Privacy Policy

Ocean Swim School is a swim coaching app: training plans, drills, courses, an AI coaching assistant, and optional human video review. We collect the account and training data needed to run those features, we never sell your data, and you can export or permanently delete everything we hold about you at any time from Settings → Privacy & data.

Ocean Swim School (“we”, “us”) is operated by Alexandru Coci. For any privacy question, or to exercise the rights described below, email alexandru.coci@olympian.org.

• Account data — your name and email address, and a password if you sign up that way (hashed by our authentication provider, better-auth; we never see it in plain text). If email/password sign-in is used, your email is verified before the account becomes usable.
• Social sign-in — if you choose to sign in with Google, Apple, or Facebook, we receive your name, email address, and a provider account identifier from them, and store a link between that provider account and yours.
• Swim profile & training preferences — the answers you give in onboarding and in Settings: your track and tier, unit preference (metres/yards), pool or open-water environment, pool length, which days you swim, session-length preference, equipment you have, personal-best times you enter, how far you can comfortably swim, and your goals.
• Progress & activity data — which lessons and courses you’ve completed, logged training-plan sessions (including if you skip one and why), drill completions, recorded benchmark times, swim logs, and the streaks, points, levels and badges derived from that activity.
• Apple Health workouts — optional, and read-only. If you connect Apple Health in Settings → Apple Health, we read your swimming workouts (distance, duration, average heart rate) so that swims recorded by a watch count toward your training. We read nothing else from Apple Health and we never write to it. You can disconnect at any time, and every other feature works without it.
• Notification token — if you allow notifications in the iOS app, your device gives us an Apple push token, which we store with your account so we know where to send your reminders. There are two: a reminder on a day you chose to swim, and a follow-up when a planned swim was missed. Both mirror emails we already send, and if you allow notifications you get the notification instead of the email, never both. Turn notifications off in iOS Settings and we stop sending them.
• Coaching conversations — the questions you ask “Ask the Coach”, our AI coaching assistant, and its replies. Your question, recent conversation history, and your current track/week are sent to our AI provider, Anthropic, to generate the reply (see “Third parties” below); the conversation is also stored in our own database so your coach can pick up where it left off.
• Video submitted for coach review — if you submit swim-technique footage for a personal video review, that video (hosted with our video provider, Bunny) plus the human coach’s written notes on it, and the personalised training plan generated from that review.
• Community content — posts, comments, and likes you post to the club feed, and who you follow. The feed also carries the swims you log (distance, time, how it felt, and the name of the session) and the badges you earn. All of it is visible to other signed-in members, not to the public internet or search engines. Swims and badges are shared by default; you can turn them off with Share my training in Community in Settings → Privacy & data. Anything you explicitly post stays visible regardless, since posting is a deliberate public act within the app.
• Subscription & billing data — on the web, your Stripe customer and subscription id, plan, status, and renewal date; on iOS, your subscription status as reported to us by Apple via RevenueCat. We never see or store your card number or Apple ID payment details — those are held entirely by Stripe or Apple.
• Technical data — a session cookie that keeps you signed in, and, for each sign-in session, the IP address and browser/device string used to create it, kept for security and troubleshooting.

We process account, training-profile, progress, coaching-conversation, video-review and billing data to provide the service you signed up for (performance of a contract). We process community posts, comments, and follows on the basis of your consent, given each time you choose to post or follow someone. Session/technical logs are kept on the basis of our legitimate interest in running a secure, working service. We do not use your data for advertising and we do not profile you for marketing purposes. We only send you transactional email (sign-in links, password resets, email verification) and training reminders for the days you chose to swim — we do not currently operate a marketing mailing list. If you allow notifications on iOS, those reminders arrive as notifications instead of email.

“Ask the Coach” is powered by Anthropic’s Claude models. It answers in the voice of the school’s head coach but is software, not a person — it never claims to be a specific named individual. It is grounded only in our own drill, course, and plan catalogue and is instructed never to invent content that doesn’t exist in the app. It is a supplement to, not a replacement for, a real video review by a human coach, and it does not diagnose medical conditions or replace professional medical advice.

Ocean Swim School has a community feed for signed-in members. If you post, comment, like, or follow, your display name and that activity are visible to other signed-in members — never to the public internet or to anyone who hasn’t signed in. By default the swims you log (distance, time, how it felt, and the name of the session) and the badges you earn appear in that feed under your display name too. You can stop that at any time with Share my training in Community in Settings → Privacy & data — turning it off hides your past and future swims and badges from the feed straight away. Your email address and password are never shown to other members.

We rely on a small set of processors, each handling only what their function needs:

• Hetzner — our server hosting, in Helsinki, Finland (EU). Our application and database run on infrastructure we control there.
• Backblaze B2 — encrypted, automated off-site backups of our database.
• Anthropic — powers the “Ask the Coach” AI feature. Your question, recent conversation history, and your track/week are sent to Anthropic’s API to generate each reply.
• Bunny.net (Bunny Stream) — hosts our video library, including course/drill videos and any technique video you submit for coach review.
• Stripe — payment processing for subscriptions purchased on the web. Stripe receives your payment details directly; we never see your full card number.
• Apple (App Store) & RevenueCat — if you subscribe inside the iOS app, the purchase is handled by Apple, and RevenueCat relays your subscription status to us. We never see your Apple ID payment details.
• Resend — delivers our transactional emails (sign-in links, password resets, email verification).
• Apple (Push Notification service) — if you allow notifications, Apple delivers them to your device. Apple receives the notification and your device token; it does not receive your training data.

We never sell your data and we never share it for third-party marketing.

We keep your data for as long as your account exists. When you delete your account, your profile, training data, progress, coaching conversations, community posts, comments, likes, and follows are permanently removed, and any video you submitted for review is deleted from our video host. Encrypted database backups age out and are overwritten on our normal backup rotation.

If you have an active paid subscription, you’ll need to cancel it first (via the billing portal on the web, or in the App Store on iOS) before you can delete your account — we don’t auto-cancel billing on deletion, so this avoids you being charged for a plan attached to a deleted account.

If you are in the UK or EU, the GDPR gives you the right to access, correct, export, or erase your personal data, and to object to or restrict its processing. You can do this yourself, any time, from Settings → Privacy & data: Export my data downloads everything we hold about your account as a JSON file, and Delete my account permanently removes it. For anything else — a correction, a complaint, or help with either of those — email alexandru.coci@olympian.org and we will respond within 30 days. You also have the right to complain to your local data protection authority.

We use one essential cookie: the authentication session that keeps you signed in. We do not use advertising or analytics tracking cookies, and we don’t run any third-party analytics on this app.

Ocean Swim School is built for adult swimmers and is not intended for children under 16. We do not knowingly collect data from anyone under 16; if you believe a child has registered, contact us and we will remove the account.

We may update this policy as the product evolves. Material changes will be reflected in the effective date above; significant changes will be communicated in-app.