It replaces version 2026-08-21, which said no photographs were collected; from this version an athlete may add a profile photo if she wants one. It is optional, it is off unless she adds it, and nothing else changed.
The short version
- One coach. Her own athletes. Nobody else has access to any of this.
- The journal is private to the athlete. Not from her coach by policy — from her coach by construction. There is no screen, no export and no database query that returns an entry to anyone but her — unless she marks that one entry “Visible to Coach”, which she can do per entry and undo at any time. The coach sees the entries she marks and nothing else: not the others, and not how many there are.
- Goals and check-ins are shared with her coach. That is the point of them.
- A profile photo is optional. If she adds one, her coach sees it. If she does not, there is no photograph of her here at all.
- We do not run analytics. There is no tracking SDK in the app, of any kind.
- Anything here can be deleted, by her, from inside the app, permanently.
- Questions, or a request to delete an account: support@kenparsolutions.com
Who runs this
The app is operated by Kenpar Solutions, LLC on behalf of a single private-lesson softball coach, for her own athletes. It is not a service anyone can sign up for: an account exists only because that coach created an invitation for a specific athlete.
There is no second coach, no organisation above her, and no way for another coach's athletes to appear here.
What is collected, and where it comes from
From the coach, when she invites an athlete — the athlete's name, her birth year, and a parent or guardian's email address (and their name, if she provides it). This is also the record of the coach affirming she has that guardian's permission. See How consent works below.
From the athlete, when she creates her account — an email address and a password. The password is handled by our authentication provider and is never visible to the coach or to us.
From her device — its timezone, so a 7am quote arrives at her 7am, and a notification token if she turns notifications on. A notification token is specific to one phone and is deleted when she signs out on it.
What she writes and does in the app — journal entries, goals, check-ins against those goals, and quotes she saves. Also a record of which daily quote and nightly prompt were sent to her, and on what day, so the app does not send the same thing twice.
A profile photo, only if she chooses to add one. This is optional and there is no prompt to do it; an account with no photo stays that way indefinitely, and nothing in the app works differently either way. She picks it from her own photo library — the app has no camera access and never takes a picture — and she can replace it or remove it at any time from her Profile screen. Removing it deletes the image file itself, not just the app's link to it.
That is the complete list. There is no location data, no contacts, no address book, no photographs other than the one profile picture she may choose to add, no device identifiers beyond the notification token, and no profile built from behaviour.
Who can see what
This is the section that matters, so it is specific rather than reassuring.
Her journal — only her, unless she marks an entry for her coach. Every entry has a box on it, “Visible to Coach”, and it is empty unless she ticks it. An entry she has not marked is readable by nobody but her — not the coach, not a parent, not a guardian with a future login. This is enforced in the database itself: the rules that decide who may read a row grant an unmarked entry to nobody except its author, and there is an automated test suite that fails if that ever stops being true. A coach asking the app for an unmarked entry gets nothing back — not an error, not an empty entry, nothing. She also cannot see how many entries exist, or whether any exist, or when the last one was written.
An entry the athlete marks “Visible to Coach” can be read by her coach, under the athlete's name in the coach's app, for as long as it stays marked. The athlete can unmark it at any time and it disappears from the coach's view immediately; the coach's app does not keep a copy. Marking is per entry — there is no setting that opens the whole journal, and nothing she wrote before the box existed is visible unless she goes back and marks it herself. The coach cannot reply to an entry inside the app.
Her goals and check-ins — her and her coach. Goals are a shared thing by design: the coach can create one with a note attached, and she can create her own. Only the athlete can log a check-in.
Her name and birth year — her coach. These come from the invitation the coach created, so she already has them.
Her profile photo, if she added one — her coach, and her guardian. Stored privately, not on the open web: the file is not served at a public address, and the app fetches it through a link that is generated on demand and stops working after an hour. The same rules that decide who may read her name decide who may fetch the image, enforced in the same place. A coach who does not coach her cannot fetch it, and neither can a signed-in stranger. If she removes the photo, the file is deleted.
Aggregate counts — the operator only. One number is looked at to understand whether the app is being used at all: how many journal entries were written in a given week, added up across every athlete together. Never who wrote them, never what they said, never whether a particular athlete wrote any. The coach does not see even this.
A parent or guardian receives an email when their athlete's account is created, naming the coach and linking to this policy. In this version, guardians do not have their own login. If one is added later, it will provide read access to messages between coach and athlete — never to the journal.
What this app does not do
- No analytics, of any kind. There is no Google Analytics, no Firebase, no Amplitude, no Segment, no session recording, and no crash-reporting SDK. None is installed in the app, and none is planned.
- No automated reading of journal content. No sentiment analysis, no keyword flagging, no “concerning content” detection. This is a deliberate decision, not an omission: automated detection of distress is wrong often enough that being wrong would be worse than being absent. It follows that the app will not alert anyone if an athlete writes something worrying — a crisis-resources page is available inside the app at all times instead.
- No advertising, and no selling or sharing of data with anyone, for any purpose.
- No AI-generated content. Every quote and prompt is chosen by the coach.
How consent works
Before an account exists, the coach affirms she has permission from the athlete's parent or guardian, and supplies that guardian's email address. That affirmation is stored — who attested, for which athlete, when, and which version of this policy was in force.
The guardian is then emailed automatically, so a parent who did not expect this finds out immediately rather than later. That email names the coach, says what is collected, links to this policy, states plainly that the journal is private unless the athlete marks an entry for her coach, and gives an address for questions or for deleting the account.
The app does not attempt to verify parental consent itself. It requires the coach to affirm it, and keeps the record.
Keeping and deleting
Deleting an account. An athlete can delete her account from inside the app, and it removes everything: journal entries, goals, check-ins, saved quotes, her profile photo if she added one, her name, her sign-in, her notification tokens, the send history, and the invitation record including the guardian email address on it. It is immediate and it cannot be undone. A parent can request the same thing by email.
Backups. The database is backed up nightly to encrypted storage so that nothing is lost if something breaks. A deleted account's data remains in those backups until they expire on a schedule; nobody reads them in the ordinary course of operating the app, and they are not used for any other purpose.
Deleted data is gone from backups within 90 days.
Everything else is kept while the account exists, because it is the account: a journal with expiring entries is not a journal.
Notifications
If notifications are turned on, the app sends a quote in the morning and a prompt in the evening, at times the coach sets. Notification tokens are per-device and are removed when an athlete signs out on that device or when the device stops accepting them.
The coach receives one notification: when an athlete creates a goal for herself. That is the only thing the app ever tells her that the athlete did not tell her directly.
Where the data lives
Application data is held in a managed Postgres database (Supabase), profile photos in that same provider's private file storage, and backups in object storage (Cloudflare R2), all encrypted at rest. Push notifications are delivered via Expo and the relevant platform notification service. The guardian notice is sent via Resend. None of these providers is given data for their own purposes.
Changes
This policy is versioned by date, and the version in force when an account was created is recorded with that account's consent record. Material changes will be notified to the guardian email on file.
Contact
support@kenparsolutions.com — questions, corrections, or a request to delete an account.
Version 2026-08-22