Privacy Policy of the Boccia ProTrainer application
Effective from: 2026-10-26
1. Data controller
The controller of your personal data is Jarosław Plewa, a sole trader operating under the business name LOBOART JAROSŁAW PLEWA, ul. Łódzka 243, 42-218 Częstochowa, Poland, tax ID (NIP) 5732484193 ("we", the "Controller").
For matters concerning personal data write to: support@bocciaprotrainer.com.
This Policy covers the Boccia ProTrainer application (https://app.bocciaprotrainer.com, the "Application"). It also covers the information website https://bocciaprotrainer.com, which collects no data other than technical server logs.
2. What data we process and where it comes from
All data comes from you (you enter it in the Application) or is generated technically while you use it. We do not buy data and do not combine it with external sources.
| Category | Examples | Source |
|---|---|---|
| Account data | e-mail address, password (stored only as a cryptographic hash), full name or nickname, language, role (athlete / coach), sport class (BC1–BC4, BC3 with assistant, other) | registration, onboarding |
| Training data | throws and their distances, sessions, drills, training plans, goals, calendar, equipment and balls, ramp settings, venue conditions, matches, tactical analyses, notes, video links, challenge league results, Skills Test results (distances of the 36 throws, score, execution, venue and surface) | entered in the Application |
| Wellbeing and health data (special category data, Art. 9 GDPR) | sleep, fatigue, mood, stress, pain, body weight, health notes, information implied by the sport class (e.g. type of motor disability) | entered voluntarily in the wellbeing diary, settings and onboarding |
| Coach data about athletes | roster, observations, form ratings, microcycles, sparring, tasks, messages and session comments, Skills Tests entered on the athlete's behalf | entered by the coach |
| Coach verification data | name from the document, coaching licence number, federation, club (centre, school), city, role, club website, contact phone, scan of the licence or club letter | submitted by the coach on the “Coach verification” screen |
| Data about other people | opponents (name, country, playing style), ramp operators, sparring partners | entered by you; you are responsible for the basis for entering it |
| Started-purchase data | selected plan, billing cycle, price zone, the amount and currency shown on the pricing screen, timestamp | recorded when you click buy and we create a payment link |
| Payment data | plan, subscription status, Lemon Squeezy subscription and order identifiers, billing period dates, country and currency. We do not receive card numbers or bank details | Lemon Squeezy (webhook) |
| Technical data | IP address, browser and device type, address of the page where an error occurred, error message text, Application version, sign-in timestamps, CAPTCHA verification result | automatically, server and Application logs |
| Push notifications | push subscription address generated by the browser, encryption keys, time zone, selected notification types, date of last delivery | after your consent in the browser |
| Correspondence | content of e-mails and support requests | when you write to us |
| Cancellation or withdrawal notices | full name, e-mail address, the contract (plan) concerned, order or subscription number (if you provide it), type of notice, chosen effective date, reason (if you give one), date and time of submission, hash of the IP address | the "Cancel contract here" form (available without signing in) |
Providing an e-mail address and password is necessary to create an account. Other data is provided voluntarily; without it some features (e.g. wellbeing analysis) will not work.
3. Purposes and legal bases
| Purpose | Data | Legal basis | How long |
|---|---|---|---|
| Running the account, saving and synchronising data across devices, training analyses, coach module | account, training and coach data | Art. 6(1)(b) GDPR – performance of a contract (Terms) | until the account is deleted |
| Processing wellbeing and health data and sport class | health data | Art. 9(2)(a) GDPR – your explicit consent given at registration or at the first entry; you may withdraw it by deleting the entries or the account | until consent is withdrawn / account deleted |
| Sharing your data with your coach | training and health data | Art. 6(1)(a) and Art. 9(2)(a) GDPR – consent given by accepting the invitation; withdrawn by leaving the roster | until you leave the roster |
| Your coach adding shots to your log (e.g. when you have no phone at the venue) — the coach cannot edit or delete your entries, and added shots are marked “recorded by coach” | training data (shots) | Art. 6(1)(a) GDPR – consent: the “Coach can record my shots” switch in Messages, off by default; withdrawn by switching it off or leaving the roster | added shots – like training data (until you delete them or the account) |
| Skills Test norms: showing you how your score compares with other athletes in the same sports category | score of your latest complete Skills Test from the last 12 months and your sports category | Art. 6(1)(f) GDPR – our legitimate interest (providing users with norms for their category); sports category – Art. 9(2)(a) GDPR (consent from the row above). You can switch off participation in the norms at any time: My Account → Privacy → “Skills Test norms” | until you switch off participation or delete the account; only tests from the last 12 months count towards the norms |
