Privacy policy

Who we are and who manages your records

SportHQ is operated by Sky Network Pty Ltd (ABN 63 145 355 353). “SportHQ”, “we” and “us” refer to that company. Our Privacy Officer can be contacted at [email protected].

We manage accounts, security, service operations and enquiries. Your club, school, association or team organiser decides what participant records to collect, who may use them and how long the organisation needs them. We store and process those records to provide the service. The organisation’s own privacy notices and registration terms also apply. Contact us if you are unsure which organisation holds your records.

We handle personal information in accordance with the Australian Privacy Principles as our privacy framework. Statutory rights and obligations depend on the laws applicable to the information and organisation, including Australia’s Privacy Act 1988 (Cth) and New Zealand’s Privacy Act 2020 where applicable.

Information we collect

Personal information includes information or an opinion about a person who is identified or reasonably identifiable. Health information is sensitive information and requires additional care. We collect only information reasonably necessary for the service or another lawful purpose. Sensitive information is collected with the consent required by law, unless a lawful exception applies.

• Accounts: names, email addresses, memberships, roles, linked family relationships, authentication and recovery records.
• Participants and registration: names, dates of birth, contact details, guardians, season history, team placements, registration answers, declarations and consent records supplied by you or your organisation.
• Coaching and communication: rosters, jersey numbers, positions, fixtures, attendance, availability, training plans, minutes, statistics, assessment results, notes, votes and team-chat content.
• Sensitive information: medical conditions, allergies, medications and emergency plans, where an authorised person provides them. Clubs may record volunteer and staff screening details, check numbers, expiry dates, verification and exemption records.
• Media: optional player photos, uploaded clips and enabled chat photos or videos.
• Billing: plan, payer, currency, subscription, transaction and invoice references. Stripe processes card details through its hosted payment services; do not send card details to SportHQ support.
• Enquiries and waitlist: email, optional name, role, club, sport, region and message, messages and support or privacy-request correspondence.
• Technical and security information: IP addresses, request and account identifiers, authentication events, access and change logs, push subscriptions and usage counters.

How we collect information

We collect information when you register, accept an invitation, complete a form, use the service, upload content or contact us. We also receive information from authorised organisers, coaches, parents and guardians, including roster imports, family links, registrations and coaching observations. Service providers supply payment, delivery and security events.

You can browse the marketing site without an account. Some account, registration or security information is needed to provide a feature; if you do not supply it, that feature or registration may be unavailable. Optional fields are identified in the relevant form. Ask your organisation why a registration field is needed before supplying sensitive information.

You may make general enquiries without giving your real name, or use a pseudonym where practical. We need enough identifying information for account access, participant registration, payments and requests concerning a particular person’s records. If we receive personal information we did not request, we assess whether we may lawfully retain it and otherwise take reasonable steps to delete or de-identify it where lawful and reasonable.

Why we use it

• Provide accounts, registration, coaching, schedules, communication and family access.
• Apply organisation permissions, consent settings and participant links.
• Process subscriptions and billing, provide support and resolve privacy requests.
• Prevent abuse, investigate security incidents and maintain service reliability.
• Deliver requested notifications, invitations and waitlist availability updates.
• Provide optional AI suggestions when requested and measure associated usage.
• Meet applicable legal obligations and establish or respond to legal claims.

We do not sell personal information or use it for targeted advertising. Joining the waitlist allows us to contact you about SportHQ availability. You can ask us to remove you from that list. Promotional communications require the consent applicable law requires and a way to opt out. Use the unsubscribe instructions provided or email [email protected] to opt out. We do not use medical or screening information for marketing. Essential account and service messages may still be sent.

Children, guardians and consent

Junior sport involves children’s personal information. Organisers must give appropriate notices and obtain consent where required, including for sensitive information and media. A recorded checkbox does not establish that the person giving consent has authority. Clubs must check guardian relationships, court orders or restrictions and review permissions when circumstances change.

Consent to participate, sharing a photo, recording health information and using optional AI are separate decisions. Do not assume one permission covers them all. To withdraw or update consent, contact your organisation or us. Withdrawal affects future use and may limit a feature; it does not automatically remove every earlier record or override lawful retention.

Where New Zealand indirect-collection notice requirements apply, information supplied by another person or imported by a club may require notice to the individual or an appropriate guardian. Organisations should explain the source, purpose, recipients and access rights, subject to applicable exceptions.

Who can see it

Authorised members can see records their permissions allow. Individual family views are limited to linked players; team-wide messages and schedules are shared within the permitted group. A coach chooses which notes to share. Medical information and guardian contacts have additional restrictions. Consent and access settings affect media visibility.

Authorised SportHQ personnel may access information when needed for support, security, administration or legal obligations. We may disclose information to providers necessary to operate the service, to recipients you or your organisation authorise, or where law requires or permits it. We assess requests for disclosure rather than giving public access to team records. An export or screenshot can create a separate copy outside SportHQ’s controls.

