Privacy Policy

Tumbling Lab is operated by Diego Frez De Castilla ("Tumbling Lab," "we," "us," or "our"). Tumbling Lab is a sports training platform for coaches, athletes, and parents/legal guardians. The platform helps users organize training, assignments, progress tracking, evaluations, scheduling, communication, and related athlete development workflows.

This Privacy Policy explains how we collect, use, store, disclose, protect, delete, and anonymize personal information when you use Tumbling Lab through our website, app, mobile experience, progressive web app, or related services.

Contact: frezdecastilla@gmail.com

1. Scope

This Privacy Policy applies to Tumbling Lab users, including athletes, parents/legal guardians, coaches, and platform administrators. It also applies to personal information submitted through public booking forms or other public-facing features.

This Privacy Policy does not apply to third-party websites, services, calendars, email systems, browsers, app stores, or external services that we do not control.

2. Information We Collect

2.1 Account Information

We may collect:

• first and last name;
• display name or nickname;
• email address;
• account role, such as athlete, parent, coach, or platform administrator;
• profile status;
• optional bio or profile information;
• account creation date;
• login/session information;
• internal user IDs.

2.2 Age Gate and Minor Status Information

During self-registration, Tumbling Lab collects month and year of birth to determine an age category. We use this for age gating and minor-related protections. Tumbling Lab does not need to store the month/year of birth from registration unless a separate athlete profile field is provided later.

Athlete profiles may include date of birth when provided by the user, parent/legal guardian, or authorized account manager.

2.3 Athlete Information

Depending on the account and features used, we may collect:

• athlete first name, middle name, last name, and nickname;
• date of birth, if provided;
• phone number, if provided;
• athlete status;
• parent-managed account status;
• parent-athlete relationship data;
• coach-athlete relationship data;
• team, organization, or coach workspace association;
• internal athlete IDs.

2.4 Parent/Guardian Information

For parent accounts and parent-managed athletes, we may collect:

• parent/legal guardian name and email address;
• parent-athlete links;
• legal guardian authority confirmations;
• parental consent records;
• records showing which documents were accepted on behalf of a minor athlete;
• technical metadata such as timestamp, user agent, source, locale, and hashed IP address.

We do not intentionally store raw IP addresses for legal acceptance records.

2.5 Training, Assignment, and Progress Data

We may collect:

• weekly training plans;
• assigned tasks and drills;
• target values, units, and order;
• assignment logs;
• submitted values and progress data;
• coach notes;
• athlete notes;
• parent-submitted logs;
• reviews;
• long-term goals;
• training session plans and logs;
• homework drills;
• progress status;
• historical training metrics.

Some training fields are free-text fields. Users should avoid entering medical, injury, or highly sensitive information unless necessary.

2.6 Evaluations, Scores, Photos, and Videos

Tumbling Lab may collect evaluation-related information, including:

• skill evaluations;
• skill key, surface, category, score, date, and evaluation results;
• evaluation responses and report payloads;
• mental toughness test results;
• points, XP, rewards, placements, and related metadata;
• photos, images, or videos uploaded or captured for evaluation reports.

Photos/videos used for evaluations may include athletes and may include minors. For minors, parental/legal guardian consent is required before evaluation media is uploaded or used.

2.7 Scheduling and Appointment Data

We may collect:

• coach services;
• appointment dates, times, duration, timezone, and status;
• full name, email, notes, location, and cancellation reason submitted for appointments;
• recurring appointment information;
• shared appointment participants;
• availability schedules;
• appointment-related notifications and emails.

2.8 Google Calendar Integration Data

Coaches may optionally connect Google Calendar. If a coach connects Google Calendar, we may process:

• Google account email;
• encrypted access and refresh tokens;
• selected calendar ID/name;
• appointment event IDs;
• sync status and error logs;
• appointment details sent to Google Calendar, which may include service name, participant name, email, notes, location, date, time, timezone, and attendees.

Google Calendar integration is optional. Tumbling Lab stores Google Calendar tokens encrypted. Tumbling Lab does not control how Google processes data once it is sent to Google Calendar.

2.9 Emails and Push Notifications

We may collect and process information related to service communications, including:

• recipient email address;
• email event type;
• delivery status;
• provider message ID;
• email payload metadata;
• error messages;
• push subscription endpoints and keys;
• device/browser/platform details;
• notification title, body, URL, status, and delivery metadata.

2.10 Cookies, Local Storage, and Device/Browser Data

We use cookies and browser storage for authentication, session persistence, workspace context, active athlete selection, calendar cache, draft recovery, UI state, service worker cache, and similar functional purposes.

We do not currently use advertising cookies or analytics cookies.

2.11 Security and Audit Data

We may collect:

• hashed IP or email identifiers for rate limiting and abuse prevention;
• role change records;
• legal acceptance records;
• parental consent records;
• data deletion/anonymization request records;
• anonymization events;
• admin audit events;
• Google Calendar sync logs;
• email and push delivery logs.

3. How We Use Information

We use personal information to:

• create and manage accounts;
• authenticate users;
• provide athlete, parent, and coach workflows;
• deliver training plans, assignments, and progress tracking;
• generate and display evaluations and reports;
• support photo/video evaluation workflows;
• manage parent-athlete and coach-athlete relationships;
• schedule and manage appointments;
• send transactional emails and push notifications;
• sync optional coach calendar events with Google Calendar;
• provide support;
• enforce Terms of Service;
• protect safety, security, and platform integrity;
• maintain legal acceptance and parental consent records;
• process account deletion/anonymization requests;
• comply with legal obligations.

4. Training Recommendations and Athletic Risk

Tumbling Lab may provide training suggestions, drills, assignments, or evaluation-based recommendations. These materials are for general athletic training support only and do not replace in-person coaching, professional supervision, medical advice, or individualized safety assessment.

