Privacy Policy

Last updated: 30 August 2026

Swimo.fit provides swim club management software. We process personal data primarily on behalf of clubs, with a strong focus on protecting minors. Questions: info@swimo.fit.

1. Roles

  • Your club (controller). Decides who is on the platform, manages rosters, and controls visibility. Direct requests for corrections or deletion to your head coach.
  • Swimo.fit (processor). Hosts and processes club data on the club’s instructions, acting as an independent controller only for platform security and for enquiries sent from our website.

2. What we collect, and from whom

Who supplies each category matters, so it is stated for each one.

  • Account and profile, from you. Name, email, sign-in method (Google, Apple, or email and password), and date of birth — used strictly to establish whether you are old enough to accept our terms yourself. Optional photo, phone, and address.
  • Swimmer records. Name, date of birth, gender, and team are entered by the club. Address, phone, emergency contacts, and authorised pickups are entered only by the swimmer or their parent, and are required. Allergies and medical notes are entered only by the swimmer or their parent, and are optional.
  • Training and performance, from coaches or imports. Meet times, SD3/SDIF imports, personal bests, goals, workouts, and attendance.
  • Communications, written by you. Posts and media attachments. Voice dictation is processed on your device; raw audio is never stored or transmitted.
  • Technique submissions and coaching feedback. Video or images of a swimmer training, submitted by the club or by the family — including footage taken away from the club, at home or on holiday — together with a short note describing what the swimmer wants looked at, and the written feedback the club’s coaches give on it. Where a coach has revised or withdrawn their feedback, we keep what it previously said.
  • Technical, generated by use. Push tokens and system logs with identifiers stripped and replaced by a placeholder. No third-party advertising, analytics, or session-recording tools. We do not sell personal information or use your content to train machine-learning models.

3. Why we use it

Our basis is normally the contract with your club, or our legitimate interest in running and securing the service. Address, phone, and emergency contacts sit there: a club cannot run sessions safely without them, which is why they are required.

Allergies and medical notes are different. They are health information, they are optional, and the basis is your consent — given in the plainest way there is: you type them in yourself, or you leave them empty. Nobody at the club can enter them for you, and nothing stops working if you do not.

4. Who can see what

Everything is scoped to a club. No club can see another club’s data.

  • Head coaches. Every record in their club, including medical notes, plus settings and critique approval.
  • Assistant coaches. For the swimmers they coach: name, date of birth, competition record, and technique critiques. Nothing else — no contact details, no address, no emergency contacts, no allergies, no medical notes. A head coach is the only member of staff who holds a swimmer’s full record.
  • Parents and swimmers. Their own profile, or their linked child’s: times, attendance, and technique feedback. Nothing about other families.
  • Media. Photos and videos are stored privately and served only through short-lived signed links, issued after checking the viewer is allowed to see them.

Technique review. A swimmer’s technique submissions, and the coaching feedback on them, are visible to every coach assigned to that swimmer, to every parent or guardian linked to them, and to the swimmer themself. That list is not a setting anyone can change: it is worked out from the swimmer each time, so feedback about a child cannot be addressed to the child while leaving their parents out. There is no private channel between an adult and a child on Swimo.fit.

Where a club requires it, an assistant coach’s feedback is held for the head coach to approve before the family sees it. Held feedback is visible to the club’s coaches only.

Footage a coach records is visible to the family once the coach has written their feedback on it, so a recording never arrives without the coaching that explains it.

5. Who we share it with

Only the infrastructure providers needed to run the platform. This list is the live one, and it is also published at /subprocessors. Clubs are told by email when it changes.

