Skip to content

Privacy Policy

Last updated: June 10, 2026

1. Who Is Responsible

The controller of your personal data is Athlete World GmbH, Hohlstrasse 207, 8004 Zürich, Switzerland, UID: CHE-369.002.950 ("we", "us").

We process personal data under the Swiss Federal Act on Data Protection (FADP). If you are in the European Economic Area or the United Kingdom, the GDPR or UK GDPR also applies where relevant.

2. Data We Collect

We collect the data you give us when you use the Service:

  • Account data: email address and password (stored as a hash, never in plain text)
  • Identity data: name, birthdate, country, profile photo, bio
  • Athletic data: team history, season stats, physical measurements
  • Uploaded videos (game film)
  • Education and recruiting intent
  • Coach license documents (for coach accounts)
  • Coach reviews and review invitations

We also collect technical data automatically when you use the platform: IP address, browser type, and server logs.

We count how often public profiles are viewed. We store one aggregated number per profile per day. No IP address, no visitor identity, and no other visitor detail is stored with that count.

3. Why We Use Your Data

We use your data for these purposes, on these legal bases:

  • To provide your profile and the platform — performance of our contract with you
  • To publish your profile and submit it to search engines — only with your consent
  • To keep the platform secure and prevent abuse — our legitimate interest
  • To meet legal obligations — where the law requires it

We do not sell your personal data.

4. Public Profiles

Your profile data is public only after you give explicit consent to publication. Before that, it is private. You can withdraw your consent and unpublish your profile at any time from your profile settings.

A public profile shows your age and your year of birth. Your full date of birth is never shown publicly — we use it only to calculate your age and to check the minimum-age requirement.

Profiles of users under 18 are never submitted to search engines for indexing.

5. Cookies

We use only strictly necessary cookies: a session cookie and a login cookie. We do not use analytics cookies or advertising cookies. Because we use no non-essential cookies, we do not show a cookie banner.

6. Who We Share Data With

We use a small number of service providers (processors) to run the platform. For each one, this is what it does, what it receives, where it processes the data, and how the transfer is protected:

  • Heroku (Salesforce, Inc.), United States — hosting of the application and the database.
    Receives: everything you enter in the Service (account, profile, athletic and coach-review data) plus server logs.
    Location: US-based provider; the application runs in a Heroku region [region to be confirmed before launch].
    Safeguard: [DPF certification / SCCs — to be confirmed before launch].
  • Amazon Web Services (S3) — storage of uploaded files.
    Receives: profile photos and uploaded videos (game film), together with the file metadata needed to serve them.
    Location: our storage bucket is in AWS region eu-central-1 (Frankfurt, Germany). Your photos and videos are stored in the EU, not in the USA.
    Safeguard: no transfer outside the EU/EEA for the stored files; for the provider relationship itself [DPF certification / SCCs — to be confirmed before launch].
  • Resend — delivery of transactional email (confirmations, notifications, review invitations).
    Receives: the recipient's email address and the content of the message we send.
    Location: US-based provider.
    Safeguard: [DPF certification / SCCs — to be confirmed before launch].
  • Sentry (Functional Software, Inc.), United States — error monitoring.
    Receives: technical error reports (error type, stack trace, browser, request URL). No request bodies, no cookies, no user identifiers. Identifying parts of URLs — profile name slugs and review-invitation tokens — are filtered out before a report is sent.
    Location: US-based provider.
    Safeguard: [DPF certification / SCCs — to be confirmed before launch].
  • YouTube (Google Ireland Limited) and Vimeo, Inc. — showing game film that an athlete has linked from those platforms.
    Receives: if a profile links a film from one of them, opening that profile loads the film's preview image from the platform, which gives it your IP address, your browser information and the address of the page you are on. If you then play the film, the platform's own player loads and may set its own cookies. Nothing you entered in the Service is sent to them.
    Location: [Google Ireland (EU) with onward transfer to the United States / Vimeo, United States — to be confirmed before launch].
    Safeguard: [DPF certification / SCCs — to be confirmed before launch].

No third party outside this list receives data when you load a page. Fonts, stylesheets and scripts are served from this website — we embed no web fonts, analytics, advertising or social-media widgets from external providers. Uploaded photos and videos are delivered from the storage provider named above. The only external content on any page is the game film an athlete has linked from YouTube or Vimeo, on that athlete's profile.

If you publish your profile, it is visible to anyone with the link, including coaches and scouts.

7. How Long We Keep Data

We keep your data while your account exists. You can delete your account yourself at any time from your profile ("Delete account"). If you cannot sign in, email privacy@athlete-world.com and we will delete it for you. Deletion removes your personal data.

  • Pending coach-review invitations are automatically deleted after 30 days
  • Residual copies in encrypted backups expire when the backups rotate

8. Your Rights

Under the FADP — and, where it applies, the GDPR — you have the right to:

  • Access the personal data we hold about you
  • Correct inaccurate data
  • Have your data erased
  • Restrict or object to processing
  • Receive your data in a portable format
  • Withdraw consent at any time (for example, unpublish your profile)

To exercise any of these rights, email privacy@athlete-world.com. We answer within 30 days.

You can also complain to the Swiss Federal Data Protection and Information Commissioner (FDPIC) or, if you are in the EEA, to your local supervisory authority.

9. Minors

The Service is for users aged 16 and older. Users aged 16 or 17 need the consent of a parent or legal guardian. We apply extra protections for minors: their profiles are never submitted to search engines for indexing.

10. Security

We protect your data with technical and organizational measures, including encryption in transit, access controls, and hardened admin sessions. No system is perfectly secure, but we work to keep your data safe.

If a data breach occurs that is likely to result in a high risk to you, we will inform the affected users and, where the law requires it, the Swiss Federal Data Protection and Information Commissioner (Art. 24 FADP), without undue delay.

11. Changes to This Policy

We may update this Privacy Policy. When we do, we update the "Last updated" date at the top of this page. If a change is significant, we will notify you — for example by email or by a notice in the Service.

12. Contact

For privacy questions and data rights requests, email privacy@athlete-world.com. For everything else, email contact@athlete-world.com.