Privacy Policy

1. Information We Collect

If you submit our contact or demo request form, we collect your first and last name, email address, the institution you represent, the reason for your enquiry, and the content of your message. We use this only to respond to you.

Complete is a performance platform for coaching staff. Athletes do not hold accounts and do not sign in. The information in a customer account is supplied by the organization and its staff, and falls into these categories:

• Staff account information: name, work email address, the credential you use to sign in, session records, and which organization and teams you belong to.
• Athlete roster information: athlete names and the profile and availability details a coaching staff records about their roster.
• Performance and device data: files that staff upload from performance-measurement vendors, and the artifacts we derive from them. This can include wearable heart-rate and heart-rate-variability data, GPS location traces, force-plate output, and similar measurements about identified athletes. It may include health-related information.
• Content staff create: notes, annotations, report configurations, and similar working material.
• Operational records: access and audit logs recording who did what and when, which we keep for security and accountability.

2. Technical Information We Collect Automatically

When you use the Services, we and the providers listed in section 7 automatically receive technical information about the connection and the device you are using. We collect this to operate and secure the Services, to diagnose failures, and to understand which product features coaching staff use. The categories are:

• Your IP address, and the approximate country, region, and city a provider infers from it.
• Your browser user agent, and the browser name and version, operating system, and device type derived from it.
• Device and display characteristics: screen and browser window dimensions, and device class.
• Locale characteristics: your time zone and language preference.
• Identifiers our providers assign to your browser and to each visit, along with the version of the analytics software running in the page.
• Request and interaction records: the pages and screens you open, the timing and outcome of requests, and which controls you interact with.

For signed-in staff, this technical information is associated with an opaque account identifier so that product usage can be understood per person. It is not used for advertising, and it is not sold or shared for cross-context behavioural advertising.

What we deliberately keep out. Product analytics records how the Services are used, never the content shown on the screen. Athlete names, measurement values, uploaded file contents, and free text a coach types are not sent to our analytics provider. Text and element attributes are masked before an interaction event leaves the browser, so we record that a control was used and where it sits in the page, not what it said.

3. How We Handle Performance and Athlete Data

We treat performance and device data as sensitive by default. Measurements collected continuously from an individual athlete — a location trace, a heart-rate series — can single that person out from the shape of the data alone. Removing a name from such a series does not reliably make it anonymous, so we do not treat name removal as anonymization and we do not rely on it as a safeguard.

Two engineering rules follow from that, and we apply them as a matter of design:

• On our servers, uploaded files and the artifacts derived from them are stored only in private object storage. Our database never stores the underlying measurements, nor anything from which they could be reconstructed. It holds a reference to the stored file together with descriptive details such as dates, file type, size, checksums, and ownership.
• Credentials for the production store are never issued to development, testing, or preview environments. Those environments run on synthetic data, not on copies of real athlete data.

4. How We Use Information

We use personal information to:

• Provide the Services to the customer organization and its staff.
• Create, authenticate, and secure staff accounts and sessions.
• Store, process, and present uploaded performance data, and generate reports.
• Respond to enquiries you send us.
• Keep the Services reliable and secure — diagnosing errors, investigating misuse, and maintaining audit records.
• Understand which product features are used, so we can improve them.
• Comply with our legal obligations.

We do not sell personal information, we do not share it for cross-context behavioural advertising, and we do not use athlete performance data for advertising.

5. Cookies, Local Storage, Analytics, and Error Reporting

The platform sets two strictly necessary cookies. One holds your encrypted sign-in session. The other is a short-lived cookie, expiring after ten minutes, that protects the sign-in exchange against tampering. Both are encrypted, restricted to our own domain, and unreadable by scripts in your browser. We also set a small cookie that remembers whether you left the navigation sidebar open. We do not set advertising or cross-site tracking cookies.

The Services keep working data in your browser’s local storage so the application remains responsive — this can include a cached working copy of the roster and uploaded performance data for the team you are viewing, and the analytics identifiers described in section 2. Those copies are for display on your device only; the stored originals remain on our servers as described in section 3. Because it persists after you close the tab, we recommend signing out on shared or public computers.

We use PostHog to understand product usage. It receives the technical information listed in section 2, together with records of which features are used. Automatic capture of interactions is enabled, but all text and element attributes are masked before an event is sent. Web addresses are restricted so that they cannot carry an athlete’s name or other record details. Vendor feature-flag and survey features are switched off.

This website uses PostHog for analytics and for error monitoring. Web addresses reported by this website are stripped down to the page path plus a short list of campaign parameters.

We use PostHog to receive reports when the application or this website fails. Error reports are built to transmit the shape of a failure rather than its contents: user details, form contents, query strings, and cookies are never included in a report.

Session replay — a reconstruction of the interface leading up to an error — is switched off in the platform today. If we enable it, replays will be captured with all inputs and text masked and with elements we mark as sensitive removed entirely, so the reconstruction shows the layout and the sequence of interactions rather than the information on the screen. This website does not record session replays.

You can block or delete cookies through your browser settings. Blocking strictly necessary cookies will prevent you from signing in.

6. Children Under the Age of 13

This website is not directed to children under 13, and we do not knowingly collect personal information from children under 13 through it. The platform is used by collegiate and professional coaching staff, and any athlete information in an account is supplied by the customer organization under its own obligations. If you believe a child under 13 has provided us with personal information through this website, contact us and we will delete it.

7. Service Providers and Subprocessors

We use the following providers to operate the Services. Each processes personal information on our instructions under a written agreement, and each is listed with the region where the relevant data is held:

• Amazon Web Services (S3) — object storage for uploaded performance files and the artifacts derived from them. United States (us-east-1). Privacy notice
• Neon — managed PostgreSQL database holding staff accounts, organizations, teams, roster records, and references to uploaded files. United States. Privacy notice
• WorkOS — authentication, staff account credentials, and session management. United States. Privacy notice
• Vercel — application hosting, content delivery, server-side execution, and aggregate traffic measurement. United States. Privacy notice
• PostHog — product usage analytics and application error telemetry. United States. Privacy notice
• Resend — delivery of messages you send us through the contact form on this website. United States. Privacy notice

We may also disclose personal information where we are required to do so by law, to enforce our agreements, or to protect the rights and safety of our users and the public. If Complete is involved in a merger, acquisition, or sale of assets, personal information may be transferred as part of that transaction; we will give notice before information becomes subject to a different privacy policy.

8. Where Information Is Stored

Personal information processed through the Services is stored in the United States. Uploaded performance files and derived artifacts are held in object storage in the AWS us-east-1 region. If you access the Services from outside the United States, information will be transferred to and processed in the United States. Where a transfer requires a safeguard under applicable law, we rely on standard contractual clauses or another lawful transfer mechanism.

9. How We Protect Information

Information is encrypted in transit and encrypted at rest. Uploaded files are held in a private store with no public access. Access to customer data in our database is constrained by row-level security so that a request can reach only the records belonging to the organization it is made for. Administrative and staff actions are recorded in audit logs.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. Where the Services link to third-party websites, we are not responsible for their privacy practices.

10. Retention of Personal Information

Information in a customer account — including staff accounts, roster records, uploaded files, and derived artifacts — is retained for as long as the account is active, and until deletion is requested by the customer organization or required by law. We have not set a fixed expiry period for these categories, and we would rather say so plainly than publish a schedule we do not operate.

Some categories do have defined periods:

• Product analytics events, and the technical information described in section 2 that is attached to them, are retained by our analytics processor for up to 7 years, the retention period of the plan we hold with them. These events carry only the opaque identifiers described in section 2, never names, contact details, or performance data.
• Security and access audit records are kept for at least 365 days.
• Records of administrative provisioning actions are kept for 400 days.
• Unaccepted invitations expire after 14 days.
• The sign-in exchange cookie expires after 10 minutes.

When a customer organization asks us to delete a person’s data, we delete it from our production systems and instruct our providers to do the same, including the analytics profile and the historical events tied to that person’s identifier. We complete this within 30 days of the request. Backups are overwritten on their normal cycle.

11. Your Rights

Depending on where you live, you may have the right to access the personal information we hold about you, to have it corrected, to have it deleted, to restrict or object to how it is processed, to receive it in a portable form, and to withdraw consent where we rely on consent. You also have the right not to be discriminated against for exercising these rights.

For information held in a customer account, please contact the organization that administers the account — it decides what is collected and how long it is kept, and we act on its instructions. If you contact us directly, we will refer your request to that organization and assist with the response.

For information we hold as controller — for example, a message you sent through this website — contact us at contact@completesports.co and we will respond within the period required by applicable law.

If you are in the EEA or the UK, you may also lodge a complaint with your local data protection authority.

12. Additional Disclosures for California Residents

Under the CCPA as amended by the CPRA, California residents have the right to know what personal information is collected and how it is used and shared, to correct inaccurate information, to delete personal information, to limit the use of sensitive personal information, and to opt out of sale or sharing.

Complete does not sell personal information and does not share it for cross-context behavioural advertising. The categories we collect, the purposes for which we use them, and the categories of provider we disclose them to are described in sections 1, 2, 4, and 7 above. To exercise a right, contact us at contact@completesports.co. You may use an authorized agent, and we will not discriminate against you for exercising your rights.

13. Changes to This Policy

We may update this Privacy Policy. When we do, we will revise the date below and post the updated policy at www.completesports.co. If a change materially affects how we handle personal information, we will provide additional notice.

14. Contact Information

For questions about this Privacy Policy or about how we handle personal information, contact us at: