Privacy notice

Who is responsible for your data

The most important thing on this page: for swimmer and club data, your swimming club is the data controller. Training Den is the data processor.

Your club decides that swimmers’ names, dates of birth, attendance and absences are recorded, and why — it is the organisation you or your family have a relationship with, and it is responsible under UK GDPR for that decision. Training Den stores and processes that data only on the club’s instructions, under a data processing agreement that a club admin accepts in the app, and uses it for Training Den’s own purposes only for the limited running of the service described under what Training Den decides for itself — for example, counting how many sessions each club writes — as the agreement allows.

If you have a question about your own or your child’s swimming data, your first point of contact is your club, not Training Den.

Training Den is also a controller in its own right for a few things it decides for itself.

Those are: your account and signing in; the service emails we send; support requests, feedback and complaints sent to us; the record of each club accepting our data processing agreement; billing, if you pay for your own subscription; referrals; our own log of how much the service is used; and keeping the platform secure and running, including our own staff screens that look across every club. For those, Freeboard LTD is the controller — not your club, and not as anyone’s processor — so come to us rather than to your club. What we hold for each, why, the legal basis and how long we keep it are under what Training Den decides for itself below. Everywhere else on this page that says “your club is the controller” or “ask your club”, read it as being about swimmer and club data.

What we hold for your club

On behalf of your club, we hold:

• Swimmer records: first name, last name, and an optional date of birth. That’s deliberately all — no home address, no photo, no medical record and no emergency contact are held for a swimmer.
• Club membership: who belongs to the club and in what role (admin, coach, parent or guardian, swimmer), which parent or guardian accounts are linked to which swimmer, and the invite links the club has sent.
• Squads and training groups: which squads a swimmer is in and, where a club divides a squad into training groups (sprint and distance, for example), which group a coach has put them in. A training group is kept with the dates the swimmer joined and left it, so the club can tell who was in a group on a given day. Only the club’s coaches and admins can see a swimmer’s training group; swimmers and parents are not shown it. It does decide two things about a swimmer: which of the squad’s group sessions appear in their session list, and whether a group session they were not marked at counts as one they missed — it does only if they were in that session’s group for the whole of that day.
• Attendance: which sessions a swimmer was present, late, absent or excused for.
• Absence notices: a category — illness, injury, holiday, school or other — plus an optional short note (up to 500 characters) a family can add. We treat “illness” and “injury” attached to a named child as health data (UK GDPR’s “special category” data). Those two categories are only offered once your club has recorded the extra legal condition it relies on for health data — see the legal basis below. The note box says “Just say when they’ll be back — please don’t include medical details.” Nothing about an illness or injury belongs in the note, because the note has no health-data safeguards of its own.
• Self-reported training data: if a swimmer, or their parent or guardian, chooses to record it — whether a swim, land (gym) or activity session was done, how it felt (“RPE”, 1–10) and an optional note; for a land session, what was actually lifted; and for an activity session, how many minutes it took.
• Activity sessions: general sessions — running, cycling, walking or anything else — that a coach gives to a squad or to named swimmers, with the coach’s instructions. The text the coach started from is kept too, and only coaches can see it. Creating an activity session makes no AI call.
• Season goals: target times a coach sets for a swimmer for particular events in a season, with an optional note (for example, what the time would qualify for). Only the club’s coaches and admins can see goals.
• Coach notes: notes a coach writes about a swimmer, in one of three visibility levels the coach picks each time — private (only the coach who wrote it — not even other coaches), coaches (any coach or admin at the club), or squad (also visible to swimmers and parents/guardians in that swimmer’s squad). Notes default to private.
• Session, dashboard and results data: sets, distances, race results, times and totals — all calculated by our own code from structured data, never invented or estimated by an AI model.
• Comments on sessions: what coaches write to each other about a session, including asking the coach who wrote it for a change. A comment is private to the coach who wrote it unless they share it with the club’s coaches and admins; a request for a change is always shared with them. Swimmers and parents never see comments.
• Saved sessions open for editing: when a coach opens a saved session to edit its text, a working copy of the page is kept on our servers — its words, each edit and who made it — so that any other coach who opens it can edit it with them. The coaches on the page also see which part of it each of them is on; that is passed between their browsers, not stored. For how long the working copy is kept, see how long we keep it.
• Voice recordings, if a coach creates a session by speaking: processed to build the session; see AI features and how long we keep it below.
• Coach assistant conversations: the history of a coach’s chats with the coach assistant. It is stored with real names, not the labels sent to the AI provider — see AI features.
• An audit log of important actions in the club (for example, who deleted or erased a record, and when), so the club can show what was done.

Your account itself — your name, email address and password — is Training Den’s own responsibility rather than your club’s, because one account can belong to more than one club. It is covered under what Training Den decides for itself.

