Privacy policy.

1. Who we are

GOLSZ is operated from Montreal, Québec, Canada. This policy explains how we collect, use, share, store and protect personal information when you visit golsz.com, create a GOLSZ account, build your Sports Passport, use the AI assistant ("Scout"), or open a shared Passport link. GOLSZ is for adults: you must be 18 or over to hold an account (see section 5). Our Terms & conditions also apply. [Legal review advised] the exact registered legal-entity name and address for the data-controller identification should be confirmed and inserted here.

2. Information we collect

Account information. When you sign up, we collect your full name, email address, a password, your date of birth, and the plan you chose. The app's sign-up form uses your date of birth to confirm that you are 18 or over.

Your Sports Passport. Your Passport holds what you choose to enter — for example sport, position and secondary position, gender, graduation year and education level, GPA, height, weight, playing foot, recruiting status, current and previous clubs, a career timeline, home and current city, country, citizenship, a short bio, a profile photo, and links to highlight footage.

Plan and training data. If you use the planning tools, we store your goal; your pathway and its sections, including any status, target date, requirements, blockers or evidence you write on a section; the steps on your plan, when each is due and when it was completed or dropped; your development plan and the days you tick off its habits; your benchmark results (with when, how and by whom each was measured); a daily record of your Passport Strength score on the days you open the app, so you can see whether it is improving; and your target list of schools and clubs — including any contact names, email addresses, notes and draft emails you add, and the status you record for each (for example, whether you have contacted them or they have replied). You enter all of it, and GOLSZ does not measure, score or verify the results themselves: the Passport Strength score counts what you have recorded and completed, not how good the numbers are. Contact details you add for a coach or anyone else are that person's personal information: only add what you are entitled to use.

Availability (health information). If you record in Settings, or by tapping Hurt in the daily check-in, that you are unavailable or limited — for example because of an injury — we store that status, the date it started, the date you expect to return and any note you add. This is information about your health. It is used to adjust your plan and Scout's advice, and it is included in what Scout receives about you (see section 6). We do not record a diagnosis. You can change or clear it at any time in Settings, or by answering the daily check-in again — tapping Great, or “I’m better”, clears it. [Legal review advised] health information is sensitive personal information under Québec's Law 25 and special-category data under the GDPR; counsel should confirm whether express consent must be captured before an athlete records it.

Photos. Your profile photo is stored in our file storage (Supabase Storage), in a folder belonging to your account. Uploaded images can be opened by anyone who has their web address — that is how your photo appears on a shared Passport.

Shared Passport links. If you create a share link, we store the link and record when it was last opened. Anyone with the link can see the Passport fields shown on the shared page: your name, profile photo, sport, position, club and country (unless you switch either off in Settings), graduation year, recruiting status, playing foot, height, weight, bio, highlight links and any verification badge, plus your benchmarks (with the method you recorded) and your career timeline if you switch those on in Settings. You can revoke a link at any time.

Scout, the AI assistant. When you use Scout we store:

• your conversations — your messages and Scout's replies, grouped by conversation so you can return to them;
• a short running summary of each conversation, which Scout uses instead of re-reading the whole transcript;
• Scout's notes about you ("Scout memory"): facts you have told it, its own inferences (recorded as inferences, with a confidence level), and your goals, preferences, concerns and the pathways you have considered or chosen. When something changes, the older note is kept as history and marked as replaced. Scout may also update your Passport and plan from what you tell it;
• a daily count of the Scout questions you ask and their estimated AI cost, linked to your account, so we can apply your plan's limits;
• for each reply, technical details — which AI model answered, the category of question, token counts, estimated cost and response time — recorded without your account identifier;
• copies of recent replies, linked to your account and to the wording of your question, so that a repeated or retried question can be answered without calling the AI again. A copy stops being used 24 hours after it was made; and
• when a general question doesn't match one of our prepared answers, up to 500 characters of the question and its category, saved without your account identifier so we can see which answers to write next. GOLSZ staff can read these. Because they can't be linked back to you, they are not deleted when you delete your account — so please leave your name and other identifying details out of general questions.