| Confirming coaching credentials before granting Coach-plan seats (a seat = Elite access for an athlete's account) | coach verification data | Art. 6(1)(b) GDPR – performance of the contract (§ 6 of the Terms) and Art. 6(1)(f) GDPR – preventing plan abuse | the decision and its date: until the account is deleted; the document scan: you can delete it yourself after approval, and we delete it with the account at the latest |
| Completing a started purchase and sales statistics (how many people open a payment and how many finish it) | started-purchase data | Art. 6(1)(b) GDPR – performance of the contract and Art. 6(1)(f) GDPR – our legitimate interest (analysing our own sales) | until the account is deleted |
| Handling payments and plans, activating the plan after purchase | payment data | Art. 6(1)(b) GDPR | until the account is deleted; payment event records for 6 years from the end of the year (defence of claims, accounting) |
| Sending transactional e-mails (registration confirmation, password reset, notice of changes to the Terms or prices, a one-off reminder that your trial is about to end) | e-mail, name, language, time zone, number of logged shots and game plans | Art. 6(1)(b) and (c) GDPR | until the account is deleted |
| Getting-started tips: at most 4 short e-mails in the first week after registration (how to start, your first training, progress towards your first analysis, working with a coach) and a one-off question to accounts created before 7 October 2026 that have not started training | e-mail, name, language, registration date, role (athlete or coach), number of logged shots and trainings, number of athletes in the coach’s squad or membership of a coach’s squad | Art. 6(1)(f) GDPR – our legitimate interest (helping you get started with the App); you opt out with the link in every e-mail of the series or by writing to support@bocciaprotrainer.com | until the series ends or you opt out; the record of e-mails sent – until the account is deleted |
| Request to a coach: storing the coach’s e-mail address you enter in My Account, so that once the coach creates an account with that address they see your request to join their squad. The App does not send any messages to that address — you pass the link to your coach yourself | the coach’s e-mail address you entered, date and status of the request; your name is visible to the coach only after they sign in with that address | Art. 6(1)(f) GDPR – legitimate interest (connecting an athlete with their coach at the athlete’s request) | until the request is accepted, dismissed or withdrawn, at most 90 days |
| Referral programme: your personal referral link and the number of accounts created with it; when you sign up through a link — a record of whose link was used | referral code, link between your account and the referrer’s account, registration date, information about a plan purchase (visible only to the administrator) | Art. 6(1)(f) GDPR – legitimate interest (growing the App through referrals and being able to thank referrers). The referrer sees only the number of accounts, never who created them | until the account is deleted |
| Push notifications (training and tournament reminders, weekly summary, message or task from the coach, trial ending, reminder of your next Skills Test) | push data | Art. 6(1)(a) GDPR – consent; withdrawn in My Account or in browser settings | until consent is withdrawn |
| Security: protection against attacks, CAPTCHA, abuse detection, error logs, backups | technical data | Art. 6(1)(f) GDPR – our legitimate interest (security of the service and data) | logs up to 30 days, backups up to 7 days |
| Handling complaints, requests and disputes | correspondence, account data | Art. 6(1)(b), (c) and (f) GDPR | until the matter is closed, no longer than 3 years |
| Receiving and carrying out a cancellation of or withdrawal from the contract submitted via the online form, sending the confirmation, cancelling the subscription renewal in Lemon Squeezy and refunding the payment | cancellation or withdrawal notices, payment data | Art. 6(1)(b) and (c) GDPR – performance of the contract and legal obligation (confirmation of receipt of the notice); Art. 6(1)(f) GDPR – protection against misuse of the form (submission limit) | 3 years from submission of the notice (proof of submission and defence of claims) |
| Visit statistics and advertising measurement (Google Analytics 4, Google Ads, Meta Pixel) | browser identifier, account identifier (UUID), event name and plan amount | Article 6(1)(a) GDPR – consent given in the cookie banner; withdraw it in My Account → Privacy | until consent is withdrawn, and no longer than 14 months at the provider |
| Newsletter: news, training tips and offers relating to the Application by e-mail | e-mail, language | Art. 6(1)(a) GDPR – separate, voluntary consent (checkbox at registration, in My Account, or the form on bocciaprotrainer.com confirmed via an e-mail link); withdrawn in My Account or via the link in every e-mail | until consent is withdrawn |
We send the newsletter only to people who have given separate consent; we do not carry out marketing based on profiling and we do not sell data.
