Privacy Policy

1. Introduction

TrackPhase ("we," "us," or "our") is a track & field team training management application developed by TrackPhase. This Privacy Policy explains how we collect, use, store, and protect your personal information when you use our web and mobile applications (collectively, the "Service").

By using the Service, you agree to the collection and use of information in accordance with this policy. If you do not agree with this policy, please do not use the Service.

2. Information We Collect

2.1 Account & Authentication Data

• Name and email address
• Account type (coach or athlete)
• Date of birth (athletes only; required at registration and encrypted at rest)
• Coaches enter a date of birth at sign-up so we can confirm they are 18 or older. It is checked and then discarded; we do not store a coach's date of birth.
• Parent or guardian email address (athletes ages 13–17 only; encrypted at rest)
• Password (stored only as a secure, one-way hash)
• Passkey credentials (WebAuthn public keys for passwordless sign-in)

2.2 Health & Wellness Data

• Sleep quality (1–10 scale) and sleep hours
• Energy level (1–10 scale)
• Soreness level (1–10 scale)
• Mood rating (1–10 scale)
• Rate of perceived exertion / RPE (1–10 scale)
• Fatigue level (1–10 scale)
• Injury notes and pain area descriptions

2.3 Training & Performance Data

• Workout sessions and exercise details
• Performance times and distances
• Personal records
• Competition results
• Results imported from Athletic.net, TFRRS, or MileSplit when an athlete or coach links a profile, along with the linked profile ID or URL

2.4 Personal & Team Data

• Journal entries (free-form text with optional mood tags and categories)
• Coach notes, annotations, and goals
• Team and group membership information
• Athlete profiles a coach creates for athletes who do not have their own account (name, graduation year, and training and results data the coach enters)

2.5 Data Stored on Your Device (iOS)

• Authentication tokens (JWT) stored securely in the iOS Keychain
• Cached profile information stored in UserDefaults
• Locally cached training data stored in SwiftData for offline access

2.6 HealthKit Data (iOS Only)

Important: If you choose to connect HealthKit, we may collect the following health and fitness data types to enhance your training analysis and readiness assessment:

• Heart rate data (resting heart rate, heart rate variability)
• Sleep analysis (sleep duration, deep sleep, REM sleep, sleep quality scores)
• Respiratory rate
• Body temperature measurements (wrist temperature deviations)
• Cardio fitness (VO2 Max estimates)
• Heart rate recovery measurements
• Apple Watch workouts: workout type, duration, distance, active calories, average and maximum heart rate, running-form metrics, and sprint splits

HealthKit Data Restrictions: In accordance with Apple's Developer Program License Agreement, all HealthKit data collected through our iOS application is:

• Never used for advertising purposes
• Never sold to third parties
• Only used to provide health and fitness services related to athletic training, performance analysis, and recovery monitoring
• Stored securely and processed in accordance with Apple's HealthKit guidelines

You maintain full control over your HealthKit data and can revoke access at any time through your device's Health app settings or by disconnecting HealthKit integration within our application.

2.7 Nutrition Data (Optional)

If you choose to use nutrition features, we collect the meals you log, including meal type, description, and macronutrient values (calories, protein, carbohydrates, and fat). If you use the optional AI meal-photo analysis feature, the photo you submit is processed to estimate these values (see Section 5 for how AI processing works). For athletes under the applicable age threshold, nutrition features require verified parental consent before they can be used.

2.8 Subscription & Billing Data (Coaches)

If you buy a paid plan, we store your plan, whether you subscribed through the App Store or on the web, subscription status, billing period dates, and the App Store transaction and product IDs or Stripe subscription ID. Card and payment details are entered with Apple or Stripe and are never stored on our servers.

