Privacy Policy

1. Introduction

Tiro ("Tiro", "we", "us" or "our") is a football performance application that helps players record training sessions, matches, recovery and wellness data. This Privacy Policy explains what information the Tiro iOS app collects, why we collect it, how it is stored, and the choices and rights you have.

This policy applies to the Tiro app distributed through the Apple App Store and to this website. By creating an account and using Tiro, you agree to the practices described here. If you do not agree with this policy, please do not use the app.

2. Information we collect

2.1 Account information

When you create an account we collect your email address and an encrypted authentication credential. You may optionally provide a display name, profile photo, playing position, preferred foot, team or club name, and date of birth or age range.

2.2 Football performance data

You choose what to record. This may include:

• Training sessions — type, date, duration, intensity and drills completed
• Match records — minutes played, position, goals, assists and personal ratings
• Physical metrics — distance covered, sprints, top speed and training load
• Technical and fitness test results you enter yourself
• Goals, targets and season plans
• Notes, reflections and self-assessments you write in the app

2.3 Recovery and wellness data

If you use the wellness features, we store the entries you make — such as sleep duration, perceived soreness, fatigue, mood, hydration and readiness scores.

2.4 Optional menstrual cycle tracking

Tiro offers an entirely optional menstrual cycle tracking feature for athletes who want to relate their cycle to training load, recovery and performance. See section 3 for how this sensitive data is handled.

2.5 Purchase and subscription data

When you buy a subscription or unlock premium features, we receive a transaction receipt and subscription status from Apple. See section 7.

2.6 Technical and diagnostic data

We collect limited technical information needed to operate and debug the app — app version, device model, operating system version, language, coarse crash reports and error logs. This data is used for stability and troubleshooting only, and is not used to build advertising profiles.

2.7 What we do not collect

• We do not collect precise background location.
• We do not access your contacts, photos library, microphone or camera unless you explicitly grant permission for a specific action (such as choosing a profile photo).
• We do not receive your payment card number, billing address or Apple ID password.

3. Health and menstrual cycle data

If you enable cycle tracking, you may record period start and end dates, cycle length, flow, symptoms and related notes. We treat this as sensitive personal data and apply the strictest handling in the app:

• It is used only to display your own cycle history and to show it alongside your training, recovery and performance data inside the app.
• It is never used for advertising, marketing, profiling, or third-party analytics.
• It is never sold, rented, shared or disclosed to data brokers.
• It is stored under your own account with row-level access controls so that only your authenticated account can read it.
• You can delete individual entries, disable the feature, or delete all cycle data at any time from within the app, independently of the rest of your account.

Tiro does not write to or read from Apple Health unless you explicitly grant that permission in iOS. Any data obtained from Apple Health (such as workouts or sleep) is used solely to display your metrics inside the app, and is never used for advertising or shared with third parties for marketing. You can revoke Health access at any time in iOS Settings.

4. How we use your data

We use the information described above to:

• Create, authenticate and secure your account
• Store and display your training, match, recovery and wellness records
• Generate the charts, trends and insights shown in the app
• Sync your data across your own devices
• Deliver, validate and restore in-app purchases and subscriptions
• Diagnose crashes, fix bugs and improve app performance
• Respond to your support requests
• Comply with legal obligations and enforce our terms

We do not use your data for automated decision-making that produces legal or similarly significant effects.

5. Legal bases for processing

Where the GDPR or UK GDPR applies, we rely on the following legal bases:

• Contract — to provide the account, features and purchases you have requested.
• Consent — for optional features such as menstrual cycle tracking, Apple Health access and any optional communications. You may withdraw consent at any time.
• Legitimate interests — to keep the service secure, prevent abuse, and fix defects, balanced against your rights.
• Legal obligation — where we must retain records or respond to lawful requests.

Health-related data, including menstrual cycle data, is processed only on the basis of your explicit consent.

6. Authentication and hosting (Supabase)

Tiro uses Supabase for user authentication and for hosting the database in which your account and performance data are stored. When you sign up or sign in, your credentials are handled by Supabase Auth, which issues a secure session token to the app.

• Passwords are stored only as salted cryptographic hashes; we never see or store your password in plain text.
• If you sign in with Apple, we receive only the identifier and the email address (or private relay address) that Apple provides.
• All traffic between the app and Supabase is encrypted in transit using TLS.
• Data at rest in Supabase is encrypted by the hosting provider.
• Access to your rows is restricted by Row Level Security policies so that a session can only read and write records belonging to that account.

