Coretex Athletics

Privacy Policy.

Effective October 8, 2026

This policy explains how Coretex Athletics, operated by Evan Kurylo in Alberta, Canada, handles information through coretexathletics.com and its associated ChatGPT Sites address. For privacy questions, access, corrections or deletion requests, contact ek.coretexgoaltending@gmail.com.

Information we collect and why

• Customer accounts: your email address, an internal account identifier and creation date. For email/password accounts, we store a salted password hash rather than a readable password. We use this information to authenticate you, maintain your account and associate saved information with it.
• Google sign-in: Google supplies a signed identity token containing an account identifier and email information. Our server verifies its signature, intended client, issuer, expiry and sign-in challenge. We store your Google account identifier and email to create or link your Coretex account. We do not store your Google password, request access to Gmail, Drive or Calendar, or store a Google refresh token. Although the identity token may include your name or profile picture, our current account system does not store those fields.
• Saved assessments: when you save a post-game report, we store its game date and answers, including preparation, physical and mental reflections, performance information and practice targets. Curriculum assessments store the selected age group, outcome ratings and timestamps. These records are associated with your account so you can review, compare or generate reports. A downloaded PDF becomes a copy you control.
• Curriculum access: the system stores age group, tier, access dates, access status and a payment reference when access is provisioned. Stripe checkout is currently being tested in a sandbox restricted to the administrator’s account; real curriculum payments are not open. The system stores checkout identifiers, the selected age group and tier, amount, payment status and access dates. When checkout is available, payment details are entered on Stripe’s hosted checkout, not stored as full card numbers or security codes by Coretex. Verified payment notifications provision access. Sandbox payments do not represent a real charge or customer booking.
• Video-review requests and uploads: submitted requests store customer and goaltender names, email, competition level, notes, requested times, booking status and price information. Uploaded clips and file metadata are stored for the review service. Access links contain credentials: keep them private.
• Shared practice drills: submitted drills include the author name, description, tags and diagram, and are stored for moderation. Approved submissions are made available in the shared drill library. Do not put private player information in a shared submission.
• Coach Hub: coaches submit their name, country, time zone, languages, biography, qualifications, session rate, currency, session length and external scheduling link. We store the application, publication consent, review status and timestamps with the coach’s account. With consent and administrator approval, those profile fields appear publicly in the coach directory. Account email and internal account identifiers are not included in public listings; the administrator can access them to review applications. Profile edits return the listing to review. Coach Hub bookings open the coach’s external scheduling website, which handles booking information and any payments under its own policies.
• Contact: the contact form opens your email application. Information you send is received through our email account and used to respond to your inquiry.
• Security and operations: our sign-in service receives your IP address and stores a hash of it and request counters to limit abuse. Hosting and delivery providers may process IP addresses, browser details, timestamps, delivery information and operational logs to run and secure their services.

Google account linking

We identify returning Google users by Google’s stable account identifier. When Google confirms current ownership of a Gmail or Google Workspace address, sign-in can reuse an existing Coretex account with that email. For other email addresses, you must first sign in to your Coretex account before linking Google. Google sign-in does not grant paid curriculum access by itself. You can choose email/password instead, and revoke Google access through your Google account settings. Revoking Google access does not automatically delete your Coretex account or sign out an existing Coretex session.

Cookies and browser storage

We use an essential, secure, HTTP-only session cookie to keep you signed in for up to 30 days, and a short-lived Google sign-in challenge cookie lasting up to 10 minutes. Signing out revokes the current session. Email verification and password-reset links expire after 15 minutes and can be used once. The site also uses browser session storage for temporary development-profile and mentorship-booking drafts; those drafts are not an account record unless a feature explicitly submits them. Blocking essential cookies can prevent sign-in.

The site’s current code does not add a separate advertising pixel or analytics tracker. Google sign-in and embedded media, including podcast players, contact third-party services when loaded. Those services may use their own cookies or receive technical information under their own policies. External shops, social platforms and other linked websites have separate privacy practices.

Who handles information

Coretex’s coach or administrator may access information as needed to operate the service, provide coaching, respond to you and handle privacy requests. Account records and saved reports are protected by server-side access checks. Approved shared drills and consented Coach Hub profiles are public as described above; other customer records are not published as a public directory.

Our service providers include OpenAI ChatGPT Sites for hosting, Cloudflare infrastructure for the site’s database and file storage, Resend for verification, password-reset and purchase-notification emails, Stripe for hosted checkout and payment verification, and Google for Google sign-in and our contact mailbox. Resend receives the recipient email and message, including one-time links or purchase details. Purchase confirmations go to the customer and purchase notifications go to the administrator. Stripe receives information needed for checkout, including email, product, price and order identifier; its privacy policy applies. Google receives information involved in Google sign-in; its privacy policy applies to its services. OpenAI’s privacy policy, Cloudflare’s privacy policy and Resend’s privacy policy describe their respective practices.

These providers may process information outside Canada, where it may be subject to local laws and lawful government access. We do not promise Canada-only storage. Coretex does not sell customer account information or use saved assessments for targeted advertising. Information may be disclosed where required by law or necessary to address abuse, protect the service or respond to a valid legal request.

Retention, access and deletion

Account records, saved reports, booking information and uploaded files currently remain stored until removed through an administrator-handled request or operational cleanup; there is no automatic account or report deletion schedule. Ending or expiring curriculum access does not automatically delete the account or its records. Expired session and verification records are invalid for authentication and are cleaned up during authentication operations. Security counters and provider logs may have different retention periods.

You can request access to, correction of, or deletion of your information by emailing the privacy contact above. We may ask you to verify ownership before acting. Deletion is currently handled manually; there is no self-service deletion button. Some records may need to be retained for legal obligations, disputes or security, and provider backups or logs may not disappear immediately. Copies you download or share are outside our control. Withdrawing information necessary for an account or service may prevent us from providing that feature.

Young goaltenders and sensitive information

These resources are used by young goaltenders. A parent or guardian should manage an account and submissions for a child who cannot provide meaningful consent, including children under 13. Do not submit another person’s information or footage without appropriate permission. Keep reflections focused on goaltending and avoid unnecessary diagnoses, medical records or private information about teammates. Coretex is a goaltender-development service, not a professional psychological service.

Camera, screen sharing and AI

The current mentorship call-room preview asks for browser permission before displaying your camera or screen locally. It does not connect another participant, upload or record that stream. Video-review file uploads are a separate submission feature. Any future live-call or recording functionality will require an updated explanation of its data handling.

AI has been used to help create website code, some graphics and interactive resources. The current account and assessment features do not send your answers to an AI service to generate coaching judgments or automated replies. Coaching interactions are handled by a coach or administrator. Hosting-provider practices are governed separately by their policies.

Security and policy changes

We use HTTPS, hashed passwords and tokens, secure session cookies, sign-in rate limits and server-side authorization. No online service can guarantee complete security. Keep your password and booking links private and contact us if you suspect unauthorized access. We will update this page as the site’s features or information handling change, with a revised effective date and additional notice for material changes where appropriate.