Privacy Policy

Last updated: November 2, 2026

What changed: explained optional screenshot imports for rosters and schedules, processing by Amazon Bedrock, and review before saving. The policy also describes optional feedback reports and their screenshots, optional carpool pickup locations and travel reminders, and the account profile and approximate location information used by analytics.

Lineup ("we," "our," or "us") is a sports team management app built for coaches. This Privacy Policy explains what information we collect, how we use it, and your rights regarding that information.

1. Information We Collect

We collect the minimum information necessary to provide the service:

Account information: When you sign in with Apple, we receive your name and email address (or Apple's anonymized relay address if you choose to hide your email). When you sign in with Google, we receive your name and email address from your Google profile. This applies to adult accounts and parent-invited player accounts for ages 13 and older, in the app or player website. We never receive your Apple or Google password.
App data you create: Teams, player names and jersey numbers, game records, player rotation data, game clock data, assignments, and training session dates, completed exercises, and notes that you enter.
Player access records: We store the parent or guardian's link to the roster player, their confirmation that the player is 13 or older, the confirmation time and policy version, and the invitation's expiry, claim, and revocation status. The age check does not ask for a date of birth. A claimed invitation connects the player's separate account to that roster player.
Subscription records: For web subscriptions we store the Lineup account identifier, Stripe customer and subscription identifiers, subscription status, paid-through date, and payment-event timing needed to verify and maintain access. Stripe collects payment and billing information directly on its hosted checkout; we do not receive your full card number. See Stripe’s Privacy Policy.
Device information: Basic technical information required for the app to function (iOS version, device type). We do not collect advertising identifiers.
Push notification tokens: If you allow notifications, we store a device token (issued by Apple) so we can send you alerts. See "Push Notifications" below.
Usage and analytics events: App screens and actions you take (e.g. "started a game," "viewed roster"), along with device model, OS version, and app version. See "Analytics" below.
Optional carpool and travel information: If you request a ride, we collect the pickup address or meeting point you choose, its coordinates, the linked children selected for that ride, and any pickup instructions or contact detail you elect to provide. Offering a ride or exploring carpool does not require a home address. Saving a departure location for future reminders and turning on reminders are separate optional choices. If you choose current-location directions, we receive a foreground location for that route calculation; we do not track your location in the background.
Optional feedback: When you tap Send feedback, we receive your problem report or feature suggestion, its text, and any screenshot you include. The report is linked to your account identifier and includes the submission time, current app screen, operating system and version, app version and build, software update identifier, and whether you opened feedback by shaking your phone or through Settings.

Feedback screenshots: Shaking your phone can prepare a screenshot of the app on your device before opening the feedback form. You can also choose an image with your phone's photo picker. You can review or remove the image before sending; opening the form or choosing an image does not upload it. We do not scan your photo library. Temporary report images are removed from the app when you discard or send the report. Check screenshots for private information, including children's information, before sending them. Shake detection uses motion readings on your device; we do not upload or retain those readings.

Screenshot imports: If you choose to extract a roster or schedule from a screenshot, the selected image and any context you provide, such as a year, are sent to our servers and Amazon Bedrock, an AWS image and text processing service in the United States. We use this information to suggest player names or game and practice details. You can review and edit the results before saving them to your team. Use screenshots containing only the information needed for the import, and avoid unrelated private information. This feature is separate from feedback reports and does not require connecting an outside AI app.

2. How We Use Your Information

To create and maintain your account
To process subscriptions, confirm payment status, and provide paid access
To sync your team and game data across your devices
To allow you to share teams with assistant coaches
To restore your data if you reinstall the app
To send push notifications and emails you haven't opted out of
To understand how the app is used so we can improve it
To investigate problem reports, provide support, and consider feature suggestions you send us

We do not sell your personal information or use it for third-party advertising. We use it to operate and improve Magic Lineup and to send the optional communications described below.

3. Data Storage and Security

Your data is stored on AWS (Amazon Web Services) infrastructure in the United States. We use encryption for data in transit (TLS) and at rest. The native app uses secure device storage for authentication tokens, including iOS Keychain.

