1. Introduction
QuokkaGo ("we", "our", "us") operates the QuokkaGo platform at quokkago.io and app.quokkago.io. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our service.
We are committed to protecting the privacy of all our users, especially children. Our platform is designed for coaches, parents, and young athletes aged 4-18.
2. Information We Collect
Account Information
- Name, email address, and role (coach or parent)
- Password (stored as a secure bcrypt hash — we never see your password)
- Timezone (auto-detected for scheduling accuracy)
Child Information
- Child's name, date of birth, and sports activities
- Training attendance and progress notes from coaches
- Profile photos (optional, uploaded by parents)
Child profiles are created exclusively by parents or authorized coaches. Children do not create their own accounts.
Usage Data
- Pages visited and features used (via Google Analytics 4, only with your consent)
- Error reports for debugging (via Sentry — no personal data included)
- Device type, browser, and IP address (for security and timezone detection)
Payment Information
Payment processing is handled by Stripe. We never store your credit card number, CVV, or full card details on our servers. Stripe's privacy policy applies to payment data.
3. How We Use Your Information
- To provide and maintain the QuokkaGo platform
- To send notifications about training sessions, progress, and account activity
- To process payments and manage subscriptions
- To improve our service based on usage patterns (anonymized)
- To send important service emails (account verification, password reset, billing)
- To comply with legal obligations
We do not sell, rent, or share your personal data with advertisers or data brokers.
4. Third-Party Services
We use the following third-party services to operate QuokkaGo:
- Mailgun (EU region) — for sending transactional emails
- Stripe — for payment processing
- Google Analytics 4 — for anonymous usage analytics (only with cookie consent)
- Sentry (EU region) — for error monitoring (no personal data)
- Telegram Bot API — for sending notifications (optional, user-initiated)
- Hetzner (Germany) — for hosting infrastructure
- Cloudinary — for storing and delivering photos and videos uploaded to athlete profiles
Our servers and database are located in the European Union (EU). Photos and videos are stored by Cloudinary, which may process them in the United States under the EU Standard Contractual Clauses.
5. Children's Privacy (COPPA Compliance)
QuokkaGo processes data about children aged 4-18. We take this responsibility seriously:
- Child accounts are created and managed by parents or authorized coaches
- Children do not have direct login access or the ability to create accounts
- Parental consent is established through the parent account creation process
- Parents can view or export their child's data at any time, and the parent who created a child's profile can delete it (see Data Retention)
- We collect only data necessary for the training tracking service
- We do not serve targeted ads to children or use their data for marketing
6. Data Retention
We retain your data for as long as your account is active. When you delete your account:
- 30-day grace period — your account is frozen, and you can cancel the deletion and restore your account
- After 30 days — your profile, contact details, settings, and notifications are permanently deleted. Records that other people still use (such as past training sessions and progress notes about a child) are kept, but your name is replaced with "Deleted user" or "Deleted coach" and can no longer be linked to you
- Financial records (payments, subscriptions, wallet transactions, used promo codes) are kept for 10 years as required by tax law, together with only your name, email address, country, and the date of deletion. Only our administrators can see this data, and it is deleted after 10 years
- Backups — deleted data may remain in database backups for up to 30 days until those backups expire
- Emails and Telegram messages sent before the deletion cannot be recalled
- Aggregate training statistics may be retained for academy reporting (anonymized)
A child's profile can be deleted only by the parent who created it. The child is then deleted for everyone, including other parents and coaches, together with their photos, videos, and health records. The same 30-day grace period applies, and the parent who requested the deletion can cancel it during that time.
7. Your Rights (GDPR)
Under the General Data Protection Regulation (GDPR), you have the right to:
- Access — request a copy of all data we hold about you
- Rectification — correct inaccurate personal data
- Erasure — request deletion of your account and data
- Data Portability — export your data as a ZIP archive with JSON files (for parents, also the original photos and videos of their children)
- Restriction — restrict how we process your data
- Objection — object to data processing for specific purposes
You can exercise these rights through your Account Settings or by contacting us.
To export your data, use "Download my data" in your Account Settings. We prepare the archive in the background and send you an email and an in-app notification when it is ready. The download link is valid for 7 days and works only when you are signed in to the same account. You can request a new export once every 24 hours.
8. Data Security
- All data encrypted in transit (HTTPS/TLS)
- Passwords hashed with bcrypt (12 rounds)
- Security tokens hashed with SHA-256
- Rate limiting on sensitive endpoints
- Regular security audits
9. Cookies
We use minimal cookies. See our Cookie Policy for details.
10. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of significant changes via email or an in-app notification. Continued use of the service after changes constitutes acceptance of the updated policy.
11. Contact Us
If you have questions about this Privacy Policy or wish to exercise your data rights, contact us at:
Email: privacy@quokkago.io