Last updated: 1 June 2025
TIRA ("we", "us", "our") is a team management app built for New Zealand community sports coaches, parents, and players. We take your privacy seriously — especially when it comes to children's data. This policy explains what we collect, why, and how you can control or delete it.
TIRA is operated by Daminda Fernando and complies with the New Zealand Privacy Act 2020.
The short version: We collect only what's needed to run your team. We never sell your data. Children's data is minimised by design — we store only a first name and date of birth. You can delete everything at any time from Profile → Privacy Dashboard.
1. What we collect
When you sign up (coaches and parents):
- Phone number — used for login via SMS verification
- Full name — displayed to your teammates
- Email address — for account recovery and notifications (optional)
- Profile photo — displayed in the app (optional)
- Device push token — used to send you team notifications
When you register a child (parents only):
- Child's first name only — last name is never stored
- Date of birth — used to verify age eligibility
- Jersey number — optional, for team organisation
- Emergency contact name and phone number
- Medical notes — stored encrypted, only accessible to coaches you authorise
When you use the app:
- RSVP responses and attendance records for team events
- Messages sent within team chats
- Event details you create (title, time, location, opponent)
- Transport preferences (whether you need a ride to an event)
2. Why we collect it
Every piece of data we hold has a specific purpose:
- Phone number — passwordless login, no password to forget or lose
- Name and photo — so your teammates know who you are
- Push token — so coaches can notify the team about schedule changes
- Children's details — so coaches know who is attending and can respond to emergencies
- Medical notes — so coaches can keep children safe during events
- Attendance and RSVPs — so coaches can plan effectively
We do not use your data for advertising, profiling, or any purpose other than running your team.
3. Children's data
TIRA stores data about children under 18 on behalf of their parents or guardians. We apply extra protections to this data:
- Only a child's first name is stored — never their last name
- Medical information is encrypted at rest using Supabase Vault
- Every time a coach views a child's medical notes, the access is logged
- Only coaches on the same team can see a child's records
- Parents can view, update, or delete their child's profile at any time from the Team tab
We do not knowingly allow children to create their own accounts. Children's profiles are always created and managed by a parent or guardian.
4. Who we share data with
We use a small number of trusted services to run TIRA:
- Supabase (supabase.com) — database, authentication, and file storage. Hosted in Sydney, Australia.
- Expo / EAS (expo.dev) — push notification delivery
- Groq (groq.com) — AI features (event creation, message drafting). Only the text you type is sent — no personal data.
- Google / Firebase — push notification delivery on Android
- Sentry (sentry.io) — crash reporting. Errors are anonymised before sending.
We do not sell, rent, or share your personal data with any other party.
5. Data storage and security
- All data is stored in Supabase's Sydney (ap-southeast-2) data centre
- All connections are encrypted in transit (TLS)
- Medical notes are encrypted at rest using Supabase Vault
- Access to data is controlled by Row Level Security — you can only see data for teams you belong to
- We do not store any payment information
6. Your rights (NZ Privacy Act 2020)
Under the NZ Privacy Act 2020 you have the right to:
- Access — request a copy of all personal information we hold about you
- Correction — ask us to correct inaccurate information
- Deletion — delete your account and all associated data
- Portability — request your data in a machine-readable format
You can exercise most of these rights directly in the app at Profile → Privacy Dashboard. For anything not covered there, email us at privacy@tiraapp.nz.
7. Data retention
- Active account data is retained while your account is active
- If you delete your account, all personal data is permanently deleted within 30 days
- Team event history (anonymised) may be retained for up to 12 months after an account is deleted
- Children's profiles are deleted immediately when a parent requests deletion
8. Cookies and tracking
TIRA is a mobile app and does not use cookies. We do not use any third-party advertising trackers or analytics services that track you across apps or websites.
9. Changes to this policy
If we make material changes to this policy we will notify you via the app before the changes take effect. The "last updated" date at the top of this page will always reflect the most recent version.
10. Contact us
For any privacy questions or requests, contact us at:
privacy@tiraapp.nz
We will respond to all privacy requests within 20 working days as required by the NZ Privacy Act 2020.