Privacy policy

Last updated: [LUCAS: confirm date on publication]

This policy explains what AllGains collects when you use the AllGains app and website, why we collect it, who we share it with and what you can do about it. We have written it to meet the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, and the privacy requirements of the Apple App Store and Google Play.

Who we are

AllGains Ltd is the data controller for your personal data. Registered address: [LUCAS: confirm registered address]. Company number: [LUCAS: confirm]. ICO registration number: [LUCAS: confirm]. You can contact us about anything in this policy at privacy@allgains.com [LUCAS: confirm mailbox].

What we collect

Your account

• Your name, email address and the way you sign in (email and password, Apple or Google). Passwords are held by our sign-in provider, never by us.
• Your date of birth. We use it to check you are old enough to use AllGains and to switch on the protections for under-18s described below.
• Profile details you choose to add: username, photo, bio, sport, positions, level, goals and club.

What you log

• Sessions, matches, drills, tests and workouts you record, including duration, effort ratings, skills, notes and results.
• Where a coach verifies a result, who verified it and when.
• If you connect a wearable or Apple Health / Health Connect, the workout summaries you choose to import, such as heart rate, distance and time. We do not read anything you have not connected.

Photos, video and clips

Media you upload, and media a club uploads in which you appear, subject to the club's rules and your (or your guardian's) consent.

Location

Only while a live session you have started is running, and only shown to the audience you pick. We do not track your location in the background. Under-18s never appear on the live map.

Device and usage

• A push notification token for your device, so we can send the notifications you have switched on.
• Analytics events about how the app is used (for example, that a sign-up step was reached or a session was logged), with your device platform and app version. We use these to see whether AllGains is working, not to advertise to you.
• Crash and error reports, which can include technical details of your device.

Why we use it, and our lawful basis

• To run your account and the features you use (logging, Passport, clubs, feed, notifications): performance of our contract with you.
• To keep AllGains safe (age checks, under-18 protections, moderation, security, fraud prevention): legitimate interests and legal obligation.
• To understand and improve the app (analytics and error reports): legitimate interests. You can object at any time.
• Health-related data such as heart rate from a wearable: your explicit consent, which you give when you connect the source and can withdraw by disconnecting it.
• Media of under-18s: the consent of a parent or guardian.

Children and young people

AllGains is for people aged 13 and over [LUCAS: confirm minimum age]. If you are under 18, your account starts with stricter settings: you are never shown on the live map, you are left out of public comparisons, physical profile and nutrition features are switched off, and you only appear in uploaded video when a parent or guardian has given consent. A parent or guardian can link to your account to see your activity and manage those consents. Coach and guardian roles are confirmed by a club admin.

Who we share it with

We do not sell your data. Other people see what your privacy settings allow. We use these processors, each under a contract that limits what they can do with your data:

• Google Firebase: sign-in and push notifications.
• Fly.io: hosting of our servers and database, in London.
• Tigris: storage of photos, video and backups.
• Resend: sending account emails.
• Sentry: crash and error reporting.

Some of these providers may process data outside the UK. Where they do, we rely on the UK's adequacy regulations or the International Data Transfer Addendum to protect it. We may also share data where the law requires it.

How long we keep it

We keep data for as long as your account is open, and retention is set per type of data; see Settings in the app for the current periods. When you delete your account we delete it, as described below.

Your rights

You can ask to see, correct, export or delete your data, to restrict or object to how we use it, and to withdraw any consent you have given. Most of this you can do yourself in the app: edit your profile, change your privacy settings, export your data or delete your account from Settings. For anything else, email us. We will reply within one month.

Deleting your account

You can delete your account in the app (Settings → Delete account) or by emailing us. Deletion removes your account, your media and your location history. Team records a coach has verified, such as a match result, stay with the club with your name removed.

Complaints

If you are unhappy with how we have handled your data, please tell us first. You also have the right to complain to the Information Commissioner's Office (ico.org.uk, 0303 123 1113).

Changes

If we change this policy in a way that matters, we will tell you in the app before the change takes effect.