Privacy Policy

D1 Performance LLC (“D1 Performance,” “we,” “our,” or “us”) provides a training system for football Athletes and their families through our websites, mobile app, and in-person services (the “Service”). This Privacy Policy explains what personal information we collect, why, who can see it, and the choices and rights you have. It applies to Athletes, Parents/Guardians, and visitors to our websites.

Four commitments sit above everything else in this policy:

• We never sell personal information. Not Athletes’, not families’, not anyone’s — and we do not “share” it for cross-context behavioral advertising as those terms are defined under state privacy laws.
• We do not use personal information for advertising. There are no ad networks, ad identifiers, tracking pixels, or advertising SDKs in our app or website, and we never use training or health information for marketing or ads.
• Minors’ data gets the most protective treatment. Most of our Athletes are teenagers. We collect only what the training service needs, we never use any minor’s data for targeted advertising or sell it, and linked Parents/Guardians have visibility into their Athlete’s training.
• You can leave. Accounts can be deleted in the app or by email, as described in Section 12 and our account deletion section of our Terms of Service.

A plain-language summary lives at Data Trust. A separate Consumer Health Data Privacy Policy covers health-related data specifically. If anything here conflicts with those pages, the more protective statement applies.

Information you (or your family) provide:

• Account details: name, email address, date of birth (used to verify our 13+ age requirement and provide age-appropriate training), and authentication identifiers managed by our sign-in provider.
• Athlete profile: sport, position, grade band, school level, goals, training environment and available equipment, height and weight entries, and — where families choose to provide it — injury history and training-readiness intake answers used to keep programming safe.
• Training activity: workout logs, sets and loads, personal records, check-ins and readiness responses, pain or discomfort reports used by the pain-safe adjustment flow, program choices, and streaks/progress milestones.
• Nutrition entries: meals or foods logged and, optionally, photos of nutrition labels you choose for logging. We re-encode those photos on your device to remove metadata before analysis and do not retain them as D1 media; only the nutrition entry you review and save is kept.
• Messages and media: messages in Trainer Threads (Premium) and video clips submitted for form review (Premium).
• Eligibility and recruiting entries: academic and eligibility information an Athlete or family chooses to track (such as GPA entries) and recruit-profile details they create.
• In-person service details: booking information, evaluation results, and — for transportation — pickup logistics and emergency contact details a Parent/Guardian provides.
• Support and requests: emails to support, bug reports, and “Request D1 Performance in your area” submissions (which include a location of interest).

Information collected automatically: device and app information (platform, app version), interaction events used to run and improve the Service, push notification tokens, error and crash diagnostics, and privacy-respecting web analytics that do not use cookies or track you across sites. Our error-monitoring tool may capture a sampled, masked replay of an app session for debugging; text and inputs are masked before capture.

Health platform data (optional): with your permission, we read exactly four data types from Apple Health (HealthKit) on iOS or Health Connect on Android: sleep, height, weight, and steps. This is read-only — we never write to your health platforms — and it is covered in detail in Section 4 and the Consumer Health Data Privacy Policy.

Payment information: payments are processed by Stripe. We receive subscription status, plan, and billing history; we never receive or store full card numbers.

We practice data minimization: each category above exists because a specific product feature needs it, and we do not collect data “just in case.”

We use personal information to:

• Run the training plan: build, adapt, and progress each Athlete’s program, apply safety rails, and respond to readiness and discomfort signals.
• Show proof of progress to the Athlete and their linked Parent/Guardian, including progress reports and training history.
• Provide Premium trainer support, including Trainer review of logs, videos, and messages.
• Operate accounts, Linked Account connections, Subscriptions, billing, and in-person bookings.
• Send service communications: transactional email (receipts, account and trial notices, renewal reminders) and push notifications you can turn off in your device settings. We do not send marketing text messages, and we do not send marketing email to Athletes.
• Provide support and respond to your requests.
• Keep the Service secure: authentication, fraud and abuse prevention, debugging, and enforcing eligibility rules such as one-trial-per-Athlete.
• Comply with legal obligations.

AI features. Two features use OpenAI: turning a sanitized nutrition-label photo into a draft entry, and drafting progress-report narratives. We send data only to provide the requested feature, do not authorize model training or opt feature data into provider data-sharing, and disable provider-side application storage on these requests. OpenAI may retain limited abuse-monitoring logs under its service terms. We never use AI to make medical judgments, and no AI feature sends data to advertisers.

