PRIVACY POLICY

1. INFORMATION WE COLLECT

We collect information you provide directly when creating an account and using our Service:

• Account Information: Your name, email address, and encrypted password when you register.
• Payment Information: Payment details are processed securely by Stripe. We do not store your credit card number, CVV, or full card details. We only retain your Stripe customer ID for transaction reference.
• Usage Data: We may collect information about how you interact with the Service, including workout progress, pages visited, and feature usage.

2. HOW WE USE YOUR INFORMATION

We use the information we collect to:

• Provide, maintain, and improve the Service
• Process payments and manage your account
• Send password reset emails and account-related notifications
• Track your training progress and provide personalized features
• Respond to your requests and support inquiries
• Protect against fraud and unauthorized access

3. PAYMENT PROCESSING

All payment processing is handled by Stripe, a PCI-compliant payment processor. When you make a purchase, your payment information is transmitted directly to Stripe's secure servers. We never see, store, or have access to your full credit card details. For more information about Stripe's security practices, please visit Stripe's Privacy Policy.

4. COOKIES AND SESSION DATA

We use essential cookies to maintain your login session and authenticate your account. These cookies are necessary for the Service to function properly and cannot be disabled. We use a secure, HTTP-only session cookie that contains an encrypted token identifying your account. This cookie expires after one year or when you log out.

5. EMAIL COMMUNICATIONS

We use Resend as our email service provider to send transactional emails, including password reset links and account confirmation emails. We do not send marketing or promotional emails unless you explicitly opt in. You can manage your email preferences through your account settings.

6. DATA SECURITY

We take reasonable measures to protect your personal information:

• Passwords are hashed using bcrypt with a cost factor of 12
• Session tokens are signed with JWT (HS256 algorithm)
• All data is transmitted over HTTPS
• Payment data is handled exclusively by Stripe's PCI-compliant infrastructure
• Password reset tokens expire after 1 hour and can only be used once

7. DATA RETENTION

We retain your account information for as long as your account is active. If you wish to delete your account and associated data, please contact us. We will delete your personal information within 30 days of your request, except where we are required to retain it for legal or legitimate business purposes.

8. THIRD-PARTY SERVICES

Our Service integrates with the following third-party services:

• Stripe: Payment processing
• Resend: Transactional email delivery
• YouTube: Embedded training video content

Each of these services has their own privacy policies governing the use of your data. We encourage you to review their respective privacy policies.

9. CHILDREN'S PRIVACY

Our Service is designed for hockey players and may be used by minors with parental consent. We do not knowingly collect personal information from children under 13 without parental consent. If you believe we have collected information from a child under 13 without consent, please contact us so we can promptly delete the information.

10. YOUR RIGHTS

You have the right to:

• Access the personal information we hold about you
• Request correction of inaccurate information
• Request deletion of your account and personal data
• Change your password at any time through your account settings

11. CHANGES TO THIS POLICY

We may update this Privacy Policy from time to time. We will notify you of significant changes by posting the updated policy on this page with a revised "Last updated" date. Your continued use of the Service after changes constitutes acceptance of the updated policy.

12. CONTACT

If you have questions about this Privacy Policy or wish to exercise your data rights, please contact us through the website.