DrillFlow Privacy Policy

Last Updated: July 2, 2026

The short version

We built DrillFlow to collect as little as possible. The most sensitive thing in this app is your family's calendar, and we designed the calendar tools so that your calendar links and credentials never pass through our servers at all.

Information We Collect

We collect only what is necessary to provide and improve the Service:

• Account information: your name, email address, and hashed password, collected when you register.
• Content you create: drills, practice plans, and settings you save to your account are stored so you can get them back on any device.
• Payment information: billing is handled entirely by Stripe. We store only your Stripe Customer ID. We never store raw card numbers or CVV codes.
• Technical data: IP address, browser type, device information, and referral source, collected automatically via standard web logs.

How We Use Your Information

We use collected data strictly to operate and improve the Service:

• To create and manage your account, and authenticate your identity at login.
• To manage your subscription and billing via Stripe.
• To communicate with you about your account: confirmations, password resets, trial-end reminders, and payment receipts.
• To analyse aggregate usage patterns and improve the drill builder, animation engine, and library.
• To respond to support requests and inquiries you send us directly.

We do not use your data for advertising profiling, behavioural targeting, or sale to any third party.

Calendar Merger

When you use the calendar setup page, your calendar feed links (from TeamSnap, GameChanger, Spordle and similar apps) are combined into a script right in your browser. Those links can contain private access tokens. We never receive them, store them, or see them unless you choose to save your setup (below). The script you create runs on your own Google account, not on ours.

Saved calendar setup (Coach and Association plans)

If you choose "Save my setup", your configuration (your feed links, home address, calendar ID and buffer settings) is stored in our database in a record that only your account can read. Feed links can contain access tokens, so treat this like private data; we do. You can delete your saved setup at any time from the calendar page, and deleting your account removes it as well.

Kitchen Display

The display reads your Google Calendar directly from your device to your calendar. The schedule data does not pass through DrillFlow servers.

• Public mode reads a calendar you have chosen to make public, using your device.
• Private mode uses Google sign-in with read-only calendar access. The sign-in token lives only in your device's memory and is never stored on our servers or written to the device's storage.
• The display keeps a small local copy of your upcoming events on the device so the screen still works during a network blip, and remembers which Google account you used so you do not have to sign in on every visit. If the device is shared, use the "Forget this device" button in the display settings to erase all of this from that device.

DrillFlow's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Practice plans and assignments

When a coach assigns a practice plan to a team and date, that assignment (the team name, the date, and a link to the plan) is readable by anyone, so that families can open the plan from the display or calendar without creating an account. Assigning a plan is how a coach chooses to share it. The drills inside an assigned plan, including a coach's own private drills, can be watched by anyone who has the link. Removing the assignment removes that access.

Shooting Challenge and children's information

DrillFlow is built for youth sports, so some features involve information about kids: first names on team rosters and calendar events, and shot counts logged by parents. We keep this to the minimum the feature needs. Please use first names or nicknames rather than full names. Shooting Challenge logging works through private links instead of accounts; anyone who has a team's link can see that team's first names and shot totals, so share links only with your team's families. Coaches can delete players, entries, or whole teams at any time, which removes that data.

What we never collect

We do not see or store your Google password, your calendar sign-in token, or (unless you save your setup) your calendar feed links. We do not collect precise device location. We do not sell personal information or share it with advertisers.

Analytics and payments

DrillFlow does not run third-party analytics or tracking scripts. Payments and subscriptions are handled entirely by Stripe; we store only your Stripe Customer ID and never see or store card numbers.

Data Sharing

We may share limited data with the following trusted service providers solely to operate the Service:

• Stripe for payment processing and subscription management. Stripe is PCI-DSS compliant.
• Hosting and infrastructure providers to store and serve the application and your drill data.
• Email delivery services to send transactional notifications on our behalf.

All providers are bound by strict data processing agreements and are prohibited from using your data for their own purposes. We may also disclose data if required by law or court order.

Data Retention & Security

We retain your account data for as long as your account is active. If you delete your account, we will remove your personal data within 30 days, except where we are required by law to retain certain records.

We implement industry-standard security measures including encrypted data transmission (HTTPS/TLS), hashed password storage, and strict access controls. No method of transmission over the internet is 100% secure, and we cannot guarantee absolute security.

Your Rights

Depending on your location, you may have the following rights regarding your personal data:

• Access: request a copy of the personal data we hold about you.
• Correction: ask us to correct inaccurate or incomplete data.
• Deletion: request that we delete your personal data, subject to legal retention obligations.
• Portability: receive your data in a structured, machine-readable format.
• Withdrawal of consent: opt out of non-essential communications at any time.

To exercise any of these rights, contact us below. We will respond within 30 days.

Cookies & Local Storage

DrillFlow uses browser local storage to save your drills and application preferences directly on your device. This data never leaves your browser unless you explicitly share a drill via a share link.

We may use minimal session cookies for authentication. We do not use third-party tracking cookies or advertising cookies.

Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will revise the "Last Updated" date at the top of this page. For material changes, we will notify you by email or by a prominent notice within the Service. Your continued use of DrillFlow after changes are posted constitutes acceptance of the revised policy.

Deleting your data

You can delete drills, plans, assignments, teams, entries, and your saved calendar setup from inside the app. To delete your account and everything tied to it, contact us at DrillFlowca@gmail.com and we will remove it.

Contact Us

Questions about this Privacy Policy? Reach out directly: