Privacy Policy

Trackteam Pty Ltd ("us", "we", or "our") operates the https://trackteam.net website and the SquadHR, TeamHR, Stadios, and VOSTEP iOS mobile applications (collectively, the "Apps"). This Privacy Policy explains how we collect, use, and protect your information when you use our Apps and website.


1. OVERVIEW

The Apps are designed with privacy as a core principle. All app data is stored on-device only, except where optional cloud features have been explicitly enabled by the user. No user registration is required to use the Apps, and we do not ask for your name, email address, or any other contact detail in order to use them.


2. DATA WE COLLECT

Player Profiles (SquadHR, TeamHR, and Stadios)

Player profiles require a first name, year of birth, biological sex, and body weight; TeamHR and Stadios also require height. The year of birth sets each player's predicted maximum heart rate; with sex and weight it is used to estimate the energy they burn, and height is used to estimate step length. Last names and email addresses are optional, and an email address is used only for workout summaries (section 3.4). Stadios profiles may also hold a number, such as a jersey number. Profile photos are optional, and a player's photo is included in their workout summary emails (section 3.4).

Club and Coach Details (SquadHR, TeamHR, and Stadios)

The Apps store the sender name and header image address used in workout summaries, and the coach's email address, which receives copies of summaries and any replies (section 3.4). In Stadios, these are your club's name and banner, and each group coach's name and email address; Stadios also stores a logo and TV background chosen from your photo library, which are stored on the device only and never uploaded.

Your Profile (VOSTEP)

VOSTEP asks for three initials, your year of birth, your biological sex, and your body weight. Your year of birth sets your predicted maximum heart rate and, with your biological sex, the norms behind your fitness rating; your weight is used to estimate the energy you burn. Initials identify you on the leaderboard if you choose to enter it. You may optionally add a profile photo, which is stored on your device only and is never uploaded.

Activity Data

The Apps collect heart rate and step data from Bluetooth heart rate sensors or an Apple Watch running WatchHR. VOSTEP additionally derives estimated VO2max, heart rate variability, recovery heart rate, and active energy from that data. TeamHR and Stadios may also use the location of the device running the App, and record the weather (see Location and Weather below). All of it is stored on-device only, unless optional cloud features are enabled by the user.

Location and Weather (TeamHR and Stadios)

With your permission, TeamHR and Stadios use the location of the device running the App, only while the App is in use, to show the training area on a map and to fetch the current weather from Apple WeatherKit. Location is never collected from players. Each session saves the place name (which you can edit), a small map image of the training area, and the weather (temperature and condition). The place name and temperature appear on Team Dashboards (section 3.1) and in AI coaching summaries (section 3.5) if those are enabled.

Device and App Identifiers

The Apps generate a random identifier on first launch to distinguish one installation from another. It is not derived from your device, your Apple ID, or any personal information, and it resets if you delete and reinstall the App. It is used to keep leaderboard entries and TeamHR dashboard entries separate, and is included with support requests if you choose to share diagnostics.

The Apps also record the date they were first opened on your device. It is kept in the device's keychain, so unlike the identifier above it remains if you delete and reinstall the App, and is removed only when the device is erased or reset. It is used to recognise the same device, for example when importing a file exported from it, and is included with support requests if you choose to share diagnostics.

Stadios links its cloud dashboards (section 3.1) to an identifier the App Store assigns when your Apple Account first downloads the App. It is the same on every device signed in with that Apple Account and remains if you reinstall the App, so a club's dashboards follow its subscription. It does not tell us your name or your Apple Account details.

TeamHub App (TeamHR) and Stadios Hub (Stadios)

The TeamHub companion app and the Stadios Hub accessory transmit unique Bluetooth sensor device identifiers, heart rate, and step data only. Each hub also shares its own location with the App over Bluetooth, to place it on the map. No identifiable player profile data is shared with either.


3. OPTIONAL CLOUD FEATURES

The following cloud features are entirely optional. Each is enabled by the user, either by turning it on or, for Stadios AI notes, by subscribing to Plus, and each can be turned off at any time. All data transmitted to third-party services is encrypted in transit via HTTPS/TLS.

3.1 Team Dashboards (InfluxDB & Grafana)
Applies to: TeamHR and Stadios

Users may optionally publish cloud dashboards of their sessions (Results, Trends, Team Analytics, and Live Session), powered by Grafana. Heart rate and step readings are uploaded to the InfluxDB cloud service during sessions, carrying a random player identifier rather than a name; the dashboards show each player's name, as chosen in the App (first name, last name, full name, or initials), by matching it to that identifier. Dashboards also show each session's results and, if enabled, AI summaries (section 3.5).

In Stadios, cloud dashboards are a Pro feature, and each has its own switch, off by default. Live Session also needs Upload Session Data, a separate switch, and player names are uploaded only while a dashboard is on. Stadios uploads go through a Cloudflare Worker, and its dashboards are linked to the App Store identifier described in section 2.

The following conditions apply:
- InfluxDB data is geographically located in the United States.
- InfluxDB data stops being visible after 30 days and is then deleted; backups may retain it for a limited period.
- Cloud dashboards are accessible to anyone with the unique dashboard URL, and to Trackteam employees for support purposes.
- Cloud dashboards stay available until the user turns them off, which deletes the dashboard and its link; turning it on again creates a new link.
- Trackteam may remove cloud dashboards after 30 days of inactivity.
- To have data removed before it ages out, contact us at info@trackteam.net. We can stop it being visible immediately; the underlying record is deleted when the 30-day period elapses.

3.2 Public Leaderboard (Cloudflare Workers, InfluxDB & Grafana)
Applies to: VOSTEP

VOSTEP's leaderboard is off by default and uploads nothing until you turn it on. Once enabled, each completed test uploads your result and the profile details needed to rank it. The following conditions apply:
- The leaderboard is public. Your initials, age group, sex, country, and estimated VO2max are visible to anyone who views it, alongside the test details that produced the result (protocol, stages completed, whether your pace was validated, and whether your maximum heart rate was measured or predicted). Your exact age and maximum heart rate are also uploaded, to check your entry, but are not shown.
- Entries are identified by your initials and the app-generated identifier described in section 2. Your name, email address, and profile photo are never uploaded, and neither are your continuous heart rate or heart rate variability recordings.
- Your result is sent to a Cloudflare Worker, which checks it before storing it in InfluxDB. When you view the leaderboard in the App, it is fetched through a second Cloudflare Worker; your identifier is sent with that request only to highlight your own entry, and is not stored.
- InfluxDB data is geographically located in the United States.
- Leaderboard entries stop being visible after 30 days on a rolling basis, and are then deleted; backups may retain them for a limited period.
- Turning the leaderboard off stops all further uploads and removes your entries from public view straight away; the underlying records are deleted when the 30-day period elapses. Deleting the App stops further uploads and resets your identifier; entries already uploaded then age out within 30 days.
- Trackteam employees can access leaderboard data for support purposes and to remove offensive or fraudulent entries.
- To have your entry removed before it ages out, contact us at info@trackteam.net. We can remove it from the leaderboard immediately; the underlying record is deleted when the 30-day period elapses.

3.3 Support Requests and Purchase Confirmations (Cloudflare Workers & SendGrid)
Applies to: all Apps

When you send us a support request through the in-app contact form, or complete a purchase, the message is transmitted to a Cloudflare Worker, which uses SendGrid to deliver the resulting email. A support request contains only the email address you provide, your message, and any diagnostics you chose to include (section 6). A purchase confirmation contains only the subscription purchased, its dates, its App Store transaction number, and the country set on your device — no name, email address, or device identifier. Neither service retains the content once the email has been sent.

3.4 Workout and Progress Summaries (Cloudflare Workers & SendGrid)
Applies to: SquadHR, TeamHR, and Stadios

Users may optionally send each player a workout summary email after a session. It goes to the player's email address and, if enabled, a copy to the coach; it is sent in the club's name, with replies going to the coach, and contains the player's profile photo if one is set and their results for that session. The header image is loaded from the club's own website by the recipient's email app. Only the recipient addresses and the contents of that summary are transmitted to SendGrid, which does not retain them after delivery.

