Privacy Policy

Last updated: March 10, 2026

Peak Performance Data ("we", "us", or "our") operates the Peak Performance Data web application (the "Service"). This Privacy Policy explains how we collect, use, store, and protect your personal information when you use our Service.

By accessing or using our Service, you agree to the collection and use of information in accordance with this policy. If you do not agree, please do not use the Service.

1. Information We Collect

1.1 Account Information

When you create an account, we collect:

• Full name
• Email address
• Role within the platform (e.g. player, coach, parent, club administrator)
• Organization or club affiliation

1.2 Athletic and Performance Data

Depending on your role and how you use the Service, we may collect and process:

• Training session logs (type, duration, intensity, notes)
• Performance test results and metrics
• Tournament and competition records
• Injury tracking data
• Coach observations, evaluations, and session plans
• Player progress reports and performance scores

1.3 Data from Third-Party Integrations

If you choose to connect a third-party service (such as Garmin Connect), we may receive activity and health data from that provider, including but not limited to workout summaries, heart rate data, pace, distance, and training load metrics. You can disconnect third-party integrations at any time from your account settings.

1.4 Usage Data

We automatically collect technical data when you use the Service, including:

• IP address and approximate location
• Browser type and version
• Device type and operating system
• Pages visited, time spent, and navigation patterns
• Referring URL

2. How We Use Your Information

We use the information we collect to:

• Provide, maintain, and improve the Service
• Manage your account and authenticate your identity
• Enable coaches, parents, and club staff to view athlete performance data in accordance with the access permissions you or your organization have configured
• Generate performance analytics, charts, and reports
• Send you important updates about the Service (e.g. security alerts, feature changes)
• Respond to your support requests
• Detect and prevent fraud or abuse
• Comply with legal obligations

3. How We Share Your Information

We do not sell your personal data. We may share your information in the following circumstances:

• Within your organization: Coaches, parents, and administrators within your club or team may access your performance data based on the role-based permissions configured in the platform.
• Service providers: We use trusted third-party services (e.g. hosting, database, analytics) that process data on our behalf under strict confidentiality agreements.
• Legal requirements: We may disclose information if required by law, court order, or governmental authority.
• Business transfers: In the event of a merger, acquisition, or sale of assets, your data may be transferred as part of that transaction. We will notify you before your data becomes subject to a different privacy policy.

4. Data Storage and Security

Your data is stored securely on servers provided by Supabase and Vercel, located in the European Union. We implement industry-standard security measures including:

• Encryption of data in transit (TLS/HTTPS) and at rest
• Row-level security policies on our database
• Role-based access controls
• Regular security reviews

While we take reasonable steps to protect your information, no method of electronic storage or transmission is 100% secure. We cannot guarantee absolute security.

5. Data Retention

We retain your personal data for as long as your account is active or as needed to provide the Service. If you request account deletion, we will remove your personal data within 30 days, except where we are required by law to retain certain information.

Aggregated, anonymized data that cannot identify you may be retained indefinitely for analytical purposes.

6. Your Rights

Under applicable data protection laws (including the GDPR if you are in the European Economic Area), you have the right to:

• Access the personal data we hold about you
• Rectify inaccurate or incomplete data
• Delete your personal data ("right to be forgotten")
• Restrict or object to certain processing of your data
• Data portability: receive your data in a structured, machine-readable format
• Withdraw consent at any time where processing is based on consent

To exercise any of these rights, please contact us at the email address below. We will respond to your request within 30 days.

7. Age Requirements

The Service is intended for users who are at least 16 years old. If you are under 16, you may use the Service only with the consent and under the supervision of a parent or legal guardian.

If you are a parent or guardian and believe your child under 16 has provided us with personal data without your consent, please contact us and we will promptly delete that information.

8. Cookies and Tracking

We use essential cookies to maintain your session and preferences (e.g. language, theme). We do not use third-party advertising cookies.

We may use privacy-respecting analytics to understand how the Service is used and improve the user experience.

9. Third-Party Links

Our Service may contain links to external websites or services that are not operated by us. We are not responsible for the privacy practices of those third parties. We encourage you to review their privacy policies.

10. California Consumer Privacy Act (CCPA)

If you are a California resident, you have the right to request disclosure of the categories of personal information we collect, the right to request deletion of your personal information, and the right to opt-out of the sale of your personal information.

We do not sell your personal data to third parties. To exercise any of your CCPA rights, please contact us at the email listed below.

11. Children's Privacy

The Service is not directed to children under 16. We do not knowingly collect personal information from children under 16 without verified parental consent. Parents may create managed accounts for their children (ages 16-18) and have full control over their child's data, including the right to access, modify, or delete it.

12. Cross-Border Data Transfers

Your data is stored on servers located in the European Union (Supabase, Hetzner) and the United States (Stripe, AWS S3). By using the Service, you consent to the transfer of your data to these regions. We ensure that all data transfers comply with GDPR adequacy requirements or Standard Contractual Clauses where applicable.

13. Data Protection Officer

For GDPR-related inquiries or to exercise your rights under the General Data Protection Regulation, you may contact our data protection contact at danielsilva@peakperformancedata.app. You also have the right to lodge a complaint with your local data protection authority.

14. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify you by email or through a prominent notice within the Service. The "Last updated" date at the top of this page indicates when the policy was last revised.

15. Contact Us

If you have any questions about this Privacy Policy or wish to exercise your data rights, please contact us:

• Email: danielsilva@peakperformancedata.app

Peak Performance Data is operated from Portugal and is subject to Portuguese and European Union data protection regulations.