Privacy Policy

PoolSide ("we", "us", "our") provides swim coaching, swimmer performance, competition, and club operations tools through our mobile app and website dashboard.

Privacy contact: xuanmingguo2316@outlook.com

This Privacy Policy applies to the PoolSide mobile app, website, dashboard, support channels, and related services.

Depending on how you use PoolSide, we may collect the following categories of personal information:

• Account and profile data (name, email, role, account/session identifiers)
• Profile details (club/squad membership, date of birth, gender, competition category gender, stroke preference)
• Optional biometrics (height, arm span)
• Training and competition data (attendance, logs, notes, splits, entries, race results, analytics inputs/outputs)
• Guardian consent data for minors (guardian email, consent status/timestamps, token metadata, audit records)
• Voice and AI workflow data (transcripts, parsed output, AI request/response metadata, AI/voice audit records)
• Notification and push data (notification records/preferences, push tokens, platform/app metadata)
• Calendar sync token data (token scope, expiry, usage metadata, ICS feed content)
• Compliance export and rights workflow data
• Website billing metadata via Stripe (customer/subscription IDs, plan and billing status)
• Technical/security telemetry and error logs
• On-device local data for offline and sync functionality

We collect data directly from you, from authorized coach/club workflows, through automated app/website operations, and from integrated service providers that help us run PoolSide.

We use personal information to operate and improve PoolSide, including:

• Providing account, training, competition, and club management features
• Managing guardian consent flows and youth safeguards
• Delivering notifications and calendar sync feeds
• Generating analytics and AI-assisted insights/parsing
• Managing subscriptions and billing
• Handling compliance exports, rights requests, and account deletion
• Maintaining service security, abuse prevention, and reliability

Where UK GDPR/EU GDPR applies, we generally rely on contract performance, legitimate interests, consent where required, and legal obligations.

We share data only where needed to deliver the service, including with:

• Supabase (authentication, database, storage, edge functions)
• Stripe (subscription and billing)
• Resend (guardian consent email delivery)
• Google Gemini API (AI insights and transcript parsing)
• Expo push infrastructure (push delivery)
• Calendar providers you choose when you subscribe using sync links
• Authorized users in your club based on role and access controls

The website uses essential auth/session cookies for secure sign-in and account access.

We do not use third-party ad networks for behavioral advertising in the app and do not sell personal information.

Depending on provider infrastructure, personal data may be processed in multiple countries. We use provider safeguards and contractual protections where appropriate.

We keep data as long as reasonably needed for service operation, security, legal obligations, and dispute handling.

Current configured retention controls include:

• Notification retention preference: 7-30 days (default 14)
• Push outbox purge target: about 14 days
• Guardian consent outbox purge target: about 30 days
• System telemetry log purge target: about 30 days
• AI generation audit purge target: about 90 days
• Saved AI responses: latest 15 records per scope/window bucket
• Compliance export signed links: short-lived (currently about 1 hour)

PoolSide includes protections for youth athletes. Minor swimmers may be restricted until guardian consent is approved.

Guardians can approve or revoke through secure consent links. If you believe child data was submitted without proper permission, contact us immediately.

Depending on your location, you may have rights to access, correct, delete, restrict, object, and port your personal data, and to withdraw consent where applicable.

California users may also have rights under CCPA/CPRA, including rights to know, correct, delete, and opt out of sale/sharing where applicable.

To submit a privacy request, contact xuanmingguo2316@outlook.com.

We use role-based access controls, row-level security, tokenized workflows, and operational monitoring. No method of transmission or storage is perfectly secure, but we continuously improve safeguards.

We may update this Privacy Policy from time to time. We will revise the Last updated date when changes are published.