Privacy Policy

1. Information We Collect

We may collect the following types of information:

• Account Information: Name, email address, and other details you provide when creating an account.
• Usage Data: Information about how you interact with the Service, including session data, feature usage, and app performance metrics.
• Voice and Audio Data: Recordings and transcripts generated during roleplay practice sessions and, when you use CoachCraft Calls, recordings and transcripts of calls made through that feature.
• Phone and Messaging Data: Mobile numbers, message content, delivery information, consent records, opt-out status, and related timestamps when CoachCraft calling or messaging features are used.
• Performance Data: Scores, feedback, and coaching insights generated by the Service.
• Device Information: Device type, operating system, and unique device identifiers.
• Plugin and Integration Information: When you connect a CoachCraft Teams account, we process the connected account identity, OAuth client and requested identity scopes, selected Team context, authorization status, tool requests, and limited audit information needed to provide and secure the integration. The CoachCraft MCP grant and audit tables do not store OAuth access or refresh tokens.
• Download Attribution Information: If you open an attributed CoachCraft download link, the link provider, app store, and mobile app may process source and campaign values, device or advertising identifiers where permitted, install status, and app-open events.
• Payment Information: Subscription and purchase details are processed by the platform's app store (e.g., Apple App Store). We do not directly collect or store your payment card information.

2. How We Use Your Information

We use the information we collect to:

• Provide, maintain, and improve the Service.
• Deliver AI-powered coaching, feedback, and personalized recommendations.
• Process your transactions and manage your subscription.
• Communicate with you about updates, support, and promotional offers.
• Analyze usage patterns in aggregate to improve product quality.
• Measure whether a CoachCraft download source leads to an app install, registration, trial, or subscription.
• Ensure the security and integrity of the Service.

3. Voice Recordings and AI Processing

Your voice recordings and roleplay session data are processed to provide you with personalized coaching and performance feedback. Your recordings are not used to train general-purpose AI models. We may use aggregated, anonymized data to improve the overall quality of the Service.

When an eligible Teams manager asks CoachCraft to generate a custom roleplay draft, CoachCraft sends the bounded roleplay brief fields to OpenAI to generate a structured private draft. That provider request does not include the Team identifier, CoachCraft user identifier, participant records, performance records, or session transcripts. CoachCraft validates the returned draft before saving it. OpenAI may also process the conversation and CoachCraft tool results when ChatGPT is the third-party host, as described below.

4. CoachCraft Plugin and App Download Handoff

You may use CoachCraft through a third-party host such as ChatGPT. The host processes your conversation and the CoachCraft tool results it receives under its own terms and privacy policy.

A Teams connection uses Supabase Auth and your existing CoachCraft account. You may use an existing signed-in session or receive an email one-time code or sign-in link. Before approval, the consent screen identifies the requesting client, your current selected Team, and the requested capabilities. Approval creates a time-limited, Team-bound CoachCraft authorization grant. Current Team membership, manager role, entitlement, and capability are checked again when a protected tool is used.

In the initial Individual download experience, CoachCraft’s anonymous download tool accepts no user input and does not receive, store, or transfer your prompt, roleplay brief, email address, ChatGPT conversation identifier, or CoachCraft account identity. If you create a brief in the host, you copy or recreate it in the CoachCraft app yourself.

Network and security infrastructure may process ordinary connection metadata, such as IP address, request headers, timestamp, and request outcome, to deliver and protect the integration. We do not intentionally include prompt or scenario content in that anonymous request.

The fixed download link uses AppsFlyer campaign attribution and may redirect through Apple. After installation, the CoachCraft app may provide bounded attribution information to AppsFlyer, Amplitude, and Adapty so we can measure registration, subscription, and revenue outcomes. Availability of identifiers depends on device settings, platform rules, and applicable law.

