Privacy policy

Swimvity is scheduling software for independent swimming instructors. This policy explains what information Swimvity handles, why, and the choices you have. Swimvity is operated by Markyn Media Pty Ltd (details below). We aim to handle personal information in line with the Australian Privacy Principles.

Two kinds of users

Instructors hold a Swimvity account and run their business with it. Parents and carers book lessons through an instructor's booking page or give details to the instructor directly. For parents' and children's information, the instructor decides what is collected and how it is used; Swimvity stores and processes it on the instructor's behalf.

What we collect

• Instructor account: name, email, a securely hashed password (never stored in readable form), business details, teaching hours, work shifts, pools and services.
• Families: parent or carer name, mobile and email; children's first names and, if provided, age, a parent-reported swimming ability, an instructor-assigned swimming level and notes; lesson locations (suburb and, if given, a street address); when lessons can happen; lesson history, cancellations and attendance.
• Google Calendar (only if the instructor connects it): free/busy times from the calendars they choose, and the events in calendars they choose to bring lessons in from. See below.
• Technical: sign-in sessions (a secure cookie), the IP address of requests for rate limiting and security logs, and an audit trail of changes made in the account.
• Billing (only if subscriptions are switched on): your subscription status from our payment provider. Card details are entered on the payment provider's page and never reach Swimvity.
• Consent records: the version of these terms you accepted, and, only if you ticked it, your choice to receive occasional product news (you can withdraw it any time in Settings).
• Product usage, without personal details: counts of steps such as "booking page published" tied to an anonymous business id, never names, contact details, children's details, addresses or calendar titles.
• Founding instructor applications: your name, email, city or suburb, approximate number of weekly lessons and, if you choose to tell us, your biggest admin challenge. We use these only to review your application and contact you about the founding programme. Applying doesn't create an account.
• Swim-school updates: your email and, if you give it, your school's name, kept because you asked for product updates about Swimvity for swim schools. You can unsubscribe at any time with the link in any update we send, or by emailing us. Requests for a research conversation are handled like other contact-form messages.

Children

Parents and carers give their children's details to their instructor. We ask for as little as possible (a first name, and optionally an age and swimming ability) and never ask for health information. Parents and instructors can choose to write other details, including health details, in free-text notes; anything written there is stored as part of the record and treated like the rest of it. Children's details are visible only to that instructor's business — never to other families, never used for marketing, analytics or profiling.

Why we use it

To provide the service: scheduling and recommending lesson times, checking travel and availability, showing the instructor's calendar, sending account and booking emails, preventing abuse, and supporting the account. We don't sell personal information and don't use it for advertising. Swimvity doesn't send marketing messages to parents.

Google Calendar

If an instructor connects Google Calendar, Swimvity: reads free/busy times from the calendars they select so lessons aren't booked over their appointments; reads events from calendars they select only to help bring their existing lessons and shifts across; and creates a separate lessons calendar where it adds and updates the lessons it manages. Swimvity never edits or deletes the instructor's own events. Titles of personal appointments are not shown to parents and are not included in emails. Access tokens are encrypted at rest. Disconnecting in Settings stops access and revokes it with Google. Swimvity's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Who else processes it

We use these service providers to run Swimvity. The app runs in Vercel's Sydney region and the database is in Sydney. Some providers, including email delivery, error reports and the security check on public forms, may process information outside Australia.

• Hosting: Vercel.
• Database and backups: Neon (on Amazon Web Services).
• Email delivery for account and booking emails: Resend.
• Spam and bot protection on public forms: Cloudflare Turnstile.
• Address search and drive-time estimates, when switched on: Google Maps Platform. What you type into an address field is sent to Google to find the address; children's details never are.
• Google Calendar, only if an instructor connects it.
• Subscription payments, once billing is switched on: Stripe.
• Product statistics, if switched on: PostHog. Only step counts tied to an anonymous business id are sent, never personal details.
• Error reports: Sentry. A report contains the type of error, the page path and a shortened error message with email addresses, phone numbers, quoted text, ids and tokens removed. No account, IP address, cookies or form contents are sent.

Security

Each business's data is separated from every other business's. Passwords are hashed; calendar tokens and staff sign-in secrets are encrypted; sessions end when a password changes; sign-in, password reset and public forms are rate-limited; and changes are recorded in an audit trail.

How long we keep it

For as long as the instructor's account is open, so their lesson history stays complete. If a subscription lapses, nothing is deleted. If an instructor closes their account, it becomes read-only straight away and the Swimvity team deletes it no earlier than 30 days later (closures are completed by hand, not automatically). If the account has invoices or payment records, we contact the instructor before deleting anything, and the account stays closed until then. When a closed account is deleted, the team keeps a copy of its data export. Copies can remain in database backups until those backups expire, and financial records may be kept for as long as the law requires. Messages sent through our contact form are deleted after 12 months. Founding instructor applications and swim-school update sign-ups aren't deleted automatically yet; we delete them on request, and how long we keep them is being finalised.

Access, correction and deletion

Instructors can correct most information in the app, download a copy of their business data, and close their account in Settings → Account & security. If a family asks to be forgotten, the instructor can erase their details from the family's page (unnamed financial records and issued invoices are kept where the law requires). Parents should contact their instructor first; we'll help the instructor respond. You can also contact us at hello@swimvity.com about privacy or to make a complaint; if you're not satisfied, you can contact the Office of the Australian Information Commissioner (oaic.gov.au).

Changes

We'll update this page if our practices change and tell instructors about significant changes by email.

Who we are

Swimvity is operated by Markyn Media Pty Ltd.
ABN: 81 697 250 150
ACN: 697 250 150
Contact: hello@swimvity.com