Privacy Policy
This policy explains how Threshr handles personal information under the Privacy Act 1988 (Cth) and the Australian Privacy Principles. Some of what Threshr stores — injuries, heart rate and how you felt after a session — is health information, which the law treats as sensitive. We only collect it with your consent, which you give when you create an account.
What we collect
- Account details: name, email address, password (stored encrypted), and the business you belong to.
- Training information: planned sessions, check-ins, effort ratings, comments, messages with your coach, and injury or pain reports.
- Activity files: sessions you upload or sync, which can include GPS location, heart rate, pace, power and cadence.
- Billing details (coaching businesses only): handled by Stripe. Threshr never sees or stores full card numbers.
- Technical information: basic logs needed to run and secure the service.
Who can see it
- Athletes: your information is visible to you, the coach assigned to you and the head coaches of your business. Other athletes and other businesses can never see it.
- Coaches: your name and email are visible to people in your business.
- Threshr: our staff access information only to provide support, keep the service secure, or where the law requires it.
How we use it
To run Threshr for you and your coach, keep it secure, send service emails (sign-in, password reset, plan updates), handle billing for coaching businesses, and improve the service using de-identified information. We don't sell personal information or use it for advertising.
Service providers and overseas storage
- Supabase — database and sign-in, hosted in Sydney, Australia.
- [Hosting provider, e.g. Netlify] — serves the app; may use servers outside Australia.
- Stripe — payment processing for coaching businesses' Threshr plans, and for athletes paying their coaching business. When an athlete pays their coach, their name, email and card details go to Stripe and to the business's own Stripe account; Threshr keeps only what was bought, the amount and its status.
- Anthropic (only if your business uses AI features) — processes the text of AI requests in the United States and doesn't use it to train its models under our agreement [confirm terms].
- [Email provider] — sends account emails, and notification emails about plan updates, messages and failed payments (you choose which under Account → Notifications). A message notification includes the start of the message.
- Phone and browser push services (Apple, Google or Mozilla, depending on your device, only if you turn phone notifications on) — deliver notifications. Their content is encrypted so these services can't read it, though it shows on your lock screen.
- GitHub (only if we keep nightly backups there) — stores encrypted copies of the database in the United States for 30 days.
Where information leaves Australia, we take reasonable steps to make sure it's handled consistently with the Australian Privacy Principles.
Keeping and deleting it
- We keep your information while your account is active.
- You can download your data or delete your account at any time under Account in Threshr. Deleting your account removes your login and your training data straight away; backups are cleared within [30] days (our own nightly copies within 30 days).
- If you leave a business, your coach keeps your past sessions unless you delete your account.
- When a business owner closes their business, all of that business's data is deleted.
Your rights
You can ask to access or correct your personal information, or complain about how we've handled it, by emailing [privacy email]. We'll respond within 30 days. If you're not satisfied, you can contact the Office of the Australian Information Commissioner at oaic.gov.au.
Data breaches
If a breach is likely to cause serious harm, we'll notify affected people and the OAIC as required by the Notifiable Data Breaches scheme.
Children
Athletes under 16 need a parent or guardian's permission, and their coach is responsible for obtaining it.
Contact
[Business legal name] · [address] · [privacy email]