Privacy Policy

1. Information We Collect

1.1 Information You Provide

• Account credentials: email address (used as your username), a hashed password (never stored in plain text), and optionally authentication details for two-factor authentication (TOTP secrets) or WebAuthn/passkey registration.
• Profile data: your display name.
• Organizational data: clubs, teams, and drills you create; folder names; session titles and tags.
• Content: the full contents of each drill/session you design - player positions, movement paths, timing data, annotations, and any text you enter into the pitch editor (markdown notes, text labels, etc.). This is stored as structured JSON within PostgreSQL.

1.2 Information We Collect Automatically

• Login metadata: IP addresses and timestamps for authentication events (login, password reset requests, email change confirmations).
• Usage statistics: session open counts and last-opened timestamps to power your "recent" and "favorite" features.
• Cookies and auth tokens: see Section 5 below.

1.3 Third-Party Services

We self-host our own infrastructure, including the PostgreSQL database. We do not use any third-party hosting or database provider, and we do not use any website analytics service.

We do not sell your personal data. We do not place advertising, tracking, or analytics cookies.

2. How We Use Your Data

• Authentication: to verify your identity and maintain your logged-in session via encrypted auth tokens stored in cookies.
• Service delivery: to store, retrieve, and display your drill designs; power real-time collaboration between coaches and teams via WebSocket connections; enable sharing of sessions between users with view-only or editing permissions.
• Organization: to support clubs, teams, folder hierarchies, drill templates, and session favorites.
• Communication: to send you password reset links (valid for 1 hour), email change confirmations, and other account-related messages via SMTP.
• Export: to generate PDF exports of your drill designs for offline use.

3. How We Share Your Data

3.1 Between Users

• When you share a session with another user (via account or club/team membership), they gain access to that session's data according to the permission level you set:
  • View-only - the other user can see but not modify your drill.
  • Can-edit - the other user can modify your drill; changes are visible in real-time to all collaborators.
• When you join a club or team, coaches and administrators of that organization may have access to sessions linked to that club/team if you enable team-wide editing.

3.2 Public Share Links

When you generate a share link (https://app.sessionmatrix.com/share/<id>), anyone with that URL can view the session as a read-only copy - without logging in. The link remains active until you revoke the share, or you delete the session.

We do not monitor, review, or moderate content on public share links.

3.3 Legal Requirements

We may disclose your data if required by law, subpoena, or court order - or to protect the safety of our users or the public.

4. Data Retention

• Account data: retained until you delete your account.
• Sessions and drills: retained until you delete them. Shared sessions remain accessible to collaborators until revoked or deleted.
• Password reset tokens: expire after 1 hour and are automatically purged.
• Email change tokens: valid until the confirmation link is used or the token expires.
• Pending login tokens (TOTP bridge): valid for 5 minutes, then automatically deleted.
• Auth tokens (login sessions): valid for up to 90 days from creation; expired tokens are purged on subsequent API requests.
• Passkey credentials: retained until you delete your account or remove the passkey.

5. Cookies and Auth Tokens

SessionMatrix uses cookies solely for authentication:

• tp_token: an opaque random token that proves you are logged in. It is stored as an HTTP cookie, sent with every request to SessionMatrix, and validated against our database. The token expires after 90 days. There are no tracking, analytics, or advertising cookies.

If you access SessionMatrix from the European Economic Area (EEA), your consent is not required for this cookie because it is "strictly necessary" for providing the service you have requested - authentication is essential to using the application.

6. Data Security

• Passwords are hashed using scrypt with per-user random salts - never stored in plain text.
• TOTP secrets are encrypted using AES-256-GCM at rest.
• Auth tokens are opaque random values (not JWTs) and can be revoked server-side without key rotation.
• Passkey credentials follow the WebAuthn standard for phishing-resistant authentication.
• All data in transit uses HTTPS (TLS).

We cannot guarantee absolute security - no system is immune to attacks or breaches - but we use industry-standard practices to protect your data.

7. Your Rights

Depending on your jurisdiction, you may have the following rights:

• Access: request a copy of the personal data we hold about you.
• Correction: update your email address via our account settings page (you will confirm the change via a link sent to the new address).
• Deletion: request deletion of your account and associated data by contacting us at [email protected] (there is currently no self-service "delete account" option in account settings). Once processed, your sessions, drill templates, passkeys, TOTP secret, backup codes, and auth tokens are permanently removed. Clubs or teams you belong to are not deleted - only your membership in them is removed; if you are the sole administrator of a club or team, it will be left without an administrator rather than deleted or reassigned.
• Portability: request export of your account data in a machine-readable format.
• Objection/opt-out: object to processing where we rely on legitimate interest; opt out of any non-essential communications.
• GDPR-specific (EEA users): right to lodge a complaint with a supervisory authority; right to restrict processing; right to data portability.

To exercise any of these rights, contact us at [email protected].

8. Children's Privacy

SessionMatrix is intended for coaches and sports professionals. We do not knowingly collect data from children under the age of 13 (or the applicable age in your jurisdiction). If we learn we have collected data from a child without lawful consent, we will delete it promptly.

9. International Data Transfers

Your data may be processed in countries other than your country of residence. We take appropriate safeguards to ensure your data is protected in accordance with this Privacy Policy - typically through standard contractual clauses or adequacy decisions where applicable under GDPR and similar laws.

10. Changes to This Policy

We will notify you of material changes by posting the updated policy on this page and, where practical, via email or in-app notice. Your continued use after changes takes effect constitutes acceptance.

11. Contact

For privacy-related questions or requests, contact us at:

Email: [email protected]