OneShot Privacy Policy

Effective date: September 2026

This Privacy Policy explains how OneShot ("we," "our," "us") collects, uses, and protects personal information when you use the OneShot app and related services. OneShot is built for high school athletes — many of whom are minors — so this policy is written to be readable by athletes and their parents or guardians alike.

1. Who uses OneShot

• Athletes — high school athletes (age 13+) building a recruiting profile: performance stats, highlight videos, academics, and personal brand.
• Coaches — college coaching staff discovering and evaluating athletes. Coaching accounts are reviewed before they can contact an athlete under 18.

2. Information we collect

Every piece of profile information in OneShot exists because a user entered it. We do not buy data about you or scrape it from other services.

3. How we use information

• Provide the service: profiles, scores, leaderboards, feeds, chat.
• Compute derived metrics (e.g., percentile scores against athletes of the same sport, position, and grade).
• Facilitate discovery: make athlete profiles visible to coaches on the platform.
• Send notifications you control in Settings.
• Keep the platform safe: moderation, fraud prevention, enforcing our Terms and Compliance Policy.
• Check content automatically: profile photos, pictures sent in messages, sampled frames from videos, and challenge clips are reviewed by an AI model to screen for unsafe content and to check that a challenge result matches its video. You can ask us to look again at any automated decision by writing to legal@oneshotathlete.com.
• Meet legal obligations.

We do not sell personal information. We do not serve third-party targeted advertising.

4. What other users can see

• Visible to coaches and other users: your athletic profile, public highlight videos, scores and leaderboard placements, academics you add, and your personal-brand content.
• Restricted by you: videos marked "Friends" or "Only Me" are enforced server-side; only the audiences you choose can view them.
• Never visible to other users: your phone number and private contact details, your notification settings, your saved lists, and your private messages (visible only to conversation participants).

Your profile photo has a public web address. Profile pictures are served from public storage so they load quickly on a recruiting profile. That means anyone who has the address of your photo can open it directly, without signing in to OneShot — and blocking someone does not take back an address they already have. We say this plainly because it is easy to assume otherwise. Two things that follow: choose a profile photo you are comfortable being seen publicly, and when you replace your photo we delete the previous file so its address stops working. Photos you send inside a conversation are different: they are private, and are served through links that expire after about fifteen minutes. One consequence worth stating plainly — if you block someone, a link their device already holds keeps working until it expires; blocking stops new access, it does not reach back into a link already issued.

5. Minors' privacy

No children under 13. OneShot is not directed to children under 13 and we do not knowingly collect their data (consistent with COPPA). Sign-up requires a date of birth; ages under 13 are refused. If we learn we hold data on a child under 13, we delete it promptly — write to legal@oneshotathlete.com.

Users 13–17 must have a parent or legal guardian's permission to use OneShot. A parent or guardian may:

• review the child's personal information,
• request corrections,
• request deletion of the account and its content,
• withdraw consent at any time,

by contacting legal@oneshotathlete.com with proof of guardianship.

Extra protections for minors:

• No sale of minors' data; no targeted advertising to minors.
• Coaches never see private contact details; all coach–athlete communication happens in-app, with blocking and reporting built in, subject to our NCAA-aligned Compliance Policy.
• California residents under 18 may request removal of content they posted (Cal. Bus. & Prof. Code § 22581). Deletion controls are built into the app, and we honor written requests.

6. Sharing

We share information only with:

• Service providers that operate parts of the platform for us, under their data-processing terms, and only to provide that service:
  • Supabase — our database, sign-in, file storage, and server functions.
  • Anthropic — the AI model that screens photos and video frames and checks challenge clips. It receives the image or frames and returns a result.
  • Resend — emails we send, such as a parent or guardian approval request and coach program verification.
  • Apple and Google, through Expo — delivering push notifications to your device.
  • PostHog — product analytics about how the app is used.
  • Sentry — crash and error reports, so we can fix what breaks.
• Legal authorities when required by law or to protect safety.
• A successor entity in a merger or acquisition, with notice to you.

7. Your rights

Depending on your location (GDPR, CCPA/CPRA, and similar laws), you may have the right to access, correct, delete, port, or restrict processing of your data, and to withdraw consent. In-app: Settings → Account covers most of these, including full account deletion. Otherwise: legal@oneshotathlete.com. We do not discriminate against users who exercise privacy rights.

8. Retention and deletion

• Account data lives as long as your account does.
• Deleting your account removes your profile, performance data, videos, messages, and personal content. Deletion is available directly in the app (Settings → Account → Delete Account).
• A limited set of safety records is kept for up to two years — reports made about an account, and moderation actions taken — so that deleting an account cannot erase a record of harm to somebody else, and cannot delete a report somebody else relied on. We also keep anything the law requires us to keep (for example, a legal hold). Details are on the account deletion page.

9. Security

Data is protected in transit (TLS) and at rest, access is controlled through row-level security so users can only read what they are authorized to see, and private videos are served through short-lived signed URLs.

10. International transfers

Data is processed in the United States. Where required, we use approved safeguards (such as Standard Contractual Clauses) for international transfers.

11. Changes

We will post material changes here and notify you in the app. Continued use after the effective date constitutes acceptance.

12. Contact

• Privacy requests: legal@oneshotathlete.com
• General legal: legal@oneshotathlete.com
• Address: OneShot, 6304 Wisteria Dr., Milton, FL 32570, USA