Privacy Policy

1. Who We Are

PitchFilthy is a product of Karls Group LLC ("Company", "we", "us", or "our"). Karls Group LLC operates the website and platform available at pitchfilthy.com and associated subdomains (the "Service").

This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Service. Please read this carefully. If you do not agree with the terms of this Privacy Policy, please do not use the Service.

For privacy inquiries, contact us at: pitchfilthy@gmail.com

2. Information We Collect

2.1 Information You Provide

When you create an account or use the Service, we may collect:

• Account information — your name, email address, and authentication credentials, managed through our authentication provider, Clerk.
• CSV upload data — pitch tracking files you upload from Trackman, Rapsodo, Yakkertech, or other supported systems. These files may contain performance data about third-party athletes (e.g., pitchers, batters), including physical measurements such as release height, arm angle, extension, plate location, and spin rate.
• Images and attachments — team logos, player headshots, and files you attach to player development plans.
• Organization data — if you create or join a team, the organization's name, member roles, and the email addresses used to invite members.
• Communications — messages you send us via email or support channels.

2.2 Information Collected Automatically

• Usage data — pages visited, features used, timestamps, and session duration.
• Device and browser data — IP address, browser type, operating system, and referring URLs.
• Cookies and local storage — see our Cookie Policy for details.

2.3 Third-Party Athlete Data

CSV files you upload may contain performance statistics, names, physical measurements, or identifiers related to athletes who are not users of the Service. You are responsible for ensuring you have appropriate authorization to upload and process any third-party data.

2.4 Data Isolation and Organization Sharing

For individual accounts, your uploaded data is scoped exclusively to your account. The Player Search feature and all report features query only the uploads associated with your account, and no other user can search, view, or access athlete data from your CSV files.

If you use a Team or Facility plan, you can create an organization and invite other people to it. Within an organization, data is shared as follows: owners and coaches can view, generate, and manage reports created within the organization; players you invite can sign in and view only the reports specifically assigned to them, and cannot see other players' data or access coaching tools. Members are added by email invitation, and an owner or coach can remove a member at any time. We do not otherwise expose your uploaded data to users outside your organization, and we do not aggregate data across unrelated accounts for any user-facing feature.

2.5 Team and Organization Data

When you create or join an organization, we store organization membership records — including each member's role (owner, coach, or player), status, and the email address used to invite them — so we can operate team accounts, enforce plan seat limits, and route assigned reports to the correct players.

2.6 Uploaded Images and Attachments

In addition to CSV files, you may upload other content that we store to provide the Service, including team logos and player headshots used to brand your reports, and files you attach to player development plans. This content is stored on our behalf by our cloud storage provider (Supabase) and is scoped to your account or organization in the same way as your other uploads.

2.7 Account Preferences

We store account-level preferences you set, such as your light/dark display-mode choice, so your settings follow you across devices when you are signed in.

2.8 Analytics and Error Monitoring

We use PostHog, a third-party product-analytics service, to understand how the Service is used — which features are used and where users run into friction — and to capture application errors and performance data so we can diagnose and fix issues faster and more reliably. PostHog processes usage events and device/browser information, and may capture session recordings in which all form inputs (such as email and payment fields) are masked. Your uploaded CSV files and generated report contents are not sent to analytics. We use this strictly to operate, debug, and improve the Service. We do not use it for advertising, and we do not sell this data. PostHog acts as a data processor on our behalf.

3. How We Use Your Information

We use the information we collect to:

• Create and manage your account
• Provide, operate, and improve the Service
• Generate pitching, hitting, umpire, catcher, and bullpen reports, player development plans, and 3D pitch visualizations from your uploaded data
• Enable report sharing links and the Player Search feature
• Operate team and organization accounts — including inviting members, assigning reports to players, and enforcing plan seat limits
• Process subscription payments and send billing communications
• Respond to support requests and communications
• Understand how the Service is used — which features are used and where users hit friction — so we can improve the user experience and diagnose and fix issues faster and more reliably
• Monitor for abuse, security threats, and technical issues
• Comply with legal obligations
• Produce anonymized, aggregated statistical data (from which all personally identifiable information has been removed) for internal product analytics, platform benchmarking, and service improvement. Athlete names are never included in any aggregated or benchmarked dataset.

We do not sell your personal data or uploaded athlete data to third parties.

4. How We Share Your Information

4.1 Service Providers

We share data with trusted third-party vendors who process data on our behalf:

• Clerk — user authentication and session management
• Supabase — cloud database storage for your account data, uploads, and reports
• Vercel — hosting, content delivery, and edge infrastructure
• Stripe — payment processing and subscription billing
• PostHog — product analytics and session replay, used only to improve the user experience and diagnose and fix issues

Each of these providers is contractually bound to protect your data and use it only to perform services for us.

4.2 Shared Report Links

When you generate a shareable report link, the report content (including athlete performance data in that report) is accessible to anyone with the link. Share links expire after 14 days. You are solely responsible for deciding who you share these links with.

4.3 Legal Requirements

We may disclose your information if required by law, court order, or governmental authority, or if we believe disclosure is necessary to protect the rights, property, or safety of PitchFilthy, our users, or the public.