Where this comes from

Most of what we hold about a swimmer is entered by the club, not by the child: a coach or admin adds a swimmer’s name and records attendance. A swimmer’s own linked account can add a few things directly — whether a session was done, how it felt and an optional note — and a parent or guardian’s account can do the same, or submit an absence notice, on a swimmer’s behalf.

A swimmer only gets their own login if the club invites them. Our advice to clubs is that swimmers under 13 should not have their own login, and a parent or guardian’s account should be used instead. When a coach invites a swimmer who is under 13, or whose date of birth the club has not recorded, the app warns them and asks them to confirm before it creates the invite. The club makes the final decision.

We do not run any advertising, and no third-party analytics or tracking (no Google Analytics, no Facebook pixel, nothing that builds an advertising or behavioural profile of you, and nothing that sells your data), and nothing here is shared, sold or used across clubs. We do keep our own short log of when accounts use the service, only to count how many people use it — see our own usage log below.

What Training Den decides for itself

For the things below, Freeboard LTD is the controller — apart from the emails we send for a club, which “Service emails” marks: we decide what is held and why, and the legal basis is ours to state. There are three legal bases in play, in plain terms:

• Contract (UK GDPR Article 6(1)(b)) — we need it to give you something you signed up for.
• Legal obligation (Article 6(1)(c)) — the law requires us to do it.
• Legitimate interests (Article 6(1)(f)) — it is needed for a sensible reason of ours, such as keeping the service safe, and it does not override your own interests or rights. You can object to anything we do on this basis — see your rights.

Payment data, if you pay for a seat

Some coaches pay for their own subscription (a “seat”) directly with us, rather than through their club — see our terms of use, section 7 (“Paying for a seat”), for what that agreement covers. That payment relationship is between you and us, not your club, so what we hold about it is separate from the swimmer and club data described above, and it is not held “on behalf of your club”. In the ordinary case your club does not know your seat exists and cannot answer anything about it.

Who is responsible for it: Freeboard LTD is the controller of this data, on its own account. Not your club, and not as anyone’s processor.

Why we are allowed to hold it: because we need it to give you the subscription you asked for and to take the payment for it — that is UK GDPR’s “performance of a contract” basis (Article 6(1)(b)) — and, for the records that have to survive the subscription itself, because the law requires a business to keep records of what it sold and to whom (Article 6(1)(c), a legal obligation). None of it is special category data, and none of it is used for marketing, profiling or anything else.

We never see, handle or store your card details. Payment is taken on a page hosted by Stripe, our payment provider — your card number never reaches our servers in any form. Nor do we hold your billing name or billing address: Stripe collects those on its own page and keeps them (see who it’s shared with below). We already hold your name and email as ordinary account data, described above; the seat adds nothing to that.

What we hold for a seat is one record per coach, and this is all of it:

• Stripe’s own identifiers for your customer and subscription record, and the identifier of the price you bought.
• Which tier you are on, and who is paying for it — today always you; the field exists so a club could take a coach’s seat over in future without a second, double-charging record, and it names that club when it does.
• Your subscription’s status, stored in Stripe’s own words (trialing, active, past due, unpaid, cancelled, paused, incomplete) plus our own “complimentary” for an account we do not charge.
• The monthly AI allowance your tier carries.
• Dates: when your trial ends, when the current billing period ends, and when your seat first lapsed if it has. Whether you have asked to cancel at the end of the current period is stored as a yes/no rather than a date — we do not hold a cancellation date.
• Two dates for pausing collection over part of a season, if a pause is set.
• Housekeeping: when we last applied an update from Stripe (so a delayed message cannot undo a newer one), and when the record was created and last changed.
• If your seat came from a pilot code: the moment that free seat stops giving full access.

Pilot codes. Some clubs are given a pilot code instead of a trial. If you use one, you pay nothing and Stripe is not involved at all; the seat record above is still kept, as “complimentary” with the date the pilot ends. We also keep which pilot code you used, when you used it and when that pilot ends, and the times we sent you the two reminder emails before it ends (by email, through Resend — see who it’s shared with). We hold these for the same reason as the rest of the seat record: to give you the seat you asked for, on the terms you agreed to when you used the code.

How long we keep it: while you have a seat, and then for six years from the end of the company’s financial year in which the last sale happened — the period UK tax law requires a company to keep its records for. That is longer than most of this notice describes, and it is why deleting your account does not delete this record — deleting your account does cancel the subscription, so nothing further is charged, but the record that it existed stays. It carries no card details, and no name or email of its own — it points at your account row, and that row’s name and email are cleared by the deletion. At the end of that period the record is deleted. The record of a pilot code you used is kept with your seat record and goes when it goes. If you never paid for a seat there is no sale to count six years from; how long we keep a pilot-only record in that case has not been decided yet, and nothing deletes it today — we will say here when it is decided.

