Privacy Policy

Trackteam Pty Ltd ("us", "we", or "our") operates the https://trackteam.net website and the SquadHR, TeamHR, and VOSTEP iOS mobile applications (collectively, the "Apps"). This Privacy Policy explains how we collect, use, and protect your information when you use our Apps and website.


1. OVERVIEW

The Apps are designed with privacy as a core principle. All app data is stored on-device only, except where optional cloud features have been explicitly enabled by the user. No user registration is required to use the Apps, and we do not ask for your name, email address, or any other contact detail in order to use them.


2. DATA WE COLLECT

Player Profiles (SquadHR and TeamHR)

Player profiles require a first name and year of birth only. Last names are optional and not required to use the Apps.

Your Profile (VOSTEP)

VOSTEP asks for three initials, your year of birth, your biological sex, and your body weight. Age, sex, and weight are required to estimate energy expenditure and maximum heart rate; initials identify you on the leaderboard if you choose to enter it. You may optionally add a profile photo, which is stored on your device only and is never uploaded.

Activity Data

The Apps collect heart rate and step data from Bluetooth heart rate sensors. VOSTEP additionally derives estimated VO2max, heart rate variability, recovery heart rate, and active energy from that data. All of it is stored on-device only, unless optional cloud features are enabled by the user.

Device and App Identifiers

The Apps generate a random identifier on first launch to distinguish one installation from another. It is not derived from your device, your Apple ID, or any personal information, and it resets if you delete and reinstall the App. It is used to keep leaderboard and dashboard entries separate, and is included with support requests if you choose to share diagnostics.

TeamHub App (TeamHR)

The TeamHub companion app transmits unique Bluetooth sensor device identifiers, heart rate, and step data only. No identifiable player profile data is shared with the TeamHub app.


3. OPTIONAL CLOUD FEATURES

The following cloud features are entirely optional and require explicit user action to enable. All data transmitted to third-party services is encrypted in transit via HTTPS/TLS.

3.1 Team Dashboards (InfluxDB & Grafana)
Applies to: TeamHR

Users may optionally upload heart rate and step data to the InfluxDB cloud service, which powers Grafana cloud dashboards. The following conditions apply:
- InfluxDB data is geographically located in the United States.
- InfluxDB data stops being visible after 30 days and is then deleted; backups may retain it for a limited period.
- Cloud dashboards are accessible to anyone with the unique dashboard URL, and to Trackteam employees for support purposes.
- Cloud dashboards are retained for at least 30 days and can be removed by the user at any time.
- Trackteam may remove cloud dashboards after 30 days of inactivity.
- To have data removed before it ages out, contact us at info@trackteam.net. We can stop it being visible immediately; the underlying record is deleted when the 30-day period elapses.

3.2 Public Leaderboard (InfluxDB & Grafana)
Applies to: VOSTEP

VOSTEP's leaderboard is off by default and uploads nothing until you turn it on. Once enabled, each completed test uploads your result and the profile details needed to rank it. The following conditions apply:
- The leaderboard is public. Your initials, age, sex, country, and estimated VO2max are visible to anyone who views it, alongside the test details that produced the result (protocol, stages completed, cadence, and heart rate figures).
- Entries are identified by your initials and the app-generated identifier described in section 2. Your name, email address, and profile photo are never uploaded, and neither are your continuous heart rate or heart rate variability recordings.
- InfluxDB data is geographically located in the United States.
- Leaderboard entries stop being visible after 30 days on a rolling basis, and are then deleted; backups may retain them for a limited period.
- Turning the leaderboard off stops all further uploads, and anything already uploaded ages out within 30 days. Deleting the App has the same effect and also resets your identifier.
- Trackteam employees can access leaderboard data for support purposes and to remove offensive or fraudulent entries.
- To have your entry removed before it ages out, contact us at info@trackteam.net. We can remove it from the leaderboard immediately; the underlying record is deleted when the 30-day period elapses.

3.3 Support Requests and Purchase Confirmations (Cloudflare Workers & SendGrid)
Applies to: all Apps

When you send us a support request through the in-app contact form, or complete a purchase, the message is transmitted to a Cloudflare Worker, which uses SendGrid to deliver the resulting email. Only the email address you provide, the content of that specific message, and any diagnostics you chose to include (section 6) are transmitted. Neither service retains the content once the email has been sent.

3.4 Workout and Progress Summaries (SendGrid)
Applies to: SquadHR and TeamHR

Users may optionally upload aggregate player session data to SendGrid to generate and deliver workout summary emails. Only the recipient address and the contents of that summary are transmitted. SendGrid data is not retained after delivery.

