Privacy Policy

How we handle your information.

Last updated: October 18, 2026 · Version 3.8

1. Who we are

Foundation Tennis Lab ("FTL", "we", "us") is an off-court tennis education app for junior tennis players ages 8 and up. It is operated as a sole proprietorship by its founder from Vaughan, Ontario, Canada. Our founder is the person responsible for privacy at FTL (our "Privacy Officer" under Canadian law). You can reach him at [email protected].

Operator contact details (also for the U.S. Children’s Online Privacy Protection Act): Foundation Tennis Lab, 2916 Highway 7, Unit 219, Vaughan, Ontario L4K 0K6, Canada · phone +1 (715) 388-3396 · email [email protected].

This policy covers the website (foundationtennislab.com), the kid app (/app), the Parent Portal (/parent), the Coach Portal (/coach) and our Android app, Foundation Tennis Lab on Google Play (package com.foundationtennislab.app).

The Android app. It opens the same kid app and Parent Portal as the website and collects the same information described in this policy, nothing more. It asks for no device permissions such as camera, microphone, location, contacts or photos, shows no ads and does not use the Android advertising ID. Google Play’s own handling of your data (for example when you download or update the app) is Google’s, under Google’s privacy policy.

2. How FTL accounts work

• Parents (18 or older) create the account, pay for the subscription, and add each child as a player. The child uses the app on the parent's account. Children never sign up on their own and never give us an email address, phone number or payment details.
• Coaches have a separate, free Coach Portal. A coach can see a child's progress only if the parent links that coach (see section 5).

3. What we collect

About your child (entered by you, or created as your child uses the app)

• Player name — the first name or nickname you enter when you add your child. This name appears inside the app and on the in-app leaderboard, so please use a nickname or first name only, never a full name.
• Avatar — the illustrated character your child picks.
• Age — the age you pick when you add your child (8 to 17, or 18+). We do not ask for a date of birth.
• Class code (optional) — if your child's coach or academy gave you one.
• Sync code — a code like FTL-XXXX-XXXX that we generate so progress can be restored on another device or shared with a coach.
• Progress — which lessons, quizzes and exercises were completed and when, quiz scores, streak days, XP, time spent on each lesson, characters and badges unlocked, trivia scores.
• Match Brain reflections — the answers your child types before and after a real match (for example how nervous they felt, what went well, what to try next, and the opponent's first name and score if your child enters them).
• Reminder address (only if reminders are turned on on that device) — the push address the device’s browser or our Android app gives us, its two encryption keys and the device’s time zone, so Ace’s reminders can reach that device at a sensible hour. See “Reminders” in section 4.
• Days the app was opened — the dates (no times, nothing else) on which your child opened the app. We use them only for the “still playing” email described in section 4 (how many of the last 7 days your child opened FTL), and delete each date after 60 days.
• Device details — device type, browser (or our Android app) and screen size, used only to fix problems.

We do not collect from children: last names, home addresses, phone numbers, email addresses, photos, video, voice recordings, precise location, biometric data, contacts, or any social-media information.

About you (the parent)

• Name, email address and a password (stored as a hash, never in plain text), or your Google account email if you sign in with Google.
• Your plan and billing status (for example "Family, yearly, active"). Card details are collected and stored by Stripe, our payment processor. We never see or store your card number.
• Where you live: your country, and your province or state if you live in Canada or the United States. We use it to see where families join from and to know which laws, taxes and languages apply to your account. It is never shown to other families.
• If you choose to tell us: how you heard about FTL (for example Instagram, a friend, or your coach). It is optional and only used to see which ways of finding FTL work.
• Your consent record: the date and time you consented, the IP address and browser used, and the version of this policy you agreed to.
• High-Five messages you send to your child, and any emails you send us.
• A parent PIN, if you set one to protect the Parent Portal on a shared device (stored as a hash).
• The language you pick for the Parent Portal, if it is not English. Our emails about your child’s free days are then written in that language too.

About coaches

• Name, email address, password (hashed) or Google sign-in, academy name, class-code prefix, referral code.
• Private notes you write about your students, and session-prep data generated from your students' progress.
• Payout details for the Coach Referral Program (payout method and, once earnings reach the legal threshold, a tax identifier). See the Coach Referral Program Agreement.