Referral data

If you create or use a referral link, Freeboard LTD is the controller of that data just as it is for your own paid seat. We hold the random referral code, who created it, which new account used it, the signup and 90-day qualification dates, the qualifying Stripe invoice, eligibility and disqualification reasons, and the amount and processing state of each account-credit grant. An administrator’s user identifier, the action and its reason or prior failure details are also retained when they manually disqualify or retry a reward, so that intervention cannot erase its own audit trail. If Stripe delivers a paid invoice before its subscription update, we keep the minimum signed invoice facts needed to retry qualification when the update arrives. We also keep Stripe’s identifier for a credit once it has been applied. We use this to perform the referral offer you chose to take part in (Article 6(1)(b), fulfilling our referral agreement) and to prevent duplicate or abusive rewards and reconcile money records (our legitimate interests, Article 6(1)(f)). It is not used for profiling.

We do not collect your friend’s contact details. The product gives you a neutral link to copy. It does not ask for their email address or phone number and does not send or generate an incentivised email, SMS or WhatsApp message on your behalf. Public link validation and each participant’s referral summary never reveal the other person’s identity.

How long we keep it: deleting an account disables its public referral code and clears the deleted person’s name and email from the account row. The pseudonymised attribution and credit ledger remains with the subscription and sales record, because it is part of the money record. It contains no friend contact details or card details. It is kept for the same period as the payment records above — six years from the end of the company’s financial year in which the referral’s last credit or sale happened — and then deleted.

Why, and the legal basis

What we use it for

In general, your club’s data is used to: plan and record swim, land-training and activity sessions; take attendance; let a swimmer or parent/guardian tell the club about an upcoming absence and why; let a swimmer optionally record how a session felt; track season goals; and give coaches, club admins and (where a club allows it) parents/guardians visibility of a swimmer’s own training history. It is not used for anything else, apart from the limited figures our own staff use to run the service (see what Training Den decides for itself).

The legal basis

Because your club is the controller, the decision about which UK GDPR Article 6 lawful basis applies (for example, that it’s necessary for club membership, or that a family has consented) is your club’s to make and document, not Training Den’s.

That is about swimmer and club data. It does not cover what Training Den decides for itself — your account, service emails (apart from those we send for your club: change-request emails, and emails about a complaint about the club), support and complaints sent to us, billing, referrals, our usage log and platform security. We are the controller of those, so the lawful basis for each is ours to state, and we state it under what Training Den decides for itself above.

Health data: illness and injury

An absence reason of “illness” or “injury”, and any note with it, is health data about a child. UK GDPR treats that as a special category, which needs an extra legal condition (Article 9) on top of the ordinary one. Your club chooses that condition, as the controller, and records it in Club settings. The app offers two:

• the explicit consent of the swimmer’s parent or guardian (Article 9(2)(a)), which we recommend; or
• a condition in Schedule 1 to the Data Protection Act 2018 that the club has chosen and written down itself, with advice where it needs it. A club relying on one must also keep an appropriate policy document, which explains how it protects that information. Most clubs use explicit consent instead.

Until a club records one, the app does not accept “illness” or “injury” as an absence reason at all — families can still say a swimmer will be away, using another reason. If the club relies on explicit consent, only a parent or guardian can send an illness or injury notice (or a coach passing on what a parent or guardian told them), and they are asked to confirm consent each time; that confirmation is saved with the notice, with who confirmed it and when. If the club relies on a Schedule 1 condition, no consent is asked for. Whichever condition applies, the note box says “Just say when they’ll be back — please don’t include medical details.” Please don’t write anything about an illness or injury in the note at all: choose “Illness” or “Injury” where your club allows it, and otherwise tell your coach directly.

If your club is relying on your (or your parent/guardian’s) consent for anything here — for example, a health-related absence reason — you can withdraw that consent at any time by telling your club. Withdrawing does not make anything already done unlawful; it just means the club needs a different basis to continue, or must stop.

Do you have to provide it?

Providing this data is not a legal requirement — no law says you must give a swimming club this information. Whether it is needed to take part in your club’s training programme, and what happens if you would rather not provide something (an absence reason, for instance), is for your club to tell you, since the club decides how it runs its own programme.

Automated decision-making

We do not carry out any automated decision-making, including profiling, that produces legal or similarly significant effects on you. Where AI is involved (see AI features below), it only drafts a suggestion that a coach reviews and decides whether to save — nothing is decided about you automatically.

