Privacy policy

The data controller for SportZync is SportZync AB (org. nr 559513-3082), registered at Korrödsvägen 9, 269 38 Båstad, Sweden. You can reach us about anything in this policy at info@sportzync.se.

[TODO — Rasmus/lawyer: confirm whether a Data Protection Officer is required — Art. 37 GDPR; large-scale processing of health data is the deciding question]

SportZync is a performance platform for athletes. To do its job it holds detailed records about your training, your competitions, your body, and how you feel. That is sensitive information, and some of it is health data.

We do not sell your data. We do not run advertising, and there are no advertising or third-party ad-tracking cookies in the app. We do not collect precise location. Your private conversations with the Zync coach are not visible to your coach, your parents, or anyone else on your team.

The plain-language version of all of this, written for athletes and parents rather than lawyers, is on the What we collect and why page. That page is the one we actually want you to read.

Account and identity

Your name and email address, held through our authentication provider (Supabase). If you sign in with Google, we receive your Google account email and basic profile — we never receive your Google password.

Athlete profile

Information you enter about a career: sport, goals, handicap or ranking, date of birth, gender, nationality, height and weight, playing style, strengths, and equipment. Date of birth matters for the rules about minors described below.

Sports performance data

For golf: rounds, hole-by-hole scoring, and individual shots including club used, distances, lie, result, and penalties, plus course and tournament names and any notes you add. For tennis and padel: matches, format, surface, conditions, scores, opponents and partners, venue, duration, and your written analysis. Also swing videos and scorecard images you upload.

Training data

Training sessions with duration and perceived exertion, workout programs and logged results, physical test measurements, fitness metrics, planning phases, and weekly targets.

Psychology check-ins (health-adjacent)

Daily check-ins recording how you feel, plus energy, focus, stress, and motivation ratings, free-text tags, and a written note. This is information about your mental state and we treat it with the same care as health data.

Medical and injury records (health data)

Injuries with body region, severity, status, dates, notes, and the point or area you marked on the body map. Medical background such as surgeries, conditions, and allergies. Treatment records including practitioner, type, and recommendations. Lab results. Documents you upload, such as scans or letters. This is health data and receives the extra protection described under “Special categories” below.

Planning and calendar

Season plans and events including titles, dates, locations, priority and notes; weekly planner entries, categories, comments, and who is mentioned or invited.

Team chat and Zync coach conversations

Messages you send in team, group, and direct conversations. Separately, your conversations with the Zync AI coach, and the durable facts Zync learns about you and shows back to you.

Nutrition

If you use the nutrition log: what you ate, when, and how you felt afterwards.

Technical and usage information

Timezone information attached to planner entries, nutrition entries, and email sends, so times display and send correctly. Through our analytics and error-monitoring providers we also receive your IP address, browser, operating system, device type, referring page, and the pages you visit within the app — see “Analytics and error monitoring” below, which is the part of this policy most people would not guess.

Billing

If you subscribe, our payment provider handles your payment details. We store customer and subscription identifiers, never your full card number.

What we do not collect

We do not collect precise or background location (no GPS coordinates). We do not use advertising identifiers, ad networks, or third-party advertising cookies. We do not sell personal data or share it with data brokers. Place names such as a course or venue are only what you type in yourself.

A career can include an athlete, coaches, and parents. What each person can see is decided by their role and by permissions that can be adjusted per member. Three boundaries are enforced in the software itself and are worth stating plainly:

• Your Zync coach conversations are private to you as the athlete. Coaches and parents cannot read them, and neither can the person who pays. This is enforced on every request, not by convention, and nothing from your Zync conversations is ever put into an email.
• Medical background, treatments, lab results, and medical documents are visible to the athlete and parents only — not to coaches. Coaches can see injuries (region, severity, and status), because that is what training decisions depend on.
• Coaches and parents in your career can ask Zync about you. Zync answers them only from what they can already see in SportZync, never from your own Zync conversations, and their questions stay private to them.

Be aware of the other side of that: psychology check-ins are visible to coaches and parents by default, as are your rounds, matches, training, planner, and team chat. If you want something to stay between you and the app, the Zync coach is the surface designed for it.

• To provide the service you signed up for — your account, your careers, your records, your team, and your plans. Legal basis: performance of a contract (Art. 6(1)(b) GDPR).
• To generate AI insights, analyses, and training plans from the data you have entered, including the Zync coach. Legal basis: performance of a contract, since this is a core part of what SportZync is.
• To process health and psychology data — see “Special categories” below. Legal basis: your explicit consent (Art. 9(2)(a) GDPR).
• To send you notification email such as the weekly digest and check-in reminders. You can stop these at any time using the unsubscribe link in any message.
• To keep the service working and secure — error monitoring, debugging, abuse prevention, and understanding which features are used. Legal basis: legitimate interests (Art. 6(1)(f) GDPR), balanced against your rights. [TODO — Rasmus/lawyer: confirm whether analytics should instead run on consent with a cookie banner — see the analytics section, this is the most likely compliance gap in the current build]
• To take payment if you subscribe. Legal basis: performance of a contract.

Injury records, medical background, treatments, lab results, medical documents, and psychology check-ins are health data or close enough to it that we treat them the same way. Under Art. 9 GDPR this is a special category of personal data and needs a stronger justification than ordinary data.

We rely on your explicit consent, which you give by choosing to enter this information. You are never required to record an injury, background history, or a check-in in order to use SportZync — every one of those features is optional, and you can leave them empty.

Injury region, severity, and status are included in the information sent to the AI coach so it can adapt suggestions around an injury. Your injury notes, medical background, treatments, lab results, and uploaded medical documents are not sent to any AI provider.

Many SportZync athletes are minors, and the product is built expecting that. Two rules apply:

• Under 13: a parent or guardian must give consent before an account is created and used. Sweden sets the digital-consent age at 13 under Art. 8 GDPR. If you are under 13, ask your parent or guardian to set up and approve your account.
• Ages 13 to 17: you can consent for yourself under Swedish law, but because SportZync records health-adjacent information we strongly recommend involving a parent or guardian, and the product supports adding them to your career as a parent member.

A parent added to a career can see the athlete’s medical background, treatments, and lab results — information deliberately withheld from coaches. Parents cannot read the athlete’s private Zync coach conversations.

[TODO — Rasmus/lawyer: decide and document the mechanism for verifying parental consent for under-13s — the app does not currently verify age or capture a parental consent record; today this rule is stated, not enforced]

We use a small number of service providers to run SportZync. They process data on our instructions and are not permitted to use it for their own purposes.

One consequence worth stating explicitly: Anthropic is the only AI provider we use. If the AI is unavailable, the coach replies with a fixed message and the other AI features return an error — nothing is sent to a different company instead.

This section exists because it is the part of our data handling that is least obvious from using the app.

SportZync includes PostHog for product analytics. It is configured with automatic capture, which means interactions such as clicks and page views inside the app are recorded without each one being individually coded. PostHog receives your IP address, browser, operating system, device type, and referring page, and sets a persistent identifier so repeat visits can be recognised. Page addresses within SportZync include career identifiers, so those are transmitted too.

SportZync also uses Sentry to report crashes and errors. Sentry receives technical context about the failure, which includes your IP address and browser information.

Neither of these is advertising, and neither is shared with advertisers. But both mean that while our own database holds no IP address or device fingerprint, our providers do receive that information. We would rather tell you that than claim otherwise.

[TODO — Rasmus/lawyer: confirm data-residency region for PostHog — it is currently configured against US cloud, which means a transfer outside the EU and requires an appropriate transfer mechanism, or a move to EU hosting]

[TODO — Rasmus/lawyer: confirm and state the hosting region for the Supabase project] [TODO — Rasmus/lawyer: confirm and state the deployment region for the Railway backend] [TODO — Rasmus/lawyer: confirm and state the Vercel deployment and edge regions]

Some providers listed above — including our AI providers, our email provider, and our analytics provider — process data outside the European Economic Area, in particular in the United States. [TODO — Rasmus/lawyer: confirm the transfer mechanism relied on for each non-EEA processor (Standard Contractual Clauses and/or EU–US Data Privacy Framework certification) and record the signed Data Processing Agreements]

We want to be straightforward here rather than describe a retention policy we have not built yet.

• Your data is kept for as long as your account and careers exist. We do not currently delete old records automatically after a fixed period.
• The only automated deletion running today removes internal scheduled-job logs after 90 days. That data contains no personal information about you.
• When a career is deleted, everything belonging to it is deleted with it — rounds, matches, training, planner, medical records, team conversations, and Zync conversations.
• When your user account is deleted, your account, check-ins, training sessions, memberships, notifications, and email records are deleted. Messages you wrote in shared team conversations remain, but are no longer linked to you.
• Backups held by our database provider may retain copies for a period after deletion. [TODO — Rasmus/lawyer: confirm the backup retention window with Supabase]

[TODO — Rasmus/lawyer: decide an actual retention policy for inactive accounts and dormant careers — there is currently no rule, which is defensible for a beta but will not hold indefinitely]

Under the GDPR you have the right to access your data, to have inaccurate data corrected, to have your data erased, to restrict or object to processing, to withdraw consent at any time, and to receive your data in a portable format.

Here is how each of those works in practice today, including where the product does not yet do the work for you:

• Access: most of your data is visible to you directly in the app. For anything else, contact us and we will provide it.
• Correction: you can edit your records in the app at any time.
• Erasure: you can delete your account from Settings. Because a career can be shared with coaches and parents, account deletion is refused while you are still an active member of a career, or while you are the athlete or the payer on one — leave, transfer, or delete those careers first, or contact us and we will help.
• Portability: there is currently no self-service export feature in SportZync. If you want a copy of your data, contact us and we will produce it manually. [TODO — Rasmus/lawyer: build a real data export, or commit to a response time for manual requests — Art. 20 gives a one-month deadline]
• Withdrawing consent: you can delete your injury, medical, and psychology records at any time, and you can unsubscribe from notification email from any message we send.

If you think we have handled your data wrongly, you can complain to the Swedish authority for privacy protection, Integritetsskyddsmyndigheten (IMY), at imy.se. We would appreciate the chance to put it right first.

Access to careers is controlled by role and permission checks enforced on the server for every request. Medical records and Zync coach conversations carry additional restrictions described above. Data is encrypted in transit. Access to production systems is limited to people who need it.

No service can promise perfect security. SportZync is in Beta and under active development; please tell us immediately if you find a way to see data you should not be able to see.

When this policy changes materially we will publish the new version here with a new version number and, where the change matters, ask you to accept it again. We keep a record of which version of this policy and of the terms of service each user accepted, and when.