Privacy policy

Who processes the data

Athlense is a project founded in Bergamo, Italy, and is being incorporated as a company. Until then, the data controllers are the project's founders; as soon as the company exists you will find its name, registered office and VAT number here.

For any privacy question or to exercise your rights, write to info@athlense.com.

Which data we process

You need an Athlense account to use the app. With the account we process:

• account data: name, email and password, which we store only in an irreversibly hashed form (we cannot read it); if you sign in with Apple or Google, the identifier they give us and your email (with Apple it can be a relay address);
• training sessions: session name and notes, course, times, photocell passes, splits and speeds;
• athletes: name, bib, group and the times of the runs they are assigned to;
• kits: AthLink identifier, MAC, name and firmware version, configuration (radio range and course) and the kit key, stored encrypted;
• course templates and app preferences (theme, language, units, timing rules);
• plan: active plan (Free or Pro) and its expiry date;
• shared kits (Athlense Pro): name and email of the people you invite, invite code and expiry;
• Athlense Live: the latest state of the current session sent by the phone and a random identifier for each browser window watching it, used only to count viewers;
• registered products: serial number and purchase date, for the warranty;
• support requests and the app's diagnostic logs, only if you choose to send them;
• security data: IP address and device type of sign-ins, sign-in attempts and password reset requests.

Bluetooth is used only to connect the phone to AthLink. To check for AthLink firmware updates, the app contacts our servers without sending data that identifies you. The app does not collect the phone's location: on Android, the system requires the location permission for Bluetooth scanning on older versions. The photocells' GPS positions are used to synchronise times and to show them on the app's map; we do not store them on our servers. The camera is used only to read the code on the product box and the image never leaves the phone.

The website uses no profiling cookies and no analytics. The only cookie is a technical one that remembers your language ("athlense-lang", 12 months). The Contact form sends nothing by itself: it prepares an email in your mail app. The hosting provider records technical visit data (such as IP and browser) for security and operation.

Data about other people

Names, bibs, groups and notes you enter for athletes and sessions concern other people, for example the athletes you coach. Enter only what is needed and, for minors, do so with the consent of whoever holds parental responsibility.

With Athlense Live, anyone with the link can see the times of the current session and, if you turn the option on, the athletes' names, without an account. Share the link only with those who need to see it; you can stop the live link or create a new one from the app.

Why we process it and on what basis

• Providing the app and the services you ask for (account, session backup and sync, athletes, kit connection and sharing, Athlense Live, product registration, support): performance of a contract, Art. 6(1)(b) GDPR.
• Protecting accounts, devices and services from unauthorised access and abuse (attempt limits, security logs): legitimate interest, Art. 6(1)(f).
• Handling the warranty and complying with legal obligations: Art. 6(1)(c).

We do not use your data for advertising or profiling and we do not sell it. The emails we send are service emails only, such as the password reset link or a kit invite.

Who we entrust it to

We use providers that process data on our behalf and on our instructions:

• Vercel Inc. (USA): hosting of the website and online services;
• the managed database provider that hosts accounts and backups;
• Resend (USA): delivery of service emails.

If you sign in with Apple or Google, Apple and Google process your sign-in data as independent controllers under their own policies. The app's map uses Apple Maps on iPhone and Google Maps on Android: the provider receives the area shown in order to load the imagery.

Some providers are based in the United States: transfers rely on the EU-US Data Privacy Framework or on the European Commission's standard contractual clauses.

For how long

• Account, sessions, athletes, kits, templates, preferences and registered products: as long as you have the account. With the Free plan, the cloud keeps the 50 most recent sessions from the last 90 days: the others are deleted from our servers and stay only on the phone. When you sign out, sessions are removed from the phone. When you delete it from the app (Settings → Account → Delete account) they are erased immediately; only an anonymous record that does not identify you remains. The database provider's backups are overwritten within the provider's technical schedule.
• Sign-ins: each sign-in stays valid for at most 60 days without use; sign-in attempts are erased after 2 days; password reset links expire after 1 hour.
• Kit invites: they expire after 7 days. Athlense Live: the session state is replaced at every update; viewer identifiers are deleted periodically after one hour.
• Diagnostic logs: 12 months. Support requests: 24 months.

How we protect the data

Encrypted connections (HTTPS); passwords stored only with a slow hash function (scrypt), never in clear text; encrypted kit keys (AES-256); short-lived, revocable access tokens; limits on sign-in attempts. On the phone, passwords and keys are kept in the system's protected keychain. An AthLink accepts only phones that know its kit key.

Your rights

At any time you can ask us to access, correct or delete your data, to restrict its processing, to object to processing based on legitimate interest and to receive it in a readable format (portability). In the app you can download your data and delete your account yourself; for anything else write to info@athlense.com. We reply within one month.

If you believe the processing breaks the law, you can lodge a complaint with the Italian data protection authority (Garante per la protezione dei dati personali, www.garanteprivacy.it) or with the authority of the EU country where you live.

Minors

To create an account you must be at least the minimum age for digital consent in your country: for example 14 in Italy and Spain; 16 where the country is not specified. You are asked to confirm this when you sign up.

Changes

If we change this policy we update the date at the top; for important changes we let you know in the app or by email.