Collected automatically

• Server logs at our host (Cloudflare): IP address, page requested, time, browser. Kept for a short period for security.
• Error reports (Sentry): on the website, the Parent Portal and the Coach Portal, technical details of errors are sent to Sentry only if you choose "Accept all" on our cookie banner; until then the page does not load Sentry at all. From your child’s app, error reports are sent only if you turn on "Send crash reports from my child’s app" in your Parent Portal Settings (it is off unless you turn it on). These reports are configured not to include names or other personal details. If you choose "Essential only", or leave that switch off, error reporting stays off. Our server also forwards browser security reports — the page address, the blocked resource and the browser type, no account data — to Sentry so we can spot attacks.
• Cookies and local storage: see section 8.

4. How we use this information

• To run the app: show lessons, track progress, keep streaks, unlock characters and badges, and restore progress on another device.
• To show you your child's progress in the Parent Portal, suggest questions to ask your child, and produce the monthly report.
• To show a linked coach their students' progress so they can prepare on-court sessions.
• To run the in-app leaderboard (player name, avatar, level, streak and scores only; visible to signed-in FTL families only).
• To take payments through Stripe, send receipts, and handle refunds.
• To send service emails: account confirmation, password reset, a note when your child finishes their first lesson, receipts, a reminder about 30 days before a yearly plan renews, and important changes to the service or this policy. We do not send marketing emails unless you opt in, and every marketing email will include an unsubscribe link (Canada's anti-spam law, CASL, applies).
• To send up to three emails about your child’s free days, each about a player only once: one about a day before the free days end (what your child did so far, or how to open FTL if they have not started), one when the free days have ended (what stays free and saved), and, if your child still opens the app on at least 3 of the last 7 days after the free days ended, one “still playing” email a few days later. They are sent only to families who never had a paid plan, and every one has a one-click link to stop them.
• To answer your support requests and to keep the service secure and prevent fraud or abuse.
• To meet legal obligations, such as tax and accounting records.

We do not use personal information for advertising, for building marketing profiles, for selling to anyone, or for training artificial-intelligence models. We do not sell or rent personal information, and we have never done so.

Reminders

If reminders are turned on, your child’s device can get a short reminder from Ace, the app’s assistant, up to once a day, for up to 7 days after your child stops playing; then they stop until your child opens the app again. Reminders are sent only during the day on the device’s own clock. They can be turned off at any time in the app’s Settings, or by you in the Parent Portal (Settings, Daily reminders). A reminder contains no personal information: no name, nothing about your child’s progress, just one of the same few lines every player gets. It is delivered, encrypted, through the push service of the device’s browser (for example Google or Apple), which cannot read it. When reminders are turned off on a device, or a device stops accepting them, we delete or stop using its reminder address.

5. Children's privacy (COPPA and PIPEDA)

FTL is built for children ages 8 and up, which includes children under 13. We follow the U.S. Children's Online Privacy Protection Act (COPPA) and its Rule as amended in 2025, Canada's Personal Information Protection and Electronic Documents Act (PIPEDA), and the Office of the Privacy Commissioner of Canada's guidance on children's privacy. This section is our direct notice to parents.

Consent comes first

We do not collect or keep a child's personal information until a parent or legal guardian has given consent. To give consent, you create a Parent Portal account, confirm your email address by clicking the link we send you (or sign in with a Google account, which Google has verified), tell us you are 18 or older and the child's parent or legal guardian, and tick a consent box that describes what we collect. We keep a record of each consent (date, time, IP address, browser and policy version). This is the "email plus" method the FTC accepts for services that use children's information internally and do not share it for marketing.

We collect only the information the app needs. We never make a child's participation depend on giving us more information than is reasonably necessary.

Who can see your child's information

• You, in the Parent Portal.
• A coach, only if you say yes. A coach can see your child’s progress only after you agree in the Parent Portal. When you enter a coach’s class code, or a coach enters your child’s sync code, we ask you first: “Share [your child]’s progress with Coach X?” If you say no, or don’t answer, nothing is shared. If you say yes, that coach sees your child’s player name and avatar, lessons and quizzes finished, quiz scores, XP, level and streak, time spent on each lesson, Match Brain answers and the coach’s own private notes — never your email, payment details or address. You can stop sharing at any time with the switch on your child’s card (or by emailing us), and the coach loses access straight away. Sharing with a coach is a separate choice from creating the account.
• The in-app leaderboard (the Board). Other signed-in FTL families see only your child’s one-word nickname, cartoon avatar and game stats (level, XP, current and best streak, Focus Score, lessons finished and best Trivia score). No real names, photos, ages, locations or contact details, and children can’t message each other — FTL has no chat, comments or messages anywhere. Nicknames that look like an email, @handle, link or phone number are refused, and the Board shows “Player” instead. The Board is on by default in Canada, the United States and most other countries; in the EU/EEA and the UK it starts off and you can turn it on. Either way you can turn it off or on at any time with “Show on leaderboard” on your child’s card. A hidden child still sees the Board and their own row, but other families don’t see them. The Board is never on the open web.
• Our service providers listed in section 7, who process the information only to run the app for us and are bound by contract to protect it.

