1. Who is responsible for your information?
Streamline Breakout is operated by MadeByCaffeinated Ltd, Company number 17111544.
For account administration, security, enquiries and operation of the Service, we act as a data controller. For swimmer, squad, testing, attendance, competition and planning information entered by a club, the club will generally be the controller and we act as its processor. The club decides why that information is used and should be your first contact for questions about a swimmer record.
2. Information we handle
- Account data: name, email address, role, club, password credentials and invitation or password-reset records.
- Security data: session tokens, sign-in times, IP address, browser or device user agent, account administration events and signals used to distinguish legitimate users from automated traffic.
- Usage data: pages visited, browser and device information, and the internal account identifier and role of a signed-in user.
- Swimmer and membership data: name, Swim England number, sex, year or date of birth, club membership, squad and profile image.
- Optional swimmer photos: a photo of a swimmer that a linked parent or guardian chooses to upload, as described below.
- Coaching and performance data: personal bests, estimated times, test results, splits, heart rates, notes, attendance, training sets and completed distances.
- Planning and competition data: calendars, meets, availability, relay and Arena League selections, qualifying standards and source links, training sessions, season plans and their revision history.
- Support data: information you include when contacting us.
3. Where information comes from
Information is provided by users and club administrators, created through use of the Service, or imported at a user’s request. Membership and performance records may be obtained from Swim England sources. A club may also provide data about a swimmer who does not personally use the Service.
A parent or guardian with a linked account may optionally upload a photo of their swimmer. Uploading a photo is never required to use the Service. Where no photo has been uploaded, the Service may show the profile image published for the swimmer by Swim England, or the swimmer’s initials.
4. Why we use information
- to provide, maintain and secure the Service;
- to authenticate users and manage invitations, roles and club access;
- to protect sign-in against bots, credential stuffing and other automated misuse;
- to calculate, display, save and export the coaching work users request;
- to show an optional photo that a parent or guardian has chosen to upload, so the swimmer is easy to recognise in the Service;
- to diagnose problems, prevent misuse and provide support;
- to understand which parts of the Service are used and improve them;
- to meet legal obligations and establish or defend legal claims.
Our legal bases for controller activities are performance of a contract, legitimate interests in operating and securing the Service, and compliance with legal obligations. Clubs determine the lawful bases for swimmer data they control. The Service does not make solely automated decisions that produce legal or similarly significant effects; coaching outputs require human review and judgement.
5. Cookies and local storage
The Service uses essential authentication cookies to keep users signed in and secure their sessions. It also stores a colour-theme preference and signed-out date-format preference in the browser; signed-in date-format preferences are stored with the user account. The Service may cache the optional local transcription model. We do not use advertising cookies. We use PostHog to measure visits to the public website and use of the coaching workspace. PostHog analytics do not use cookies or persistent browser storage, and session recording and automatic interaction capture are disabled.
The sign-in page uses Cloudflare Turnstile as a security measure. Turnstile may use cookies or similar device technologies and processes signals such as IP address, user-agent header, TLS fingerprint, site key and the website origin to distinguish people from automated traffic. We use Turnstile only for security and fraud-prevention purposes, not for advertising or behavioural analytics.
6. Sharing and international transfers
Information is available to authorised users in the relevant club and to our personnel where needed to operate or support the Service. We may use vetted hosting, infrastructure and technical service providers acting under contract, and disclose information where required by law or in connection with a business reorganisation. We do not sell personal information.
Cloudflare provides Turnstile and receives the security signals described above when the sign-in page is used. Cloudflare processes those signals on our behalf to protect the Service and may also process limited Turnstile data for its own legitimate interests in maintaining and improving bot detection. More information is available in Cloudflare’s Turnstile Privacy Addendum.
PostHog receives the analytics usage data described above as our service provider. Dynamic record identifiers and URL query strings are excluded from page-view data, and we do not send swimmer or coaching-record contents.
If a provider processes personal information outside the United Kingdom, we use an appropriate transfer mechanism and safeguards where required by law.
7. Retention and security
Club workspace information is kept for the life of the club’s account and then deleted or returned in line with its agreement and instructions, subject to backup cycles and legal requirements. Account, support and security records are kept only as long as reasonably needed for the purposes above. Uploaded swimmer photos are kept until a parent or guardian replaces or removes them, or until the swimmer’s membership record is deleted. Specific retention periods can be requested from us or from the relevant club.
We use appropriate technical and organisational measures designed to protect personal information, including access controls and separation of club workspaces. No online service can guarantee absolute security.
8. Children’s information
The Service is for authorised club personnel, not for children to create their own accounts. Clubs may record information about child swimmers and are responsible for ensuring that use is lawful, fair, transparent and consistent with safeguarding requirements. We process that information on the club’s instructions.
Optional photos. Only a parent or guardian whose account is linked to a swimmer can upload a photo for that swimmer, and they do so voluntarily. By uploading, they confirm that they are entitled to do so and that they are happy for the photo to be seen by the people described below. Please choose a simple head-and-shoulders photo of the swimmer alone, and do not upload images of other people.
- The photo is cropped to a small square, re-encoded as a JPEG and stored with the swimmer’s membership record in the Service’s database. The original file is not kept, and image metadata such as location data is removed.
- It is shown to the parents and guardians linked to that swimmer and to authorised coaches and administrators of the swimmer’s club. It is not shown to other clubs or made public, and we do not use it for advertising, analytics or any purpose other than displaying it in the Service.
- A parent or guardian can replace or remove the photo at any time from the swimmer’s page, and removing it deletes it. You can also contact the club or us to have a photo deleted. A photo is also deleted when the swimmer’s membership record is deleted.
9. Your rights
Depending on the circumstances, you may have rights to be informed and to access, correct, erase, restrict, object to or receive a portable copy of your personal information. For swimmer or club records, contact the club first. You can also contact us and we will assist the relevant controller.
You may complain to the Information Commissioner’s Office, although we would appreciate the opportunity to resolve your concern first.
10. Contact and changes
For privacy questions or requests, email streamlinebreakout@madebycaffeinated.co.uk. We may update this notice as the Service or law changes and will show the new date at the top of this page.