Privacy Policy

Last updated: September 16, 2026

Athlometer (“Athlometer”, “we”, “us”, or “our”) operates the Athlometer platform at athlometer.com (the “Service”). This Privacy Policy explains what personal data we collect, how we use and share it, how long we keep it, and the rights you have. It applies to visitors of our website, people with Athlometer accounts, and athletes and guardians whose data an organization enters into the Service.

1. Our Roles

Athlometer is used by gyms, clubs, schools, federations, and other organizations (“Customers”). We act in two different roles:

• Controller for the data we collect about our own users and visitors: account details, billing contact details, website usage, communications with us, and security logs.
• Processor for the data a Customer and its coaches enter about athletes and other people (“Customer Data”). The Customer decides what to enter, who can see it, and to whom reports are sent, and is the controller of that data. We process it only on the Customer’s instructions given through the Service.

If you are an athlete or a parent or guardian and have questions about data an organization holds about you or your child, please contact that organization first. We will support them, and you can also contact us at privacy@athlometer.com.

2. Data We Collect

2.1 Data you provide

• Account data: name, email address, password (stored as a salted hash), optional profile image, role, time zone, and date and time format preferences. If you sign in with Google, we receive your name, email address, and profile image from your Google account.
• Organization data: workspace name, type, country, logo, teams, seasons, member roles, and invitations you send.
• Athlete data (Customer Data): name, email address, date of birth, sex, height, weight, competition weight, limb dominance, sport, position, group, status, coach notes, custom attributes, avatar photo, goals, team memberships, and any external identifiers used to match imported rows.
• Testing data (Customer Data): test and metric definitions and formulas, session details including date, time, venue name and map coordinates, raw measurements, computed metrics and indices, benchmarks, and coach comments.
• Files (Customer Data): photos, videos, documents, spreadsheets you import, and PDF reports attached to athletes, results, tests, or sessions.
• Report recipients: email addresses you enter to send an athlete report, such as an athlete’s or guardian’s address.
• Billing data: if you buy a paid plan, our payment provider collects your billing name, address, tax identifier, and payment details. We receive the plan, status, and transaction references, not your full card number.
• Communications: what you send us when you contact support or give feedback.

2.2 Data collected automatically

• Usage data: pages visited, features used, and in-app events such as creating a test or capturing a measurement, collected through PostHog and associated with your account ID once you sign in. Unhandled errors are also reported with the page and browser context needed to fix them.
• Performance data: aggregated page-load and performance metrics collected by Vercel Analytics and Speed Insights, which do not use cookies or identify you.
• Log and security data: IP address, browser and device type, referring URL, timestamps, and sign-in attempts, including rate-limit counters. Sign-in and sign-up forms are protected by Cloudflare Turnstile, which analyses browser signals to distinguish people from bots.
• Map requests: when a session location is shown on a map, your browser requests map tiles from our tile provider, which receives your IP address.

3. How and Why We Use Data

We use personal data to:

• provide, operate, and secure the Service, including authentication, role-based access, and hosting Customer Data (performance of our contract with you; the Customer’s instructions for Customer Data);
• compute metrics, progress signals, benchmarks, and goal statuses, and generate PDF reports, as configured by the Customer (Customer’s instructions);
• send transactional email: email verification, password reset and password-change notices, welcome messages, and reports you choose to send (contract);
• process subscriptions and payments through our payment provider and keep required billing records (contract; legal obligation);
• understand how the Service is used, diagnose errors, and improve features (legitimate interest in running and improving the Service);
• prevent abuse, enforce our Terms, and protect the Service and its users (legitimate interest; legal obligation);
• respond to your requests and support questions (contract);
• comply with law and respond to lawful requests.

We do not use Customer Data to train machine-learning models, to build profiles for advertising, or for any purpose other than providing the Service to the Customer. We do not sell personal data.

4. Health-Related and Sensitive Data

Body measurements, dates of birth, and physical performance results may be considered health-related or otherwise sensitive data in some jurisdictions. Customers must have an appropriate legal basis, such as explicit consent, before entering this data, and must not enter clinical or medical records. The Service is not designed for data regulated as protected health information under HIPAA. We apply the same security controls to all Customer Data regardless of category.

5. Children and Minor Athletes

Athlometer is built for coaches and sports organizations, many of which work with athletes under 18. Customers may enter data about minor athletes and may invite an athlete to hold an account that shows only that athlete’s own results. The Customer is responsible for obtaining verifiable consent from a parent or guardian before entering a minor’s data, inviting a minor to an account, or sending a minor’s results by email, in line with the law that applies to it. Athlete accounts must not be created for children under 13.