We do not share children's information with anyone else. We do not disclose it to advertisers, data brokers or analytics companies.

What the app never has

• No advertising of any kind.
• No chat, messaging, comments, friend lists or any way for users to contact each other.
• No public profiles and no search for other players.
• No in-app purchases for children; all payments are made by the parent.
• No third-party trackers, ad networks or social-media plug-ins.

Your rights as a parent

At any time you may: review the information we hold about your child (Parent Portal or email); correct it; refuse to let us collect or use any more of it; and have it deleted. To delete a child, use "Remove" on the child's card in the Parent Portal, or delete your whole account under Settings, or email [email protected] with your name and your child's player name or sync code. We answer within 5 business days and complete deletion within 30 days. Step by step, with what is deleted and when: foundationtennislab.com/delete-account. Refusing further collection ends your child's use of the app, because the app cannot work without tracking progress.

If we learn that we have collected personal information from a child under 13 without a parent's consent, we delete it as soon as we can.

How long we keep children's information

We keep your child's information only as long as it is needed to run the app for your child:

• While your account is active, we keep it so progress, streaks and reports work.
• When you remove a child or delete your account, that child's information is deleted from our live systems immediately and from backups within 30 days.
• If a Parent Portal account has not been signed in to for 24 months, we email you a warning and then delete the children's information on that account 30 days later.
• Consent records are kept for 3 years after deletion so we can show that consent was given, as the law requires.
• The record of which days the app was opened is deleted after 60 days.
• Error reports (Sentry) are deleted after 90 days. Server logs are kept for no more than 30 days.

We never keep children's personal information indefinitely.

Security for children's information

Our founder is responsible for our information-security program. It includes: encrypted connections everywhere, hashed passwords, database rules that let each account see only its own data, signed links for lesson files, a parent PIN option for shared devices, least-privilege access to our providers, and a review of these safeguards at least once a year. We check that each provider we share information with can keep it secure and we rely on their written data-protection terms.

6. Where information is stored

Our providers store information mainly in the United States, and Cloudflare serves the site from data centres around the world. This means your information and your child's information leave Canada. Canadian law allows this when we protect the information by contract, which we do. Government or law-enforcement bodies in those countries may have the right to request access to information stored there.

7. Service providers we share information with

These companies process information only on our instructions and only to run FTL. Each has its own privacy policy.

• Supabase (United States) — our database and sign-in system. Holds parent, coach and child records, progress and reflections. Privacy policy
• Cloudflare (global) — hosts the website and app, protects lesson files, and keeps server logs. Privacy policy
• Stripe (United States) — payments and subscriptions. Receives the parent’s name, email, billing address and card details; receives nothing about children. New subscriptions are sold through Link (Stripe’s Managed Payments) as the seller of record: Stripe/Link then also uses your payment information under its own privacy notice to work out tax, check for fraud, send receipts and handle payment support. Privacy policy · Link privacy
• Resend (United States) — sends our service emails to parents and coaches. Receives the email address and the content of the email. Privacy policy
• Sentry (United States) — error reports: on the website and portals only if you accept optional cookies, from your child’s app only if you turn on crash reports in Settings, and the browser security reports our server forwards (see section 3). Privacy policy
• Google — only if a parent or coach chooses "Sign in with Google". Google tells us your name and email address. Privacy policy
• Google Play — only if you install our Android app. Google Play delivers and updates the app under Google’s own privacy policy; we receive no information about your child from it. Privacy policy
• YouTube — the videos in Ace's Film Room and Athletic Exercises are embedded from YouTube using YouTube's privacy-enhanced (youtube-nocookie.com) player. When your child plays a video, YouTube may still set cookies and collect viewing data under Google's privacy policy. No FTL account information is sent to YouTube.

We do not share personal information with any other company. If we ever need to add a provider that would receive children's information for a new purpose, we will update this policy and, where the law requires it, ask for your consent again.

