Security policy

How we keep your order and your team safe.

Effective October 28, 2026

The short version

• Your team data never leaves your devices. Rosters, plans and notes live in your browser and your backup files. We don't have a copy, so there is nothing of it on our side to leak.
• No passwords. Your order page opens with a one-time code emailed to you, and each coach's device proves itself with its own key.
• Payments go straight to Stripe or Etsy. Card details never touch our servers.
• Found a problem? Email orders@coachesofficehq.com with "Security report" in the subject. Details below.

Payments

Website checkout runs on Stripe, which is certified to the payment-card industry's security standard (PCI DSS). Etsy orders are paid on Etsy. We never see or store a full card number.

Getting into your order

• There are no accounts or passwords. To open your order page in a new browser, we email a 6-digit code to your order's address. It works once, for 10 minutes, and five wrong tries cancel it.
• A browser that has opened your order stays signed in for 30 days with a cookie that page scripts can't read, that is sent only over HTTPS, and that other websites can't use.
• Repeated guesses at codes are slowed down and blocked, and refused attempts are logged and counted so we notice when someone is trying.

Activation and devices

• Each coach's activation link is single-use and expires after 72 hours. We store it only in scrambled form.
• When a device activates, it creates its own key that can't be copied out of the browser. We keep only the public half. Every check-in is signed with that key and can't be replayed.
• Each seat works on at most 2 devices. Devices check in about every 14 days and pause after 30 days without one.
• Lost a phone or think a link went to the wrong person? Reset that seat from your order page. The old devices stop at their next check-in, and the coach gets a fresh link.

Etsy codes

License and add-on codes are random, single-use and long enough that guessing one isn't practical. A code is marked used before its order is created, so it can't be redeemed twice. Redeeming an add-on code never reveals whether an email address has bought from us.

This website and the app

• Everything is served over HTTPS, with browser security headers that block other sites from framing our pages and limit which scripts may run.
• Our servers limit the size of what is sent to them and check its format, and payment notifications from Stripe are verified by their signature before we act on them.
• Bot protection and rate limits sit in front of the store.
• Service keys live in our hosting provider's encrypted settings, never in our code or in your browser.
• Software dependencies are checked for known security issues automatically, and every change is tested before it goes live.
• The site, the app and activation are checked every 5 minutes, with an independent check every hour, and we are alerted when something fails.

Your data

• Your team data stays on your devices. Error reports from the hosted app carry only the error, the app version and a device label, with any email address masked.
• What we do hold (order, seat and device records) is stored with our providers, Stripe and Upstash, and reached only by our servers. We keep backup copies, stored encrypted.
• Our privacy policy lists everything we collect and who processes it.

What you can do

• Keep the email account on your order secure: it is the key to your order page.
• Don't forward activation links or post Etsy codes. Each one is worth a seat.
• Release devices you no longer use (Library → This device → Release this device).
• Save a backup with BACK UP EVERYTHING regularly and keep it somewhere private. It holds your roster, which may include information about minors.
• Only import backup files from people you trust.
• Our emails come only from coachesofficehq.com addresses, and Etsy codes arrive only as Etsy messages. We never ask for a password or card details.

Reporting a security problem

If you think you've found a weakness in the store, activation or the app, email orders@coachesofficehq.com with "Security report" in the subject. Tell us what you found, how to reproduce it, and what it could affect.

• We aim to reply within 3 business days and keep you posted until it's fixed.
• Please give us a reasonable time to fix it before you tell anyone else.
• Test only against your own order and devices. Don't access other people's data, run automated scans or denial-of-service tests, or use social engineering.
• We won't take legal action against anyone who reports in good faith and follows these rules. We're a small business and don't run a paid bug bounty, but we'll gladly credit you if you'd like.

If something goes wrong

If a problem ever affects your information, we will fix it, tell the people affected by email as soon as we know what happened, and explain what to do next.

Changes

If this policy changes, the effective date at the top changes with it.