Supabase acts as our data processor and processes data solely on our instructions. You can read more at supabase.com/privacy.

7. In-app purchases (Apple)

Paid features and subscriptions in Tiro are sold exclusively through Apple In-App Purchase. All payments are processed by Apple — not by us.

• We never receive or store your credit or debit card number, billing address, or Apple ID password.
• Apple provides us with a transaction identifier and your subscription status (for example: active, expired, or in a trial period) so that we can unlock the correct features on your account.
• Subscriptions renew automatically unless cancelled at least 24 hours before the end of the current period. You can manage or cancel a subscription at any time in your Apple ID settings.
• Refunds are handled by Apple in accordance with the App Store terms. We cannot issue App Store refunds directly, but we're happy to help you raise a request.

Apple's handling of your payment information is governed by Apple's Privacy Policy.

8. Sharing and disclosure

We share personal data only with the following categories of recipients:

• Supabase — authentication and database hosting (data processor).
• Apple — App Store distribution, in-app purchase processing and subscription status.
• Legal and safety — where required by law, valid legal process, or to protect the rights, safety and property of our users or of Tiro.
• Business transfer — if Tiro is involved in a merger, acquisition or asset sale, your data may transfer to the successor entity under the same protections. We will notify you before your data becomes subject to a materially different policy.

We do not share your data with advertising networks or data brokers.

9. We do not sell your personal data

10. Tracking and advertising

Tiro does not display third-party advertising and does not use your data to track you across apps or websites owned by other companies. We do not request App Tracking Transparency permission because we do not perform such tracking. We do not use advertising SDKs, fingerprinting, or cross-app identifiers.

11. Data retention

We retain your account and performance data for as long as your account remains active, so that your history stays available to you. When you delete your account, your personal data is deleted from our production database within 30 days and removed from encrypted backups within 90 days, except where we must retain limited records (such as purchase records) to meet legal, tax or accounting obligations.

12. Security

We apply industry-standard safeguards, including:

• TLS encryption for all data in transit
• Encryption at rest for stored data
• Row Level Security so accounts can access only their own records
• Hashed credentials and short-lived session tokens
• Least-privilege access controls for the small number of people who administer the service

No method of transmission or storage is completely secure. While we work hard to protect your information, we cannot guarantee absolute security. If we become aware of a breach affecting your personal data, we will notify you and the relevant authorities as required by law.

13. Your rights

Depending on where you live, you may have the right to:

• Access the personal data we hold about you
• Correct inaccurate or incomplete data
• Delete your data ("right to be forgotten")
• Export your data in a portable format
• Restrict or object to certain processing
• Withdraw consent for optional features at any time
• Lodge a complaint with your local data protection authority

To exercise any of these rights, email tirosupport587@gmail.com. We will respond within 72 hours and complete verified requests within 30 days. We will not discriminate against you for exercising your privacy rights.

14. Deleting your account

You can delete your Tiro account and all associated data at any time from within the app: Settings → Account → Delete Account. This is permanent and cannot be undone. If you cannot access the app, email tirosupport587@gmail.com from your registered address and we will process the deletion for you.

Deleting your account does not automatically cancel an active App Store subscription — please also cancel it in your Apple ID settings.

15. Children's privacy

Tiro is not directed to children under 13, and we do not knowingly collect personal data from them. Users under the age of digital consent in their country should only use Tiro with the consent and supervision of a parent or guardian. If you believe a child has provided us with personal data, contact us and we will delete it promptly.

16. International data transfers

Your data may be processed on servers located outside your country of residence, including in the European Union and the United States. Where data is transferred out of the EEA or the UK, we rely on appropriate safeguards such as Standard Contractual Clauses with our processors.

17. Changes to this policy

We may update this Privacy Policy to reflect changes to the app or to legal requirements. The "Last updated" date at the top of this page always shows the current version. For material changes we will provide notice in the app before the change takes effect. Continued use of Tiro after an update means you accept the revised policy.

18. Contact us

For any question about this policy, your data, or to exercise your privacy rights:

• Email: tirosupport587@gmail.com
• Typical response time: within 72 hours

---

This policy is provided for the Tiro iOS application distributed via the Apple App Store.