2.9 Device & Website Usage Data

• Push notification device tokens, so we can send notifications to your device
• Website analytics collected by Google Analytics when you visit trackphase.app (see Section 3)

3. Website Analytics, Cookies & What We Do Not Collect

3.1 Google Analytics on Our Website

Our website, trackphase.app, uses Google Analytics 4, a web analytics service provided by Google LLC, on our public marketing pages only: the home, pricing, FAT Pro, timing-system, scholastic-coaches, and contact pages. It does not run on the sign-in, sign-up, billing, team-invite, parental-consent, parental-deletion, support, or legal pages. On the pages where it runs, Google Analytics collects:

• The pages you view, the referring site, and the time of your visit. We remove everything from the page address except the page itself and any campaign (UTM) tags, and we reduce a referring address on another site to that site's domain.
• Browser, device type, operating system, screen size, and language
• Approximate location (such as city or region) that Google derives from your IP address. Google Analytics 4 does not log or store IP addresses.
• Clicks on certain buttons, such as demo requests, downloads, and checkout links, including any campaign (UTM) tags in the link that brought you to the site

Google Analytics sets first-party cookies (_ga and _ga_*) that store a random identifier for your browser so visits can be counted. We do not send your name, email address, or account ID to Google Analytics. We use this information only to understand how people find and use our website and to improve it. We do not use it to show you advertising: Google signals and ad personalization are turned off.

Opting out: you can block or delete cookies in your browser settings, or install the Google Analytics Opt-out Browser Add-on. The Service works the same if you opt out.

3.2 Browser Storage

When you arrive at our website from a link with campaign (UTM) tags, we keep those tags and a random reference code in your browser's session storage, which clears when you close the tab. If you then click a purchase link for FAT Pro, they are added to the Stripe checkout link so we can see which campaign led to the purchase.

3.3 What We Do Not Collect

We are committed to collecting only the data necessary to provide the Service. We do not:

• Use advertising SDKs or show advertising
• Collect the Identifier for Advertisers (IDFA) or any device advertising identifiers
• Collect device fingerprints
• Collect precise geolocation

4. How We Use Your Information

We use the information we collect to:

• Authenticate your identity and manage your account
• Deliver core training management features, including scheduling, check-ins, and performance tracking
• Enable coaches to monitor athlete wellness and adjust training plans
• Display your training history and personal records
• Provide journaling functionality for personal reflection and coach–athlete communication
• Generate optional AI-assisted insights on request: training-load recommendations a coach requests for an athlete, and meal-photo nutrition estimates an athlete requests (see Section 5 for the third-party AI processor involved)
• Process subscription purchases and apply the features of your plan
• Send push notifications and service emails, including parental notices for minor athletes
• Maintain and improve the reliability of the Service
• Measure and improve our website using analytics (see Section 3)

5. Data Sharing & Disclosure

We do not sell your personal data to third parties.

Your data may be shared in the following limited circumstances:

• Within your team: Health, wellness, and training data you submit may be visible to your assigned coach(es) as part of the core functionality of the Service.
• Service providers: We use the following third parties to operate the Service. Each receives only the data described below:
  • Neon (database hosting): stores all Service data.
  • Vercel (application hosting): runs the Service; all requests and data pass through its infrastructure.
  • Stripe (web payments): a coach's email address, our internal account ID, and the chosen plan and billing interval, plus the payment details you enter on Stripe's checkout page. Stripe tells us your subscription status.
  • Apple: App Store purchases are processed by Apple, which sends us transaction and renewal status. Push notifications are delivered through Apple's push notification service, which receives your device token and the notification text. That text can include an athlete's name, a team name, results, check-in activity, or wellness and workload alerts.
  • Resend (email delivery): sends parental notices and parental deletion confirmations. For a parental notice it receives the parent or guardian's email address, the athlete's name and email address, and a consent link.
  • Google (Google Analytics): website usage data described in Section 3.
  These providers process data on our behalf to operate the Service.
• AI processing: Our optional AI features send data to our third-party AI provider, Anthropic, to generate a result:
  • Training-load recommendations (requested by a coach): the athlete's acute:chronic workload ratio, acute and chronic load and risk zone, average wellness readiness score and trend for the last 7 days, number of sessions logged in the last 7 days, and the days until their next competition and its importance rating. The athlete's name and contact details, individual check-in answers, journal entries, and HealthKit data are not sent. For an athlete under 18, a recommendation is available only after a parent or guardian has consented through a parental notice that describes this sharing.
  • Meal-photo nutrition analysis (requested by an athlete): only the meal photo. We do not store the photo; the athlete reviews the estimate before saving it. Meal-photo analysis for minors requires verified parental consent before it can be used.
  This data is used to return the result, is not used to train AI models, and is not sold.
• Result sites: When a profile is linked, the athlete's public results are requested from Athletic.net, TFRRS, or MileSplit. Our servers fetch TFRRS and MileSplit results, and those sites receive only the linked profile ID or URL. Athletic.net results are fetched by the iOS app on your device, so Athletic.net also receives your device's IP address and standard browser information.
• Legal requirements: We may disclose information if required to do so by law, regulation, or valid legal process.

6. Data Storage & Security

• All data transmitted between your device and our servers is encrypted using HTTPS (TLS).
• Passwords are stored as secure, one-way hashes and are never kept in plaintext.
• Dates of birth and parent or guardian email addresses are encrypted at rest.
• Authentication tokens on iOS are stored in the system Keychain, the most secure on-device storage available.
• Server-side data is stored in a PostgreSQL database managed through Prisma ORM with access restricted to authorized services only.

While we implement commercially reasonable safeguards, no method of electronic transmission or storage is 100% secure. We cannot guarantee absolute security.

7. Data Retention

We retain your personal data for as long as your account is active or as needed to provide the Service. Specific retention periods:

• Raw health & wellness metrics (daily HealthKit metrics such as resting heart rate, HRV, sleep, VO2 Max, respiratory rate, and wrist temperature; wellness check-in scores; RPE and workload entries): retained for 24 months from the date of collection. An automated weekly process permanently deletes records older than 24 months regardless of account status.
• Apple Watch workouts (workout type, duration, distance, calories, heart rate, running-form metrics, and sprint splits): retained for 24 months from the workout date, then permanently deleted by the same weekly process.
• Training & performance records (workout sessions, personal records, and competition results): retained for the lifetime of your account.
• Journal entries and nutrition logs: retained until you delete them or close your account.
• Coach-created athlete profiles (athletes without their own account): automatically deleted after 180 days with no coach activity, unless the athlete claims the profile.
• Subscription records: retained until account deletion. Apple and Stripe keep their own payment records under their own policies.
• Account credentials & profile data: retained until account deletion.
• Aggregated, de-identified analytics: may be retained indefinitely as they cannot be linked to any individual.

If you delete your account, all personal data (including all categories above) will be permanently removed from our production systems within 30 calendar days, and from backup systems within 90 days.

Coach access on team removal: When an athlete is removed from a team, all coach access to that athlete's data is revoked immediately. The removal is recorded in our audit log for compliance purposes.

8. Your Rights & Choices

You have the right to:

• Access your data: View your health, wellness, training, and journal data within the app at any time.
• Delete journal entries: Remove any journal entry you have created.
• Manage passkeys: Add or remove passkey credentials used for authentication.
• Delete your account: Request permanent deletion of your account and all associated data (see Section 8.1 below).
• Data portability: Request a copy of your personal data in a portable format by contacting us.

8.1 Your Right to Deletion (GDPR Article 17 & CCPA § 1798.105)

Under the General Data Protection Regulation (GDPR Article 17) and the California Consumer Privacy Act (CCPA § 1798.105), you have the right to request erasure of your personal data. We honor this right through a self-service in-app deletion flow and by email request.

What gets deleted

• Account credentials (email anonymized, password hash removed)
• Athlete profile and all associated health & wellness data
• Training records, workout history, and personal records
• Journal entries, coach notes, and goal records
• Team memberships and competition entries
• HealthKit data synced to our servers
• Push notification tokens and device records

How to delete your account

• In-app (immediate): Go to Settings → Delete Account. Deletion is immediate and permanent; if it cannot complete right away, it completes automatically within 24 hours. Deleting an account immediately cancels any web (Stripe) subscription it pays for. App Store subscriptions are billed by Apple; cancel those in your Apple ID subscription settings.
• By email: Send a request to privacy@trackphase.app from the address associated with your account. We will complete deletion within 30 calendar days.

Audit retention

A minimal audit log entry (user ID, deletion timestamp, initiator) is retained after deletion solely for compliance and fraud-prevention purposes, as permitted under GDPR Article 17(3) and applicable law. This record contains no health data or PII beyond the anonymized user ID.

