We take children’s data seriously.

1. Data controller

Heroskills · Roman Dinkel (Einzelfirma), Zedernweg 4, 7000 Chur, Schweiz. Contact for all privacy requests: info@heroskills.app.

2. What data we process

Parent and coach account: email address (for magic-link login and emails about your account), first name (required at signup), time of sign-up, IP address at login, browser type for the session cookies, language and email settings, a log of your logins and account actions (90 days), a delivery log of team emails (which email when, without content), redeemed vouchers.

Coach account additionally: teams (name, sport, age group), the player names or numbers you assign, invite codes, deselected drills.

Child profile: first name or nickname (no family name required), sport, year of birth (optional), club (optional), training logs (which drill was started and finished when, with measurements such as reps), personal bests and milestones, answers in the tactics plays (chosen answer, right or wrong, Hockey IQ points), joker and rest days, rewards, home label (e.g. “Garage”), avatar, kid code, language, time zone (automatically from the device).

Device data: an anonymous device ID (cookie, technically required for the kid corridor without its own account), screen type (tablet, mobile, desktop).

Payment data: processed exclusively by Stripe Payments Europe Ltd. We store neither credit card number nor IBAN. Stripe only sends us the subscription status and the customer ID.

3. Legal bases

Performance of a contract (Art. 6(1)(b) GDPR / Art. 31(1)(a) revFADP): for providing the app, account management and payment processing.

Consent of the legal guardians (Art. 6(1)(a) + Art. 8 GDPR / Art. 6 revFADP): for processing children’s data. Consent is given by creating the child profile in the parent account. Children have neither their own email nor their own account.

Legitimate interest (Art. 6(1)(f) GDPR): protection against abuse (rate-limiting, brute-force protection), security logging; an operations log of the days the parent/club dashboard and the kids’ app were opened (one entry per account or kid and day, deleted after 90 days, immediately together with the account or kid); anonymous counters in the kids’ app (only day, step and count, e.g. “first exercise started” — no kid, device or IP; a one-way daily token prevents double counting and is deleted within two days at the latest), so we can see where getting started gets stuck; rare emails from the Heroskills team (news, short feedback questions) — you can turn them off in the settings at any time.

4. Who receives your data

Supabase, Inc. (cloud database and auth) — servers in Ireland (EU). A data processing agreement is in place. supabase.com/privacy.

Resend, Inc. (sending login, account and progress emails plus rare emails from the Heroskills team, which you can turn off) — servers in the USA. Transfer based on EU Standard Contractual Clauses (SCC). resend.com/legal/privacy-policy.

Stripe Payments Europe Ltd. (payment processing) — servers in Ireland and the USA, SCC. stripe.com/privacy.

Vercel, Inc. (hosting the web app) — servers in the EU (Frankfurt). vercel.com/legal/privacy-policy.

5. Cookies

Heroskills sets only technically required cookies — no tracking cookies, no advertising cookies, no third-party cookies. Specifically:

• sb-<project>-auth-token: session cookie after login (Supabase Auth), lifetime 400 days.
• heroskills_device_id: anonymous device identifier for the kid corridor, lifetime 1 year.
• heroskills_trial_started_at: technical anchor timestamp — set during the beta phase, but currently has no effect on usage; lifetime 1 year.
• hs_kid_code: kid code after the QR scan, so the home-screen icon opens the child’s training directly; lifetime 1 year.
• NEXT_LOCALE: chosen language, lifetime 1 year.

In addition, the app keeps technically necessary state in the device’s browser storage (localStorage), e.g. kid code, first name and avatar for the kid corridor; it stays until it is cleared in the browser.

6. How long we store data

• Trial data (without account): at most 30 days after the trial ends.
• Account data: until you delete it. After a deletion request the data stays for 30 days in a grace period (reversible), after which it is irreversibly deleted.
• Payment records: legally mandated retention of 10 years (Art. 958f Swiss Code of Obligations).

7. Your rights

You have the right at any time to access, rectification, erasure, restriction of processing, data portability and withdrawal of a consent once given (with effect for the future). Please send requests to info@heroskills.app.

You can also exercise access and data portability yourself: under Settings → “Export data” you download all data of your account and your children as a JSON file, for teams the team details and the player names you assigned. Only technical protection data (e.g. rate-limit counters) and our providers’ server logs (e.g. IP address at login) are not included — we provide information on these on request.

Parents additionally have the right to view, correct and delete their children’s data at any time. For complaints you can contact the Swiss Federal Data Protection and Information Commissioner (FDPIC, edoeb.admin.ch) or the competent supervisory authority in the EU member state of your residence.

8. Children under 16

Heroskills is aimed at children aged 8 to 16. Data processing is carried out exclusively through the parent account. Children have no account of their own, no email address of their own and no direct way to log in. Children can only reach the training corridor via a kid code on a family device set up by the parents.

If, as a legal guardian, you no longer want Heroskills to process your child’s data, delete the child profile in the parent area or the entire parent account at /settings.

9. Governing law, place of jurisdiction

Swiss law applies. The place of jurisdiction for disputes is Chur, Switzerland, unless mandatory consumer protection provisions specify a different court.

10. Changes to this policy

We occasionally update this privacy policy when our data processing changes or the legal framework requires it. For material changes we inform active users by email at least 30 days before they take effect.