In Stadios, summaries are sent through a Cloudflare Worker, which uses SendGrid to deliver them, and also show the change from the player's previous four weeks and their AI note (section 3.5) if enabled.

3.5 AI Coaching Summaries (Cloudflare Workers & Anthropic Claude AI)
Applies to: TeamHR and Stadios

Users may optionally enable AI coaching summaries of player session data. In TeamHR, these are player, team, and trends summaries, shown in the App and on dashboards (section 3.1) if enabled.

In Stadios, AI notes come with a Plus subscription: subscribing turns them on, and each kind can be turned off under Club › AI Notes. They are a note on each player's result, and an overview of each group session. Each compares the session with recent weeks, using a compact summary of each past session. Notes are saved with the results on your device; player notes are added to workout summaries (section 3.4), and overviews appear on dashboards (section 3.1) if enabled.

The following conditions apply:
- Session data is sent to a Cloudflare Worker, which forwards it to Anthropic's Claude AI to write the summary. The summary is returned to the App.
- Players are identified by first name, last name, full name, or initials, as chosen in the App.
- Only averaged or aggregate session data is transmitted (no time-series).
- Our Cloudflare Worker does not keep the session data or the summaries.
- Data sent to Claude AI is not used for AI model training.
- For more information, refer to Anthropic's Privacy Policy at https://www.anthropic.com/privacy.
- Summaries and notes are written by AI, may contain errors, and are not medical advice.

3.6 AI Step Summaries (Cloudflare Workers & Anthropic Claude AI)
Applies to: VOSTEP

VOSTEP Pro can write a short summary of each completed test, explaining what the result means and how it compares with your recent tests. This is off by default and sends nothing until you turn it on under Step Setup › AI Summary. The following conditions apply:
- After each completed test, your result is sent to a Cloudflare Worker, which checks it and forwards it to Anthropic's Claude AI to write the summary. The summary is returned to the App and stored on your device only.
- What is sent: the test's date, protocol, and results (estimated VO2max, fitness rating, and the maximum heart rate it was based on; the heart rate at the end of each stage; starting and peak heart rate; one-minute heart rate recovery; a single heart rate variability value; active energy; and pace accuracy), similar figures for up to 10 of your earlier tests from the past 180 days and whether each used the same sensor, your age and biological sex, and your unit settings.
- What is never sent: your name, initials, profile photo, email address, country or location, the app-generated identifier described in section 2, and your continuous heart rate or heart rate variability recordings.
- Our Cloudflare Worker does not keep your test data or your summaries.
- Data sent to Claude AI is not used for AI model training. Anthropic's handling of it is governed by Anthropic's Privacy Policy at https://www.anthropic.com/privacy.
- Turning AI Summary off stops all further requests. Summaries already written stay on your device until you delete the test they belong to.
- Summaries are written by AI, may contain errors, and are not medical advice.


4. APPLE HEALTH (VOSTEP)

VOSTEP can write your completed test results to the Apple Health app. This is off by default; switching it on is what prompts iOS to ask your permission, and you choose which categories to allow.

VOSTEP only writes to Apple Health. It never reads any data back, and it does not request read permission for any category. When enabled, a completed test writes VO2max, heart rate, heart rate variability, heart rate recovery, active energy burned, step count, flights climbed, and a workout record. A test run with an Apple Watch writes VO2max only.

Health data written by VOSTEP stays on your device under your control, governed by your Apple Health privacy settings. We never use Health data for advertising or marketing, never sell it, and never transmit it to any third party. You can withdraw permission at any time in the Health app under Sharing, or by turning the setting off in VOSTEP.

The leaderboard (section 3.2) and AI step summaries (section 3.6) are separate features with separate opt-ins, and neither reads from or writes to Apple Health.