We do not use personal information for targeted advertising, we do not sell it, and we do not use profiling to produce legal or similarly significant effects about anyone.

Health-related data gets stricter treatment than anything else we hold. The full standalone policy is at Consumer Health Data Privacy Policy; the essentials:

• Scope: we read only sleep, height, weight, and step data from Apple Health or Health Connect — nothing else, and read-only.
• Optional and consent-based: connecting a health platform is opt-in through your device’s permission flow plus our in-app consent. Declining blocks nothing — training, Fuel, recovery, and Progress all work with manual entries instead.
• Minors: health-platform data stays off by default for every Athlete. An Athlete may turn it on themselves, and a linked Parent/Guardian can stop future collection at any time — independently, and for as long as they leave that stop in place.
• Use: health data personalizes the training experience (for example, recovery guidance informed by sleep). It is never used for advertising or marketing, never sold, never shared with data brokers, and never used to make insurance, credit, or employment determinations. We do not store Apple Health data in iCloud.
• Revocation: you can disconnect at any time in your device’s health settings or the app; we stop reading immediately, and you can ask us to delete previously synced values.
• Discomfort reports, injury-history entries, and readiness intake answers are treated with the same care: used only to keep training safe and appropriate, visible to the Athlete’s linked Parent/Guardian and (on Premium) their Trainer, and never used for advertising.

The Service is built for teen Athletes, so minors’ privacy is a design constraint, not an afterthought:

• No accounts under 13. We ask for date of birth at onboarding with a neutral age screen (no pre-filled dates) and block signups under 13. If we obtain actual knowledge that a child under 13 has provided personal information, we delete it and close the account. Report a suspected under-13 account to support@d1performancetraining.com.
• Parent/Guardian involvement for teens. Athletes 13–17 use the Service with Parent/Guardian permission. A linked Parent/Guardian can see their Athlete’s plan, progress, and training story, may purchase for them, and can contact us to review or request deletion of their minor Athlete’s information.
• No ads, no sale — for anyone, especially minors. We do not serve targeted advertising to any user and we do not sell or share the personal information of any user, including consumers we know to be under 16.
• Protective defaults. Health-platform data stays off for every Athlete until it is turned on, and a linked Parent/Guardian can stop it at any time; there are no public profiles, public leaderboards, social feeds, or stranger messaging in the Service.

Personal information is visible or disclosed only as follows:

• Within the family: a linked Parent/Guardian sees their Athlete’s training information as described in Section 5. Athletes can see which adults are linked to them.
• D1 Performance staff: Premium Trainers see their assigned Athletes’ training data, messages, and videos. Support access is limited to what a request requires.
• Service providers (processors): vendors that run the Service under contracts limiting them to providing their service to us: Clerk (authentication), Convex (application database and backend), Stripe (payments), Vercel (website hosting and cookieless analytics), Sentry (error monitoring and masked session replay), Resend (transactional email), Expo (app builds and push notification delivery), OpenAI (the AI features in Section 3), Cal.com (in-person booking), and Google Maps (location display on our public website only).
• Legal and safety: if required by law, legal process, or to protect the safety of a user (especially a minor), the public, or the Service.
• Business transfers: if D1 Performance is involved in a merger, acquisition, or asset sale, personal information may transfer with the business — bound by the commitments in this policy, and we will notify you of any change in ownership or use.
• Aggregated or de-identified data that cannot reasonably identify anyone (for example, overall training-volume statistics) may be used to improve the Service; we commit to not re-identifying it.

That list is exhaustive. There are no data brokers, no ad networks, no analytics resellers, and no sale of personal information — including health data, for which sale is prohibited entirely.

We keep tracking minimal: essential cookies from our authentication provider keep you signed in, and our web analytics are cookieless and do not follow you across sites. We use no advertising cookies, no social-media pixels, and no cross-site trackers, which is why you will not see a cookie consent banner on our sites.

Do Not Track and Global Privacy Control: because we do not sell or share personal information or track users across third-party sites, there is no sale or cross-context sharing for these signals to switch off. We treat a Global Privacy Control (GPC) signal as a valid opt-out of sale/sharing — which our practices already satisfy — and we do not change our behavior in response to Do Not Track headers because no cross-site tracking occurs in the first place.

We keep personal information only while it serves the purpose it was collected for:

• Account, profile, training, nutrition, and health-derived data are retained while the account is active, because the product’s core promise — long-term proof of progress — depends on history.
• Nutrition-label photos are processed transiently after on-device sanitization and are not retained as D1 media. The reviewed Food Log entry and per-athlete capture-attempt history are removed through account deletion.
• When an account is deleted, we purge and anonymize as described in Section 12 and the account deletion section of our Terms of Service.
• Billing, tax, refund, and legal records are retained as required by law (with Stripe holding payment records under its own obligations).
• Support emails are retained as our record of the request and its resolution.
• Residual copies in encrypted backups roll off on the backup schedule after deletion.
• Error diagnostics and session replays are retained on our monitoring provider’s short rolling window, then deleted.

We maintain a written internal retention policy and do not retain personal information indefinitely without a purpose.

We use administrative, technical, and organizational safeguards appropriate to the sensitivity of the data we hold: encryption in transit and at rest, role-based access controls (Trainers see only assigned Athletes; families see only their linked Athletes), verified-requester rules for support actions, secrets management, and monitoring. No system is perfectly secure, so we do not promise the impossible — but if a breach affects your personal information, we will notify you and the appropriate authorities as required by applicable law.

We extend these rights to all users regardless of state, so you do not need to figure out which law covers you:

• Access / know: confirm whether we process your personal information and get a copy of it.
• Correction: fix inaccurate personal information (much of it is directly editable in the app).
• Deletion: delete your account and personal information (Section 12).
• Portability: receive your data in a portable, machine-readable format.
• Opt out of sale, sharing, targeted advertising, and profiling: we do none of these, so there is nothing to opt out of — and we will honor the request anyway, including GPC signals.
• No discrimination: exercising a right never costs you features, price, or quality of service.

How to exercise rights: use the in-app account controls or email support@d1performancetraining.com from the email on your account (that address match is also how we verify most requests; we may ask for more verification when the request is sensitive). A Parent/Guardian may act for their linked minor Athlete, and you may use an authorized agent where your state provides for one. We respond within 45 days (extendable once by 45 days for complex requests, with notice).

Appeals: if we decline a request, we will explain why, and you may appeal by replying or emailing legal@d1performancetraining.com with “Appeal” in the subject. We answer appeals within 60 days. If we deny your appeal, you may contact your state Attorney General — for Virginia residents, via the Virginia Office of the Attorney General.

California notes: we do not sell or share the personal information of any consumer, including consumers under 16 years of age, and we have not done so in the preceding 12 months. We do not disclose personal information to third parties for their own direct-marketing purposes (California “Shine the Light,” Civil Code §1798.83); California residents may direct related inquiries to legal@d1performancetraining.com.

The Service is operated from the United States, data is processed and stored in the United States, and the Service is intended for and directed to United States residents. We do not target, market, or offer the Service to individuals in the European Union, European Economic Area, or United Kingdom. If you use the Service from outside the U.S., you understand your information will be processed in the U.S. under this policy.

Any Athlete or Parent/Guardian can delete their account in the app (Account → Delete Account) or by emailing support@d1performancetraining.com from the account email. Before you confirm in-app, we show a preview of exactly what will be deleted and what will be retained. In short: your profile, Linked Account connections, invites, service requests, evaluations, and push registrations are purged; your identity record is anonymized; your sign-in account is deleted; and records we must keep (billing, tax, refund, fraud-prevention, safety, and legal records) are retained without your profile attached. Deleting an account does not by itself cancel an active Subscription — the payer should cancel first. Full detail, including timelines, is in the account deletion section of our Terms of Service.

We may update this policy as the Service or the law changes. The “Last updated” date reflects the current version. If a change materially reduces your rights or meaningfully changes how we handle personal information — especially minors’ or health data — we will notify you by email or in-app notice before it takes effect, and where the law requires consent for a new use, we will ask for it rather than assume it.

Privacy questions, rights requests, and deletion help: support@d1performancetraining.com.

Legal notices and appeals: legal@d1performancetraining.com, or write to D1 Performance LLC, 3553 Drews Ct, Alexandria, VA 22309.