadcast (Pro tier only, only when the Live Parent Scoreboard session is active):

When you share a Stat Coach link with an assistant coach, game state (roster names, on-field status, scores, quarter) and stat events are transmitted as ephemeral broadcast messages via Supabase Realtime between the primary device and the assistant's device. No data from the Stat Coach feature is written to any database. Broadcasts exist only in memory for the duration of the active session and are discarded when the session ends. The assistant coach's device connects directly to the Supabase Realtime channel using the same 6-character session code — no personal data of the assistant is collected or stored by ITCC LLC.

Optional: Live Sync & Parent View data transmitted to ITCC LLC's backend (Pro tier only, only when you activate this feature):

• Live game scores and per-player statistics (the same data visible to you in-app)
• Team name, opponent name, and game date
• Player roster names (first name + last initial format only)
• Team colors and quarter configuration
• A 6-character session game code used to route parent view requests

This data is transmitted to ITCC LLC's secure backend (Vercel serverless functions) and stored in our Supabase-hosted database. Each live session record expires automatically after 12 hours and is deleted from the database. Your Pro license key is used to authorize write access to the Live Sync endpoint — no other personal data is transmitted beyond what is listed above.

Optional: Cloud Backup data transmitted to ITCC LLC's backend (Pro tier only, only when you activate this feature):

• Season history data (game scores, per-player statistics, MVP records, dates)
• Team name and team identifier
• Player roster names (first name + last initial format only, same as stored locally)

When you use the Cloud Backup feature, this data is transmitted to ITCC LLC's secure backend and stored in our Supabase-hosted database, associated with your Pro license key. One backup is stored per license key — each new backup replaces the previous one. You may delete your cloud backup at any time by contacting cgmaxfftp@itcc.llc.

Terms of Service & Privacy Policy consent record (all users):

• Consent version, timestamp, and license key — stored on our backend to document your agreement to our Terms

What we do NOT collect on our servers (stored locally on your device only, if collected at all):

• Full names, addresses, or phone numbers of players — the App only asks for first name and last initial (e.g., "Jaxon B.")
• Coach-added player photos — when a coach adds a player photo from their device's camera roll via the in-app player photo feature, it is stored exclusively in the browser's localStorage on the coach's device (resized to 120×120px). These photos are never uploaded to our servers. Exception: If a parent/guardian submits a photo via the optional Parent Media Consent Form, that photo is transmitted to and stored in ITCC LLC's Supabase database as part of the consent record — see Section 3A.
• Payment card numbers or full payment details — all payments are processed directly by Stripe, Inc. ITCC LLC never receives or stores your card data
• Precise geolocation data
• Device identifiers, advertising IDs, or behavioral tracking data
• Audio recordings — voice commands are processed entirely by your device's on-device speech recognition engine (the browser's Speech Recognition API). The App receives only text transcriptions of recognized commands; no audio stream is captured or transmitted by ITCC LLC.

Note on email addresses: ITCC LLC collects your email address in the following scenarios: (1) when you purchase a Pro subscription — your billing email is used to send your license key and manage your subscription; (2) when you create your coach account on first use by signing in with Google, Microsoft, or a magic link — your email is stored in our Supabase auth system to identify your account, record your consent, and enable sign-in; and (3) optionally, when you check the box to receive occasional tips and offers from CGMax FFTP at the time of account creation — we store your marketing opt-in preference and may send you infrequent promotional emails. You may opt out of marketing emails at any time using the unsubscribe link in any such email or by contacting us at cgmaxfftp@itcc.llc. Opting out does not affect transactional emails (license delivery, sign-in magic links). Additionally, if a coach uses the optional Parent Media Consent Form feature and submits the form, an email notification is sent to ITCC LLC's team inbox for record-keeping purposes. See Section 3A for full details.

Web server access logs: Like all websites, our web host may automatically log basic access information such as your IP address, browser type, operating system, and pages visited for security and operational purposes. This data is controlled by our web hosting provider under their own privacy policy and is not linked to your coaching data.

No cookies, no trackers: CGMax FFTP does not use cookies, tracking pixels, third-party analytics scripts, or any form of behavioral tracking technology. The App does not set or read browser cookies at any point. All persistent data is stored exclusively in your browser's localStorage and is never transmitted to advertising or analytics platforms. We do not use Google Analytics, Facebook Pixel, or any similar service.