Separately, the app does work out two things about a swimmer automatically from stored training records — whether their recent logged effort has gone up or down compared with their own average, and whether they have missed a run of sessions or come to fewer than half of them recently. Both are worked out by our own fixed arithmetic, never a model, and both are written to describe only what was measured (“62% above their own average”) — never a risk, a prediction, or advice. Only coaches can see either figure; a swimmer or parent/guardian account cannot reach it, even by asking directly. Nothing is decided or changed automatically because of either one — a coach reads it and decides, or does not.

These flags are on by default, because they can help a coach notice a swimmer who is struggling. A club admin can switch them off for the whole club, and a club can leave an individual swimmer out of them — for example, if that swimmer or their parent or guardian objects.

Who it’s shared with

We don’t sell or share your data for marketing. To run the service at all, some data passes through a small number of infrastructure providers acting as our own sub-processors. Each one publishes a data processing agreement (DPA), linked below. Each provider’s standard DPA applies to our account through that provider’s terms of service. Our Vercel account is on Vercel’s Pro plan, which its DPA covers.

Each link goes to the provider’s own, current agreement, which is the one that applies to our account. We check the links automatically every week; if one ever stops working, search “[provider name] DPA” on the provider’s site. Before adding a new sub-processor, we will email your club’s admin contact and give the club the chance to object. A fuller list, with exactly what each provider receives, is available on request.

Stripe is different from the rest of this table in one respect. It acts as our processor when it takes your payment for us, but as a controller in its own right for its own legal duties: preventing fraud, and the anti-money-laundering and know-your-customer checks the law requires of it. For those, Stripe’s own privacy policy applies. Payment happens only if you choose to pay for your own seat — see payment data above.

AI features

Anthropic (Claude) is the default provider for these AI features, with OpenAI as an automatic backup. Our platform administrator can reverse that order. Voice audio always uses OpenAI GPT-Live, with no fallback to Anthropic. These features send data to the selected provider: the coach assistant (typed chat), session and land-training creation, reading a photographed whiteboard, and the session page, which sends a line a coach is writing — with its heading and the few lines around it, or, for a round’s count line, its heading and the lines of that round — for the AI to read, without the coach pressing anything. Everything else — saved sessions, dashboards, attendance, results, activity sessions — loads with zero AI calls, and neither provider trains its models on data sent through this app.

Separately, our own staff may read overall usage figures about the service through an AI assistant (Claude Code from Anthropic, or Codex from OpenAI). That assistant receives figures only — counts, totals and percentages, for the whole service or for each club — never anyone’s email address, a name from anyone’s account or record, or anything anyone wrote, though it includes club names, and for a club with one coach its figures are in effect about that coach. This is not covered by the provider agreements above, and the app itself makes no AI call for it; see what Training Den decides for itself.

The line that matters is not which screen a coach is on — it is whether they typed, spoke, or took a photo. Typed text is name-masked everywhere. Audio and photographs are not masked anywhere.

Wherever a coach types — the coach assistant, and swim and land-training session creation — a swimmer’s or coach’s name and internal ID are replaced with a meaningless label (like [S7]) before anything reaches an AI provider. That covers what a coach types now, the conversation history the app replays on later turns, and anything the app looks up for the AI to answer with — an attendance list, a coaching note and who wrote it, a swimmer’s history or times. The label changes every conversation (on the session page, a fresh set at least every minute), so it can never become a standing pseudonym for a particular child. This is enforced in code and covered by automated tests, including one that captures everything sent to the provider and fails if a real name appears anywhere in it — it is not a prompt asking the AI to behave.

Your coach’s own screen is unaffected: the real name is put back before they see the reply or the draft, and the saved session keeps real names. The label only ever exists in what travels to the provider. If the club’s roster cannot be loaded for any reason, the AI request is refused rather than sent unmasked.

What masking does not cover:

• Voice audio. A coach can create a swim session or a land-training session by speaking. OpenAI GPT-Live receives the audio directly, so a name said out loud reaches OpenAI as said. Voice audio never goes to Anthropic, including when Anthropic is selected for the app’s other AI features. (This is why the coach assistant cannot be spoken to at all: naming an individual child is the ordinary thing to do there, so the assistant has no spoken mode. Adding one would take a change to the software, not a setting.)
• What the app says back during a spoken session. OpenAI GPT-Live produces the spoken reply. The app sends it brief task replies and, when a draft is saved, its title. Those replies and titles can contain real names restored by normal session processing, including a surname the coach did not say aloud. When the call asks the app to prepare a session, conversation text is processed transiently by the selected AI provider, with swimmer and coach names masked first. That text can include other personal details from the call: matching names are masked, but not every kind of personal information. Training Den does not store that raw dialogue. Only the training description extracted from the coach’s words continues into the normal draft and conversation history.
• Photographs. A photo of a whiteboard or printed plan is not scanned or redacted for names before it goes to the AI’s vision model. The caption a coach types alongside it is masked; the picture is not.
• Squad names. The AI is always told what your club’s squads are called, because it has to name them back exactly to put a session in the right one. Usually harmless — but a squad named after a person sends that name every time. Renaming the squad is a two-minute fix on the Club screen.
• The limits of matching a name in text. Masking compares against the names actually stored for that club, so a misspelling or a nickname isn’t caught; a bare surname is deliberately never masked; a first name that is also an everyday word (Max, Grace, Will, May…) is only masked when it’s capitalised; and a coach who has left the club is no longer on the staff list, so their name is not masked at all.
• A name added or changed in the last minute, on the session page. The session page’s reads use a copy of the club’s names that is up to a minute old, so a swimmer or coach added to the club, or renamed, in the last minute may reach the provider unmasked if a coach names them on that page straight away.
• One thing masking adds rather than removes. If a coach types just “Freya” and one Freya is on the roster, what comes back is her full name — so a coach can see a surname they didn’t type. If more than one Freya is on the roster nothing is guessed: it comes back as “a swimmer”.
• A fuller version of this list, written for a club committee, is available to clubs on request.

A club can restrict the assistant further. In Club settings, a club admin can switch “Assistant privacy” between Standard and Strict for the whole club. On Strict, the assistant is not given any way to look up anything about a named individual — no attendance list, no coaching notes, no individual history, times or pace, no morning briefing, and no breakdown of a figure swimmer by swimmer or coach by coach — not even under a label. It keeps working for club-, squad- and session-level figures, sessions, dashboards and drafts, and coaches still see all of the detail on the ordinary screens; only the AI loses access. Three things to be precise about: Strict is where a new club starts, and an admin can switch it to Standard at any time; it applies to the assistant only, and changes nothing on the session creation screens; and it is not a promise that no label ever leaves — a coach can still type “how is Freya doing”, and that message still goes with her name replaced by a label.

Figures shown to a coach — distances, durations, percentages — are always calculated by our own code from the club’s stored data, never by the AI, so the AI is never the source of a number. This applies everywhere in the app, regardless of masking.

This is a risk-reduction measure, not an exemption. The masked labels are pseudonymisation under UK GDPR, not anonymisation — the data is still personal data, because your club can still link a label back to a real child. Using this app’s AI features does not take your club outside the scope of its own data protection obligations.

Each provider keeps a copy of what it’s sent for a limited time, mainly for abuse and safety monitoring — generally up to 30 days by default at both OpenAI and Anthropic, longer only if a request is flagged for a genuine policy violation. Neither company’s free consumer chat product (ChatGPT.com, claude.ai signed in personally) is used by this app. (Our staff’s own assistant, described above, does run on a Claude or ChatGPT plan, under that plan’s terms; it receives only usage figures.)

International transfers

Since 5 February 2026, UK law allows personal data to be sent abroad where the protection it gets there is not materially lower than in the UK (the “data protection test”) — for example, to a US company certified under the UK–US “data bridge”, or under a contract with approved safeguards such as the UK’s International Data Transfer Agreement or Addendum.

• Supabase stores the database in London, UK, and Vercel runs our website, API and scheduled jobs in London, UK (lhr1). Their own support access and platform operations can still involve other countries — for Vercel, mainly the United States. Supabase also runs its Realtime service, which we use while a coach has a saved session open for editing, on servers in several countries: what it carries for us (account and page identifiers, never the session’s words) and the sign-in token it checks (with the coach’s email address and the name they signed up with) can pass through any of them. Supabase’s DPA covers that with the EU standard contractual clauses and the UK’s International Data Transfer Addendum; Vercel’s with the standard contractual clauses and the UK’s International Data Transfer Agreement. Vercel is also certified under the UK–US data bridge.
• Resend stores data in the United States. Resend’s data processing agreement is in place for our account: Resend signs it for every account when the account is opened, and it covers these transfers with the EU standard contractual clauses and the UK’s International Data Transfer Addendum. Resend is also listed under the UK Extension to the EU–US Data Privacy Framework (the UK–US data bridge).
• OpenAI and Anthropic process in the United States. Each company’s data processing agreement applies to our account through its terms of service, and each uses the EU standard contractual clauses with the UK’s International Data Transfer Addendum as its safeguard for these transfers. You can read openai.com/policies/data-processing-addendum and www.anthropic.com/legal/data-processing-addendum directly. This covers the app’s own AI features. The usage figures our staff read through an AI assistant are sent under our own plans’ terms, not these agreements; they are designed not to be personal data.
• Stripe, if you pay for your own seat: our contract is with Stripe Payments Europe, Limited, in Ireland, and Stripe transfers payment data to Stripe, LLC in the United States. Stripe, LLC is certified under the UK–US data bridge, and Stripe’s DPA falls back to the standard contractual clauses or the UK’s International Data Transfer Addendum if the data bridge ever stops applying.

