Privacy notice

Version 2026-10-08

Short version

We keep what is needed to follow athletes' training, tests and results – nothing more.
Only you, the athlete's guardians and the club's authorised staff can see it.
We never sell data, show no ads and use no tracking or analytics.
Everything is stored in the EU. You can download everything and delete your account yourself under Settings.

1. Who is responsible?

Sport Tracking (sport.assistiq.se) is run by Mikael Berglund (Assistiq), Sweden. Contact for all privacy questions: mikaelberglund1976@gmail.com. We reply within one month.

Responsibility is shared like this:

Your account (name, e-mail, sign-in, security, support): we are the controller.
Athletes a club adds (results, tests, training, photo): the club is the controller and we are the club's processor under our data processing terms. Questions about a club's athletes go to the club first – we help the club answer.
Athletes a parent adds for their own family: we are the controller for storing them in the app.

2. What we keep and why

What	Why	Legal basis
Account: name, e-mail, password (hashed by Supabase) or Google id, club role, language	Sign you in with the right access	Contract (Art. 6(1)(b))
Athlete: name, birth date/year, club, sport, events, optional sign-in e-mail	Follow and plan training and competition	Club's legitimate interest/membership (6(1)(f)) or contract with the parent (6(1)(b))
Results, competitions, tests, goals, training sessions, training diary, comments	Statistics, development and planning	As above
Photo of an athlete or club logo (optional)	Recognise the athlete in the app	Consent (6(1)(a)) – remove it any time and the file is deleted
Health data: “Did anything hurt?” (yes/no) after a session and body weight at some tests	So the coach can adjust training	Explicit consent (Art. 9(2)(a)) from a guardian, or the athlete from age 13. No free text is stored.
Registration confirmation (who, role, when, version) and consent log	Show the data was added with a right to do so	Legal obligation/accountability (6(1)(c), Art. 5(2))
Invitations to result reporters (e-mail, hashed PIN)	Let someone report results from a competition	Club's legitimate interest (6(1)(f))
Security: sign-in times, account approval, a log when an administrator helps you via “view as”	Protect accounts and investigate faults	Legitimate interest (6(1)(f))

We never ask for national ID numbers, addresses or payment cards. We collect nothing from other sources.

3. Children and young people

A guardian or the club adds the athlete and confirms they have the right to. The confirmation is stored.
From 13, an athlete can get their own sign-in (with their own e-mail set by the guardian or club) and decide on the health question themselves. Under 13, the guardian decides.
A signed-in athlete only sees their own data. Never ads.
For children, the guardian exercises the rights below.

For athletes: what does the app save about me?

Your name, when you were born, your club, a photo if someone added one, your results, tests and training sessions. It is there so your coach can help you. Only you, your parents and your coaches can see it. We never sell it. Whether something hurt is only saved if you (13+) or your parent said yes – and it can be turned off, then the answers are deleted. Want something changed or removed? Talk to your parent or coach.

4. Who can see the data?

The athlete, guardians and the club's owners/admins. People the club gave read access (viewer) see the club's athletes and results, but never health answers.
Coaches only see athletes in the groups they coach. Health answers are visible to coaches of the athlete's own groups only – not to other members.
We (the platform administrator) have access for operations and support. When we look “as” a user to help, it is logged.

Providers (processors) needed to run the service:

Provider	What	Where
Supabase	Database, sign-in, files (photos), sign-in e-mails	EU (Ireland)
Vercel	Web servers and hosting	Server functions in the EU (Dublin), pages delivered via a global CDN; US company – EU–US Data Privacy Framework and standard contractual clauses
Google	Only if you choose “Sign in with Google” – we store no Google tokens	EU/US (Google's terms)
Resend	Invitation e-mails, once enabled	US company – standard contractual clauses

We only disclose data to authorities when the law requires it.

5. How long?

Account: until you delete it (Settings → Your data → Delete my account). It is deleted immediately.
Athletes and their results: until the club/guardian removes the athlete or the account. Photos are deleted at the same time, and files without an owner are cleaned up every night.
Health answers and weight: until consent is withdrawn – then they are deleted immediately.
Backups: none today. If we add them, deleted data disappears from them within 7 days.
Server logs at Vercel (e.g. IP address) are kept for a short time under Vercel's defaults.

6. Your rights

Know what we keep and get a copy – “Download my data” under Settings gives everything as JSON.
Correct inaccurate data.
Erase – yourself under Settings, or ask us/the club.
Withdraw consent (photo, health answers) at any time.
Object to or restrict processing based on legitimate interest, and data portability.
Complain to the Swedish Authority for Privacy Protection, imy.se.

7. Security

All traffic uses HTTPS. Passwords are handled by Supabase and stored only as hashes. The database protects every row with access rules (row-level security), so users can only read what they are allowed to. Photos are in private storage and shown only to authorised users. We have a data breach routine and notify the supervisory authority within 72 hours when required.

8. Cookies and browser storage

Only what the app needs to work: sign-in cookies (Supabase), language (lang), selected club (active_ctx, last_ctx), and in the browser's local storage light/dark mode and whether you closed the install prompt. No tracking or advertising cookies – so no cookie banner.

9. Changes

If this text changes in substance we update the version above and notify users of significant changes.