Privacy Policy

Last updated

Terms of ServiceContact us

The short version

You can draw and animate a play on Playmaker without an account, without giving us your name, and without your play ever reaching our servers — an unsaved play lives in the address bar of your own browser.

If you make an account we store the plays you save, your email address, and a record of how you use the product. We set a long-lived cookie so we can tell a returning visitor from a new one. We take payments through Stripe and never see your card number. We send you email you can turn off in one click, apart from the few messages your account cannot work without.

The rest of this page is the detail, and it is written from what the software actually does rather than from a template.

Who we are, and how to reach us

Playmaker is a play designer for sports coaches, at playmaker.click, operated by OK200.

For anything on this page — a question, a correction, a copy of your data, a request to delete something — use the support page or email paul+playmaker@ok200.net. A person reads it.

What you can do without an account

Everything on the canvas. Placing players, drawing runs, animating, switching sport, loading a formation template and exporting a PNG all happen in your browser.

An unsaved play is held in the page's URL fragment (the part after #), compressed. Browsers never send a fragment to a server, so a play you have not deliberately saved or shared is not something we hold.

Two things are still true while you are signed out:

  • We set the analytics cookie described below and record what you do in the product (which sport, which tool, whether a play got animated) against it.
  • If you press Copy share link, that specific play is uploaded, because a link somebody else can open has to be readable by a server. See Share links below.

What we collect

Information you give us

  • Account: your email address, your name if you supply one, and either a password (stored only as a bcrypt hash — we cannot read it) or the fact that you signed in with Google. If you sign in with Google we receive your Google account's email address, name and profile picture URL. We never receive your Google password.
  • Two-factor authentication, if you turn it on: a secret and a set of recovery codes, stored encrypted.
  • The two-question survey we may show once, asking what kind of coach you are and what level you coach. Both answers are optional and both are stored on your account, because they are what tells us which coaches the product is actually for.
  • Support messages: whatever you write in the form on the support page, plus the email address you give us so we can reply.

Plays you save

A saved play is stored on our servers: its name, its sport, the positions and paths you drew, when you created and last changed it, and a small thumbnail image we render so your playbook has pictures in it. Thumbnails are kept on private storage and are served only to the account that owns them.

Share links

Pressing Copy share link uploads a snapshot of that play and gives you a URL of the form playmaker.click/p/xxxxxxxxxx. We also generate a preview image of the play so the link unfurls in a messaging app, and we count how many times the page has been viewed.

A share link is unlisted, not secret. It is not in our sitemap and not linked from anywhere, but anyone who has the URL can open it without signing in, and anything you put in a play's name is visible to them.

  • Share links you created while signed in are taken down when you delete your account, and can be deleted with the play. We do not expire them.
  • Share links you created while signed out are not attached to any account. There is currently no way for you to delete one yourself, because there is no way for us to tell that it was you who made it. Email support with the code from the URL and we will remove it.

A share link that nobody ever opens does not last forever. If a link you made while signed out has never once been opened — by you or by anybody else — we take it down 12 months after you created it, and delete it for good 30 days later. A link that has been opened at least once is not expired by age at all, however old it gets, because people are clearly still using it.

We also delete the generated preview image of any link nothing has opened for 90 days. That does not affect the link itself; we just draw the picture again if it is needed later.

How you use the product

We run our own analytics rather than handing your behaviour to an advertising network. It works like this:

  • On your first visit we set a cookie called playmaker_aid holding a random identifier (a UUID). It is not linked to you as a person until you make an account.
  • The cookie lasts two years, and the two years restart each time you visit.
  • Against that identifier we record events: the name of the thing that happened (play_created, share_link_copied, paywall_viewed and so on), a small set of properties describing it (which sport, which mode, how many plays you have saved), the path of the page it happened on, the page's referrer, and a per-tab session identifier.
  • Events also record your account ID once you have one, which means the history recorded before you signed up is joined onto your account when you sign up. That is deliberate: it is how we can tell what made someone decide the product was worth an account.

We do not record the contents of your plays as analytics, and we do not put anything free-text into an event.

Where you came from

When you first arrive we read the utm_* parameters on the URL, the referring site and the page you landed on, and we keep them in the same two-year cookie. If you go on to create an account, that first-touch information is copied onto the account and kept for as long as the account exists — it is how we know which of the things we do actually bring coaches in.

Payments

Pro subscriptions are taken through Stripe. Your card details are entered on Stripe's own checkout page and are never sent to, or stored by, us. What we store is what Stripe tells us: a customer identifier, a subscription identifier, the plan and its status, the card's brand and last four digits, and when the current period ends. Invoices and receipts come from Stripe's records, which is also where you manage or cancel the subscription.

Email we send, and whether you opened it

We record which of our emails were sent to you and when, so that nobody gets the same message twice. Links inside our email go through a signed redirect on our own domain before landing where they say they will, which lets us count clicks and attribute a signup to the message that caused it. We do not use tracking pixels to record opens.

Diagnostics when something breaks

When the application throws an error we send a report to Flare, an error-tracking service, so it gets fixed. The report is configured to strip credentials, tokens, two-factor secrets, Stripe payment details and email addresses, and to withhold the IP address of the person who hit the error. It still contains the URL, the stack trace and the shape of the request, and that can incidentally include an account ID.

Google Analytics

Alongside our own analytics we send Google Analytics 4 a copy of four events — account created, signed in, checkout started, purchase completed — so that Search Console and Google Ads have something to attribute traffic against. Google sets its own cookies to do this, and its use of that data is governed by Google's privacy policy, not ours. IP anonymisation is Google's default for GA4.

This is the one place a third party gets behavioural data about you. If you use an ad blocker or tracking protection it is very likely already blocked, and nothing in Playmaker breaks when it is.

