Privacy Policy

1. Who We Are

Train My Game Pty Ltd ("TMG", "we", "us", "our") is an Australian company based in Adelaide, South Australia. We operate the Train My Game platform, a sports coaching and athlete development tool for coaches and athletes.

Contact: admin@trainmygame.com.au

2. What Data We Collect

We collect the following categories of personal information:

• Identity & Contact: full name, email address
• Profile Data: age, date of birth, sport position, team details
• Performance Data: training session logs, drill completions, scores, statistics, progress metrics
• Media: photos and videos uploaded to the platform. This covers drill and session videos an athlete submits, game video a coach uploads for analysis, profile pictures, photos and videos sent between a coach and an athlete in a message thread, and photos and videos a coach attaches to a post on their feed
• Community feed content: posts a coach writes for their athletes, any photo or video attached to them, and the reports athletes send us about a post or a message
• Messages: the messages sent between a coach and an athlete, and any media attached to them
• Payment Information: billing details processed via Stripe (we do not store card numbers directly)
• Device & Technical Data: device type, browser, IP address, operating system
• Device Identifier: the mobile app creates a random identifier for the device it is installed on, and stores it on that device. We hold it against the athlete's account so that an account can only be signed in on one device at a time, and so we can tell when one login is being shared between several devices. It is not linked to any advertising identifier, it is not shared with anyone, and it is created by the app rather than read from the phone. It is erased if the app is uninstalled
• Push Notification Tokens: Firebase Cloud Messaging (FCM) tokens used to send in-app and push notifications
• Usage Data: how you interact with the platform, session timestamps, feature usage
• Shot Location Data: the court zones from which shots are attempted and made, used to produce shooting heatmaps and to inform training recommendations
• Diagnostic & Error Data: where the application encounters an error, we collect the error, the device type and operating system, the application version, the screen in use, and your user identifier, to diagnose and fix faults

3. Why We Collect It

We collect and use personal information to:

• Provide and operate the coaching platform (creating programs, tracking progress)
• Process payments between coaches and athletes via Stripe
• Send notifications about sessions, program updates, and platform news
• Improve the platform through usage analytics
• Respond to support requests
• Limit an account to one device at a time, and identify logins being shared between several devices
• Keep the platform safe: reviewing content and conduct that athletes report to us, acting on those reports, and suspending accounts where necessary
• Comply with legal obligations

4. Children's Data & Parental Consent

Our parental consent system works as follows:

• When an athlete under 18 accepts an invitation, they provide their date of birth and their parent/guardian's name and email
• The athlete's account is created and marked pending parental consent
• An email is sent to the parent explaining what data is collected, who the coach is, and providing a consent confirmation link
• The athlete cannot use the app until a parent or guardian approves. Until then they see a waiting screen, and they can ask us to send the request again
• If consent is not confirmed within 48 hours, the coach is notified to follow up
• The parent or guardian receives weekly email summaries of their child's training activity
• Parents can view their child's training history, stats, and session logs at any time via a secure Parent Portal at app.trainmygame.com.au/parent
• Parents can withdraw consent at any time via the Parent Portal, which immediately locks the athlete's account and notifies the coach

Train My Game uses two AI features, and they send different things. It matters which one a coach is using, so both are set out here rather than summarised together.

• AI training programs. We send the athlete's age band, skill level, training goals, session length and frequency, program duration, available equipment, court access, any court zones the coach has chosen to focus on, and any notes the coach writes about that athlete. No name, no contact details, no date of birth and no parent's details are sent. The athlete's exact age is never sent, only the band they fall into.
• AI game analysis. Where a coach uploads game video for analysis, the athlete's name and playing number are sent to the AI provider along with the tracking data produced from the video, so that the statistics come back attributed to the right player. Contact details, date of birth and parent's details are not sent.

Coaches should not include health information, diagnoses or other sensitive personal information in the notes they write about an athlete.

We comply with the Privacy Act 1988 (Cth) and its Australian Privacy Principles in relation to all personal information, including that of minors. We do not knowingly collect personal information directly from children under 13 without verified parental consent.

If you believe we have collected data from a minor without appropriate consent, please contact us at admin@trainmygame.com.au and we will promptly investigate and take appropriate action.