You can delete a conversation from Scout's history. That removes its transcript, but not what Scout has already saved to your Passport, plan or memory, or the conversation's summary; all of those are deleted with your account, and you can ask us to clear Scout's memory of you at any time.

Payment information. If you subscribe to a paid plan, checkout is handled entirely by Stripe — GOLSZ never receives or stores your card number. When you start checkout we pass Stripe your GOLSZ account identifier and email address, so the payment can be matched to your account. We store your Stripe customer reference, your plan, and your subscription and payment status (for example, whether a recent charge failed) so we can apply what your plan includes.

Push notifications. If you turn notifications on, your browser creates a push subscription (an endpoint address and encryption keys), which we store so we can send you notifications such as reminders about plan steps that are due and follow-up reminders about your targets. You can turn them off in Settings or in your browser's notification permissions.

Trust & safety information. Text you write in Scout, your bio and other Passport fields, and highlight titles is checked by an automated moderation system before it is saved or sent (see sections 4 and 6). If the check flags or blocks something, we keep the text, the decision and the reasons in a moderation record that GOLSZ staff review. If you report content, ask to be verified (including any proof link you provide), or submit an appeal, we store that too, along with the outcome. Actions GOLSZ administrators take on accounts are logged, with who took them. We also keep an internal trust score for each account (section 4).

Content from retired features. GOLSZ previously offered a feed, messaging and following between accounts. Posts, messages and follows created while those features were available are still stored. The app no longer shows them, they are included in your data download (section 8), and they are deleted with your account.

Usage and technical information.

• Time in the app. While you are signed in and the app is open and visible on your screen, it records one minute of activity for each minute, totalled per day against your account. You and GOLSZ administrators can see these daily totals; we use them to understand how the product is used.
• Error reports. If the app hits an unexpected error, it sends us the error message, technical details and the address of the page you were on, linked to your account if you are signed in. Our servers record their own errors the same way. GOLSZ administrators use these reports to find and fix faults.
• Sign-up protection. When an account is created, we record the IP address the request came from, the date, and how many sign-up attempts came from that address that day, so we can stop mass account creation. This record is not linked to the account created, and it is deleted automatically after 30 days. The sign-up form also contains a hidden field that people can't see but automated scripts tend to fill in; an account created with it filled in starts with the lowest trust score (section 4).
• Approximate location, for currency. To show prices in the right currency, our hosting provider works out your country (and, in Europe, your continent) from your IP address. We use only the resulting region — Canada, the United States, Europe or elsewhere — and we do not store it.
• Infrastructure. Our hosting and database providers (Vercel and Supabase) process standard request information, such as IP addresses and the time of each request, as part of delivering and protecting the service.

3. Cookies, browser storage and analytics

Cookies. GOLSZ's own pages and app do not set cookies. Third-party services we use or link to may set their own cookies under their own policies — in particular Stripe, on its checkout and billing pages.

Browser storage. The app keeps a few items in your browser's local storage: your background theme (light or dark), your language, your currency if you choose one yourself, and — through our authentication provider's standard client library — your sign-in session, so you stay signed in between visits. You can clear these at any time in your browser's settings. None of them is used for advertising.

Analytics. GOLSZ does not use Google Analytics, advertising pixels, or any other third-party analytics or advertising tracker. We do measure use ourselves: the time-in-app totals and error reports described in section 2, and counts in our administrator tools such as sign-ups, plans and Scout usage.

4. How we use your information

We use your information to: operate your account, Passport and planning tools; power Scout's guidance; process payments and apply plan limits; detect and act on abuse, spam and unsafe content; send notifications you've turned on; understand how GOLSZ is used and fix faults; respond to support requests; and meet our legal obligations. We do not sell your personal information, and we do not use it for advertising.

Automated decisions and profiling.