ProviderWhat reaches themWhy
Google Cloud PlatformEverything. The application runs on Cloud Run and the database is Cloud SQL for PostgreSQL, so all of the data described in the Privacy Policy lives on Google's infrastructure. Server logs go to Cloud Logging; credentials and signing keys are held in Secret Manager; container images in Artifact Registry.Hosting, database, logging, and secret storage.
Firebase AuthenticationYour email address, your sign-in identity, and a session token. Also the identity provider you chose.Signing you in and verifying every request. We never store your password ourselves.
Firebase StoragePhotos and videos you upload, video thumbnails, and profile pictures.Storing media for technique submissions and feedback, posts, and profiles.
Cloud FirestoreOnly tiny 'something changed' markers: a club identifier, a topic name such as 'calendar' or 'posts', a timestamp, and sometimes an opaque identifier (which session an attendance update belongs to). No message text, no names, no email addresses, no swimmer records, no media. Clients can read only their own club's markers and can never write.Telling apps that are open to refresh. PostgreSQL remains the only store of actual content.
Google Sign-InIf you choose it: the fact you signed in, and the email address and name on your Google account.An optional sign-in method.
Apple Sign-InIf you choose it: the fact you signed in, and the email address (or Apple's private relay address) and name you release to us.An optional sign-in method on iOS.
ResendThe recipient's email address and the full contents of each notification email, which includes the sender's name, the swimmer's name, and an excerpt of a technique submission's note, a coach's written feedback, or a post. Sent from noreply@invitation.swimo.fit.Delivering invitation and notification email.
Apple Push Notification serviceYour device's push token, and the notification's title and body, which contains an excerpt of a technique submission's note, a coach's written feedback, or a post that triggered it.Delivering push notifications to iPhones and iPads.
Firebase Cloud Messaging (Google)The same push token, title, and body, for Android devices.Delivering push notifications on Android.
Google Maps PlatformVenue and event addresses you type, and the coordinates they resolve to. Address autocomplete runs in your browser and talks to Google directly.Turning an address you type into a suggestion and a set of coordinates.
Google Weather APIVenue coordinates and the times of upcoming sessions. No personal details.Pool conditions on the dashboard and storm watch/warning alerts.
Google FontsYour browser's IP address and user agent, because the web app loads its typeface from Google's font servers.Web typography.
Apple (App Store)Whatever Apple collects when you download or update the mobile app, under Apple's own privacy policy. We do not receive it.Distributing the iOS app.

6. Where your data is stored

All processing happens in the United States. We do not currently offer a transfer mechanism for clubs outside the US; a club elsewhere should talk to us first.

7. Children

Swimo.fit acts as a Service Provider under the Children’s Online Privacy Protection Act (COPPA). We process children’s data solely to provide the platform to the club, never for our own commercial purposes, and we never sell data or build advertising profiles.

  • Nobody self-registers. A child is here because their club invited them, or because their name appeared in a competition results file the club imported.
  • A club can record very little about a child. Name, surname, date of birth, gender, and team. A coach cannot enter a child’s address, phone, photograph, emergency contacts, allergies, or medical notes.
  • A child never agrees to anything themselves. The account is created locked, and a parent or guardian accepts on the child’s behalf — from their own account, or through a single-use link we email them. The child is never shown an accept button. This applies to assistant coaches under 18 as well, and where the role is a coaching one their guardian is told what it involves and agrees to it specifically.
  • The agreement expires when the child grows up. On turning 18 they accept in their own name, and we delete the guardian’s address from their record.

8. Keeping and deleting data

  • Club records are kept while the club uses Swimo.fit. A swimmer’s times from three seasons ago are the point of the product.
  • Deactivated swimmers. After five consecutive years deactivated, we delete the personal details — contact information, address, photos and video, emergency contacts, authorised pickups, allergies, and medical notes. Reactivating resets the clock.
  • Competition records are retained by the club, as its own sporting record. Name, date of birth, meets, times, personal bests. Your club decides how long to keep its results; we hold them on the club’s behalf. This is true of a deletion request too, not only of the five-year sweep — see below.
  • Abandoned uploads are deleted after 7 days; notification records after 30 days. Invitations expire after 7 days.
  • Deleted posts and events are really deleted from the database. What happens to a photo or video depends on who put it there. Media you uploaded is removed from our file storage when you delete the thing it was attached to. Media a coach recorded is part of the club’s records, like results and attendance, and is kept when the coach removes it from view — although a request to erase a swimmer’s records removes all of it, whoever uploaded it. A file still attached somewhere else stays until that last reference goes too.
  • Coaching feedback is never destroyed. A coach can correct what they wrote, or withdraw it — in which case you see that feedback was given and removed, rather than an empty space. What it originally said is kept, and is read only if a report about it is investigated.

9. Cookies

A session cookie keeps you signed in, and a small browser-storage entry remembers whether you prefer light or dark. No advertising or tracking cookies.

10. Your rights

  • See what is held. Settings → Your data → Download my data produces a full JSON copy of what you can see.
  • Correct it. Profile details in settings; swimmer records through your head coach, or ask us.
  • Delete it. Settings → Delete account, or email deleteme@swimo.fit. We remove everything personal — contact details, address, photos and video, emergency contacts, authorised pickups, allergies, medical notes, and what you wrote.
  • What deletion does not reach: the club’s competition record. Name, date of birth, and the times swum are retained by your club as its own sporting record. We hold them on the club’s behalf and for no purpose of our own.
  • Act for a child. Parents and guardians can make any of these requests for their child, without going through the club.

Write to info@swimo.fit. We aim to reply within 30 days, and may need to check who you are first.

11. Changes to this policy

When this policy or the terms change materially, we ask you to accept the new version the next time you sign in. The date at the top always reflects the current version.