5. THIRD-PARTY DATA SHARING

We do not sell, trade, or share your personal data with third parties, except as required to operate the optional cloud features described above (InfluxDB, Cloudflare, SendGrid, and Anthropic), and Apple WeatherKit for weather in TeamHR and Stadios. These providers process data solely for the purpose of delivering those features.


6. ANALYTICS & CRASH REPORTING

We use opt-in Apple Analytics for anonymised usage analytics and crash reporting. This data is collected only if you have opted in via your device's privacy settings and is governed by Apple's Privacy Policy.

When using the in-app contact form, you have the option to share app diagnostics with us to assist with support. These consist of app and system versions, your device model and region, your app settings, your subscription status and purchase dates (VOSTEP and Stadios), the number of players, groups, sessions and sensors (SquadHR, TeamHR and Stadios), the identifier and first-launch date described in section 2, and a short log of recent app errors, such as a failed Bluetooth connection or upload. They do not include any profile, result or heart rate data. You can send a support request without them.


7. PUSH NOTIFICATIONS

The Apps do not use push notifications.


8. MINIMUM AGE REQUIREMENT

The Apps are rated 16+ on the App Store and are intended for users aged 16 years and older. We do not knowingly collect personal information from anyone under 16 using the Apps themselves.

Clubs using SquadHR, TeamHR, or Stadios may add players under 16. Their details are entered by the club, which is responsible for having the player's consent, or a parent's or guardian's, to do so. If you believe a minor's information has been entered without consent, please contact us at info@trackteam.net and we will remove any of it held in our cloud services.


9. DATA SECURITY

All data transmitted to third-party cloud services is encrypted in transit using HTTPS/TLS. On-device data is protected by iOS device security. While we take reasonable measures to protect your data, no method of electronic transmission or storage is 100% secure.


10. GDPR COMPLIANCE (EUROPEAN USERS)

If you are located in the European Economic Area (EEA), you have certain rights under the General Data Protection Regulation (GDPR), including the right to access, correct, or delete personal data we hold about you. As our Apps store data on-device by default, most personal data remains under your direct control.

Our lawful basis for processing any data transmitted to cloud services is your explicit consent, which you provide by enabling those optional features. Every such feature is off until you turn it on or subscribe to the plan that includes it, and turning it off withdraws that consent for all future processing.

Some of this data (heart rate, estimated VO2max, biological sex, and body measurements) is health data or otherwise a special category under Article 9. We process it only on the basis of your explicit consent, only for the feature you enabled, and never for advertising, profiling, or automated decision-making.

For data held by optional cloud services, you may request deletion by contacting us at info@trackteam.net. For the VOSTEP leaderboard, turning the leaderboard off in the App removes your entries from public view immediately, without any request being necessary, and we can do the same on request; the underlying records are deleted when the 30-day retention period elapses. Deleting the App stops further uploads and resets your identifier, and entries already uploaded then age out within 30 days. For TeamHR and Stadios dashboards, turning a dashboard off deletes it, and uploaded session data ages out within 30 days.


11. AUSTRALIAN PRIVACY ACT COMPLIANCE

We comply with the Australian Privacy Act 1988 (Cth) and the Australian Privacy Principles. You have the right to access and correct personal information we hold about you. To exercise these rights or to make a privacy complaint, please contact us at info@trackteam.net. We will respond within 30 days.


12. LINKS TO THIRD-PARTY SITES

Our website and Apps may contain links to third-party websites, including manufacturers and retailers of the heart rate sensors and step equipment the Apps work with. We only link to products and services we have personally purchased and tested, and we receive no commission for doing so. We are not responsible for the privacy practices of those sites and encourage you to review their privacy policies.


13. CHANGES TO THIS POLICY

We may update this Privacy Policy from time to time. Any changes will be posted on this page with an updated effective date. We encourage you to review this policy periodically.


14. CONTACT US

For privacy enquiries, data access requests, or to request removal of cloud data, please contact us at:

Trackteam Pty Ltd
Email: info@trackteam.net
Website: https://trackteam.net
ABN: 74 640 842 128
Melbourne, Victoria, Australia