We keep a written transfer risk assessment for each of these providers, checked against each provider’s own data processing agreement and the official data bridge list.

How long we keep it

Most of your club’s data has no automatic time limit. It is kept while your club uses Training Den, until the club removes it, or until the club deletes its account.

That covers swimmer records, attendance, session history, self-reported training data (whether a session was done, an effort rating and a note), activity sessions, season goals and race results. A club admin can remove a single swimmer’s details at any time (see your rights).

Absence notices (the whole notice, with its reason and any note) are deleted automatically 365 days after the session they were about, or after the notice was given if the session has no date.

AI conversation history — a coach’s chats with the coach assistant, and with the AI while building a session or a dashboard — is deleted automatically 365 days after the conversation was last used or updated. It is worth naming specifically: it is stored with real names, not the labels sent to the AI provider (see AI features above), so it can carry more detail than the session it was used to draft.

These two periods are the same for every club, and a club cannot make them longer. They start for a club 14 days after it first accepts a version of our data processing agreement dated 4 October 2026 or later, which sets them out, so the club is told before anything is deleted. Until then, any period the club had chosen for itself still applies — if it chose none, they have no time limit: absence notices are kept until the club deletes them, and conversations while the club uses Training Den — and a new club starts with absence notices kept for 365 days. If a club had already chosen a shorter period, the shorter one stays.

Coach notes have no automatic time limit: they are kept for as long as the session they belong to. If a club chose a period for them in an earlier version of the app, they are still deleted when it ends.

A saved session open for editing — the working copy of its page, with its words, each edit and who made it — is normally cleared when a coach saves the session and leaves the page; otherwise a nightly job deletes it once nobody has written to it for 14 days. Comments on a session are kept with the session, and go when it is deleted.

A pending club invite link expires automatically. No voice transcript is stored: we keep no word-for-word record of a voice call. What a coach’s spoken description becomes is kept like a typed one: as the source text of the session it drafted, for as long as that session, and in the AI conversation history above. Earlier versions of the app let a club admin choose to keep voice transcripts for a number of days; any kept that way are deleted when that period ends, or sooner with the conversation they belong to.

These deletions are done by scheduled jobs set to run every night on our hosting platform. Absence notices, coach notes and conversations are also cleaned up whenever a coach marks a session delivered, and voice transcripts whenever a voice session ends.

A complaint you send through our form (see Complaints below) is kept while it is open, and for 3 years after it is resolved; then a scheduled job deletes it. If the club it is about deletes its account, we keep the record ourselves, as controller, so there is still a record of how the complaint was handled — see Complaints for how long.

Rate-limit records should be gone within about two days, and server logs are kept for the period set out under what Training Den decides for itself. Our usage log keeps an account’s entries for 90 days, and after that only daily totals that do not say which accounts they counted (see our own usage log).

Swim times recorded with a training-timing feature we have since retired are still stored, but nobody can see them in the app any more. They are deleted with the rest of the club’s data if the club deletes its account.

Payment records are kept even if you ask us to delete them, and they are the one thing here your club has no say over. If you have paid for a seat, the subscription record described under payment data above outlives both your subscription and your account, for six years: the law requires a business to keep records of what it sold, and a request to erase your data does not override that for this category. Deleting your account cancels the subscription and strips the name and email from the account it pointed at, so what remains is a record of a sale rather than a record about you — but it remains.

Your rights

Under UK GDPR you have the right to access, correct (rectify), erase, restrict, receive a copy of (portability), and object to the processing of, your personal data. Because your club is the controller of swimmer and club data, the right way to exercise most of these is to ask your club directly — but you can also come to us and we will help.

Not for what Training Den decides for itself, though. For your account, emails we sent you, anything you sent us, our usage log, and — if you are a coach paying for a subscription — your seat, we are the controller and your club is not: it cannot see your seat, cannot act on it, and in the ordinary case does not know it exists. So for those, come to us through our contact form, and see what Training Den decides for itself for what we hold and how long we have to keep it.

We answer a request made to us within one month. If we need to ask you what you mean — for example, which club or which records — the month pauses until you reply. We search in a way that is reasonable and proportionate to the request, which is the standard UK law sets.