We use AWS Cognito for authentication and AWS Aurora DSQL for database storage. Access is limited by account role, team membership, and parent or player links. Player accounts receive only their own assignment data, rather than the broader coach or parent view.

Feedback access: Submitted reports and screenshots are stored on our AWS infrastructure and are available to authorized administrators for support and product improvement. They are not shared with other team members. Feedback text and screenshots are not sent to Amplitude or PostHog, used for advertising or tracking, or shared through a connected AI app.

Import processing: Our screenshot extraction service does not store the screenshot or the extracted draft in our database, or include their contents in request logs or analytics. Details you confirm and save become ordinary team data and follow the same access and retention rules as details you enter manually.

Player browser session: the player website keeps its authentication and refresh tokens and basic signed-in account information in the browser's sessionStorage, separately for production and staging. This lets a player return to assignments in that browser tab without using the invitation again. Sign-out, account deletion, or a rejected session refresh clears those credentials. Browser session storage normally ends when the tab's browsing session ends; browser restore settings may retain it. The website can remember the 13-or-older answer in sessionStorage for that environment. A blocked storage area still allows sign-in for the current page.

Player invitations: invitations expire after seven days and are single-use for connecting an account. The secret is in the invitation link's fragment, is removed from the browser address after a successful claim, and is not an ongoing assignment credential. We store its hash, rather than the original secret. These private player pages do not load website analytics; Google and Apple sign-in scripts load only after the 13-or-older choice. External exercise media opens separately with referrer information withheld.

Connection checkout cookie: when you choose web checkout during AI connection, we use a temporary secure, HttpOnly cookie to resume the pending approval after Stripe returns you. It is used for that connection flow, not advertising.

Carpool directions and private departure locations: A pickup location is separate from your child's profile and the team directory. It is protected with application encryption and is made available for directions only to the particular driver you approve, during the sharing window you are shown. Access ends when pickup is marked complete, when you revoke or cancel sharing, or at the displayed deadline. Being a coach, another linked guardian, or a subscriber does not give someone access to your pickup location. Each future ride needs its own approval. A departure location you separately choose to save stays private to your account and can be deleted in Carpool and travel.

Routing providers and maps: Amazon Location Service processes the address searches, coordinates, route stops and travel timing needed to find places and estimate driving times. Its geolocation data providers may process request parameters outside the AWS region receiving the request; see Amazon Location data sources and attribution. When you choose to open navigation in another maps app, that app receives the authorized destination or pickup stops and handles them under its own terms and privacy settings. Lineup can end further access through Lineup, but cannot erase an address a person has already seen, a screenshot they took, or another maps app's history. Carpool pickup fields, private departure locations and precise routes are excluded from ordinary request logs, analytics, team exports and connected AI app data. Review screenshots for private information before sending feedback.

4. Push Notifications

With your permission, we send push notifications through Apple's push notification service (APNs) for:

Game reminders (24 hours, 2 hours, and 1 hour before a scheduled game)
Alerts when a co-coach adds a game to a team you're on
New take-home assignments for linked parents and players
Carpool responses and ride updates, requests from your team if you opt in, and optional departure or pickup-ready reminders
Occasional product announcements

You can turn off notifications at any time in iOS Settings → Notifications → Lineup, or by declining/disabling permission when prompted in the app. We store your device's push token on our servers only so we can address notifications to your device; the token is deleted when you sign out or delete your account.

5. Email Communications

We send email from coach@lineup.parent-ai.com via Amazon SES for:

Re-engagement reminders if you haven't opened the app in 7, 14, or 30 days
Occasional product announcements

Every one of these emails includes an "Unsubscribe" link so you can opt out with one click. We may still send transactional or security-related notices (for example, account or billing confirmations) even if you've unsubscribed from other emails, since those aren't marketing. If your Apple ID uses "Hide My Email," Apple relays our messages to your real address on our behalf — we never see it. We keep a log of each email sent (your user ID, the kind of email, and the timestamp) to avoid duplicate sends and to honor unsubscribes.

