Privacy policy

Who is responsible

Xavier Digital Solutions is a company registered in Mozambique, at Rua Castelo Branco, n.º 190, Bairro da Malhangalene, 1100 Cidade de Maputo, Moçambique.

Your club decides what it records about its swimmers, families and coaches, and why. For that information the club is the controller, and we process it on the club's behalf and under its instructions.

We are the controller for your AquaticsFlow account itself (your sign-in email and password), for payments for AquaticsFlow plans and AquaticsFlow+, and for this website.

If you want to see, correct or remove what your club holds, you can ask your club, or write to hello@aquaticsflow.com and we will help.

What we hold

• Your account: your name, email address, a securely stored password (we never see it), your language, and your role in the club.
• Swimmers: name, date of birth, sex and squad, and if the club adds them, a federation licence number and, for a swimmer who signs in, an email address.
• Parents and guardians: name, and email and phone if the club adds them; which swimmers you are linked to; and any consent you gave, with the version of the club's text you agreed to.
• Training and competition: sessions, attendance, check-ins (sleep, energy, mood, soreness, and whether a swimmer is ill or injured), times, personal bests, goals, meet entries, relay teams and dryland workouts.
• Coaches: the expiry dates of safeguarding and first-aid certificates.
• Club fees: what is owed, payments the club records, and receipts. Never card numbers.
• Phone alerts: if you turn them on, an address from your phone's browser so we can deliver them.
• Payments to AquaticsFlow: taken by Whop. We keep only whether a plan is active and Whop's reference for it. Your card details go to Whop, never to us.
• The waitlist: if you join it on our website, your name, email, role, and if you add them your club, country, club size and the software you use now, plus which of our posts brought you. We use it only to tell you about the launch and send your invitation.
• The family details form: if a parent uses their club's join link to send their details, their name, email and, if they add it, phone; each child's first name, surname and date of birth; and, if they tick it, their agreement to the club's consent text, with its version. Only the club's admins and head coach see it. If the club accepts it, the parent is linked to their children and invited to sign in, and the ticked consent counts only once they confirm their email. If the club declines it, nothing is linked and no one is invited; it stays visible to the same people until the club leaves or you ask us to delete it.

Health information

A check-in can say that a swimmer is ill or injured. That is health information. Only the swimmer, their linked parents and the club's coaches can see it, and it is used only to keep the swimmer safe in training.

Children

Most swimmers are children. A child only has an account if their club invites them. The club records a parent's consent before a child is made active, and a parent can give or withdraw consent in the app.

There are no private messages between people in AquaticsFlow: announcements go from coaches to a whole squad and its parents. Alerts on a phone's lock screen and emails never name a child or show a time. Swimmers under 18 are never emailed; their parents are.

Who can see it

Everyone sees only their own club. A coach sees the swimmers they coach; a club admin and the head coach see the whole club. A parent sees only their own children, and a swimmer only themselves. The database enforces this, not just the screens.

Who we share it with

We do not sell data or use it for advertising, and we use no analytics or advertising trackers. These providers help us run AquaticsFlow:

• Supabase: the database and sign-in, stored in the European Union (Paris, France).
• Netlify: hosts the app and this website. Requests pass through its servers, including in the United States.
• Resend: sends our emails, from the European Union (Ireland).
• Sentry: receives a report when a screen crashes, stored in the European Union (Germany). A report says what failed in our code, the page address with every identifier removed, and the device's browser and system. Sentry also receives how long about one page load or request in ten took, cleaned the same way, so we can find slow screens. Neither ever includes a name, an email, an IP address, a cookie, or anything typed into the app.
• Whop: takes payments, in the United States.
• Apple, Google and Mozilla: deliver phone alerts, as encrypted messages with no names in them.

Transfers outside the European Union

Where a provider handles data outside the European Union, we rely on the safeguards that provider offers for international transfers.

How long we keep it

For as long as your club uses AquaticsFlow. When a club leaves, or when you ask us to delete information, we delete or anonymise it, except records the club must keep by law, such as consent and payment records.

Waitlist details are deleted 6 months after launch, or sooner if you ask (email hello@aquaticsflow.com).

Your rights

You can ask to see, correct, delete or move your information, or object to how it is used. You can download everything held about you from Settings, and a parent can download their child's. For anything else, write to hello@aquaticsflow.com. You can also complain to the data protection authority where you live.

Cookies

We use only the cookies needed to keep you signed in and to remember your language. Your browser also remembers small preferences on your device, such as light or dark mode. There are no tracking or advertising cookies.

Security

Every connection to AquaticsFlow is encrypted. Who can see what is decided by rules in the database itself, so a screen can never show something its viewer isn't allowed to see.

Changes

If we change this policy, we update the date at the top, and we tell clubs in the app about important changes.