• Access: ask your club, who can see your records directly. A club admin can download everything the app holds that is linked to one swimmer — the right starting point for a request about a particular child (“Download this swimmer’s data”, on the swimmer’s page) — or download the whole club’s data. Anyone with an account can also download a copy of the data held about their own account from inside the app (“Download my data”: in Your account for a coach, and on “Who can see my stuff” for a swimmer or parent). That download does not include your entries in our usage log; ask us for those. What a download cannot find: free text that names a child in a record that is not linked to them — a coach’s note or transcript about a whole session, a comment on a session, or the coach assistant’s conversation history. A club answering a request about a child should search those by hand too. No download includes the working copy of a saved session open for editing, which is cleared after a save or deleted once nobody has written to it for 14 days.
• Rectification: a coach or admin can correct a swimmer record directly in the app — ask your coach or admin. A coach or admin can change their own name in Your account. For anything else, ask your club or us.
• Erasure: a club admin can permanently erase a single swimmer’s record on request. This replaces the swimmer’s name with a non-identifying marker, clears their date of birth, and archives them so they no longer appear on the active roster. Any health-related absence-notice detail is deleted outright rather than anonymised, and so are the swimmer’s race results. Free text on their attendance, adjustment and completion records (swim, land and activity) is cleared, and so is the coach’s note on their season goals. The family’s guardian link is removed, and the erased swimmer is left out of the club’s analyses from then on. If this child has their own sign-in, it is scrubbed too — unless it is shared with something else (another club, another child they guard), in which case it is left alone and the club is told to handle it separately. When a sign-in is scrubbed, the record that it agreed to our terms, with the email address it used, is kept for six years as evidence of what was agreed, then deleted; its entries in our usage log are deleted at once. Attendance history, training totals for the squad, and the record of which squads and training groups they were in are kept, against the anonymised record, so a squad’s own history stays accurate. This does not reach everything that might name a child: a coach’s notes, comments or a transcript written about a whole session, rather than about this one child, are not touched, nor is the working copy of a session open for editing — nothing on those records says which child they concern — and neither is the coach assistant’s conversation history, which keeps real names rather than the labels sent to the AI provider (see how long we keep it for how that is governed instead). This does not remove the swimmer entirely from the database — it is a thorough scrub, not a hard delete — and it is a step only a club admin can take, not something a swimmer or parent/guardian can trigger themselves from this app. If you want a swimmer’s record erased, ask your club admin, or tell us through our contact form and we will help make sure it happens.
• Deleting your own account: anyone can delete and scrub their own account at any time from within the app — a coach or admin from Your account, and a parent, guardian or swimmer from “My account” (“Delete my account”). Deleting a swimmer’s or parent’s login does not erase the swimmer’s training record, which belongs to the club: ask the club admin for that (see Erasure above). This removes your club memberships, your links to swimmers, your private notes and conversations, and your entries in our usage log, and clears your name and email from your profile. The record that you agreed to our terms is kept, with the email address you were signed in with, for six years (see what Training Den decides for itself). The sign-in record our provider Supabase holds cannot be removed by the app itself: we remove it by hand within a month. You can ask about it through our contact form. If you pay for your own seat, deleting your account cancels that subscription too, so you are not left being charged for an account that no longer exists — the record that the subscription existed is kept, for the reason given under payment data, but nothing further is taken from your card.
• Restriction and objection: there is no general in-app switch. Ask your club, or us, and we follow a written procedure to pause or stop the processing you have objected to while it is looked at. There is one switch built in: the automatic training-load and attendance flags (see automated decision-making) can be turned off by your club for everyone, or for one swimmer.
• Portability: the downloads described under “Access” above give the data in a portable, machine-readable form.

Complaints

Complaining to your club: your club is the controller of swimmer and club data, so you can complain to it at any time. Since 19 June 2026 UK law requires a controller — for swimmer data, your club — to make it easy to complain, acknowledge a complaint within 30 days, respond without undue delay, and keep you told how it is going. If you are signed in, you can choose your club on our form, and the complaint goes to that club’s admins in the app. If you are not signed in, we read it and pass it on to the club.

Complaining to Training Den directly: use our complaints form or email admin@trainingden.app. The form sends an automatic email to the address you give, with a reference number, to confirm the complaint has arrived; it does not repeat what you wrote. If you don’t get one (check your spam folder), your complaint has still been received. Either way, a person acknowledges your complaint within 30 days at the latest, and we reply as soon as we can and keep you told how it is going.

What we keep: your name, email address, which club it is about, what you wrote, and how it was handled. The club’s admins can see a complaint about their club, and so can the small number of Training Den staff who make sure every complaint is answered. We keep the record while the complaint is open and for 3 years after it is resolved. If the club deletes its account in that time, the record is kept anyway, with the club’s name noted on it, so there is still a record of how your complaint was handled. We then hold it ourselves, as controller, relying on legitimate interests, and delete it 3 years after we responded — or, if it was never resolved, 3 years after the club was deleted.

Complaining to the regulator: you have the right to complain to the Information Commissioner’s Office — from 30 September 2026 formally the Information Commission, and still known as the ICO — the UK’s data protection regulator. You can do this at any time, but the ICO usually expects you to raise it with your club (or with us) first, and it may not take up a complaint that has not been. Contact it at ico.org.uk, or by phone on 0303 123 1113.