Automated analyses. The Application automatically calculates accuracy, trends, fatigue curve, training load and suggests rest or a type of drill. These are informational suggestions that have no legal effect on you and are not decisions within the meaning of Art. 22 GDPR. They do not replace the advice of a doctor or physiotherapist.
Skills Test norms. The score of your latest complete test from the last 12 months goes into the pool from which we calculate the norms for your category (BC1–BC4). Other users see only aggregate figures: the number of athletes in the category, the quartile values and their own percentile — and only once the category has at least 20 athletes. No one other than you and your coach can see your name or your score. We store the percentile with the test so that your history does not change retroactively. Incomplete tests, invalidated tests and test accounts are not counted. Switching off participation also removes your earlier tests from the pool; you still see your own score and progress. The norms are information, not a decision within the meaning of Art. 22 GDPR.
4. Who we share data with
We use processors who process data on our behalf under data processing agreements:
| Entity | Role | Data location | Transfer safeguard |
|---|---|---|---|
| Supabase, Inc. | database, sign-in and sessions, backups | Ireland (eu-west-1 region, AWS) | data in the EEA; technical support may operate from outside the EEA under Standard Contractual Clauses (SCC) |
| Vercel, Inc. | hosting of the Application, content delivery network, server functions (plan activation, account deletion, push delivery, error logging) | Application files on edge servers worldwide; server functions in Frankfurt (Germany) | Data Privacy Framework (DPF) and SCC |
| Lemon Squeezy, LLC | seller (Merchant of Record) of paid plans: payments, invoices, taxes, customer portal | USA | Lemon Squeezy is a separate controller of your payment data; its policy is available on the payment page |
| Resend, Inc. | sending transactional e-mails and getting-started tips from support@bocciaprotrainer.com and hosting the newsletter list and sending the newsletter | Ireland (eu-west-1 region) | data in the EEA; technical support may operate from outside the EEA under SCC |
| Cloudflare, Inc. | CAPTCHA (Turnstile) on the sign-in screen | global | DPF and SCC; Cloudflare processes the IP address and browser data to distinguish humans from bots |
| Push service providers (Google, Apple, Mozilla – depending on the browser) | delivery of push notifications | global | notification content is encrypted with your browser's key |
| Google Ireland Limited | visit statistics (Google Analytics 4) and advertising measurement (Google Ads) — only after you consent to cookies | Ireland / USA | DPF and SCC; we send a browser identifier and an account identifier (a random string), never your e-mail or training data |
| Meta Platforms Ireland Limited | advertising measurement (Meta Pixel, Conversions API) — only after you consent to cookies | Ireland / USA | DPF and SCC; we send an advertising cookie identifier and the event name (e.g. checkout started), never your e-mail or training data |
| Your coach (if you accept an invitation) | insight into training and wellbeing data, messages; with your consent also adding shots to your log | – | the coach is a separate controller and is responsible for their own processing |
Data may be disclosed to authorised public bodies where required by law, and to advisers (accounting, legal) to the extent necessary for the defence of claims.
5. Transfers outside the EEA
Your training data and account are stored in Ireland, and e-mails are sent from servers in Ireland. Some processors (Vercel, Lemon Squeezy, Cloudflare) are based in the USA, and analytics data — if you consent to cookies — may also reach Google and Meta outside the EEA. Transfers to these entities take place on the basis of the European Commission's adequacy decision for the EU-U.S. Data Privacy Framework (for certified entities) or Standard Contractual Clauses approved by the European Commission. You can obtain a copy of the safeguards by writing to the address in section 1.
6. How long we keep data
- Account and training data – for as long as the account exists. Data entered in the free tier is not deleted after the trial ends; we only limit its presentation.
- After account deletion – data is deleted from the database immediately and from backups within 7 days. Active subscriptions are cancelled in Lemon Squeezy.
- Payment event records (order identifiers, amounts, dates) – 6 years from the end of the year in which the payment was made, due to tax regulations and the defence of claims.
- Coach verification document – kept in private storage accessible only to us. After approval you can delete the file with one click in the Application (the verification status stays); otherwise the file is deleted together with the account. The decision itself (approved / rejected, date, reason) is kept until the account is deleted.
- Skills Test results – like training data, for as long as the account exists. You can invalidate a test in the Application (it stays in your history but does not count towards the norms). Only the latest complete test from the last 12 months counts towards the norms.
