What this portal stores.

Your registration

CoachManagement Agency collects your email address, chosen UID, optional coaching name, account status and registration time to verify your email, let you log in and contact you about a personalized coaching website. Registration does not give access to student records.

Passwords and verification

Passwords are stored as salted password hashes, not readable passwords. Verification codes expire after 30 seconds and are stored in the application database as keyed hashes. Gmail processes the recipient address and email content to deliver codes; messages can remain in the agency Gmail account after code expiry.

Security and cookies

An essential secure session cookie keeps you signed in for up to eight hours. The server stores a hash of that session token. Keyed hashes derived from request IP addresses and email addresses support abuse limits. Cloudflare Turnstile checks requests for abuse, and Cloudflare Access protects agency administration and separately provisioned client dashboards. Those providers may process additional technical data under their own policies.

Agency review

Authorized agency administrators can see registration details, keep internal discussion notes and assign a personalized website link. Password hashes are not shown in the admin interface. The agency receives a registration notification at coachmanagement.agency@gmail.com. Gmail sending authorization belongs to the agency; clients are not asked to connect their Gmail accounts.

Retention and requests

Account records remain until the agency removes them. Temporary challenges older than one day and expired sessions/rate records are cleaned up when new verification requests are processed. Expired credentials stop working immediately even before cleanup. Email-provider records and backups have separate retention. Contact the agency to request correction or deletion; identity verification may be needed. A client dashboard has its own configuration and data practices.

Contact

coachmanagement.agency@gmail.com

Notice version: 6 November 2026. The operator should review this notice against its actual deployment and applicable legal obligations before launch.