Legal

Privacy Policy for Athlo

Last updated: October 21, 2026

Athlo.ai Ltd. ("Athlo", "we", "our", or "us") provides the Athlo mobile app and related services (the "Services"). This Privacy Policy explains what information we collect, how we use it, who we share it with, and the choices you have.

By using Athlo, you acknowledge this Privacy Policy.

1. Information We Collect

We collect information you provide directly, information created through use of the Services, and limited technical data needed to operate the app.

1.1 Account and profile information

• Account credentials and identity data, such as email address and password (handled through our authentication provider).
• Profile data you add, such as name, avatar/photo, phone number (if provided), date of birth (if provided), and role-related details.
• Organization membership and role information (for example admin, coach, player, member).

1.2 Organization, team, and event information

• Organization setup data and member associations.
• Team, group, and player records maintained by your organization.
• Event details including titles, schedules, status, attendance/invite status, and lineup-related information.
• Event location data you enter or select (for example address and map coordinates).
• Player career records: when a player in an organization is linked to a player profile, a copy of that player's match participation and statistics (for example appearances, minutes played, goals, assists, shots and cards), match results, and attendance (present, absent or excused, with the event type and date), together with the names of the organization, team and opponent at the time. Records copied from an organization are marked as "verified". See section 7.1.

1.3 Messages, posts, and collaboration data

• Chat content, including text messages, reactions, message status metadata, and conversation settings.
• Media attachments you choose to upload in chat or other app features, such as images and voice recordings.
• Comments and post interactions where those features are enabled.

1.4 Device, notification, and app-operation data

• Push notification data such as device push token (for example FCM token), platform/OS type, and notification state updates (read/seen).
• Basic technical data required for app delivery and troubleshooting, such as app version, platform type, and service logs.

1.5 Data stored locally on your device

• Local app storage/caches used for performance and offline-friendly behavior (for example local chat cache and media cache index).
• Local preferences such as chat retention settings, assistant preferences, and other user settings.
• If you enable local calendar sync, event mapping/configuration data used to write events to your device calendar.

2. Permissions and Optional Features

Depending on platform and your choices, Athlo may request access to:

• Photos/Camera: to let you upload profile, post, challenge, drill, or chat media.
• Microphone and speech recognition: for voice messages and optional voice assistant features.
• Location: to select event locations and open map/navigation-related flows.
• Calendar: to sync Athlo events to your device calendar when enabled.
• Notifications: to send event, message, and system notifications.

You can usually control permissions in your device settings. If a permission is denied, related features may not work.

3. How We Use Information

We use information to:

• Provide and maintain core app functionality (accounts, organizations, events, invites, chat, and media handling).
• Authenticate users and secure access to protected resources.
• Deliver push notifications and route users to relevant content.
• Support optional features you turn on, such as local calendar sync and voice assistant capabilities.
• Improve reliability, diagnose failures, prevent abuse, and protect service integrity.
• Comply with legal obligations and enforce our terms.

4. Legal Bases for Processing (where applicable)

Depending on your location, we process personal data under one or more of these bases:

• Contract: to provide the Services you request.
• Legitimate interests: to secure, maintain, and improve the Services, and to keep a player's sporting history available to the player and their parents or guardians (section 7.1).
• Consent: where required (for example certain device permissions).
• Legal obligation: where processing is required by law.

5. How We Share Information

We do not sell your personal information. We may share data in the following cases:

• Within your organization: data may be visible to other members based on role, permissions, and feature behavior.
• With the player's profile: records an organization keeps about a player who is linked to a player profile are copied to that profile's career portfolio, and stay available to the profile's owner, its co-owners and the player after the player leaves the organization (section 7.1).
• Service providers/processors that help us operate Athlo, such as:
  • Supabase (authentication, database, storage, edge-function processing, realtime messaging infrastructure).
  • Firebase Cloud Messaging (push notification delivery).
  • Google Maps services used in location/map flows.
  • Stripe (card payments to organizations).
• Legal and safety disclosures when required by law or to protect rights, safety, and security.
• Business transfers in connection with mergers, financing, acquisition, or asset sales.

6. International Data Transfers

Our database, file storage and backend processing are hosted in London, United Kingdom. Some service providers listed in section 5 (for example push notification delivery, maps and card payments) may process data outside the UK. Where they do, we rely on appropriate safeguards, such as UK adequacy regulations or the UK International Data Transfer Agreement or Addendum.