Service providers and overseas processing

Providers used to deliver the service include:

Our providers operate internationally. Overseas processing or access may include the United States and India. Cloudflare uses a global network, and the countries involved in an AI request depend on the selected model and routing. An Australian endpoint does not establish Australian-only storage. Contact us for information about the providers relevant to your organisation or a particular feature. Where applicable law requires safeguards for an overseas disclosure, we take reasonable steps to put those safeguards in place. Acceptance of this policy does not waive those protections.

Optional AI and free text

AI context can contain first names or jersey numbers, positions, statistics and coaching notes. Generated context excludes photos and surnames; device filtering removes known private contact and medical phrases, and platform filtering also removes email and phone patterns. Free text can still identify a person. Review prompts and avoid health details, guardian contacts and other sensitive material. AI outputs can be inaccurate or disclose information included in a prompt.

SportHQ’s server records AI usage rather than prompt text. Coaching plans, notes or conversations saved in the app can still be held on your device or synchronised as team records. AI providers process requests under their own arrangements; we cannot promise that providers never retain requests or use them for model improvement without checking the selected provider and settings. Your own OpenRouter account has separate terms and billing.

Cookies, devices and external content

The website stores theme preferences locally. The coaching app stores working data on the device and synchronises when online. Authentication uses session cookies or browser storage depending on the part of the app. Where enabled, a seven-day sign-in-status cookie helps the website display the appropriate account link; it contains no credentials and does not grant access. We do not use advertising or analytics trackers on the marketing website. Bot checks, payment pages and external embeds have their own processing. See cookies and device storage.

Security and incidents

Controls include server-side access checks, club data separation, limited-life sign-in codes, rate limits, sensitive-access logs, application encryption for screening numbers and authenticator seeds, and short-lived media links. No system or device is entirely secure. Secure your email and device, use available additional authentication and notify us promptly about suspected unauthorised access.

We investigate incidents and work with affected organisations. Where legally required, we notify affected people and the relevant regulator.

Retention and deletion

We take reasonable steps to destroy or de-identify personal information when it is no longer needed for a permitted purpose and there is no legal requirement to retain it. Organisations must regularly review their records and retention settings; archiving a record is not the same as deleting it.

• Club registers: clubs configure lapsed-player archiving and archived-contact retention. If no periods are configured, those records are not automatically removed. Removing archived contacts can leave names, dates of birth and season history.
• Screening records: retained under the club’s configured period after a person leaves; the default is 84 months. Clubs must choose a period appropriate to their obligations; different roles and jurisdictions may have different requirements.
• Access logs: the retention period is seven years, subject to a legal hold. Logs contain identifiers, actions and counts rather than record contents.
• Chat media: enabled storage has a configurable expiry period, defaulting to 365 days. Media expiry does not establish the retention period for chat text.
• Privacy requests: correspondence and outcome records support handling and accountability. Requester email removal follows the retention date set when a platform request is closed.
• Club closure: owner-requested deletion normally has a 30-day grace period. Authorised platform administration can schedule a different period, up to 90 days. Deletion runs after the scheduled date; failed media removal is retried. Retained security or legal records can have separate requirements.

Removing a player from the club register does not by itself erase every coaching record or copy. We coordinate requests with the organisation and explain the scope, any lawful exceptions and remaining actions. Devices receive deletion changes when they reconnect; exports and offline copies need separate attention.

Deleted information may remain in backups until those copies expire. Our backup retention policy is seven days for managed-database recovery copies and no more than 30 days for additional operational copies. The backup retention period runs from removal from the live system, after any club-deletion grace period. If a backup is restored, deletions must be reapplied before normal service resumes. Provider transaction, security and delivery records can have separate retention requirements. Information retained for legal obligations, disputes or security is limited to the relevant purpose and period.

Access, correction, deletion and complaints

Ask your organisation or [email protected] to access or correct your information, withdraw consent, request deletion or make a privacy complaint. Include your name, account email, relevant organisation and what you need. Do not send sensitive documents initially. We may verify your identity and authority, including a guardian’s authority, through a suitable secure process.

We aim to respond to Australian privacy enquiries within 30 days. Where New Zealand law applies, access and correction decisions generally have a 20-working-day limit, subject to permitted extensions. We explain any refusal or extension and available review options. Deletion is assessed against the records held and applicable retention requirements; it is not an unconditional right to erase all records.

If you are dissatisfied, you can contact the Office of the Australian Information Commissioner or New Zealand’s Office of the Privacy Commissioner, as appropriate. You can request this policy in another accessible format.

There is no charge to make an access request, ask for correction or make a complaint. If a lawful, reasonable charge is needed to provide access, we explain it before proceeding. If we decline to correct information, you may ask us to attach a statement of the correction you sought where applicable law provides that right.

Our Privacy Officer assesses complaints, may seek further information and coordinates with the relevant organisation. We explain the outcome and any corrective action, aiming to respond within 30 days or advising you of progress if more time is needed. You may use the external complaint avenues above.

Changes to this policy

We will date updates and explain material changes through an appropriate service notice. A revised policy does not authorise unrelated uses of existing information without any additional notice or consent required by law.