Privacy Policy

Last updated: August 5, 2026

1. Information We Collect

When you use NextPlay, we collect:

Account information: email address, display name, and password (securely hashed)
Team data: team profiles, player rosters, strengths/weaknesses, and metrics you enter
Chat conversations: messages between you and AI coaching agents
Uploaded files: documents and data files you upload for analysis
Usage data: login timestamps, IP addresses (for security), and feature usage
Approximate location: we look up the country and city of the IP addresses described above, so we can see which regions our coaches come from. The lookup happens entirely on our own servers against a local database, so your IP address is never sent to a geolocation provider. It identifies a city, not an address, and we do not track your movements.

2. How We Use Your Information

To provide and improve the AI coaching experience
To personalize AI responses based on your preferences and feedback
To maintain account security and prevent abuse
To communicate service updates if necessary

3. Data Storage & Security

Your data is stored securely with encryption at rest. Passwords are hashed using bcrypt. Authentication tokens are stored as httpOnly cookies. We use security headers (CSP, HSTS, X-Frame-Options) to protect against common web attacks.

4. Third-Party Services

We use the following third-party services to run NextPlay. Each receives only the data needed for its function:

OpenAI API: to power AI coaching conversations (your messages are sent to OpenAI for processing). Please note: Data sent via the OpenAI API is strictly for generating your responses and is NOT used by OpenAI to train their public models.
Payment provider (merchant of record): processes subscription payments and issues receipts. Your card details are entered directly with the payment provider - NextPlay never sees or stores your card number.
AWS S3: for video storage in the scouting feature.
Railway: our hosting and database infrastructure, where your account data is stored.
Resend: sends our transactional and (if you opted in) marketing emails.
Sentry: error monitoring - receives technical error reports that may include your IP address and request metadata, used solely to fix bugs.
Web search providers (Serper, Jina): when you ask for opponent scouting, the team names and search queries involved are sent to these services to fetch public web results. Your account and roster data are never included.
Google Analytics and Meta Pixel: usage and conversion analytics, loaded only after you accept analytics cookies (see section 5).
Social login providers (Google, Facebook, Apple): if you choose to sign in with them.

Our servers are located in the United States. By using NextPlay you consent to your data being processed there. We do not sell your personal information to anyone.

5. Cookies & Analytics

We use a small number of cookies and similar technologies:

Essential cookies: authentication tokens and session cookies that keep you signed in. These are required for the service to work and cannot be disabled.
Analytics cookies (optional): Google Analytics and Meta Pixel help us understand how coaches use NextPlay and measure our marketing. How we ask depends on where you are, because the law does. Where consent is required before any tracking may begin, such as in the European Economic Area and the United Kingdom, we show a cookie banner and nothing loads until you click Accept. In the United States, where the rules work the other way around and give you the right to opt out rather than the duty to opt in, these load by default and you can switch them off at any time using the Your Privacy Choices control that appears on every public page. If your browser sends a Global Privacy Control signal, we treat that as an opt out and load nothing, wherever you are.
Measurement sent from our servers (optional): while analytics are on, we also send certain events to Meta directly from our servers rather than from your browser, so that ad blockers do not distort our marketing measurement. These events cover registration, downloading a free guide, and purchasing a plan, and they carry a hashed (irreversibly encoded) version of your email address, your IP address and your browser's user-agent string, which Meta requires unhashed for matching. Turning analytics off stops these too.
Preference cookies: remember choices like your cookie-consent decision.
Measurement cookie on our video page: if you arrive at our /watch page from an email we sent, we set a single first-party cookie containing a random identifier, so that we can count how many separate people watched rather than how many times the page was opened. It contains nothing about you, is never shared with anyone, is never linked to your name or email address, is used only to produce aggregate counts for that one page, and expires after 90 days. If your browser sends a Global Privacy Control signal we record nothing about how far the video was watched.

You can change your mind at any time, in either direction, from the Your Privacy Choices control on any public page. It sits in the page footer where there is one. Choosing to decline is remembered on that device and is never overridden, including in regions where we would otherwise default to on.

Marketing emails are sent only if you opted in (an optional checkbox - never pre-ticked), and you can withdraw that consent at any time by emailing team@trynextplay.app.

6. Data Isolation

Each coach's data is completely isolated. Your team profiles, players, conversations, and files are only accessible to you. Other users cannot see your data.

7. Data of Minors

NextPlay is designed for use by coaches, club managers, and team staff. We do not directly collect information from children. By entering data regarding minors (such as youth players' metrics or profiles) into the platform, you represent and warrant that you have the legal authority, and have obtained all necessary permissions or consents from parents or legal guardians, to process and store this data on our system.

8. Data Retention & Deletion

You can delete your account at any time from the app settings. Your account is deactivated immediately, and 30 days later everything in it is permanently deleted: your teams, players, conversations, practice plans, notebook, uploads and videos, along with your login history, the record of emails we sent you and any social sign in you had linked. Your email address is released, so you are free to sign up again from scratch.

Those 30 days exist so a decision made in a bad week is not final. Sign in again at any point before the deletion date and we will restore everything exactly as you left it. We email you the exact date when you request the deletion, and again three days before it happens. After that date nothing can be recovered, by you or by us.

The same 30-day rule applies when a paid subscription or free trial expires without renewal: your account content is kept for a 30-day grace period so you can pick up where you left off, and is then permanently deleted. Renewing within the grace period preserves everything. Accounts managed under a club or academy organization are covered by the organization's plan and are not subject to individual expiry deletion.

9. Your Rights

You have the right to:

Access your personal data
Correct inaccurate data
Delete your account and all associated data
Export your data upon request

10. Governing Law & Jurisdiction

This Privacy Policy and any disputes arising out of or related to it shall be governed by and construed in accordance with the laws of the State of Israel, without regard to its conflict of law principles. Any legal action or proceeding shall be brought exclusively in the competent courts located in Israel.

11. Contact

For privacy-related questions, contact us at: team@trynextplay.app