Privacy Policy
QBFlowDoc ("we", "us", "our", "the app") is a quarterback cognitive-training app operated by Helix Physical Therapy and Chiropractic ("Helix"), Lakeway, Texas. This policy explains what we collect, why, who we share it with, and the choices you and your family have.
The app is used by youth athletes, including children under 13, so please read the Children's Privacy section carefully.
1. Information we collect
- Profile you enter: a name or nickname, competition level/track, and playing position.
- Age information: a date of birth you enter so we can apply the correct consent process. We store only the derived age range (under-13 vs. 13+) and birth year — not the full date of birth.
- Account details (only if you create an account): your email address, via Sign in with Apple, Google, or email/password.
- Training data: your Flow Score, phase scores, drill results, streaks, and training cadence.
- Reflections you write: QB Diary entries and Coach-Mentor conversations. These stay private to the athlete.
- Playbooks (optional): if you upload a playbook, its contents are stored encrypted and visible only to you.
- Motion sensor data: the VOR module uses the gyroscope to measure head rotation during a drill. Raw motion data is used only during the active drill and is never recorded, transmitted, or stored — only the resulting score is saved.
- Device & usage data: basic app-usage events for product analytics. Analytics are currently disabled by default; if enabled we use PostHog and do not collect precise location.
2. What we do not collect
- Contacts, photos, location, microphone, or camera
- Social graph or friends lists
- Advertising identifiers (IDFA)
- Payment card details — Apple processes all payments
3. How your data is stored
The app is local-first. If you never create an account, your data stays on your device. If you sign in, we back it up to our cloud provider (Supabase) so it syncs across devices. You can train and see your scores entirely offline without an account.
4. How we use information
- To provide training, compute your scores, and track progress over time.
- To sync your data across your devices when you sign in.
- To share a training summary with a coach only when an athlete joins that coach's team and the required consent is in place.
- To operate optional AI helper features that process text you submit on our server.
- To keep the app secure and to understand and improve how it is used.
We do not sell your personal information, and we do not use children's data for behavioral advertising.
5. Who we share it with
We share data only with service providers that help us run the app, under contracts that limit their use of it:
| Service | Purpose | Privacy policy |
|---|---|---|
| Apple App Store & StoreKit | Payment processing | apple.com/legal/privacy |
| RevenueCat | Subscription management | revenuecat.com/privacy |
| Supabase | Auth + cloud storage | supabase.com/privacy |
| PostHog (if enabled) | Anonymous analytics | posthog.com/privacy |
Coaches: if an athlete joins a team, the coach can see that athlete's training summary (Flow Score, phase scores, cadence). Coaches never see QB Diary entries or Coach-Mentor conversations.
6. Children's Privacy (COPPA)
QBFlowDoc is intended for athletes 12 and older and is used by children under 13. We comply with the U.S. Children's Online Privacy Protection Act (COPPA):
- We ask for a date of birth to determine whether an athlete is under 13.
- For an athlete under 13, we do not upload their personal information to our cloud, let them create an account, or share any data with a coach until we obtain verifiable parental consent. Until then the child can still train — their data stays on the device.
- We obtain verifiable parental consent by emailing a parent or guardian a confirmation link before enabling any online collection or sharing.
- The only personal information we collect from a consented under-13 athlete is what is described in Section 1, used solely to provide the app's features.
- Parental rights: a parent or guardian may review the personal information we hold about their child, ask us to delete it, and refuse any further collection, by contacting office@helixsportsmed.com. Withdrawing consent turns off cloud sync, coach sharing, and AI features.
7. Your choices & rights
- Access & deletion: delete your account and associated cloud data in the app (Account → Delete account), or email office@helixsportsmed.com. We delete within 30 days.
- Withdraw consent: manage or withdraw parental consent any time in Account.
- Local data: uninstalling the app removes data stored on the device.
- Depending on where you live (e.g. California/CCPA, or the EU/UK), you may have additional rights to access, correct, export, or delete your data and to complain to a regulator. Contact us to exercise them.
8. Data retention
We keep account and training data while your account is active. When you delete your account we remove your personal data from our systems, except where we must retain limited records to meet legal obligations.
9. Security
We use industry-standard measures including encryption in transit (TLS/HTTPS), database row-level security so users can only access their own data, and access controls. No system is perfectly secure, but we work to protect your information. If you believe your account has been compromised, contact us immediately.
10. Changes to this policy
We may update this policy; we will revise the "Last updated" date and, for material changes affecting children, seek renewed parental consent where required.
11. Contact
Email: office@helixsportsmed.com
Helix Physical Therapy and Chiropractic, 15401 Debba Dr., Lakeway, TX 78734