6. Analytics

We use Amplitude and PostHog, product analytics services, to understand how people use Magic Lineup so we can improve it. Analytics events include which screens you view and actions you take (e.g. starting a game, adding a player), along with device model, OS version, and app version. We keep player names and rosters, precise carpool locations, pickup instructions, and contact numbers out of analytics. PostHog receives your account identifier, display name and email as account profile properties, and can derive an approximate city, region and country from your connection IP address. Amplitude receives account and device identifiers without your name or email. PostHog also receives limited website page and app-store-link events, administrative screen and request outcomes, and server request outcomes such as the type of action, response status, and duration. We use random visitor identifiers on the website and internal account identifiers in the app. We do not send form contents, authentication credentials, invite tokens, or URL query strings to PostHog, and session recording is disabled. These services process analytics data on our behalf under their data processing terms and retain it according to the retention settings for our respective plans.

7. Connected AI Apps

Adult coaches and parents can connect Magic Lineup to an outside AI assistant — today Claude (Anthropic) or ChatGPT (OpenAI) — for basic schedule and player-management tasks. Player accounts cannot connect AI apps or purchase subscriptions. Lineup Pro adds AI practice and game planning and deeper analysis for adult accounts. Access remains limited by your team role and the permissions you approve. This connection is off by default. Nothing is shared through an AI app connection unless an authorized adult deliberately connects one, and that adult can disconnect at any time from Settings → AI apps in the app, which revokes its access immediately.

While a connection is active, the assistant can request your team name and settings, your roster (player names, jersey numbers, and availability), your schedule, playing-time minutes and game statistics, and any practice or game plans it has written for you. This is the same information your own account can already see in the app — connecting never widens what you have access to.

An AI assistant is never given other parents' or coaches' contact details, your invite codes, your payment details, or the contents of your account credentials. Those are withheld by our servers. The assistant can see whether Pro access is active and when it expires so it can explain which features are available.

Important: once information reaches Claude or ChatGPT, it is handled under that company's privacy policy, not ours, and we have no control over or visibility into what they do with it — including how long they keep it and whether it is used to improve their models, which depends on the plan and settings you have with them. Please read Anthropic's Privacy Policy or OpenAI's Privacy Policy before connecting, and review your own data controls in that product. Because rosters contain children's names, treat this as a deliberate choice about your players' information, not just your own.

On our side, we keep a record of which AI apps you have connected, when each was connected and last used, and the fact that a plan was created or applied. We retain the access records for as long as the connection exists and for 90 days after you disconnect. We do not store your conversations with the AI assistant — we never receive them.

8. Camera and Microphone

Camera. The app uses your camera only to scan a team's QR code when you join. No photos or videos are taken or stored.

Microphone and voice notes. During a practice you can hold the Note button and talk, and the app turns what you say into a written note on the current drill. The microphone is on only while you hold the button. The words are worked out by speech recognition that runs on your phone itself, so your voice is not sent to us, to Apple, to Google, or to anyone else. No recording is kept: the audio is used as you speak and then discarded. If your phone can't recognise speech on its own, the app does not fall back to an online service; it opens the typed note instead. On iPhone, the permission prompt for speech recognition shows Apple's standard wording that speech may be sent to Apple; that wording is the same for every app, and Magic Lineup asks only for recognition on the phone.

The note you save is text, and it is stored and synced like any note you type. Practice notes are attached to a drill, never to a player. If you connect an AI app (section 7), your practice notes are part of what it can read.

If you use your keyboard's own dictation key in the typed note, that is your phone's keyboard feature, and Apple's or Google's settings decide how it handles your voice, not ours.

You can turn voice notes off in the practice screen's Blocks menu, and you can turn off microphone access for Magic Lineup at any time in your phone's Settings.