7. Data Retention

We keep personal data only as long as needed for the purposes described in this policy, unless a longer retention period is required by law.

• Account data: retained until you delete your account in the App (Profile → Danger Zone → Delete my account), which deletes it straight away; remaining copies in our hosting provider's encrypted backups are deleted within 7 days.
• Organization data: retained while the organization uses Athlo, until the organization deletes it.
• Chat and attachments: deleted automatically after the conversation's retention period (30 days by default); voice messages are deleted after at most 90 days.
• Local device chat retention controls: Athlo includes local retention options for cached chat data (including options such as 7, 30, 90, 365 days, or keep forever for local retention preferences).
• Local calendar sync data: stored on-device while sync is enabled or until removed by app/user actions.
• Player career portfolio: kept for as long as the player profile exists, as described in section 7.1.

7.1 Player career portfolio

A player profile keeps a career portfolio: the match and attendance records described in section 1.2, for every organization the player has been registered at.

• When records are added: a record is copied from the organization once the activity is finished (when a tracked match is completed, a league result is confirmed, or an event's attendance register closes, 24 hours after the meeting time), and straight away if the player is removed from or unlinked from the organization. Until then, corrections the organization makes update the copy.
• Who can see it: the profile's owner, its accepted co-owners and the player's own account. An organization sees records for its current players only; it cannot see a former player's portfolio, or records from other organizations.
• How long it is kept: for as long as the player profile exists. It is not removed when the organization deletes the player, the event or the organization, so that the player keeps their sporting history. It is deleted when the player profile is deleted.
• Verified and self-reported records: records copied from an organization are marked as "verified", because they come from the organization's own match tracking, results and attendance registers. We may later let a profile's owner add records themselves (for example matches played outside Athlo); those will be marked as self-reported, are not checked by Athlo or any organization, and are never marked as verified.
• Your choices: the profile's owner can ask us to correct or delete individual records, or the whole portfolio, by contacting us (section 13).

8. Security

We use technical and organizational measures to protect personal data, including:

• All data is sent over encrypted connections (HTTPS/TLS) and stored with our hosting provider, Supabase, in London, UK (AWS eu-west-2), which encrypts it at rest.
• Chat messages are additionally encrypted in our database (AES-256-GCM).
• Access is role-based: people only see the data their role in an organization allows, and organizations cannot see each other's data or a former player's history.
• Passwords are never stored in readable form. Card payments are handled by Stripe; we never see or store card numbers.
• Our staff access personal data only where needed to provide support or keep the Services safe.

No method of transmission or storage is completely secure, so we cannot guarantee absolute security. If a personal data breach is likely to put people at risk, we will notify the Information Commissioner's Office within 72 hours of becoming aware of it, and tell the affected users, or the organization responsible for them, without undue delay. To report a security concern, email support@athlo.ai with the subject "Security".

9. Your Choices and Rights

Depending on applicable law, you may have rights to access, correct, delete, object to, or restrict processing of your personal data, and to request data portability.

You may also:

• Update profile and certain account data in the app.
• Control device permissions (camera, mic, calendar, location, notifications) in OS settings.
• Request account or data actions by contacting us.

To exercise rights, contact us using the details below. We may need to verify your identity before processing requests.

10. Children's Privacy

Athlo is not directed to children under 13. If we learn we collected personal data from a child under 13 without appropriate authorization, we will take steps to delete it.

Organizations using Athlo to manage youth participants are responsible for obtaining any required parent/guardian consents and ensuring lawful use of participant data. This includes the career portfolio described in section 7.1, which a parent or guardian who owns the player's profile can view and ask us to delete.

11. Third-Party Links and Services

Athlo may include links or integrations with third-party services. Their privacy practices are governed by their own policies.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will post updates on this page and revise the "Last Updated" date.

13. Support and Contact

If you have any questions, concerns, requests, or enquiries about this Privacy Policy, your personal data, or how Athlo handles your information, please contact our support team at support@athlo.ai.

For a dedicated support page, please visit:

• Support page: athlo.ai/support

You can also reach us through:

• Email: support@athlo.ai
• Website: athlo.ai
• Company: Athlo.ai Ltd.