Security and your data

Swimvity holds information about families and children, so we treat security as part of the product. This page describes what we actually do today. We don't hold security certifications such as ISO 27001 or SOC 2, and we won't claim to.

How your account is protected

• Connections are encrypted (HTTPS) and the site sends strict security headers.
• Passwords are stored only as strong one-way hashes (scrypt). Changing or resetting a password signs you out everywhere, and you can sign out of every device yourself.
• Sign-in, password reset, sign-up and public forms are rate-limited to slow down guessing and abuse.
• Google Calendar access tokens and staff sign-in secrets are encrypted at rest.
• Each business's data is kept separate from every other business's, and automated tests try to break that separation on every release.
• Swimvity staff sign in separately with a password and an authenticator code. Staff tools show account-level information only. They can't open your families, children, lessons or payments, and every staff action is logged with a reason. The one exception: completing an account closure makes a full export of that account, which the team keeps.

Your data stays yours

• Download your business data at any time, including families, lessons, payments and invoices (Settings → Account & security → Download my business data).
• If a subscription ends or a payment fails, nothing is deleted. Your account becomes read-only.
• Close your account whenever you like: it becomes read-only straight away, and the Swimvity team deletes it no earlier than 30 days later, except records the law requires to be kept. If it has invoices or payment records, we contact you first.
• If a family asks you to delete their details, you can erase them from their family page.

Google Calendar

Optional. If you connect it, Swimvity reads busy times from the calendars you choose so lessons aren't booked over your appointments, reads events only to help you bring existing lessons across, and writes only to a separate lessons calendar it creates. It never edits or deletes your own events, and your private appointment titles are never shown to parents.

Payments

Card details for your Swimvity subscription are entered on our payment provider's secure page and never reach Swimvity. Families pay you directly; Swimvity never handles lesson money.

Backups and where data lives

Swimvity runs on Vercel, and your data is stored in a managed Postgres database (Neon, on Amazon Web Services) with automated backups. We test that backups can be restored. Some of our service providers process information outside Australia; the privacy policy lists them.

Reporting a problem

If you think you've found a security issue, please email hello@swimvity.com with details. Please don't access other people's data while testing.