5. How We Store Your Data

Your data is stored using the following third-party services:

• Firebase (Google Cloud): Our primary database, authentication, file storage, and cloud functions infrastructure. Data is stored on Google Cloud servers, which may be located in the United States or other regions. Google maintains appropriate security certifications and data processing agreements. By using the Platform, you consent to your personal information being stored and processed in the United States in accordance with Google's data processing agreements, which comply with internationally recognised privacy standards including ISO 27001 and SOC 2.
• Stripe: Payment processing. Card and banking details are handled directly by Stripe and subject to Stripe's own privacy policy and PCI DSS compliance. We store only transaction records and Stripe account identifiers.
• Sentry: Application error and crash reporting. Receives diagnostic data including a user identifier, device type, application version and error details. No training data, names, email addresses or payment details are sent to Sentry.
• Anthropic: Both AI features send data to Anthropic's Claude API: AI program generation, and AI game analysis. Section 4 sets out exactly what each one sends; in short, program generation sends no name, and game analysis does. Data sent to the Claude API is not used to train Anthropic's models.
• Roboflow: Where game video analysis is used, uploaded video is processed by Roboflow to detect players and events.
• Expo: Push notifications to the mobile app are delivered through Expo's push service, which receives the device's push token and the contents of the notification. Notifications name sessions, programs and the coach or athlete they concern.
• Google (Gmail): Email we send you (parental consent requests, weekly summaries for parents, and account notices) is delivered through Google's mail servers.

We implement appropriate technical and organisational security measures to protect your data against unauthorised access, loss, or misuse.

6. Who We Share Data With

We do not sell your personal data to any third party. Data is shared only as follows:

• Within the platform: Coaches can see the performance data, session logs, and profile information of their own registered athletes only. Coaches cannot access training or performance data belonging to athletes registered with other coaches.
• Coach profiles: A coach's profile information is readable by any signed-in user of the Platform. This supports joining a coach by invite code and viewing a coach's public profile page. It applies to coach profile data only, never to athlete training or performance data.
• The community feed: A coach writes posts for their own athletes, and every athlete registered to that coach can see them, along with any photo or video attached. Athletes cannot post to the feed and cannot comment on it, so nothing an athlete writes appears there. A coach's posts are not visible to athletes registered with any other coach. We do not check posts before they appear; if an athlete reports one, it comes to us and we review it.
• Messages: Messages and attached media are visible to the two people in that conversation: the coach and the athlete. Where an athlete reports a message or a post to us, our staff can see the reported content in order to deal with the report.
• Facility owners: Where a coach belongs to a facility, the owner of that facility can access the profile and training data of athletes registered to that coach, for the purpose of managing their facility.
• Stripe: Payment processing data is shared with Stripe to facilitate transactions between coaches and athletes.
• Google / Firebase: As our infrastructure provider, Google processes data on our behalf under a data processing agreement.
• Legal requirements: We may disclose information if required by law, regulation, or court order.

7. Data Retention

We retain personal data for as long as your account is active or as needed to provide services.

• If you close your account and request deletion, we will delete your personal data within 30 days of that request.
• Certain data may be retained for longer periods where required by law (e.g. financial records).
• Backups may persist for up to 90 days before complete removal from all systems.

8. Data Breach Notification

In the event of a data breach that is likely to result in serious harm to any user, Train My Game Pty Ltd will notify affected individuals and the Office of the Australian Information Commissioner (OAIC) as required under the Notifiable Data Breaches scheme (Part IIIC of the Privacy Act 1988 (Cth)). Notification will be made as soon as practicable after we become aware of an eligible data breach. If you believe your data may have been compromised, contact us immediately at admin@trainmygame.com.au.

9. Your Rights

Under the Australian Privacy Act 1988 and Australian Privacy Principles, you have the right to:

• Access: request a copy of the personal information we hold about you
• Correction: request correction of inaccurate or incomplete data
• Deletion: request deletion of your personal data (subject to legal obligations)
• Opt-out: unsubscribe from marketing communications at any time
• Complaint: lodge a complaint with the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au

To exercise any of these rights, contact us at admin@trainmygame.com.au. We will respond within 30 days.

10. Cookies

We use essential cookies only: those necessary for the platform to function (e.g. authentication session tokens). We do not use advertising or tracking cookies. You can disable cookies in your browser settings, but this may affect platform functionality.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify users of material changes via email to the address associated with their account at least 14 days before the changes take effect. Continued use of the platform after notification constitutes acceptance of the updated policy.

12. Contact Us

For any privacy-related queries, requests, or complaints:

Train My Game Pty Ltd
Adelaide, South Australia, Australia
Email: admin@trainmygame.com.au

13. Governing Law

This Privacy Policy is governed by the laws of South Australia, Australia. Any disputes will be subject to the exclusive jurisdiction of the courts of South Australia.