3.5 AI Coaching Summaries (Anthropic Claude AI)
Applies to: TeamHR

Users may optionally upload player session data to Anthropic's Claude AI service to generate AI coaching summaries. The following conditions apply:
- Option to upload first names, full names, or initials.
- Only averaged or aggregate session data is transmitted (no time-series).
- Data sent to Claude AI is not used for AI model training.
- For more information, refer to Anthropic's Privacy Policy at https://www.anthropic.com/privacy.


4. APPLE HEALTH (VOSTEP)

VOSTEP can write your completed test results to the Apple Health app. This is off by default; switching it on is what prompts iOS to ask your permission, and you choose which categories to allow.

VOSTEP only writes to Apple Health. It never reads any data back, and it does not request read permission for any category. When enabled, a completed test writes VO2max, heart rate, heart rate variability, heart rate recovery, active energy burned, step count, flights climbed, and a workout record.

Health data written by VOSTEP stays on your device under your control, governed by your Apple Health privacy settings. We never use Health data for advertising or marketing, never sell it, and never transmit it to any third party. You can withdraw permission at any time in the Health app under Sharing, or by turning the setting off in VOSTEP.

The leaderboard described in section 3.2 is a separate feature with a separate opt-in, and does not read from or write to Apple Health.


5. THIRD-PARTY DATA SHARING

We do not sell, trade, or share your personal data with third parties, except as required to operate the optional cloud features described above (InfluxDB, Cloudflare, SendGrid, and Anthropic). These providers process data solely for the purpose of delivering those features.


6. ANALYTICS & CRASH REPORTING

We use opt-in Apple Analytics for anonymised usage analytics and crash reporting. This data is collected only if you have opted in via your device's privacy settings and is governed by Apple's Privacy Policy.

When using the in-app contact form, you have the option to share app diagnostics with us to assist with support. These consist of app and system versions, your device model and region, your app settings, and the app-generated identifier described in section 2. They do not include your profile, your test results, or your heart rate data. You can send a support request without them.


7. PUSH NOTIFICATIONS

The Apps do not use push notifications.


8. MINIMUM AGE REQUIREMENT

The Apps are intended for users aged 17 years and older. We do not knowingly collect personal information from individuals under the age of 17. If you believe a minor has provided personal information through our Apps, please contact us at info@trackteam.net and we will take steps to remove that information.


9. DATA SECURITY

All data transmitted to third-party cloud services is encrypted in transit using HTTPS/TLS. On-device data is protected by iOS device security. While we take reasonable measures to protect your data, no method of electronic transmission or storage is 100% secure.


10. GDPR COMPLIANCE (EUROPEAN USERS)

If you are located in the European Economic Area (EEA), you have certain rights under the General Data Protection Regulation (GDPR), including the right to access, correct, or delete personal data we hold about you. As our Apps store data on-device by default, most personal data remains under your direct control.

Our lawful basis for processing any data transmitted to cloud services is your explicit consent, which you provide by enabling those optional features. Every such feature is off until you turn it on, and turning it off withdraws that consent for all future processing.

Some of this data (heart rate, estimated VO2max, and biological sex) is health data or otherwise a special category under Article 9. We process it only on the basis of your explicit consent, only for the feature you enabled, and never for advertising, profiling, or automated decision-making.

For data held by optional cloud services, you may request deletion by contacting us at info@trackteam.net. For the VOSTEP leaderboard we can remove your entry from public view immediately, and the underlying record is deleted when the 30-day retention period elapses. Disabling the feature or deleting the App has the same effect without any request being necessary; deleting the App also resets your identifier.


11. AUSTRALIAN PRIVACY ACT COMPLIANCE

We comply with the Australian Privacy Act 1988 (Cth) and the Australian Privacy Principles. You have the right to access and correct personal information we hold about you. To exercise these rights or to make a privacy complaint, please contact us at info@trackteam.net. We will respond within 30 days.


12. LINKS TO THIRD-PARTY SITES

Our website and Apps may contain links to third-party websites, including manufacturers and retailers of the heart rate sensors and step equipment the Apps work with. We only link to products and services we have personally purchased and tested, and we receive no commission for doing so. We are not responsible for the privacy practices of those sites and encourage you to review their privacy policies.


13. CHANGES TO THIS POLICY

We may update this Privacy Policy from time to time. Any changes will be posted on this page with an updated effective date. We encourage you to review this policy periodically.


14. CONTACT US

For privacy enquiries, data access requests, or to request removal of cloud data, please contact us at:

Trackteam Pty Ltd
Email: info@trackteam.net
Website: https://trackteam.net
ABN: 74 640 842 128
Melbourne, Victoria, Australia