We take children’s data seriously.

1. Data controller

Heroskills · Roman Dinkel (Einzelfirma), Zedernweg 4, 7000 Chur, Schweiz. Contact for all privacy requests: info@heroskills.app.

2. What data we process

Parent and coach account: email address (for magic-link login), optionally first name, time of sign-up, IP address at login, browser type for the session cookies.

Child profile:first name or nickname (no family name required), sport, year of birth (optional), training logs (which drill was started and finished when), rewards, home label (e.g. “Garage”).

Device data: an anonymous device ID (cookie, technically required for the kid corridor without its own account), screen type (tablet, mobile, desktop).

Payment data: processed exclusively by Stripe Payments Europe Ltd. We store neither credit card number nor IBAN. Stripe only sends us the subscription status and the customer ID.

3. Legal bases

Performance of a contract (Art. 6(1)(b) GDPR / Art. 31(1)(a) revFADP): for providing the app, account management and payment processing.

Consent of the legal guardians(Art. 6(1)(a) + Art. 8 GDPR / Art. 6 revFADP): for processing children’s data. Consent is given by creating the child profile in the parent account. Children have neither their own email nor their own account.

Legitimate interest (Art. 6(1)(f) GDPR): protection against abuse (rate-limiting, brute-force protection), security logging.

4. Who receives your data

Supabase, Inc. (cloud database and auth) — servers in Ireland (EU). A data processing agreement is in place. supabase.com/privacy.

Resend, Inc. (sending magic-link and transactional emails) — servers in the USA. Transfer based on EU Standard Contractual Clauses (SCC). resend.com/legal/privacy-policy.

Stripe Payments Europe Ltd. (payment processing) — servers in Ireland and the USA, SCC. stripe.com/privacy.

Vercel, Inc. (hosting the web app) — servers in the EU (Frankfurt). vercel.com/legal/privacy-policy.

5. Cookies

Heroskills sets only technically required cookies — no tracking cookies, no advertising cookies, no third-party cookies. Specifically:

• sb-<project>-auth-token: session cookie after login (Supabase Auth), lifetime 1 year.
• heroskills_device_id: anonymous device identifier for the kid corridor, lifetime 30 days.
• heroskills_trial_started_at: technical anchor timestamp — set during the beta phase (until 16 August 2026), but currently has no effect on usage.
• heroskills.locale: chosen language, in localStorage.

6. How long we store data

• Trial data (without account): at most 30 days after the trial ends.
• Account data: until you delete it. After a deletion request the data stays for 30 days in a grace period (reversible), after which it is irreversibly deleted.
• Payment records: legally mandated retention of 10 years (Art. 958f Swiss Code of Obligations).

7. Your rights

You have the right at any time to access, rectification, erasure, restriction of processing, data portability and withdrawal of a consent once given (with effect for the future). Please send requests to info@heroskills.app.

Parents additionally have the right to view, correct and delete their children’s data at any time. For complaints you can contact the Swiss Federal Data Protection and Information Commissioner (FDPIC, edoeb.admin.ch) or the competent supervisory authority in the EU member state of your residence.

8. Children under 16

Heroskills is aimed at children aged 8 to 16. Data processing is carried out exclusively through the parent account. Children have no account of their own, no email address of their own and no direct way to log in. Children can only reach the training corridor via a kid code on a family device set up by the parents.

If, as a legal guardian, you no longer want Heroskills to process your child’s data, delete the child profile in the parent area or the entire parent account at /settings.

9. Governing law, place of jurisdiction

Swiss law applies. The place of jurisdiction for disputes is Chur, Switzerland, unless mandatory consumer protection provisions specify a different court.

10. Changes to this policy

We occasionally update this privacy policy when our data processing changes or the legal framework requires it. For material changes we inform active users by email at least 30 days before they take effect.