• Moderation. The automated check described in section 2 can stop text from being saved or sent, without a person being involved at that moment. It can also send content for human review.
• Trust score. Every account has an internal trust score from 0 to 100, which is not shown to you. It starts at 50 and is recalculated from how long the account has existed, whether your identity has been verified, how many items of your content were flagged by moderation and then reviewed by a moderator, how many different people have reported your posts, and whether the account has been banned. We use it to send content from very-low-trust accounts for human review even when the automated check would allow it. If messaging between accounts is offered again, it will also limit how many new conversations a new or low-trust account can start each day.

You can ask us at hello@golsz.com which personal information was used in such a decision and the main reasons for it, ask us to correct that information, and ask for a person at GOLSZ to review the decision. [Legal review advised] counsel should confirm that this meets section 12.1 of Law 25 and Article 22 of the GDPR, including whether a person must be told at the time a decision is made.

5. Adults only (18 and over)

GOLSZ is for adults. You must be 18 or over to hold an account. The app's sign-up form refuses a date of birth under 18, and GOLSZ does not knowingly collect personal information from anyone under 18. Giving a false date of birth breaks our terms, and we will close any account we find belongs to someone under 18. If you believe someone under 18 has an account, tell us at hello@golsz.com.

Legacy managed profiles. Before 20 September 2026, an adult account could create a managed profile for an athlete under 18, which held the athlete's name and date of birth inside the adult's account. That is no longer possible: the endpoint that created those profiles refuses every request. Any such profile created before then remains part of the adult account that created it, which is responsible for it (see section 3 of our Terms). That adult can have it deleted at any time by emailing hello@golsz.com, and it is deleted if they delete their account (section 7). [Legal review advised] counsel should confirm what must be done about any under-18 information recorded while that structure was live — retention, deletion or notification — and should review these clauses before managed profiles are ever reintroduced, rather than afterwards.

6. AI processing, service providers and where your information is stored

We use the following providers to run GOLSZ. Each receives the information it needs for its role.

• Supabase — database, sign-in and file storage. It holds the information described in this policy, and sends sign-in emails (account confirmation, password reset and email-change messages) through our email delivery provider.
• Vercel — hosts golsz.com and runs our server functions, so it processes every request to the site and the app.
• Stripe — payments, if you subscribe (section 2).
• Anthropic — the AI models behind Scout and behind the automated moderation check. When you ask Scout something, your question and the profile, plan and conversation context needed to answer it are sent to Anthropic's API; text that is checked by moderation is sent the same way. Scout can also use Anthropic's web-search tool, which runs searches based on your question.
• xAI (Grok) — may be used as an emergency fallback for Scout. Where it is configured and Anthropic's models fail to respond, the same request — your question plus the context needed to answer it — is sent to xAI's API instead. It is not used for routine requests.
• Google Fonts — our pages and the app load their typefaces from Google (fonts.googleapis.com and fonts.gstatic.com), so your browser's IP address reaches Google when a page loads.
• cdnjs (Cloudflare) and jsDelivr — the app loads the code libraries it runs on (React and Supabase's client) from these content-delivery networks, so your browser's IP address reaches them when the app loads.
• Browser push services — if you turn notifications on, they are delivered through the push service run by your browser or device maker (for example Apple, Google or Mozilla), which receives your subscription address and the encrypted notification.

The sign-up form is built to support Cloudflare Turnstile, a bot check, but it is not active. If it is turned on, Cloudflare will process technical data such as your IP address to assess whether a sign-up is automated, and we will update this policy.

We may also disclose information where the law requires it, or where we believe in good faith that it is necessary to protect someone's safety (see section 15 of our Terms).

Where your information is stored. Your personal information is stored and processed outside Québec and Canada, including in the United States, by the providers listed above. [Legal review advised] the exact hosting regions for Supabase and Vercel, the privacy impact assessment Law 25 requires before personal information is communicated outside Québec, and whether a transfer mechanism (such as Standard Contractual Clauses) is needed for users in the EU/EEA or UK should be confirmed with each provider and counsel rather than assumed here.

