Privacy Policy

Effective 2026-07-10.

What this app is

Swim Cor Swim! is a private, invite-only web app for tracking one family's swim times. It is not a commercial product. Access is granted only to allowlisted email addresses; there is no public sign-up.

What we collect

• Your Google account email address, provided by Google when you sign in.
• The swim data you enter yourself: swimmer name, age, gender, meet names, meet dates, event times, cut/standard progress, and any meet-schedule screenshots you upload.

Where the data lives

• The primary database is hosted by Supabase (Supabase, Inc.) on Postgres. All authenticated app traffic passes through their auth service.
• The web frontend is served by Cloudflare Pages (Cloudflare, Inc.). Cloudflare sees your IP and standard HTTP request metadata for CDN and DDoS protection.
• Sign-in is delegated to Google (Google LLC). We request only the openid email profile scopes. No Gmail, Drive, Calendar, or other Google account data is accessed.
• Uploaded meet-schedule screenshots are sent to a private OCR service running on the operator's home server, through a Cloudflare-authenticated tunnel. Images are processed in-memory and are not stored on that server.

What we don't do

• We don't sell data.
• We don't run ads.
• We don't run third-party analytics.
• We don't share your data with anyone outside the processors above.

Retention

Your account and swim data are retained for as long as your email remains on the allowlist. To have your data deleted, ask the person who gave you access; the row is removed from Supabase and your Google identity is revoked from the allowlist. Deletion is typically completed within a few days.

Your rights

• Access: you can view all of your swim data inside the app.
• Correction: you can edit any incorrect times, meets, or swimmer details in the app.
• Deletion: ask the person who gave you access to request account deletion.
• Portability: data export is not currently self-serve; ask the person who gave you access and we'll send you a JSON dump.

Cookies and local storage

• IndexedDB (Dexie): we store your swim data locally in your browser so the app works offline. This is not a tracker.
• LocalStorage: we store your Supabase auth session so you stay signed in.
• We do not use tracking cookies, first-party or third-party.

Children

The app is intended for use by adults tracking their own or a child's swim times. If a swimmer is under 13, only a parent or guardian should create the account and enter the child's data on the child's behalf. No account is created for the child directly.

Contact

This app is operated privately for one family. For any question or data request, contact the person who gave you access.

Changes

This policy may change over time. The current version is always at swimcor.com/privacy.