TIRA

Last updated: 1 October 2026

TIRA ("we", "us", "our") is a team management app built for New Zealand community sports coaches, parents, and players. We take your privacy seriously — especially when it comes to children's data. This policy explains what we collect, why, and how you can control or delete it.

TIRA is operated by Aurodox Ltd and is committed to protecting your privacy in line with applicable privacy and data protection laws.

1. What we collect

When you sign up (coaches and parents):

• Email address — used for passwordless sign-in via an 8-digit one-time code (default method, free)
• Mobile number — used for passwordless sign-in via a 6-digit SMS one-time code (optional alternative to email)
• Full name — displayed to your teammates
• Profile photo — displayed in the app (optional)
• Device push token — used to send you team notifications

When you register a child (parents only):

• Child's first name only — last name is never stored
• Date of birth — used to verify age eligibility
• Jersey number — optional, for team organisation
• Emergency contact name and phone number
• Medical notes — stored encrypted, only accessible to coaches you authorise

When you use the app:

• RSVP responses and attendance records for team events
• Messages sent within team chats
• The earlier version of any chat message you edit
• Event details you create (title, time, location, opponent)
• Game results coaches record — the score and, optionally, a player of the match
• Transport preferences (whether you need a ride to an event)

2. Why we collect it

Every piece of data we hold has a specific purpose:

• Email address / mobile number — passwordless sign-in via one-time code; no password is ever created or stored
• Name and photo — so your teammates know who you are
• Push token — so coaches can notify the team about schedule changes
• Children's details — so coaches know who is attending and can respond to emergencies
• Medical notes — so coaches can keep children safe during events
• Attendance and RSVPs — so coaches can plan effectively
• Player of the match — coaches can name a player of the match for a game; this is shown to your team with a star next to the player's name for the season
• Earlier versions of edited messages — so a safety concern can be properly looked into if an edited message is reported. Children and young people use team chat, and this stops a message being changed afterwards to hide what it said.

We do not use your data for advertising, profiling, or any purpose other than running your team.

3. Children's data

TIRA stores data about children under 18 on behalf of their parents or guardians. We apply extra protections to this data:

• Only a child's first name is stored — never their last name
• Medical information is encrypted at rest using Supabase Vault
• Every time a coach views a child's medical notes, the access is logged
• Coach access to emergency contacts and medical notes is off by default — parents must explicitly turn it on from Profile → Privacy Dashboard
• Only coaches on the same team can see a child's records
• If a child is named player of the match, their team sees their first name only, with a star
• Parents can view, update, or delete their child's profile at any time from the Team tab

We do not knowingly allow children to create their own accounts. Children's profiles are always created and managed by a parent or guardian.

4. Who we share data with

We use a small number of trusted services to run TIRA:

• Supabase (supabase.com) — database, authentication, and file storage. Hosted in Sydney, Australia.
• Expo / EAS (expo.dev) — push notification delivery
• Groq (groq.com) — AI features (event creation, message drafting). Only the text you type is sent — no personal data.
• Google / Firebase — push notification delivery on Android
• Sentry (sentry.io) — crash reporting. Errors are anonymised before sending.

We do not sell, rent, or share your personal data with any other party.

5. Data storage and security

• All data is stored in Supabase's Sydney (ap-southeast-2) data centre
• All connections are encrypted in transit (TLS)
• Medical notes are encrypted at rest using Supabase Vault
• Your session token is encrypted on your device using your phone's hardware-backed secure storage (iOS Keychain / Android Keystore) — it is never stored in plain text on your device
• Access to data is controlled by Row Level Security — you can only see data for teams you belong to
• We do not store any payment information

6. Your rights

You have the right to:

• Access — request a copy of all personal information we hold about you
• Correction — ask us to correct inaccurate information
• Deletion — delete your account and your personal information (section 7 explains what is kept for your team, and why)
• Portability — request your data in a machine-readable format

You can exercise most of these rights directly in the app at Profile → Privacy Dashboard. For anything not covered there, email us at privacy@tiraapp.nz.

7. Data retention

While you use TIRA:

• Your account information is kept while your account is active.
• Team chat messages are automatically deleted 60 days after they are sent.
• If you edit a message, we keep the earlier version for safety reviews. Earlier versions are never shown in the app — not to your team, your coach, or you. Only the TIRA team can access them, and only to look into a reported safety concern. They are deleted along with the message, 60 days after it was sent.

If you delete your account:

Deleting your account in the app takes effect immediately. If you ask us by email instead, we will do it within 5 working days.

• Deleted straight away — your name, email address, mobile number, profile photo, push notification token, your reactions and poll votes, and any rides you offered or asked for.
• Kept by your team, without your name — events and announcements you created, your past RSVPs and attendance, and your place in the team's history. Other members rely on these, so they stay with the team but are no longer linked to you.
• Messages you sent stay in the team chat until they are automatically deleted, 60 days after they were sent. Your name is removed from them on our servers straight away, and from teammates' apps the next time they open the chat — they then show as "Team member (account deleted)". Notifications already delivered to phones can't be recalled.
• Kept for our records — a note that an account was deleted (the date and device type only), support requests you sent us, usage records for our AI features (with no link to you), and the log of who viewed children's medical notes, so that access always stays accountable.

Children's profiles:

• When a child's last linked parent or guardian removes them — or deletes their own account — the child's medical notes, emergency contacts, RSVPs and ride details are deleted immediately, and the rest of their profile is anonymised (their name and date of birth are removed and they are taken off the team).
• If another parent or guardian is still linked to the child, only your link is removed — the child's profile stays with them.
• When a child is removed from a team, they are also taken off any game they were player of the match for.

8. Cookies and tracking

TIRA is a mobile app and does not use cookies. We do not use any third-party advertising trackers or analytics services that track you across apps or websites.

9. Changes to this policy

If we make material changes to this policy we will notify you via the app before the changes take effect. The "last updated" date at the top of this page will always reflect the most recent version.

10. Contact us

For any privacy questions or requests, contact us at:
privacy@tiraapp.nz

We will respond to all privacy requests within 20 working days.