[Legal review advised] Anthropic's and xAI's own data-retention and model-training terms for API usage should be confirmed and summarised accurately here rather than assumed — we have not independently verified whether content submitted through their APIs is used to train their models.

7. Retention and deleting your account

We keep your information for as long as your account exists, unless you delete it sooner (for example, a Scout conversation).

Deleting your account. You can delete your account from Settings, or by emailing hello@golsz.com from the address on your account. If you have, or have had, a paid plan, the app asks you to cancel billing first, because deleting the account does not stop Stripe's billing; if it still won't let you delete, email us and we'll delete the account for you.

When your account is deleted, we delete your sign-in account, profile and Passport; your planning data; your Scout conversations, summaries, memory and cached replies; your usage records; your push subscriptions, share links and verification requests; and any posts, messages and follows from retired features. We also delete the files in your account's photo folders; if removing a file fails, the failure is recorded so the file can be removed by hand.

If your account holds a legacy managed profile for an athlete under 18 that nobody else can sign in to, we will not delete your account and leave that profile without an owner: we tell you which profiles are affected and ask you to confirm, and confirming deletes those profiles together with your account.

What we keep after deletion.

• moderation records about content you wrote, with the link to your account removed;
• reports you made and appeals you submitted, with the link to your account removed, and reports other people made about your profile or messages;
• the log of actions GOLSZ administrators took on your account;
• error reports, with the link to your account removed (a server-side report's technical details can still contain your former account identifier);
• the unmatched Scout questions described in section 2, which were never linked to your account;
• sign-up protection records (IP address, date and attempt count), which were never linked to your account and are deleted after 30 days; and
• payment records held by Stripe, which Stripe keeps under its own legal obligations and policies.

Copies may also remain for a limited time in our database provider's backups. [Legal review advised] specific retention periods for each category above (rather than "kept"), the backup period, and whether moderation records should keep the text that was flagged should be defined with counsel to meet GDPR and Law 25 data-minimisation requirements precisely.

8. Your rights

Depending on where you live, you may have the right to access, correct, delete or restrict your personal information, to receive a copy of it in a portable format, to object to certain processing, and to withdraw your consent. In the app you can correct your Passport, delete Scout conversations, turn notifications off, download a copy of your data from Settings (Download my data, a JSON file), and delete your account. For anything else — including information the download doesn't cover — email hello@golsz.com.

If you're in Québec, you can complain to the Commission d'accès à l'information; elsewhere in Canada, to the Office of the Privacy Commissioner of Canada; and in the EU/EEA or the UK, to the data-protection authority where you live. [Legal review advised] a response-time commitment should be stated (Law 25 sets 30 days for access and correction requests) once we've confirmed our internal process can meet it, and counsel should confirm whether an EU/UK representative must be appointed under GDPR Article 27 now that GOLSZ is established outside the EU but offers the service to people in it.

9. Security and confidentiality incidents

Information is encrypted in transit. Within our database, row-level security rules restrict who can read and change records — generally to the account a record belongs to (and, for a legacy managed profile, the adult account that created it) and to authorised GOLSZ administrators, whose actions are logged. No system is perfectly secure, and we can't guarantee absolute security of information transmitted to us.

Confidentiality incidents. If a confidentiality incident involving your personal information presents a risk of serious injury, we will notify you and the Commission d'accès à l'information, as Québec law requires. [Legal review advised] counsel should confirm the notification process and timing, and that the register of confidentiality incidents Law 25 requires is in place.

10. Person in charge of the protection of personal information

The person in charge of the protection of personal information at GOLSZ is its founder. Contact: hello@golsz.com. [Legal review advised] under Law 25 this role falls by default to the person with the highest authority in the business; the owner should confirm it, or delegate it in writing, and may add the person's name here.

11. Changes to this policy

We may update this policy as the product changes. Material changes will be reflected by updating the "last updated" date above, and where appropriate we'll notify account holders directly.

12. Contact

Questions about this policy, or requests relating to your personal information, can be sent to hello@golsz.com.