- Technical logs and error reports – up to 30 days.
- Inactive accounts – after 24 months without sign-in we may delete the account after 30 days' e-mail notice (this does not apply to accounts with an active paid plan or a Founders package).
- Data held by the coach – when you leave the roster, the coach loses access to your current data. The coach's own notes and form ratings remain in their module as their materials; you may ask the coach directly to delete them.
7. Your rights
You have the right to:
- access your data and obtain a copy;
- rectification – you can correct most data yourself in the Application;
- erasure – My Account → Delete account, or on request by e-mail;
- restriction of processing and objection to processing based on legitimate interest (you can switch off participation in the Skills Test norms yourself: My Account → Privacy);
- data portability – My Account → Data export (CSV and JSON);
- withdraw consent at any time (wellbeing and health: delete the entries or the account; coach: leave the roster; shots recorded by the coach: switch it off in Messages; push and newsletter: switch off in My Account), without affecting the lawfulness of earlier processing;
- lodge a complaint with the President of the Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warsaw, Poland, https://uodo.gov.pl. If you live in another EEA country, you may complain to the supervisory authority there.
We handle requests within one month; in complex cases the period may be extended by a further two months, of which we will inform you.
8. Browser storage (cookies and similar)
8.1. Strictly necessary storage (no consent required)
The Application stores in your browser's memory (localStorage, IndexedDB, Service Worker cache) only data necessary for the service to work:
- the sign-in session (token refreshed every 15 minutes);
- a copy of your training data for offline work and a queue of changes to be sent;
- settings (language, font size, big-buttons mode, dashboard layout, onboarding state);
- Application files so that it works without an Internet connection.
These are strictly necessary for providing the service and therefore do not require separate consent (Art. 399(3)(2) of the Polish Electronic Communications Law of 12 July 2024 (Prawo komunikacji elektronicznej); for users in Germany – § 25(2)(2) TDDDG). You remove them by signing out (the Application clears its data) or by clearing site data in your browser. The Cloudflare Turnstile script may store a technical challenge identifier for the duration of the verification.
8.2. Analytics and advertising cookies (only with your consent)
On your first visit we show a banner with two equally prominent options: "Accept" and "Essential only". Until you click "Accept", no analytics or advertising script is loaded and nothing is sent to third parties.
Once you consent, we use:
- Google Analytics 4 — visit statistics and in-app paths (which screens lead to a new account);
- Google Ads — advertising measurement;
- Meta Pixel and Conversions API — advertising measurement on Facebook and Instagram.
We send these providers only: the browser identifier from their own cookie, your account identifier as a random string (UUID), and the event name with an optional plan amount (e.g. "checkout started, USD 144"). We never send your e-mail address, your name, your training data or your health data.
Legal basis: your consent (Article 6(1)(a) GDPR and Art. 399 of the Polish Electronic Communications Law of 12 July 2024 (Prawo komunikacji elektronicznej); for users in Germany – § 25(1) TDDDG). You can withdraw consent at any time in My Account → Privacy → "Analytics cookies", or by clearing site data in your browser. Withdrawal does not affect the lawfulness of processing before it. Consent is stored for 180 days in the bpt_consent cookie and covers both bocciaprotrainer.com and the Application itself.
9. Push notifications
We send notifications only after your consent given in the browser, at most once a day, in the evening hours of your time zone. You can withdraw consent in My Account (toggle) or in browser settings; the subscription address is then deleted from our database. You can switch off each notification type separately in My Account → Notifications.
10. Children and minors
The Application is intended for people who are at least 16 years old. Younger athletes may use the Application with the consent of a parent or legal guardian, who is responsible for the account. If we learn that an account has been created by a younger person without such consent, we will delete it. A coach entering data about minor athletes is responsible for holding their guardians' consent.
11. Security
We apply, among others: encrypted connections (TLS), passwords stored only as hashes, rejection of passwords from public breaches, CAPTCHA at sign-in, short session tokens with rotation, row-level access rules in the database (each user sees only their own data, a coach only the data of athletes who accepted them), size limits on saved records, daily backups, and sign-out of other devices after a password change. We will inform you without undue delay of a personal data breach likely to result in a high risk to your rights.
12. Changes to this Policy
We will inform you of material changes in the Application or by e-mail at least 14 days before they take effect. The current version is always available in the Application (My Account → Privacy Policy) and at https://app.bocciaprotrainer.com/privacy.
Version dated 2026-10-26.