Privacy Policy

1. Who We Are

Train My Game Pty Ltd ("TMG", "we", "us", "our") is an Australian company based in Adelaide, South Australia. We operate the Train My Game platform, a sports coaching and athlete development tool for coaches and athletes.

2. What Data We Collect

We collect the following categories of personal information:

• Identity & Contact: full name, email address
• Profile Data: age, date of birth, sport position, team details
• Performance Data: training session logs, drill completions, scores, statistics, progress metrics
• Media: photos and videos uploaded to the platform. This covers drill and session videos an athlete submits, game video a coach uploads for analysis, profile pictures, photos and videos sent between a coach and an athlete in a message thread, and photos and videos a coach attaches to a post on their feed
• Community feed content: posts a coach writes for their athletes, any photo or video attached to them, the comments athletes write on those posts and the posts they like, and the reports athletes send us about a post, a comment or a message
• Parent or Guardian Details: for an athlete under 18, the email address of the parent or guardian who is asked to give consent. We do not ask for the parent's name
• Country and Time Zone: the country an athlete or coach lives in (used for age and child-safety rules that differ between Australia, New Zealand and the United States) and a coach's time zone (used to show session times)
• Agreement Records: the version of our Terms of Service and this Privacy Policy you agreed to, and when
• Messages: the messages sent between a coach and an athlete, and any media attached to them
• Payment Information: billing details processed via Stripe (we do not store card numbers directly)
• Device & Technical Data: device type, browser, IP address, operating system
• Device Identifier: the mobile app creates a random identifier for the device it is installed on, and stores it on that device. We hold it against the athlete's account so that an account can only be signed in on one device at a time, and so we can tell when one login is being shared between several devices. It is not linked to any advertising identifier, it is not shared with anyone, and it is created by the app rather than read from the phone. It is erased if the app is uninstalled
• Push Notification Tokens: Expo push tokens (mobile app) and Firebase Cloud Messaging tokens (coach web app) used to send push notifications
• Usage Data: the activity records the platform keeps to work, such as session timestamps, streaks and when you last signed in. We do not use an analytics or advertising tool
• Waitlist Sign-ups: if you join a waitlist on our website, for example for our app for athletes, we keep the email address you give and whether you are an athlete or a parent. We use it only to tell you when that product launches, and we do not share it. You can ask us to remove it at any time by emailing admin@trainmygame.com.au
• Shot Location Data: the court zones from which shots are attempted and made, used to produce shooting heatmaps and to inform training recommendations
• Diagnostic & Error Data: where the application encounters an error, we collect the error, the device type and operating system, the application version, the screen in use, and your user identifier, to diagnose and fix faults

3. Why We Collect It

We collect and use personal information to:

• Provide and operate the coaching platform (creating programs, tracking progress)
• Process payments between coaches and athletes via Stripe
• Send notifications about sessions, program updates, and platform news
• Fix faults and improve the platform, using the error reports described above. We do not use an analytics tool
• Respond to support requests
• Limit an account to one device at a time, and identify logins being shared between several devices
• Keep the platform safe: reviewing content and conduct that athletes report to us, acting on those reports, and suspending accounts where necessary
• Comply with legal obligations

4. Children's Data & Parental Consent

Our parental consent system works as follows:

• When an athlete signs up, they give their date of birth and the country they live in. If they are under 18, they give a parent or guardian's email address
• The athlete's account is created and marked pending parental consent
• Before a parent approves, we hold only what the athlete gave at sign-up (name, email, date of birth, country, and optionally playing position and skill level), the parent's email, the coach they joined if any, and the device identifier and push token described in section 2. The athlete cannot use the app, message anyone, book sessions or see any feed until a parent approves. A parent, or the athlete, can delete the account at any time, including before approval
• An email is sent to the parent explaining what data is collected, naming the coach where the athlete has joined one, and providing a consent confirmation link
• The athlete cannot use the app until a parent or guardian approves. Until then they see a waiting screen, and they can ask us to send the request again
• If consent is not confirmed within 48 hours, the coach is notified to follow up
• The parent or guardian receives weekly email summaries of their child's training activity
• Parents can view their child's training history, stats, and session logs at any time via a secure Parent Portal at app.trainmygame.com.au/parent
• Parents can withdraw consent at any time via the Parent Portal, which immediately locks the athlete's account and notifies the coach
• Parents can delete their child's account from the Parent Portal. Deletion follows section 7

Train My Game uses two AI features, and they send different things. It matters which one a coach is using, so both are set out here rather than summarised together.

• AI training programs. We send the athlete's age band, skill level, training goals, session length and frequency, program duration, available equipment, court access, any court zones the coach has chosen to focus on, and any notes the coach writes about that athlete. No name, no contact details, no date of birth and no parent's details are sent. The athlete's exact age is never sent, only the band they fall into.
• AI game analysis. Where a coach uploads game video for analysis, the athlete's name and playing number are sent to the AI provider along with the tracking data produced from the video, so that the statistics come back attributed to the right player. Contact details, date of birth and parent's details are not sent.

Coaches should not include health information, diagnoses or other sensitive personal information in the notes they write about an athlete.

We comply with the Privacy Act 1988 (Cth) and its Australian Privacy Principles in relation to all personal information, including that of minors. We do not knowingly collect personal information directly from children under 13 without verified parental consent.

In the United States, Train My Game is only for athletes aged 13 and over. A US athlete under 13 cannot create an account.

If you believe we have collected data from a minor without appropriate consent, please contact us at admin@trainmygame.com.au and we will promptly investigate and take appropriate action.

5. How We Store Your Data

Your data is stored and processed using the following services. Some of them are outside Australia; where they are, this is marked.

• Firebase (Google Cloud), in Australia: our database is in Google's Melbourne region (australia-southeast2), and uploaded photos and videos are stored in Google's Sydney region (australia-southeast1). Daily database backups are kept in Google Cloud for 30 days.
• Firebase (Google Cloud), in the United States, for now: some of the server programs that process your data (including sign-up, parental consent, email sending, game analysis and payment handling) still run in Google's United States region (us-central1) while we move them to Australia. While a request is handled there, the data it needs is processed in the United States. We will update this policy when the move is complete.
• Game video tracker, in Australia: when a coach uploads game video for analysis, the video is processed by our own player-tracking service running on Google Cloud in Sydney, which receives the video and the names and playing numbers of the athletes in it.
• Stripe, United States and elsewhere: payment processing. Card and banking details are handled directly by Stripe and subject to Stripe's own privacy policy and PCI DSS compliance. Stripe also receives the name and email address of the athlete or parent paying, to create their customer record. We store only transaction records and Stripe identifiers.
• Sentry, United States: application error and crash reporting. Receives diagnostic data including a user identifier, device type, application version and error details. We do not send training data, names, email addresses or payment details to Sentry.
• Anthropic, United States: both AI features send data to Anthropic's Claude API: AI program generation, and AI game analysis. Section 4 sets out exactly what each one sends; in short, program generation sends no name, and game analysis does. Data sent to the Claude API is not used to train Anthropic's models.
• Expo, Apple and Google, United States: push notifications to the mobile app are delivered through Expo's push service and then Apple's or Google's notification service, which receive the device's push token and the contents of the notification. Notifications name sessions, programs and the coach or athlete they concern. A notification about a new message shows the first 100 characters of the message to an adult; for an athlete under 18 it says only "New message from your coach", without the message text.
• Google (Gmail): email we send you (parental consent requests, weekly summaries for parents, payment and account notices) is delivered through Google's mail servers. We keep a copy of each email we send for 30 days, then delete it.
• YouTube (Google): some drill videos are YouTube videos shown inside the app and website. When you play or load one, your device connects to YouTube, which receives your IP address and browser or device details under Google's privacy policy.
• Google Fonts: our website and web app load their fonts from Google, which receives your IP address and browser details when a page loads.

Where personal information is sent to a service outside Australia, we take reasonable steps to make sure that service handles it consistently with the Australian Privacy Principles, including through their published data processing terms.

We implement appropriate technical and organisational security measures to protect your data against unauthorised access, loss, or misuse.

6. Who We Share Data With

We do not sell your personal data to any third party. Data is shared only as follows:

• Within the platform: Coaches can see the performance data, session logs, and profile information of their own registered athletes only. Coaches cannot access training or performance data belonging to athletes registered with other coaches.
• Coach profiles: A coach's profile information is readable by any signed-in user of the Platform. This supports joining a coach by invite code and viewing a coach's public profile page. It applies to coach profile data only, never to athlete training or performance data.
• The community feed: A coach writes posts for their own athletes, and every athlete registered to that coach can see them, along with any photo or video attached. Athletes cannot write posts, but they can comment on and like a coach's posts. A comment shows the athlete's name, and every athlete registered to that coach can see it. The coach can remove any comment. A coach's posts and their comments are not visible to athletes registered with any other coach. We do not check posts or comments before they appear; if an athlete reports one, it comes to us and we review it.
• Game video: game video a coach uploads for analysis can be watched by every athlete registered to that coach, not only the athletes who appear in it. Each athlete's statistics are visible to that athlete and the coach.
• Messages: Messages and attached media are visible to the two people in that conversation: the coach and the athlete. Where an athlete reports a message or a post to us, our staff can see the reported content in order to deal with the report.
• TMG administrators: a small number of TMG staff have technical access to platform data, including messages. They use it only to deal with a report, a safety concern, a support request you make, or a legal requirement.
• Facility owners: Where a coach belongs to a facility, the owner of that facility can access the profile and training data of athletes registered to that coach, for the purpose of managing their facility.
• Stripe: Payment processing data is shared with Stripe to facilitate transactions between coaches and athletes.
• Google / Firebase: As our infrastructure provider, Google processes data on our behalf under a data processing agreement.
• Legal requirements: We may disclose information if required by law, regulation, or court order.

7. Data Retention

We retain personal data for as long as your account is active or as needed to provide services.

• How to delete your account: athletes can delete their account in the mobile app (Profile, then Delete Account), including while waiting for a parent's approval. Coaches can delete their account in the web app (Profile, then Delete Account) once no athletes remain on their roster. A parent can delete their child's account from the Parent Portal. You can also email us at admin@trainmygame.com.au. Step-by-step instructions, including how to ask us by email if you no longer have the app, are on our Delete your account page.
• What deletion removes: your sign-in, profile, training programs and history, logged sessions, streaks, goals, notifications, uploaded photos and videos, messages and the media in them (for both people in the conversation), feed posts (coaches) and feed comments and likes, and copies of emails sent to you. Any active subscription is cancelled at once, and your customer record at Stripe is deleted. Deletion starts immediately and normally finishes within an hour; we will complete it within 30 days.
• What we keep: past bookings, with your name removed, so the coach keeps the date, time and amount for their records. Payment and transaction records, and the records of parental consent and its withdrawal, for as long as the law requires. A record that the account was deleted, without your name or email. Reports made to us about content. Stripe keeps its own records of past payments under its own legal obligations. Game video a coach recorded is the coach's record and stays with the coach; the deleted athlete's name and statistics are removed from it. Photos and videos a coach posted that show an athlete also stay with the coach; if you ask us to remove one you appear in, we will.
• Agreement records: the record of which version of our Terms of Service and this Privacy Policy you accepted, and when, is kept after your account is deleted, as evidence of that agreement.
• Backups: deleted data can remain in our daily database backups for up to 30 days, after which the backups expire and it is gone.

8. Data Breach Notification

In the event of a data breach that is likely to result in serious harm to any user, Train My Game Pty Ltd will notify affected individuals and the Office of the Australian Information Commissioner (OAIC) as required under the Notifiable Data Breaches scheme (Part IIIC of the Privacy Act 1988 (Cth)). Notification will be made as soon as practicable after we become aware of an eligible data breach. If you believe your data may have been compromised, contact us immediately at admin@trainmygame.com.au.

9. Your Rights

Under the Australian Privacy Act 1988 and Australian Privacy Principles, you have the right to:

• Access: request a copy of the personal information we hold about you
• Correction: request correction of inaccurate or incomplete data
• Deletion: request deletion of your personal data (subject to legal obligations)
• Opt-out: unsubscribe from marketing communications at any time
• Complaint: lodge a complaint with the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au

To exercise any of these rights, contact us at admin@trainmygame.com.au. We will respond within 30 days.

10. Cookies

We use only what the platform needs to work: your browser's storage keeps you signed in and remembers settings. We do not use advertising or tracking cookies, and we do not use an analytics tool. Two third parties are loaded by our pages: Google Fonts (for the typefaces) and, when a drill uses one, a YouTube video; they receive your IP address and browser details as described in section 5. You can clear or block this storage in your browser settings, but you may not be able to stay signed in.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify users of material changes via email to the address associated with their account at least 14 days before the changes take effect. Continued use of the platform after notification constitutes acceptance of the updated policy.

12. Contact Us

For any privacy-related queries, requests, or complaints:

13. Governing Law

This Privacy Policy is governed by the laws of South Australia, Australia. Any disputes will be subject to the exclusive jurisdiction of the courts of South Australia.