Keeping it safe

Every club-owned table in our database is scoped to that club, so one club cannot see another’s data. That’s enforced by our own server checking your club membership on every request it handles — which is most of what the app does — and, additionally, by the database’s own row-level security on the smaller number of screens where your browser reads data directly rather than through our server. Coach notes default to private. Signed-in access is logged.

The few Training Den staff accounts that can see across every club are the most sensitive accounts we have, so they are protected by two-step verification: those screens refuse to open for a staff member who has signed in with a password alone, until they also enter a code from an authenticator app.

Cookies & your device

We don’t use tracking or advertising cookies, and we don’t run any third-party analytics or tracking. The short log we keep of when accounts use the service is kept on our servers and stores nothing in your browser (see our own usage log). So we don’t show a cookie-consent banner, because there is nothing here that needs your consent under the rules that cover it. The app sets no cookies of its own. What it does store in your browser is used only to make the app work, or to remember a choice you made:

• Your sign-in session, so you stay signed in.
• Which club you are looking at, if you belong to more than one, and which view you last used — coaching, or your own or your child’s training — so that if you both coach and train or follow a child, the app opens in that view.
• Your preferences: light or dark theme, which squad or view you last had open on a plan, which way you last chose to create a session, which of the app’s notes on a draft session you have already confirmed, whether you have dismissed the “install the app” nudge, and whether you have been shown where to switch between clubs or views.
• Drafts in progress: a session or question you are passing from one screen to another. These sit in storage that your browser clears when you close the tab, and most are removed as soon as they are read.
• While you sign up: the address you are confirming, what you agreed to on the form, including the club you named, and which account it is for, kept in storage your browser clears when you close the tab.
• A pending invite, while you sign up or sign in from an invite link, so the invite can be used once you are in. If it has to wait until you have agreed to our terms, we also note which account it is kept for, so nobody else who signs in on the same device can use it.
• A note after joining a club, if you join one as a swimmer or parent while you already coach, or belong to another club: the club you joined and, for a parent, the name of the swimmer the invite was for, so the app can tell you once where to switch. It is removed once shown, and when someone else signs in on the device.
• A starter checklist note, for club staff: that the first week of your setup checklist in a club is over, or that you dismissed it, so the app stops asking.
• A copy of your profile, saved when the coaching screens open: your name and email address, the clubs you belong to with your role and settings in each, and your subscription’s plan and status (for example, when a trial or the current period ends), so the app can open straight away, and still open at the pool without signal. It is replaced each time those screens load — so when someone else signs in to them on the device, it becomes theirs — and kept for up to two days.
• Saved copies of the plan, for club staff: the plan weeks and months you have looked at, and the ones either side of them, as the plan shows them — session titles, squads, the coaches’ names, distances, targets, training times, seasons, phases and meets — so a week you have already seen opens at once while the app checks it for changes. They include what coaches have typed, as written (session objectives, squad descriptions, the focus and notes typed on planned weeks and days and in week patterns, and the names of week patterns, training groups and temporary timetables) and, for a session set for particular swimmers, an internal reference to which swimmers it is for — never their names. They are only for you and are not shared with anyone; they never include swimmers’ absence notices; they are replaced with the latest version each time you look; they expire on their own after two days; and they are deleted when you sign out or when someone else signs in on the device.
• An offline poolside copy for coaches: the session and register a coach has open, and any register changes made without signal, so they can keep working at the pool and the changes are sent when the connection comes back. These copies expire on their own within about two days.
• The app’s own cache (a “service worker”), which keeps the app’s files and a few screens so it opens quickly and works offline, and fetches an updated version when there is one.

Signing out clears your session, which club you were looking at, a note after joining a club, a pending invite, the starter checklist note and the saved copies of the plan; signing out of the coaching screens also clears the copy of your profile, the offline poolside copies and the cached screens. None of it is used to track you anywhere else or for advertising; here, your sign-in is what tells our usage log which account was active (see our own usage log). We do not run error reporting in your browser; if we ever do, we will update this section first.

Contact

For anything about your own or your child’s swimming data, start with your club. To reach Training Den directly, use our contact form or email admin@trainingden.app. Either takes questions, requests to see, correct or delete data, objections and complaints, and neither needs an account.

The form is the better of the two for anything about a specific club if you are signed in, because it then records which club the request concerns rather than leaving us to work it out — but a request counts however it reaches us, so an email is no weaker. You can also complain to the ICO at any time, though it will usually expect you to have raised it with your club or us first — see complaints.

Changes to this notice

Last updated 22 October 2026. When we change what we do with your data, we update this page and the date above. If a change affects what your club has agreed with us, we tell your club’s administrators first, as our data processing agreement says.