We do not knowingly collect personal data directly from children, and our marketing website and sign-up are directed at adults. If you believe a child’s data was entered or an account created without appropriate consent, contact us and we will work with the organization to correct or delete it.

6. Who We Share Data With

We share personal data only in these cases:

• Within your organization: according to the role-based access the Customer configures. Owners and admins see all workspace data; coaches see the athletes, tests, and sessions they created or are assigned through teams; athletes see only their own results. Team positions and rankings are never shown to athletes or guardians.
• Recipients you choose: when a coach sends a report, it is emailed to the address the coach enters.
• Service providers (sub-processors): companies that process data on our behalf under contracts that restrict their use of it to providing services to us. Our current providers are listed below. We will update this list when providers change.
• Legal requirements: if required by law, regulation, legal process, or an enforceable government request, or to protect the rights, safety, or property of Athlometer, our users, or others.
• Business transfers: in a merger, acquisition, or sale of assets, personal data may be transferred to the successor, who must honour this policy. We will notify you of any such change.
• With your consent: for any other purpose you agree to.

7. International Transfers

Our providers store and process data in the European Union and the United States. Product analytics is hosted in the EU. Where personal data protected by EU, UK, or Swiss law is transferred to a country without an adequacy decision, we rely on the European Commission’s Standard Contractual Clauses, the EU-US Data Privacy Framework where the recipient is certified, or another lawful transfer mechanism, together with supplementary safeguards such as encryption in transit and at rest.

8. How Long We Keep Data

• Account and Customer Data: for as long as your account or the workspace exists. When you delete your account, or a workspace Owner deletes the workspace, the associated data, including uploaded files, is permanently deleted from our production systems immediately upon confirmation. Residual copies in encrypted backups are automatically discarded within 90 days.
• Individual records: athletes, results, files, and other records a coach deletes are removed from production immediately, subject to the same backup window.
• Billing records: invoices and transaction records are kept by us and our payment provider for as long as tax and accounting law requires, even after a workspace is deleted. They never contain athlete results.
• Usage, error, and security logs: kept for a limited period needed for analysis and security, then deleted or aggregated.
• Email records: our email provider keeps delivery metadata for a limited period for deliverability and abuse prevention.

Aggregated or de-identified data that cannot reasonably be linked to a person may be kept indefinitely.

9. Security

We protect data with encryption in transit (TLS) and at rest, hashed passwords, role-based access controls enforced on the server, tenant isolation between workspaces, short-lived signed URLs for file access, rate limiting and bot protection on authentication, mandatory email verification, and security headers. No method of transmission or storage is completely secure, so we cannot guarantee absolute security. If we become aware of a breach affecting your data, we will notify affected Customers without undue delay so they can meet their own obligations.

10. Your Rights

Depending on where you live, you may have the right to access, correct, delete, or receive a copy of your personal data, to restrict or object to certain processing, to withdraw consent, and to complain to a data protection authority. You can:

• view and edit your account details, time zone, and formats in Settings;
• delete your account at any time from Settings; a workspace Owner can also delete the whole workspace;
• ask us at privacy@athlometer.com for a copy of your data in a machine-readable format or to exercise any other right.

If your request concerns Customer Data, we will refer it to the responsible organization and assist them, since they control that data. We respond within 30 days, or sooner where the law requires. We will not discriminate against you for exercising your rights.

11. Cookies and Similar Technologies

• Essential: a session cookie that keeps you signed in, security cookies used by our authentication and bot protection, and a local preference for light or dark theme. These are required for the Service to work.
• Analytics: PostHog sets first-party cookies and local storage to recognise your browser across visits and link usage to your account. Analytics is disabled on local development environments and is not used for advertising. You can block or delete these cookies in your browser; the Service will keep working.

We do not use advertising cookies or third-party tracking pixels.

12. Third-Party Links

The Service may link to third-party websites, including our payment provider’s checkout and customer portal and Google’s sign-in. Their privacy practices are governed by their own policies, which we encourage you to read.

13. Changes to This Policy

We may update this Privacy Policy from time to time. For material changes we will notify you by email or through a prominent notice in the Service at least 30 days before they take effect. The “Last updated” date above identifies the current version.

14. Contact

For questions about this policy, our data practices, or to exercise your rights, contact privacy@athlometer.com. Customers can request a data processing agreement at the same address.