9. Data Sharing

We do not sell, rent, or share your personal information with third parties, except:

Team members you invite: When you share a team via invite code or QR code, invited coaches can view and manage the team roster and games you created.
Parent and player assignment access: a linked parent or guardian can invite a player age 13 or older to use their own account. The player sees their assigned exercise instructions, their own progress and session history, and the team name and sport. Team coaches and parents linked to that player can see the player's session dates, exercise completions and notes, including sessions entered by the player. These records are not public or shared with other families through player access. A linked parent can disconnect the player's access and can undo a session entered by that player.
A driver you approve: Your agreed carpool driver receives the pickup location and any protected instructions or contact detail you chose to include, only during that ride's authorized directions window. Other team members see only the limited offer or request information you submit, such as child first names, seats, event and a broad area you choose to share.
Service providers: Amazon Web Services (AWS) hosts our infrastructure and database, Amazon Bedrock processes screenshots you submit for roster or schedule extraction, Amazon Location Service processes optional place searches and driving routes, Amazon SES delivers our emails, Apple's APNs delivers push notifications, and Amplitude and PostHog process analytics events. Each processes data only as necessary to provide their services and is bound by data processing terms.
Web billing: Stripe processes web subscriptions and receives account reference and transaction information needed for checkout and recurring billing. Stripe also processes payment information you enter on its checkout under its own privacy policy.
AI assistants you connect: If you turn on an AI app connection, the information described in section 7 is sent to that assistant at your request. Unlike our service providers, Anthropic and OpenAI act on their own behalf under their own privacy policies here, not as processors bound by ours.
Legal requirements: We may disclose information if required by law or to protect our legal rights.

10. Data Retention

We retain account data for as long as your account is active. If you delete your account, account data is deleted from our servers within 30 days. Team data shared with other coaches is retained until all coaches leave the team. Disconnecting player access stops future access but keeps the team's training records. Deleting a player account removes its sign-in and access links; the team's session dates, completed exercises and notes may remain with the deleted account's authorship link removed.

Temporary carpool information: Completing a pickup, cancelling a request or revoking its sharing removes the temporary pickup payload from the live arrangement. Server checks deny directions after the sharing deadline even before cleanup runs. Scheduled cleanup removes expired event coordination records; this first release does not keep a long-term carpool history. A separately saved private departure location remains until you choose to delete it or delete your account. Encrypted backups, if retained, follow their configured retention; access expiry and revocation must still be enforced if data is restored.
Push tokens: deleted when you sign out or delete your account.
Email send logs: retained for 90 days, then deleted.
Analytics events: retained according to the data retention settings of our Amplitude and PostHog plans.
Connected AI app records: retained while the connection is active, then 90 days after you disconnect.
Feedback reports and screenshots: retained with your account for support and product improvement, and deleted when your account is deleted. You can also request deletion of a submitted report by contacting privacy@parent-ai.com.

11. Children's Privacy

Adult coaches, assistant coaches, parents and guardians must be 18 or older to use an adult account. A player who is 13 or older may use a separate account after an invitation from their linked parent or guardian. That account is limited to the player's own assignments and training history, with no billing or AI-app connection permissions. The guardian confirms the player is 13 or older when issuing an invitation, and the player chooses an age range before sign-in and confirms eligibility when connecting.

Players under 13 must not create or use an account. The player sign-in flow does not offer sign-in or load sign-in provider scripts after an under-13 answer. Their parent or guardian can view assignments and record sessions on their behalf using the adult's account. We do not provide an under-13 account or parental-consent signup flow. Adults may still enter the roster and training information needed to manage their team. Please avoid contact details, dates of birth, school information, or sensitive information in rosters or training notes.

If you believe someone under 13 has an account or has provided personal information through a player account, contact privacy@parent-ai.com so we can investigate and remove the account and associated personal information as appropriate.

12. Your Rights

You have the right to:

Access the personal data we hold about you
Request correction of inaccurate data
Request deletion of your account and associated data
Export your data

To exercise these rights, contact us at privacy@parent-ai.com.

13. Sign in with Apple and Google

We use Apple and Google sign-in where offered. Their privacy policies govern how they handle your credentials. We receive an authentication token and the name and email provided for sign-in. We do not have access to your Apple or Google password or other account contents.

14. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes by updating the "Last updated" date at the top of this page. Continued use of the app after changes constitutes acceptance of the updated policy.

15. Contact

For privacy questions or requests, contact us at:
privacy@parent-ai.com