Privacy Policy

How TrackStat collects, uses and protects personal information. · Effective date: 13 July 2026

1. Who we are

TrackStat (“we”, “us”, “our”) is a performance-analysis platform for sprint and athletics coaches, operated by Track Speed Development Pty Ltd (ABN 77 647 817 516), a company based in New South Wales, Australia, trading as TrackStat. This policy explains what personal information we handle when you use trackstat.app and our related services (the “Service”).

It applies to coaches who hold an account, and to the athletes whose performance data coaches record in the Service. If you are an athlete or a parent and want to know how your data is used, please read the section on athletes’ data and minors and speak to your coach, who controls that data.

2. Coaches, athletes and our role

Understanding who is responsible for what matters here:

• For coach account and billing data — the information you give us to create and pay for an account — we are the data controller.
• For athlete performance data — the athletes, results, videos, GPS files and metrics a coach enters — the coach (or their organisation) is the controller, and we act as a processor handling that data on the coach’s behalf and under their instructions. The coach is responsible for having a lawful basis to record each athlete’s data, including obtaining consent from athletes or their parents/guardians where required.

Under GDPR terms, coaches who record data about athletes located in the EU/UK should treat their use of TrackStat as processing carried out under this policy and the Terms of Service, which together form our processing terms. Contact us at info@trackstat.app if you need a separate data processing agreement.

3. What data we collect

We collect the following categories of personal information:

• Coach account data. Your name, email address, and optionally your organisation and phone number, plus your password (stored only as a secure hash by our authentication provider).
• Athlete profiles you create. Athlete name, age, gender, height, weight, leg length, squad/team, event specialisation, free-text notes, and an optional profile photo. This is entered by the coach.
• Performance and physiological data. Video analyses and uploaded video, spatiotemporal metrics, GPS session files and derived speed/acceleration data, competition results, lactate measurements and curves, and custom testing data recorded over time.
• Billing data. Subscription tier and status, and billing identifiers from our payment processor. We do not receive or store full card numbers — payment card details are handled directly by Stripe.
• Technical and usage data. Standard information your browser sends (such as IP address and device/browser type) and basic logs our hosting and infrastructure providers generate to operate and secure the Service.

4. Athletes’ data and minors

TrackStat is built for coaching, and many athletes recorded in it are children or young people. We take this seriously.

• Accounts are for adults. Only coaches aged 18 or over may hold an account. Athletes do not have their own logins; their data exists only as records created by their coach.
• Coaches must have the right to record athlete data. By entering an athlete’s information, the coach confirms they have obtained any consent required under the law that applies to them — including consent from a parent or guardian for athletes who are minors — and that they will honour requests from athletes or parents to access, correct or delete that data.
• Sensitive data. Some athlete data (for example physiological measurements and images) may be sensitive or “special category” data under privacy law. Coaches are responsible for handling it lawfully; we protect it with the safeguards described below and use it only to provide the Service.
• Deletion. A coach can delete an athlete and their associated records at any time from within the Service. If you are an athlete or parent, contact the coach who holds your data, or email us at info@trackstat.app and we will assist the responsible coach.

5. How we use data

We use personal information to:

• provide, operate and maintain the Service and its analysis features;
• create and secure your account and authenticate you;
• process subscriptions, payments and related billing communications;
• respond to support requests and send essential service messages;
• keep the Service secure, prevent abuse, and diagnose problems;
• comply with our legal obligations.

We do not sell personal information, and we do not use athlete data for advertising.

6. Legal bases (for EU/UK users)

Where the EU or UK GDPR applies, we rely on these legal bases:

• Contract — to provide the Service you signed up for and manage your subscription.
• Legitimate interests — to secure, maintain and improve the Service, where not overridden by your rights.
• Consent — where required, including the consent a coach obtains from athletes or parents before recording athlete data.
• Legal obligation — to meet tax, accounting and other legal requirements.

7. Who we share data with

We share personal information only with service providers who help us run the Service, under contracts that require them to protect it and use it only for the purposes we specify (“sub-processors”):

We may also disclose information if required by law, to enforce our Terms, or in connection with a business transfer — in which case we will require the recipient to honour this policy.

8. International transfers

Our providers may process data in countries other than yours, including the United States. Where we transfer personal data out of the EU, UK or Australia, we rely on appropriate safeguards such as Standard Contractual Clauses or the providers’ own approved transfer mechanisms. Contact us for more detail on the safeguards in place.

9. How long we keep data

We keep personal information for as long as your account is active and as needed to provide the Service. When you or a coach delete a record — an athlete, an analysis, or an entire account — we remove it from the live Service and delete it (including from backups) within 30 days, except where we must retain limited billing records to meet legal and tax obligations.

10. How we protect data

Data is encrypted in transit, access is restricted per coach account through database row-level security so one coach cannot see another’s data, uploaded videos are stored in a private bucket, and payment card data never touches our servers. No system is perfectly secure, but we work to protect your information and will notify you and the relevant authority of a data breach where the law requires.

11. Your rights and choices

Depending on where you live, you may have the right to access, correct, delete, export, or restrict the processing of your personal information, to object to certain processing, and to withdraw consent. Australian users have rights of access and correction under the Australian Privacy Principles; EU/UK users have the rights described in the GDPR.

You can edit your profile and delete athletes and analyses directly in the Service. To exercise any other right, or to request deletion of your account and all associated data, email info@trackstat.app. We will respond within the timeframe the applicable law requires. For athlete data, we will act on the responsible coach’s instructions.

12. Cookies and tracking

We use only the cookies and local storage necessary to keep you signed in and to run the Service. We do not use third-party advertising or cross-site tracking cookies. If we add optional analytics in future, we will update this policy and, where required, ask for your consent first.

13. Changes to this policy

We may update this policy as the Service evolves. When we make material changes we will update the effective date above and, where appropriate, notify you by email or in the app. Continuing to use the Service after a change means you accept the updated policy.

14. Contact and complaints

For any privacy question or request, contact info@trackstat.app.

If you are in Australia and are not satisfied with our response, you may complain to the Office of the Australian Information Commissioner (oaic.gov.au). If you are in the EU or UK, you may complain to your local data protection authority.