How we handle your data

1. Who this policy covers

Athletic Advantage is a wellness and development platform used by school athletic programs. This policy applies to school administrators, coaches, and athletes who use our website console or mobile app, and to parents/guardians who interact with us on an athlete's behalf (for example, to grant consent).

Your school is the primary point of contact for how your data is used at that school — we act as the school's data processor. Nothing here overrides a data processing agreement your school has separately signed with us.

2. What we collect

Account information: name, email, role (admin, coach, or athlete), and school affiliation.

Wellness data (sensitive health information): daily check-in responses — sleep, soreness, energy, mood, stress, and pain — training load and session logs, recovery and gym program assignments, and automated ACWR workload and Recovery Score figures calculated from the above.

Development data: coach-entered scores across the six development domains — Fitness/Physical, Tactical, Technical, Footballer Culture, Psychological, and Wellness — used to track an athlete's individual development plan.

Communications: team messages, direct messages between coaches and athletes, and department announcements. Messages are automatically deleted after 12 months.

Technical data: login timestamps, device/browser information, and basic usage analytics — collected only after you accept our cookie/analytics notice, and never combined with wellness data.

3. Why we collect it

Wellness and development data exists for one purpose: to help coaches and school staff support athlete wellbeing and make more informed training decisions. We do not use it for advertising, we do not sell it, and we do not repurpose it beyond what your school has engaged us to do.

4. Consent for athletes under 18

Every athlete under 18 requires a parent or guardian's recorded consent before any wellness data is collected for them. See our Parental Consent page for how that works, and our Wellness Data Policy for exactly what "wellness data" means in this product.

5. Who can see your data

Access is scoped by role and enforced at the database level, not just in the app's screens:

• An athlete can see only their own data.
• A coach can see only athletes on teams they're assigned to — never another coach's team, and never another school.
• A school admin can see only their own school — never another school's data.

We do not share individual wellness data with any third party outside your school, except the infrastructure providers listed below, each bound to only process it on our instructions.

6. Where your data is stored

All data is hosted in Australia (AWS Sydney, ap-southeast-2) via our database provider, Supabase. We chose an Australian region specifically because this product handles children's health data and many government schools require in-country residency.

Sub-processors we currently use: Supabase (database and authentication, hosted in Sydney) and Resend (transactional email delivery — account confirmations and consent requests only, never wellness content). If we add payment processing (Stripe) or analytics (Google Analytics), they will be added to this list before going live, along with where each one processes data.

7. How we protect it

• Encrypted in transit (TLS) and at rest.
• Passwords are hashed — we never see or store them in plain text.
• Row-level security enforced per school and per role on every table that holds personal or health data.
• The credentials that could bypass these protections never ship to your browser or the app.

8. How long we keep it

We keep wellness and account data for as long as your school's subscription is active and your account exists. Team and direct messages are automatically deleted after 12 months. When an athlete leaves a school or a school ends its subscription, we delete or de-identify their data on request.

9. Your rights

You (or, for a minor, their parent/guardian) can ask us to: give you a copy of the data we hold, correct anything inaccurate, or delete your account and associated data. Contact your school first, or email us directly — see below.

10. Cookies and analytics

We only load analytics tools after you actively accept our cookie banner. Analytics never receives wellness data, health information, or anything that identifies an individual athlete.

11. Changes to this policy

If we make a material change to how we handle your data, we'll update the date at the top of this page and, where required, ask for your consent again.

12. Contact us

Questions about this policy or your data: hello@athleticadvantageschool.com