The safest way to train is under the supervision of a qualified coach. Users perform exercises, drills, or skill progressions at their own risk. If a user is unsure how to perform an exercise safely, they should seek help from a qualified coach or medical professional before continuing.

5. Children and Minors

Tumbling Lab is not primarily directed to children under 13. However, athletes may be minors.

Self-service signup is available only for users 13 and older. Users under 13 may access Tumbling Lab only when a parent/legal guardian creates or grants access and provides required parental consent.

Athletes ages 13–17 may use Tumbling Lab only with parent/legal guardian authorization.

Parents/legal guardians may manage athlete accounts, create parent-managed athletes, create or grant child logins, provide consent, request deletion/anonymization, and exercise applicable rights on behalf of their child.

If we learn that a user under 13 created an account without proper parent/legal guardian consent, we may restrict, delete, anonymize, or require parental confirmation for the account.

See also the Children’s Privacy Policy and Parent Consent Policy.

6. Parental Consent

When a parent/legal guardian creates or manages a child athlete account, Tumbling Lab may record consent for:

• child account creation;
• parent-managed athlete accounts;
• training data processing;
• coach access;
• appointment scheduling;
• training recommendations;
• athletic risk acknowledgment;
• photo/video evaluation consent;
• notifications;
• Google Calendar-related appointment processing.

Parental consent records may include document version, timestamp, user agent, locale, source, hashed IP, parent user ID, athlete ID, and relationship information.

7. How We Share Information

We do not sell personal information. We do not share personal information for cross-context behavioral advertising. We do not currently use advertising networks or analytics providers.

We may share information with service providers that help operate Tumbling Lab, including:

• Supabase for authentication, database, storage, and security controls;
• Resend for transactional email delivery;
• Google Calendar / Google OAuth when a coach chooses to connect Google Calendar;
• browser push notification services, depending on the user’s browser and device;
• Hostinger, the hosting/infrastructure provider used to run the app;
• Apple and Google if the app is distributed through app stores;
• legal, safety, or government authorities when required by law or necessary to protect rights, safety, or security.

8. Google Calendar

Google Calendar integration is optional and primarily available to coaches. If a coach connects Google Calendar, appointment data may be sent to Google. This may include participant names, emails, notes, location, service name, and appointment timing.

If a user requests deletion/anonymization in Tumbling Lab, we delete/anonymize information within Tumbling Lab according to this Policy. External copies of appointment data already synced to a coach’s Google Calendar may not be automatically removed by Tumbling Lab. Coaches should manage connected calendars and delete external events where appropriate.

9. Push Notifications

Push notifications are optional. Users must enable them through supported browser/device permission flows. Notifications may include service-related information such as assignment updates, appointment updates, evaluation availability, relationship requests, or other account-related messages.

Users may disable push notifications in Settings or through browser/device controls.

10. Legal Bases for EU/UK Users

For users in the European Economic Area, United Kingdom, or similar jurisdictions, we rely on the following legal bases where applicable:

Users may withdraw consent where processing is based on consent, but withdrawal does not affect processing that occurred before withdrawal.

11. Data Retention

We keep personal information only as long as reasonably necessary for the purposes described in this Policy, unless a longer retention period is required or permitted by law.

General retention approach:

12. Account Deletion and Anonymization

Users can start account deletion/anonymization from Settings. Parents/legal guardians can request deletion/anonymization of linked or managed child athlete data.

When an account or athlete is deleted/anonymized, Tumbling Lab is designed to:

• delete or anonymize direct personal identifiers;
• use placeholders such as "Deleted User" or "Deleted Athlete";
• delete linked skill-evaluation photos/videos from the skill-visual-reports storage bucket;
• preserve non-identifying KPIs such as evaluation score, date, skill, surface/category, and aggregate counts;
• preserve legal acceptance, parental consent, deletion request, anonymization event, and admin audit records;
• scrub or minimize emails, notification logs, appointment personal fields, and report payloads where applicable.

Coach and platform administrator deletion may require manual review because these accounts can control elevated data or workspace-level records.

13. Your Rights and Choices

Depending on your location, you may have rights to:

• access your personal information;
• correct inaccurate information;
• request deletion or anonymization;
• request a copy of certain data;
• restrict or object to certain processing;
• withdraw consent where applicable;
• lodge a complaint with a data protection authority.

Parents/legal guardians may exercise rights for their child where permitted by law.

To make a request, contact frezdecastilla@gmail.com or use the in-app controls available in Settings.

14. California and U.S. State Privacy Rights

We do not sell personal information and do not share personal information for cross-context behavioral advertising.

If you are a resident of California or another U.S. state with applicable privacy rights, you may have rights to access, correct, delete, or limit certain uses of personal information. You may contact us at frezdecastilla@gmail.com to exercise applicable rights.

15. Security

We use reasonable technical and organizational measures designed to protect information, including authentication controls, role-based access, database security policies, server-side authorization checks, encrypted communications, encrypted Google Calendar tokens, rate limiting, and audit records.

No method of transmission or storage is completely secure.

16. International Transfers

Tumbling Lab may process information in countries other than where you live. Service providers may store or process data in the United States or other locations. By using Tumbling Lab, you understand that your information may be transferred and processed internationally, subject to appropriate safeguards where required.

17. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we may provide notice through the app, email, or other reasonable means. Continued use after the effective date means the updated policy applies.

18. Contact

Tumbling Lab / Diego Frez De Castilla Privacy Contact: frezdecastilla@gmail.com

Legal and support pages

Contact

For privacy, support, account deletion, or security questions, contact frezdecastilla@gmail.com.