9. Children's Privacy & Minor Athletes

9.1 Children Under 13 (COPPA)

The Service is not directed at children under 13 years of age. Athlete registration requires a date of birth and will not permit account creation for anyone who indicates they are under 13. Coach registration requires a date of birth showing the coach is 18 or older. We do not knowingly collect personal information from children under 13. If we become aware that we have inadvertently collected data from a child under 13, we will promptly delete that information. If you believe a child under 13 has provided us with personal data, please contact us at privacy@trackphase.app.

9.2 COPPA Direct Notice to Parents — Minor Athletes Ages 13–17

In accordance with the Children's Online Privacy Protection Act (COPPA, 15 U.S.C. § 6501 et seq.) and FTC Rule 16 C.F.R. § 312.4, we deliver a direct notice to a parent or guardian of every athlete between the ages of 13 and 17. At registration these athletes must provide a parent or guardian email address. We collect only the registration details (name, email address, date of birth, and parent/guardian email, plus the team invite or claim code if one is entered, which adds the athlete to that team's roster) and a security log of the registration (IP address and device type), email the notice immediately, and keep athlete features such as training, wellness check-ins, and journaling locked until the parent or guardian verifies consent using the link in the notice.

What the Notice Covers

The direct notice sent to parents describes, in plain language:

• Our identity and contact information (TrackPhase, privacy@trackphase.app)
• The categories of personal information we collect from the child (account data, wellness check-ins, training records, journal entries, nutrition logs, imported results, HealthKit data and Apple Watch workouts if connected)
• How that information is used (solely to provide coaching and training management features)
• Whether information is disclosed to third parties (the child's assigned coach(es) and the service providers listed in Section 5, including Anthropic for coach-requested training recommendations and Apple for push notifications; never sold)
• Parental rights: the right to review, correct, refuse further collection, or delete the child's personal information

Parental Rights (COPPA § 312.6)

A parent or guardian of a minor athlete may, at any time:

• Review the personal information we have collected from their child
• Correct inaccurate personal information
• Refuse further collection or use of personal information by requesting account deactivation
• Delete their child's personal information from our systems (see Section 8.1)

To exercise any of these rights, contact us at privacy@trackphase.app. We will respond within 30 calendar days.

9.3 Additional Protections for Minor Athletes

• Account flagging: Minor accounts (ages 13–17) are identified at registration using date of birth and flagged internally for enhanced protections.
• Breach notification: In the event of a data breach affecting minor accounts, we will notify the parent/guardian email on file within 72 hours.
• Data minimization: We collect only the data necessary for the coaching relationship: wellness check-ins, training records, and performance data. No advertising identifiers are collected for any user, including minors, and athlete data is never used for advertising. Website analytics (Section 3) runs only on our public marketing pages. It does not run on the team-invite, sign-up, consent, or account pages athletes and parents use.
• Health data restrictions: HealthKit data for minor athletes is subject to the same restrictions as all users: never sold, never used for advertising, and only used to provide athletic training services.
• No excess data conditioning: We do not condition a minor athlete's participation in the Service on the disclosure of more personal information than is reasonably necessary to provide the coaching and training features.

10. Consumer Health Data Privacy Policy

Applicable to residents of Washington, Nevada, and Connecticut under the Washington My Health MY Data Act (MHMD), Nevada SB 370, and the Connecticut Data Privacy Act (CTDPA).

10.1 Consumer Health Data We Collect

The following data types are classified as "consumer health data" or "sensitive personal information" under applicable state law (CCPA/CPRA, Washington MHMD, Nevada SB 370, Connecticut CTDPA):

• Heart rate data: Resting heart rate and heart rate variability (HRV/SDNN) collected via Apple HealthKit
• Sleep data: Sleep duration, sleep quality scores, deep sleep and REM sleep minutes
• Biometric indicators: VO2 Max estimates, heart rate recovery, respiratory rate, wrist temperature deviation
• Subjective wellness metrics: Daily energy level, soreness, mood, fatigue ratings (1–10 scale)
• Injury and pain data: Injury notes and pain area descriptions entered during wellness check-ins
• Physical activity data: Workout sessions with heart rate data synced from Apple Watch
• Journal entries: Free-form athlete journal text with optional mood tags. Where journal content describes physical or mental health conditions, this data constitutes sensitive personal information under CCPA/CPRA § 1798.140(ae) and consumer health data under the Washington MHMD Act.