8. Cookies and local storage

• Essential (always on): the sign-in session for parents and coaches; the kid app's saved state (progress, streak, character) in your browser's local storage (in the Android app, the same storage on the device) so it opens instantly; your cookie choice; and, when you visit a coach's referral link (foundationtennislab.com/coach/CODE), a first-party cookie for 70 days that records which coach referred you.
• Optional (only after you choose "Accept all"): error reporting through Sentry on the website and portals. Your child’s app follows your Parent Portal setting instead (see section 3).

We do not use advertising cookies, cross-site trackers, Facebook pixels or Google Analytics. You can change your choice by clearing your browser's storage for foundationtennislab.com; the banner will ask again.

9. Your rights (parents and coaches)

Wherever you live, you can ask us to: see the personal information we hold about you or your child; correct it; delete it; give you a copy in a machine-readable form; stop using it for a purpose; or withdraw consent (which ends the subscription for that child). Email [email protected]. We reply within 30 days and never charge for these requests.

If you are in Canada and are not satisfied with our answer, you can complain to the Office of the Privacy Commissioner of Canada. In Quebec, you may contact the Commission d'accès à l'information. If you are in the United States, you may contact the Federal Trade Commission. If you are in the European Economic Area or the United Kingdom, you have the rights set out in the GDPR and can contact your local data-protection authority.

10. How long we keep parent and coach information

• While your account exists, we keep it.
• If you cancel your subscription, your account and your child's progress stay so you can come back later. You can delete the account at any time under Settings; deletion from live systems is immediate and from backups within 30 days.
• Payment records (invoices and receipts) are kept for 7 years because Canadian tax law requires it. Stripe holds these; we keep only the invoice summaries.
• Coach payout and tax records are kept for 7 years for the same reason.
• The record of the box you tick to agree that your plan renews automatically (the plan and price shown, the wording, the date and time, and your browser type) is kept for 3 years after your subscription ends, so we can show what you agreed to.

11. Security and breaches

We use encrypted connections (HTTPS) everywhere, store passwords only as hashes, use row-level security so each account sees only its own data, and give our own tools the least access they need. No system is perfectly secure. If a breach of security creates a real risk of significant harm to you or your child, we will notify you and the Office of the Privacy Commissioner of Canada as soon as feasible, and we will report to other authorities where the law requires.

12. If you live in the EU/EEA or the UK

FTL is run from Canada. If you live in the European Union, the European Economic Area or the United Kingdom, the GDPR (or the UK GDPR) gives you the rights below. We have not appointed a representative in the EU or the UK; contact us directly at the details in section 1.

• Who decides how your data is used: Foundation Tennis Lab (the “controller”), at the contact details in section 1.
• Why we may use it (legal bases): to provide the app and the subscription you asked for (contract); a parent’s consent for a child’s information, the Board and coach sharing (consent — you can withdraw it at any time, which doesn’t affect what happened before); to keep FTL secure and fix errors (our legitimate interests); and to keep tax and payment records (legal obligation).
• Children: a parent or guardian creates the account and gives consent for their child. Children can’t sign up on their own. For children in the EU/EEA and the UK the Board starts off, and nothing is shared with a coach unless the parent says yes.
• Your rights: access, correction, erasure, restriction, data portability (a copy in a machine-readable form), objection, and withdrawing consent. Use the Parent Portal or email us; we answer within one month and never charge.
• International transfers: your information is stored mainly in the United States (see sections 6 and 7). Canada has an EU and UK adequacy decision for commercial organisations; for U.S. providers we rely on their data-processing terms, which include the European Commission’s standard contractual clauses (and the UK addendum), or the EU–U.S. Data Privacy Framework where the provider is certified.
• How to complain: you can contact us first, and you always have the right to complain to your local data-protection authority (in the UK, the Information Commissioner’s Office, ico.org.uk; in the EU, the authority in your country — list of EU authorities).
• No automated decisions with legal or similarly significant effects are made about you or your child.

13. Changes to this policy

If we make a material change, we will email every account holder at least 14 days before it takes effect and show the date and version at the top of this page. If a change would let us use children's information in a new way, we will ask for your consent again before doing so.

The Parent Portal and some of our emails can be shown in other languages. This policy is written in English, and the English version is the official one.

14. Contact

Privacy questions, requests or complaints: [email protected]
Privacy Officer: the founder, Foundation Tennis Lab.
Foundation Tennis Lab, 2916 Highway 7, Unit 219, Vaughan, Ontario L4K 0K6, Canada · phone +1 (715) 388-3396 · email [email protected].

---

This privacy policy reflects how Foundation Tennis Lab operates today. For questions specific to your legal situation, please consult a lawyer.