Children's Privacy (COPPA Compliance)

We take the privacy of minors extremely seriously. FFTP is a coaching tool for adults — it is designed to be used exclusively by coaches and adult team staff, not by players or children.

• The App is free to use for any coach — no payment is required for the Lite tier. A free account is required to use the App (all tiers). The Pro tier additionally requires a paid license key validated by the coach.
• The App is designed to capture only first name and last initial of players (e.g., "Marcus T.") — never full last names or any other identifying information during normal gameplay.
• We do not knowingly collect personal information from children under 13 in any form through the App itself.
• Coaches using this App confirm by use that they have obtained appropriate parental or guardian consent as required by applicable law for any coaching activities involving minors.

If you believe a child has submitted personal information through the App in any way, please contact us immediately at cgmaxfftp@itcc.llc and we will take appropriate action.

Parent Media Consent Form & Player Photos

CGMax FFTP includes an optional Parent Media Consent Form that coaches may use to obtain verifiable parental or guardian consent before associating a photo with a player's profile in the App. This form is entirely optional.

Information collected through the consent form:

• Player's first and last name
• Player's age
• Player's jersey number
• Team name and season
• Parent or legal guardian's full name and relationship to player
• Parent or legal guardian's email address — used to send a confirmation copy of the consent record
• Parent or legal guardian's phone number (optional)
• Parent or legal guardian's digital signature (captured as a base64-encoded PNG image)
• Player photo (optional, base64-encoded image) — only if the coach or parent chooses to include one

How this information is used and stored:

• The completed consent form is transmitted via HTTPS to ITCC LLC's Vercel serverless backend (send-consent.js) and stored in ITCC LLC's Supabase database in the parent_photos table. This database record serves as the official, auditable record of parental consent.
• An email notification is simultaneously sent to ITCC LLC's team inbox (cgmaxfftp@itcc.llc) as a backup human-readable copy of the consent record.
• A confirmation email is sent to the parent or guardian's email address (as provided on the form) via Resend, confirming that their consent has been received and recorded.
• Consent records are retained in ITCC LLC's Supabase database for the duration of the applicable sports season and may be retained for up to one year thereafter for legal compliance purposes.
• Coach-side player photos (added by the coach from their device's camera roll) are stored exclusively in the browser's localStorage on the coach's personal device. These coach-side photos are automatically resized to a 120×120 pixel thumbnail. They are never uploaded to any server.
• If a photo is submitted via the Parent Media Consent Form, that photo is transmitted and stored in ITCC LLC's Supabase database as described above, associated with the consent record.

COPPA compliance: This consent form is specifically designed to serve as the verifiable parental consent mechanism required by COPPA (Children's Online Privacy Protection Act) before any player-identifying information (photo) is associated with a minor's profile in the App. Consent is collected directly from the parent or legal guardian, not from the child. Participation is entirely voluntary — a player may fully participate on the team without a profile photo.

How We Use Information

Because FFTP operates locally on your device, we do not "use" your coaching data — we never receive it. The limited purposes for which information is processed are:

• App functionality: localStorage enables the App to save your roster, stats, preferences, team profiles, and attendance records between sessions. This processing occurs entirely on your device.
• Lite tier access: The Lite tier is free — no code or payment is required. A free account is required to access the App. App tier status (Lite vs. Pro) is controlled on your device with no server-side validation for Lite access beyond your account sign-in.
• Pro license validation: When you enter or re-validate a Pro license key, the key is transmitted via HTTPS to ITCC LLC's validation endpoint (hosted on Vercel) and checked against our license database (hosted on Supabase). The response indicates whether your subscription is active. No other personal data is transmitted during this check beyond the license key itself.
• Pro subscription payments: When you purchase a Pro subscription, payment is handled entirely by Stripe, Inc. Stripe transmits a webhook event to our backend confirming a successful payment. We use this event to generate your license key and email it to your billing address via Resend. We store your email address, license key, Stripe customer ID, and subscription status in our Supabase license database solely to manage your subscription. If you have a coach account, your new license is automatically linked to your account at the time of purchase.
• Coach Account & Sign-In (required, all tiers): All coaches — Lite or Pro — must create a free account on first use by signing in with Google, Microsoft, or a magic link email. We create a coach account in our Supabase auth system. Your email and authentication provider are stored to manage your sign-in session, record your consent, and enable cloud sync. We do not store your Google or Microsoft password — authentication is handled entirely by each provider's OAuth flow. Your session is maintained via a JWT token stored in your browser. You may sign out at any time from within the App.
• Cross-Device Cloud Sync (optional, all tiers when signed in): When you are signed in, your coaching data is automatically synced to ITCC LLC's Supabase database. Lite accounts sync basic team data — roster, team colors, notes, and settings — for your one active team. Pro accounts sync all of the above plus full season history and game data across all your teams. Sync uses a "last write wins" model with version tracking. Your data is stored in the coach_data table protected by Row Level Security — no other user can access your data. Sync occurs in the background and does not interrupt your workflow. You may sign out at any time to stop syncing.
• Promotional communications (optional, only with consent): At the time of account creation, you may optionally check a box to receive occasional tips, product updates, and offers from CGMax FFTP. If you opt in, we will send infrequent marketing emails to the address associated with your account. Your marketing preference is stored as part of your coach profile. You may withdraw consent and unsubscribe at any time via the unsubscribe link in any such email or by contacting us at cgmaxfftp@itcc.llc. Opting out has no effect on transactional emails (license delivery, sign-in magic links, support replies).
• Stat Coach / Co-Coach (optional, Pro tier): When you share a Stat Coach link, game state and stat events are transmitted as ephemeral Supabase Realtime broadcasts between your device and the assistant's device. No data is written to any database. Broadcasts are discarded automatically when the session ends. No personal data of the assistant coach is collected.
• Live Sync & Parent View (optional, Pro tier): When you tap "Go Live Now," live game data is transmitted to ITCC LLC's Vercel/Supabase backend and associated with a temporary 6-character session code. This data is made available in read-only form to anyone who opens the parent view link. The session record expires and is deleted after 12 hours. This transmission only occurs while you are actively hosting a session.
• Cloud Backup & Restore (optional, Pro tier): When you use the Cloud Backup feature, your season history (game scores, player stats, MVP records, team name) is encrypted in transit via HTTPS and stored on our Supabase database associated with your Pro license key. One backup per license key is stored. Backups persist until replaced by a newer backup or deleted upon your request. Cloud backups are used solely to allow you to restore your season data on a new device or after clearing browser data.
• Terms of Service consent tracking (all users): When you accept the Terms of Service and Privacy Policy and sign in on first launch, a consent record is stored on our backend. This record includes the consent version, timestamp, your tier (Lite or Pro), your user agent string, and your account email and user ID (linked via your authenticated session). This record allows ITCC LLC to demonstrate that informed, identity-linked consent was obtained for all coaches. If the backend is temporarily unavailable, consent is stored locally on your device and submitted on next sync.
• Photo upload consent logging (Pro tier): Each time a Pro coach taps "I Have Consent — Upload Photo" in the in-app photo consent confirmation prompt, a record is stored on our backend. This record includes your user ID, coach email, license key, team ID, player name, and the timestamp of the confirmation. This log exists solely to document that you, the coach, attested to having parent or guardian consent before uploading a specific player's photo.
• Security and operations: Web server access logs (IP address, browser type, referrer) are used to protect against abuse, diagnose technical issues, and maintain availability.
• Voice command audio feedback (Pro): When you use Voice Stat Logging, the App plays synthesized audio tones (a chime on success, a buzz on failure) using the browser's built-in Web Audio API. This sound synthesis is entirely local to your device — no audio is recorded, captured, transmitted, or stored by the App or by ITCC LLC at any point. The Web Audio API generates tones mathematically; it does not access your microphone for this purpose.
• Communications: If you contact us at cgmaxfftp@itcc.llc, we will use your email address solely to respond to your inquiry.

Data Sharing and Disclosure

We do not sell, rent, or trade any personal information. We do not share your coaching data with advertisers, data brokers, or analytics platforms.

We may disclose information in the following limited circumstances:

• Web hosting (GitHub Pages): The App's static files are hosted on GitHub Pages. GitHub may log basic access information. See GitHub's Privacy Statement.
• Stripe, Inc. (payment processing): Pro subscriptions are processed by Stripe. When you purchase a subscription, Stripe collects your payment details and billing email. Stripe shares with us only your email address, subscription status, and customer ID — never your full card details. Stripe's use of your data is governed by Stripe's Privacy Policy.
• Supabase (auth, license database, cloud sync, Live Sync, Cloud Backup, and consent storage): We use Supabase as our primary backend database and authentication provider. Supported sign-in methods include Google OAuth, Microsoft (Azure Active Directory) OAuth, and magic link email via OTP. The following data is stored in Supabase: your email address and authentication provider (for coach accounts — all users), license key, Stripe customer ID, subscription plan, and subscription status (for Pro subscription management), coach data including rosters, season history, team profiles, and settings (for cloud sync, associated with your user account and protected by Row Level Security), temporary live game data under a session code (expires after 12 hours), season history backups (persists until replaced or deleted on request), Terms of Service consent records for all users (app_consents table — includes consent version, timestamp, tier, account email, and user ID), photo upload consent confirmations for Pro coaches (photo_consent_log table — includes coach user ID, player name, team ID, and timestamp), and parent media consent records (player name, guardian name, guardian email, guardian phone, digital signature, optional photo) submitted via the optional Parent Media Consent Form — stored in the parent_photos table and protected by Row Level Security. Supabase's data processing is governed by Supabase's Privacy Policy.
• Vercel (serverless backend): Our license validation and webhook processing functions are hosted on Vercel. License key validation requests and Stripe webhook events are processed through Vercel's infrastructure. See Vercel's Privacy Policy.
• Resend (transactional email): We use Resend for all transactional email delivery: (1) Pro license key delivery email sent to the billing address after purchase; (2) Supabase auth magic link OTP emails for sign-in (Resend is configured as our Supabase SMTP provider); and (3) parent/guardian consent confirmation emails sent after a Parent Media Consent Form is submitted. Resend processes your email address and email content for delivery purposes only. See Resend's Privacy Policy.
• Legal requirements: We may disclose information if required to do so by law, court order, or government regulation, or to protect the rights, safety, or property of ITCC LLC or others.
• Business transitions: In the event of a merger, acquisition, or sale of ITCC LLC or its assets, any data we hold may be transferred as part of that transaction. We will notify affected users if this occurs.

Data Storage, Retention, and Deletion

All coaching data is stored in your browser's localStorage on your own device. ITCC LLC does not have access to this data and cannot retrieve it.

How to delete your data:

• In any browser: go to Settings → Privacy → Clear Browsing Data → Clear Site Data / Local Storage
• On iOS Safari: Settings → Safari → Clear History and Website Data
• On Chrome/Android: Settings → Site Settings → Storage → Find the App → Clear Data
• Uninstalling the App from your home screen will remove the installed cache but may not delete localStorage — follow the steps above to ensure full deletion

To delete your coach account and cloud data (all users): Contact us at cgmaxfftp@itcc.llc with your registered email. We will permanently delete your account, all associated coaching data, and your marketing preference from our database within 15 business days. If you are a Pro subscriber, cancelling your subscription does not automatically delete your cloud data — you must request deletion separately if desired.

Web server access logs are retained according to our hosting provider's standard retention schedules (typically 30–90 days) and are then automatically deleted.

Security

We implement reasonable technical and organizational measures to protect the App and its infrastructure, including HTTPS encryption for all data in transit between your browser and our web server. However, because all coaching data is stored locally on your device, the security of that data also depends on the security of your device and browser.

We recommend:

• Using a device passcode or biometric lock
• Not sharing your Pro license key with unauthorized individuals
• Keeping your browser and operating system updated

No system can guarantee absolute security. If you become aware of a security issue affecting the App, please notify us at cgmaxfftp@itcc.llc.

California Residents — CCPA / CPRA Rights

If you are a California resident, the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA) may afford you certain rights regarding your personal information. In the context of FFTP:

• Right to Know: If you have created a coach account (Lite or Pro) or have a Pro subscription, we hold your email address, license information (if applicable), your synced coaching data, and your marketing preference. We also retain minimal server log data as described in Section 2. You may contact us to request a summary of all data we hold about you.
• Right to Delete: You may request deletion of your account, synced coach data, and license information by contacting us. We will process your request within 15 business days. For server log data associated with your IP address, we will coordinate deletion with our hosting provider.
• Right to Opt Out of Sale: We do not sell personal information. There is nothing to opt out of.
• Non-Discrimination: You will not receive different service or pricing for exercising any CCPA/CPRA rights.

To exercise any California privacy rights, contact us at cgmaxfftp@itcc.llc.

Changes to This Privacy Policy

We may update this Privacy Policy from time to time as the App evolves. When we make material changes, we will update the "Last Updated" date at the top of this page. For significant changes, we will make reasonable efforts to notify active users (for example, by displaying a notice within the App on next access).

Continued use of the App after any changes to this Privacy Policy constitutes acceptance of the updated Policy.

Contact Us