5. SMS Messaging Data

If you separately opt in to a CoachCraft SMS program, we collect your mobile number, consent record, and text-message content to operate that program. Message frequency varies; for the invited CoachCraft Calls product test it is typically one to five messages during an active test session. Message and data rates may apply. We do not sell, rent, or share mobile numbers or text messaging originator opt-in data and consent with third parties or affiliates for their marketing or promotional purposes. We may disclose this information only to service providers acting on our behalf to deliver the messaging service, or when required by law.

6. Data Sharing

We do not sell your personal data, voice recordings, or session transcripts. We may share information only in the following circumstances:

• Supabase: Supabase provides CoachCraft account authentication, email sign-in delivery, OAuth authorization, database, and backend infrastructure and processes the data needed for those services.
• OpenAI: OpenAI processes information when you use CoachCraft through ChatGPT. For the Teams custom-roleplay draft tool, CoachCraft also sends the bounded roleplay brief to OpenAI for generation as described above. The other Teams MCP tools do not make a separate CoachCraft-server request to an AI provider.
• Other Service Providers: We work with service providers who assist us in operating the Service, including hosting, analytics, payment processing, calling, and message delivery. These providers may use information only to provide services on our behalf and are required to protect it.
• Attribution and Analytics Providers: AppsFlyer, Amplitude, Adapty, and app-store providers may process bounded device, campaign, install, app-use, and subscription information as described above and under their own terms.
• Legal Requirements: We may disclose information if required by law, regulation, or legal process.
• Business Transfers: In connection with a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction.

7. Data Security

We implement industry-standard technical and organizational measures to protect your information. Data is encrypted in transit and at rest. However, no method of electronic transmission or storage is 100% secure, and we cannot guarantee absolute security.

8. Data Retention and Deletion

We retain your information for as long as your account is active or as needed to provide the Service. You may request deletion of your account and associated data at any time by contacting us. Upon a valid deletion request, we delete or de-identify personal data within 30 days except for the limited records kept for the periods below or where a longer period is required for security, fraud prevention, legal compliance, or dispute resolution.

For the CoachCraft Teams integration, saved practice-plan and custom-roleplay drafts expire after 14 days. Rate-limit events older than 24 hours and metadata-only tool audit records older than 365 days are deleted by the daily retention process.

During OAuth consent, CoachCraft temporarily stores a SHA-256 hash of the authorization reference together with the exact account, client, selected Team, redirect URI, and scopes shown for consent. CoachCraft does not retain the original authorization reference in that preview record. The preview expires within 10 minutes and is deleted on the next daily retention run.

An approved Teams OAuth grant expires after 365 days unless it is revoked sooner. Expired grants are deleted on the next daily retention run. A revoked grant is retained for up to 30 days for security and audit purposes and is deleted sooner if its original expiration occurs first. OAuth client registration settings are retained while that integration client remains configured; they contain client configuration, not prompts or Team content.

These integration periods do not replace retention rules for the underlying CoachCraft account, roleplay sessions, or records a Team customer is required or permitted to retain. Infrastructure, authentication, AI, app-store, attribution, and analytics providers may process separate operational records under their configured services and terms. The periods above describe CoachCraft-controlled integration records; they do not assert a retention period for provider logs. We verify production provider data-control and logging settings before making a new public integration available.

9. Your Rights

Depending on your jurisdiction, you may have the right to:

• Access the personal data we hold about you.
• Request correction of inaccurate data.
• Request deletion of your data.
• Object to or restrict certain processing of your data.
• Data portability where applicable.

To exercise any of these rights, please contact us at the address below.

10. Children's Privacy

The Service is not intended for children under the age of 13. We do not knowingly collect personal information from children under 13. If we become aware that we have collected data from a child under 13, we will take steps to delete it promptly.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy within the app or on our website. Your continued use of the Service after changes are posted constitutes acceptance of the updated policy.

12. Contact Us

If you have questions about this Privacy Policy or wish to exercise your data rights, please contact us at:

Elevated Apps LLC
Email: support@coachcraft.ai