Privacy Policy

1. Who We Are

KAIROS is an AI-assisted sports coaching platform operated from Ontario, Canada. We are subject to PIPEDA, Canada's federal privacy legislation.

An individual is accountable for privacy compliance and answers requests at the address at the bottom of this page.

2. Information We Collect

• Account: first name, last name, email, role (coach, parent, athlete, club director), language, and authentication credentials handled by Firebase Auth.
• Assessment answers: responses to the behavioral questionnaire, the reception channel, the motivation profile, and the stability/adaptability section.
• Athlete profile: first and last name, date of birth or age, gender, sport, position, height, weight, dominant side, and the AI-generated behavioral analysis.
• Weekly wellness check-ins: sleep quality, mental energy, injury flag and accompanying note, weekly goal. This data often concerns a minor.
• Espace Parent: the parent's own behavioral profile (6 questions) and a free-text "home context" note about the family's week.
• Advice feedback: whether a generated guide helped, plus an optional comment explaining why not.
• Technical data: IP address (used to limit abuse), pages visited, timestamps.
• Payment: handled entirely by Stripe. We store no card numbers.

3. Why We Use It

• To generate and display behavioral profiles and their guides.
• To manage your account, subscription, and access rights.
• To send service emails (registration, payment confirmation, check-in reminders, reports). Promotional messages require separate consent.
• To detect abuse and protect the platform.
• We do not use your data, or a minor athlete's data, to train artificial intelligence models.

4. Who We Share It With

We sell no data. We rely on the following providers, whose servers are primarily in the United States:

• Firebase (Google): authentication and database.
• Vercel: hosting and infrastructure.
• Anthropic: analysis generation. Questionnaire and profile data are sent to it. Anthropic does not train its models on data received through its API.
• Stripe: payment processing.
• Resend: transactional email delivery.
• Upstash: rate limiting — temporarily holds IP addresses.
• Telegram: internal technical alerts. These carry no names, emails, or free-text notes — only counters and non-identifying references.

Your information may therefore be transferred outside Canada and be subject to the laws of the host country.

5. Minor Athletes

KAIROS is built for athletes, many of whom are minors. We account for that explicitly.

• Consent is mandatory: no profile for an athlete under 18 can be created without a parent or guardian's confirmation. This check is enforced server-side and cannot be bypassed from the browser.
• Shared assessment links: when a coach sends an assessment link, an athlete under 18 must name a parent or guardian and confirm their authorisation. Age is self-declared, so this is an attestation recorded with a timestamp, not an identity verification.
• Direct use by a minor: a minor athlete may access their own portal and complete weekly check-ins once parental consent is in place.
• Deletion: a parent or guardian may request deletion of a minor's data at any time, with no justification required.

6. Share Links

If you enable sharing on a profile, anyone with the link can view it. Sharing is off by default, can be revoked in one click, and exposes no contact details. We advise against publicly sharing a minor's profile.

7. Retention and Deletion

• Active account: data is kept while the account exists.
• Account deletion: your data is permanently erased within 30 days. This covers the account, athlete profiles, wellness check-ins, home-context notes, parent profiles, generated plans, game days, Espace Parent access keys, and advice feedback.
• Payment records: kept 7 years, as tax and accounting obligations require.
• Emails: every non-essential email carries an unsubscribe link.

8. Your Rights

At any time you may:

• Obtain a machine-readable copy of your data — export is built into your account.
• Have inaccurate information corrected.
• Request deletion of your account and data.
• Withdraw consent for a given use.
• Complain to the Office of the Privacy Commissioner of Canada.

We acknowledge requests within 5 business days and complete them within 30 days.

9. Cookies and Local Storage

No advertising cookies and no third-party trackers. We use only:

• kairos_session — authentication session (strictly necessary).
• kairos_locale — your language preference.
• kairos_cookie_consent — your cookie choice.

Vercel Analytics collects aggregated usage metrics without cookies or personal identifiers.

10. Security and Incidents

Data is encrypted in transit and at rest, and access to production data is restricted. In the event of a breach posing a real risk of significant harm, we will notify affected individuals and the Office of the Privacy Commissioner of Canada, as PIPEDA requires.

11. What KAIROS Is Not

KAIROS provides behavioral and organisational guidance. It is not a clinical tool, a diagnosis, or medical, psychological, or nutritional advice. The indicators shown are relative markers, not a professional assessment. For any physical or mental health concern, consult a qualified professional.

12. Changes

We may update this policy. Any significant change will be announced by email or in-app before it takes effect.