Privacy policy of the SECRET app
Who is responsible for your data
Your personal data is processed by the SECRET sports club, Odesa, Ukraine (the club).
For questions about personal data, email hello@secretcheerdance.com.
Who the app is for
The SECRET app is for club members: parents and other legal guardians of athletes, the athletes themselves and coaches. You can sign in only with a phone number registered with the club.
What data we process and why
- Parents and legal guardians: full name and phone number — so you can sign in and receive notifications and bills; which children are yours and their order in the family — for access and the family discount.
- Athletes: full name, date of birth, team and team history — for the schedule, age categories and competition entries; form of address (feminine or masculine) — only for the app’s texts; phone number if the athlete signs in herself or himself.
- Athlete documents: type and number of the birth certificate (under 14) or ID card (14 and over) and their scans — for the competition credentials committee.
- Health data: medical insurance, medical certificates and clearances — status, expiry date, scan — for admission to training and competitions.
- Sports data: sports ranks and titles, training attendance, skills and homework, answers about taking part in competitions.
- Coaches: full name and phone number; a photo only with the coach’s consent.
- Payments: bills, amounts, due dates, status, the bank’s payment ID, receipts, bank transfer reference (athlete’s full name and transfer code). We do not receive or store payment card data: Apple Pay payments are processed by the bank.
- Consents: which version of a document you accepted, when and on whose behalf.
- Technical data: push notification token and app version; number, time and result of sign-in attempts — to protect against code guessing; an activity log (who changed what and when); app crash reports without names, phone numbers or documents.
- Coach notes about an athlete are visible only to their author and the club administrator. Coaches may not write health data into notes — this is a club rule.
We do not collect location, phone contacts, photos of athletes or advertising identifiers (a photo from your phone reaches us only when you upload a document scan yourself), we do not track you across other apps and websites, we show no ads and we do not sell data.
Children’s data
A child’s data is entered by the parents or other legal guardians and by the club: the administrator (team rosters, phone numbers) and coaches (attendance, skills, notes, team assignment). Consent to processing a child’s data is given by the parents or other legal guardians. An adult athlete manages their own data. Consent to processing the data of a child under 18, including at 14–17, is given by the parents or other legal guardians, on first sign-in to the app. It can be withdrawn at any time by emailing us.
Who can see data in the club
- Parents — the data of the children they added to their family, except coach notes.
- Other parents of the same child see your first name and surname initial (for example, “Andrii V.”) in the children’s order and in payments, and are notified when you add a child.
- An adult athlete — their own data.
- An athlete under 18 who signs in themselves — their schedule, attendance, profile, skills and competitions; not document files or payments.
- A coach — the athletes of their team, and a coach standing in for a colleague — the athletes of the session they lead; for documents and medical certificates only the type, status and expiry date, without files.
- The club administrator — data of the whole club.
To find their child in the club, parents search by surname; suggestions show only the first name and team of children under 18, without date of birth. Children not yet assigned to a team are visible to all club coaches: first name, year of birth and the guardian’s name.
Who we share data with
Only with services the app cannot work without, and only the part of the data they need:
- Google Firebase Authentication (Google LLC) — the phone number, to send the SMS code and confirm sign-in. Google may process it on its servers outside Ukraine.
- The hosting provider of the club’s server (a data centre in the European Union) — the app’s data.
- Apple — the device token and the text of a push notification. The text has the child’s first name without a surname and no health data. Payment notifications show the month and the amount, post-training ones whether the child attended, and coaches’ notifications about a new child the year of birth.
- The club’s bank that accepts Apple Pay payments — the amount and payment reference.
- Banks, for a transfer to IBAN — your bank and the club’s bank see the amount and the transfer reference with the athlete’s full name; you make the transfer yourself in your bank.
- The club’s software cash register (PRRO) service — data for the fiscal receipt, which it passes to the State Tax Service as the law requires.
- Sentry — app crash reports without names, phone numbers or documents.
We disclose data to public authorities only where the law requires it.
Where and how long we store data
Data is stored on the club’s server in the European Union. The phone keeps only what it needs for display; document scans are not stored on the device.
We keep data while you or your child train at the club. After leaving the club or deleting the account we keep it for 3 more weeks, then delete it.
Deleting your account
You can delete your account in the app: Profile → «Видалити обліковий запис» (Delete account). Or email hello@secretcheerdance.com with the phone number you sign in with.
Deleted at once: sign-in with your phone number, notifications on your devices and settings. The rest of your data — payments and receipts, consents, the child’s club record — the club keeps for 3 more weeks, then deletes. If another parent also follows the child in the app, they keep access, and the child’s record stays while the child trains at the club.
Your rights
Under the Law of Ukraine “On Personal Data Protection” you have the right to know what data of yours we process and why, to access it, to request correction or deletion, to withdraw consent, and to complain to the Ukrainian Parliament Commissioner for Human Rights or to a court. To exercise a right, email us.
How we protect data
- Data travels only over encrypted connections.
- Everyone sees in the app only what their role needs.
- Document scans open through short-lived links.
- Changes to data are recorded in a log: who changed what and when.
- Access keys to banks and services are kept only on the server.
Training sign-up on the website
The sign-up form on the website collects only what we need to contact you: your name, phone number and your child’s age; the club calls you back on that number. It does not ask for the child’s name. You send a request only after consenting to the processing of these details.
The request is stored in the club’s Google Sheet (Google Workspace, Google LLC), and the administrator gets an email about it at the club’s address. We use the details only to arrange training and keep them for 3 weeks; then the request is deleted automatically. To have a request deleted, email hello@secretcheerdance.com.
Changes to this policy
The current version is always on this page; its date is shown at the top.