Privacy Policy

1. Who We Are

SportsDevHub ("we", "us", "our") is an athlete development platform operated from the United Kingdom and Ireland. We provide tools for coaches to assess, track, and develop athlete performance.

Data Controller: SportsDevHub
Contact: privacy@sportsdevhub.org

2. What Data We Collect

We collect the following categories of personal data:

Account Data

• Name, email address, and password (hashed)
• Sport and organisation details (coaches)
• Phone number (optional)

Athlete Performance Data

• Athlete names, positions, and profile information
• Attribute grades and scores
• Goals, milestones, and progress data
• Training session records
• AI-generated development blueprints

Usage Data

• Pages visited and features used
• Device type, browser, and IP address
• Timestamps of actions

Payment Data

• Subscription tier and billing status
• Payment processing is handled entirely by Stripe — we do not store card numbers

3. How We Use Your Data

We process your data for the following purposes:

4. Data Sharing & Third Parties

We share data with the following processors, all of which have their own GDPR-compliant privacy policies:

We do not sell your personal data to any third party.

5. Data Retention

• Active accounts: Data retained for the duration of your account
• Deleted accounts: All personal data is deleted within 30 days of account deletion
• Payment records: Retained for 7 years as required by UK tax law
• Server logs: Automatically deleted after 30 days

6. Your Rights (GDPR)

Under the UK GDPR and EU GDPR, you have the following rights:

• Access — Request a copy of all data we hold about you
• Rectification — Correct inaccurate personal data
• Erasure — Request deletion of your account and all associated data
• Portability — Export your data in a machine-readable format (JSON)
• Restriction — Request we limit processing of your data
• Objection — Object to processing based on legitimate interests
• Withdraw consent — Where processing is based on consent, withdraw at any time

To exercise any of these rights, go to Settings → Privacy & Data or email us at privacy@sportsdevhub.org. We will respond within 30 days.

7. Cookies

We use the following cookies:

We do not use advertising or tracking cookies. Authentication cookies are strictly necessary for the service to function.

8. International Transfers

Some of our processors (Supabase, Vercel, Stripe, Google) may process data outside the UK/EEA. These transfers are protected by Standard Contractual Clauses (SCCs) or adequacy decisions as required by UK GDPR.

9. Data Security

We protect your data through:

• Encrypted connections (HTTPS/TLS) on all pages
• Hashed passwords (bcrypt)
• Row Level Security (RLS) on all database tables
• JWT-based authentication with server-side verification
• Security headers (CSP, HSTS, X-Frame-Options)
• Rate limiting on API endpoints
• Role-based access control (coach/athlete/admin)

10. Children's Data & Under-18 Protections

SportsDevHub is used by coaches working with athletes of all ages, including children and young people. We take the privacy and safety of under-18 athletes seriously and comply with the ICO Children's Code (Age Appropriate Design Code) and UK GDPR Article 8.

Age Tiers

We apply different levels of protection based on athlete age:

Under-13 Athletes (UK GDPR Article 8)

We require verified parental or guardian consentbefore creating an account for any athlete under the age of 13. Consent is collected during the athlete sign-up flow and recorded with timestamp and IP address. A parent or guardian may withdraw consent at any time, which will suspend the athlete's account pending review.

Supervised Messaging

Coaches cannot send private 1:1 messages to any athlete under 18. All communication with under-18 athletes is conducted via supervised 3-way threads that include the linked parent or guardian. This aligns with CPSU/NSPCC safeguarding best practice.

Gamification (ICO Children's Code Standard 12)

Gamification features (badges, achievements, leaderboards) are disabled by defaultfor all athletes under 18, in accordance with ICO Children's Code Standard 12 (profiling and nudge techniques). A parent or guardian may opt-in to enable these features from the Parent Portal.

Data Retention for Children's Data

• Athlete data is retained for the duration of the active coach-athlete relationship
• Consent records are retained for 6 years after the athlete turns 18 (legal requirement)
• Parents/guardians may request deletion at any time via the Parent Portal

11. Parent & Guardian Rights

If your child has an athlete account on SportsDevHub, you have the following additional rights as their parent or guardian:

• Access — View all performance data, grades, goals, and session records held about your child via the Parent Portal
• Erasure— Request deletion of your child's account and all associated data from Settings → Data & Privacy in the Parent Portal
• Consent withdrawal— Withdraw consent for your child's account at any time; this will suspend the account pending review
• Gamification opt-in/out — Control whether gamification features are enabled for your child
• Portability— Export a copy of all your child's data in machine-readable JSON format

To exercise any of these rights, log in to the Parent Portal or email privacy@sportsdevhub.org. We will respond within 30 days.

13. Changes to This Policy

We may update this policy from time to time. We will notify you of significant changes via email or an in-app notification. The "Last updated" date at the top of this page will always reflect the current version.

14. Contact & Complaints

If you have any questions about this policy or wish to exercise your rights:

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) in the UK or the Data Protection Commission (DPC) in Ireland.