4.4 Business Transfers

In the event of a merger, acquisition, or sale of all or substantially all of our assets, your information may be transferred to the acquiring entity, subject to the same privacy protections described here.

5. Data Retention

We retain your data for as long as your account is active or as needed to provide the Service:

• Account data — retained until you delete your account
• Uploaded CSV files — retained until you delete the upload or close your account
• Images and attachments — logos, headshots, and development-plan attachments are retained until you delete them or close your account
• Organization membership records — retained while your organization is active; a removed member's membership record is deleted when they are removed
• Pitch row data — retained until the associated upload is deleted or your account is closed; pitch row data tied to deleted uploads is removed within 30 days of deletion
• Shared report links — automatically expire and are deleted after 14 days
• Usage and log data — retained for up to 90 days for security and operational purposes

You may delete your uploaded data at any time through the Uploads page in your dashboard. To delete your account entirely, contact us at pitchfilthy@gmail.com. Account deletion requests are processed within 30 days of receipt. Upon processing, your account data and associated pitch row data will be permanently deleted, except where retention is required by applicable law or legitimate business necessity (such as billing records required for tax purposes).

6. Data Security

We implement reasonable administrative, technical, and physical safeguards to protect your information, including:

• Encryption in transit via HTTPS/TLS
• Encrypted database storage through Supabase
• Row-level security policies restricting data access to the account owner
• Authentication handled by Clerk with industry-standard session management

No method of transmission over the Internet or electronic storage is 100% secure. While we strive to use commercially acceptable means to protect your data, we cannot guarantee absolute security.

7. Data Breach Notification

In the event of a confirmed security breach affecting personal data stored on our systems, we will:

• Notify affected users within 72 hours of discovery, or as soon as reasonably practicable given the circumstances
• Describe, to the extent then known, what categories of data were affected, the scope of the incident, and the steps we have taken to contain and remediate the breach
• Provide recommended actions you can take to protect yourself, such as changing passwords or monitoring account activity
• Notify relevant regulatory authorities as required by applicable law, including applicable state data breach notification laws

Notification will be delivered to the email address associated with your account. If you believe your account has been compromised, contact us immediately at pitchfilthy@gmail.com.

8. Your Rights and Choices

Depending on your location, you may have certain rights regarding your personal data:

• Access — request a copy of the personal data we hold about you
• Correction — request correction of inaccurate personal data
• Deletion — request deletion of your personal data, subject to legal obligations
• Portability — request a copy of your personal data in a portable format (e.g., CSV export of your account information). To request a data export, email pitchfilthy@gmail.com with the subject line "Data Export Request." We will provide your data within 30 days.
• Opt-out of marketing — unsubscribe from any marketing emails at any time

To exercise any of these rights, contact us at pitchfilthy@gmail.com. We will respond within 30 days. We may need to verify your identity before processing your request.

California Residents (CCPA)

California residents have additional rights under the California Consumer Privacy Act (CCPA), including the right to know what personal information we collect, the right to opt out of the sale of personal information (we do not sell personal information), and the right to non-discrimination for exercising your privacy rights.

Physical Performance Measurements and Biometric Data

The Service processes physical performance measurements that may be uploaded as part of CSV files, including release height, arm angle, extension, plate location, spin rate, and body position data. Depending on jurisdiction, some of these measurements may qualify as biometric information or physical characteristic data subject to heightened legal protection. For example, the Illinois Biometric Information Privacy Act (BIPA) and similar laws in other states impose specific consent, retention, and destruction requirements on biometric data.

We do not independently assess whether any specific data point in a user's CSV upload qualifies as biometric data under applicable law. Users should not upload physical measurement data for athletes located in or subject to the laws of Illinois, Texas, Washington, or any other jurisdiction with biometric privacy protections without first obtaining any required written consents from those athletes (or their guardians, if minors). If you believe we hold biometric data subject to your rights under applicable law, contact us at pitchfilthy@gmail.com.

9. Children's Privacy

The Service is not directed to children under the age of 13, and we do not knowingly collect personal information from children under 13. If you are a parent or guardian and believe we have inadvertently collected personal information from your child, please contact us immediately at pitchfilthy@gmail.com and we will promptly delete the information.

Users between the ages of 13 and 18 must have parental or guardian consent to use the Service. By using the Service, you represent that you are either 18 or older, or have obtained required parental consent.

While the Service is restricted to users aged 13 and older, CSV uploads frequently contain performance data about minor athletes who are not users of the platform. Users are solely responsible for obtaining any consents required by applicable law before uploading performance data, biometric data, or any other personal information about minors. We do not verify whether athletes named in uploaded files are minors, and we cannot obtain consent on your behalf.

10. Third-Party Links

The Service may contain links to third-party websites. We are not responsible for the privacy practices of those sites and encourage you to review their privacy policies before submitting any personal data.

11. Changes to This Policy

We reserve the right to update this Privacy Policy at any time. When we make material changes, we will update the "Last updated" date at the top of this page and, where appropriate, notify you by email or through the Service. Your continued use of the Service after changes become effective constitutes acceptance of the revised policy.

12. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

Karls Group LLC
Email: pitchfilthy@gmail.com