SMP Privacy Policy

1. About us

SMP (“the app”, “we”, “us”) is jointly operated by:

• PETERSMP AS represented by Peter Eriksson — business operations
• Vision Consulting (Norwegian sole proprietorship) by Olle Johanson — development and technical operations

Both parties are joint data controllers under Article 26 of the GDPR. For privacy-related inquiries, contact olle@visionconsulting.no.

2. What is SMP?

SMP is a mobile app that lets athletes send focus reports to their coach after training or competition. Coaches can read the reports, comment on them and track development over time. The app is built around the FOKUS 4 methodology (four focus areas).

3. What data do we collect?

3.1 Account and profile

• Email address (for authentication and communication)
• Name (provided by you)
• Role: athlete or coach
• Optional: bio, phone, club, date of birth, sports, profile picture

3.2 Content you create

• Reports you send as an athlete: date, type (training / competition), sport, opponent, score per focus area (1–5), free-text notes
• Messages you write in the comment thread on a report
• Links between coach and athlete

3.3 Technical information

• Push token (only if you have enabled push notifications) — used to notify you when a coach comments on a report, and vice versa
• Timestamps for when content is created and when a coach opens a report

We do not collect: location data, contacts, health data from Apple Health / Google Fit, advertising IDs, analytics data, or anything beyond what is listed above.

4. How do we use the data?

• To deliver the service: display reports, link athlete and coach, deliver messages
• To send you push notifications about activity on your reports (optional)
• To provide support if you contact us

We do not use your data for marketing, profiling, or share it with third parties for commercial purposes.

5. Who processes the data?

We use the following data processors to deliver the service:

• Supabase (storage and authentication) — operated by Supabase Inc., servers located in EU. Link: supabase.com/privacy
• Expo Push Service (push notification relay) — operated by 650 Industries Inc. Link: expo.dev/privacy
• Apple Push Notification Service / Google Firebase Cloud Messaging — delivers the actual push notification to your device (only push token, never content)

Data processing agreements are in place with these providers in accordance with GDPR.

6. How long do we retain the data?

We retain your data as long as you have an active account. When you request deletion, account, profile, reports, and messages are deleted within 30 days. Backups may retain data for up to 90 days before being permanently erased.

7. Your rights

Under the GDPR you have the right to:

• access the data we hold about you
• have inaccurate or outdated data corrected
• have your data deleted (“right to be forgotten”)
• receive your data in a structured format (data portability)
• object to or restrict processing
• file a complaint with the Norwegian Data Protection Authority (datatilsynet.no) if you believe we are processing data unlawfully

To exercise these rights, send an email to olle@visionconsulting.no.

8. Security

All communication between the app and our servers is encrypted with HTTPS/TLS. Passwords are never stored in plain text — only as salted hashes by Supabase. Server-side data access is restricted via row-level security: you see only your own reports, and coaches see only reports from athletes they are actively linked to.

9. Children under 16

If a user is under 16, parental consent is required. The club or coach inviting an underage athlete is responsible for obtaining such consent before sending an invitation.

10. Changes to this policy

We may update this policy when the service or legislation changes. Material changes are communicated via the app or email. The “Last updated” date at the top reflects when the latest version took effect.

11. Contact

PETERSMP AS · Vision Consulting
Email: olle@visionconsulting.no