Cookies we set

Cookie Why How long
playmaker_aid The anonymous analytics identifier described above, and the first-touch attribution attached to it. Readable by the page's own JavaScript, which is how events are tagged. 2 years, refreshed on each visit
Session cookie Keeps you signed in and carries the CSRF protection on forms. Encrypted. Until the session ends
playmaker_seen_playbook Remembers that you have already been shown the sample play and the first-visit tour, so you are not shown them again. 1 year
sidebar_state Remembers whether you collapsed the sidebar. 1 year
Google Analytics cookies Set by Google, for the conversion mirror above. Google's durations
Stripe cookies Set by Stripe on its own checkout and billing pages, including for fraud prevention. Stripe's durations

We do not show a cookie banner, and the analytics cookie is set on your first visit rather than after you agree to it. We are telling you that plainly here rather than implying a consent step that does not exist. If you would rather not be counted, block cookies for this site or use a tracking blocker — the product works either way — or email support and we will delete the events already recorded against your identifier.

Why we use any of it

  • To run the product: sign you in, store and show your plays, generate thumbnails and share previews, enforce the free plan's limit.
  • To take and manage payments, and to stop billing when you cancel.
  • To send the email described in the next section.
  • To decide what to build. This is what the analytics is for: which sports get used, where people give up, whether a change made the product better. Those questions are answered from aggregate counts.
  • To keep the service up and secure: rate limiting, abuse prevention, error diagnostics.
  • To meet obligations we have, such as keeping records of payments.

We do not sell your personal information. We do not share it with advertisers. We do not use your plays to train machine-learning models.

Email, and how to stop it

There are two kinds.

Transactional — email verification, password resets, payment receipts and security notices. These are part of having an account and cannot be switched off while the account exists.

Everything else — the welcome message, the short onboarding sequence over your first couple of weeks, a win-back message if you disappear, and product update announcements. Every one of these carries an unsubscribe link that works without signing in, and the List-Unsubscribe headers that make your mail client's own one-click unsubscribe button work (RFC 8058). Product updates are opt-in and can be toggled separately in your profile settings. Unsubscribe links do not expire — one in a two-year-old email still works.

Who else handles your data

We use a small number of providers to run the service. Each gets only what it needs:

  • Stripe — payments and subscription billing.
  • Amazon Web Services (SES) — sending email.
  • Google — Sign in with Google, if you use it; Google Analytics 4, as described above.
  • Flare (Spatie) — error diagnostics.
  • Our hosting and database provider — where the application and its data run.

Some of these operate outside Australia, including in the United States and the European Union, so using Playmaker involves your information being transferred and stored overseas.

How long we keep things

  • Your account and your plays — for as long as the account exists. See deletion below.
  • Raw analytics events — pruned after 12 months. The daily aggregate counts derived from them are kept indefinitely; those are totals, not rows about you.
  • First-touch attribution on an account — for the life of the account.
  • The record of emails we sent you — kept, so that a suppression or a "send-once" guarantee survives.
  • Payment records — as long as we are required to keep them.
  • Anonymous share links — kept for as long as people are still opening them. A link nobody has ever opened is taken down 12 months after it was created, and deleted for good 30 days after that. A link that has been opened at least once is kept indefinitely, until somebody asks us to remove one.
  • The preview image we generate for a share link — deleted once nothing has opened that link for 90 days. This does not affect the link, which keeps working; we simply draw the picture again if it is ever needed.

Deleting your account

You can delete your account yourself, from Settings → Profile, including if you only ever signed in with Google. When you do:

  • your plays and the share links you made while signed in stop resolving;
  • your email address is released, so you could sign up again with it later;
  • your password, remembered-login and API tokens are revoked;
  • any Pro subscription is cancelled and you are not billed again.

Be aware of what deletion does not currently do: the underlying account record is retained rather than erased, so that a deletion can be reversed if it was a mistake and so that we keep the payment history we are obliged to keep. Analytics events already recorded are not removed by the deletion, and neither are share links you created while signed out.

If you want the record itself erased rather than closed, email support and ask — we will do it, and we will tell you what could not be erased and why.

Your choices and your rights

Depending on where you live you may have rights to access, correct, delete or receive a copy of your personal information, to object to some processing, or to complain to a regulator. Australian privacy law and the GDPR both cover most of this.

In practice:

  • Access and correction — your account details are editable in Settings; your plays are visible in My Plays.
  • A copy of your data — there is no self-service export yet. Ask support and we will assemble it.
  • Deletion — as above.
  • Opting out of analytics — block cookies for this site, or ask support to delete what has been recorded against your identifier.

If you are in the EU or UK, our lawful bases are: performing our contract with you (running your account, taking payment), our legitimate interests (product analytics, security, error diagnostics), your consent (product update emails, the persona survey), and legal obligation (payment records).

If you think we have got something wrong, tell us first — paul+playmaker@ok200.net. If we cannot sort it out, you can complain to the Office of the Australian Information Commissioner, or to your local data protection authority.

Children

Playmaker is built for coaches and is not directed at children. Do not create an account if you are under 16 unless a parent or guardian agrees to these terms on your behalf. If you believe a child has given us personal information, email support and we will delete it.

Security

Everything is served over HTTPS. Passwords are bcrypt-hashed. Two-factor authentication is available and we recommend it. Play thumbnails are on private storage and served only to their owner. Share codes are long enough, and the routes that read them rate-limited hard enough, that guessing one is impractical. Session cookies are encrypted and are invalidated when a password changes.

No system is perfectly secure. If you find a vulnerability, please email paul+playmaker@ok200.net before disclosing it publicly.

Changes to this policy

If we change how any of this works we will change this page and move the date at the top of it. If a change materially affects you we will say so in the product or by email rather than hoping you re-read the page.