10.1a Legal Basis for Processing

We process consumer health data on the following legal bases:

• Explicit consent: HealthKit access requires your explicit permission via iOS. Wellness check-ins and journal entries are submitted at your discretion. You may withdraw consent at any time by revoking HealthKit permissions, ceasing check-in submissions, or deleting your account.
• Performance of a contract: Wellness and performance data submitted by athletes is necessary to deliver the core coaching and training management service described in our Terms of Service.

10.1b Retention of Consumer Health Data

• HealthKit biometrics & raw wellness metrics (heart rate, HRV, sleep, VO2 Max, respiratory rate, wrist temperature, check-in scores): retained for 24 months from the date of collection, then permanently deleted.
• Journal entries: retained until you delete them or close your account.
• Apple Watch workouts and their heart rate data: retained for 24 months from the workout date, then permanently deleted.
• Training & performance records (workout sessions, personal records, competition results): retained for the lifetime of your account.

10.2 No Sale of Consumer Health Data

We do not sell, rent, or otherwise transfer consumer health data to any third party for monetary or other valuable consideration. This commitment applies to all health data types listed in Section 10.1.

10.3 Third-Party Sharing & Processors

Consumer health data may be processed by the following service providers solely to operate the Service:

• Neon (database hosting): All health and wellness data is stored in a PostgreSQL database hosted by Neon, Inc. Neon acts as a data processor and does not use your data for any purpose beyond database operations.
• Vercel (application hosting): The Service runs on Vercel's infrastructure. Request data passes through Vercel's edge network in transit only.
• Anthropic (AI processing): When a coach requests a training-load recommendation, the athlete's average wellness readiness score and trend and workload metrics are sent to Anthropic to generate it. Meal photos an athlete submits for analysis are sent the same way. See Section 5.
• Apple (push notifications): Coach alerts delivered as push notifications can include wellness scores and workload warnings, which pass through Apple's push notification service.

We do not share consumer health data with any other third party, including data brokers, advertisers, or analytics providers.

10.4 Deletion Rights & 30-Day Response SLA

You have the right to request permanent deletion of all consumer health data and associated personal information. We will fulfill verified deletion requests within 30 calendar days of receipt.

To submit a deletion request:

• In-app (immediate): Use the "Delete Account" option in Settings. This immediately and permanently deletes your account and all associated health data from our systems.
• By email: Send a deletion request to privacy@trackphase.app from the email address associated with your account. We will respond and complete the deletion within 30 calendar days.

Upon deletion, all consumer health data is permanently removed from our production database and will be purged from backup systems within 90 days in accordance with our backup retention policy.

10.5 Consent

Consumer health data is collected only with your explicit consent:

• HealthKit data requires explicit permission granted through the iOS Health app. You may revoke this permission at any time.
• Wellness check-in data is submitted voluntarily by you for each check-in.

11. California Residents — CCPA Rights

Applicable to residents of California under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA).

11.1 Data Categories Collected (CCPA § 1798.100)

The following table lists each category of personal information we collect, how it is collected, its retention period, and whether it is disclosed to third parties.

We do not collect device advertising identifiers (IDFA) or precise geolocation, and we never store payment card details (Apple and Stripe handle payments).

11.2 Your CCPA Rights

As a California resident, you have the following rights:

• Right to Know: Request disclosure of the categories and specific pieces of personal information we have collected about you in the past 12 months.
• Right to Delete: Request deletion of personal information we have collected from you (see Section 8.1).
• Right to Correct: Request correction of inaccurate personal information we hold about you.
• Right to Opt Out of Sale or Sharing: We do not sell or share your personal information with third parties for cross-context behavioral advertising. Because we do not sell or share personal data, there is nothing to opt out of. You may confirm this on our Do Not Sell My Personal Information page.
• Right to Non-Discrimination: We will not discriminate against you for exercising any of your CCPA rights.

To exercise your rights, email privacy@trackphase.app with the subject line “CCPA Rights Request.” We will verify your identity and respond within 45 calendar days, with a possible 45-day extension where reasonably necessary.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When we do, we will revise the "Effective Date" at the top of this page. We encourage you to review this policy periodically. Continued use of the Service after changes are posted constitutes your acceptance of the updated policy.

13. Contact Us

If you have any questions or concerns about this Privacy Policy or our data practices, please contact us at:

TrackPhase
privacy@trackphase.app