Data Policy

Overview

This Data Policy explains, in more technical detail than our Privacy Policy, how AthlOS stores, secures, and lets you control your data.

Where Your Data Lives

Account, profile, and post data (names, sport and position, posts, comments, likes, and reactions) is stored in a managed Postgres database through Supabase.

Photos and other media you upload are stored in Cloudflare R2, a secure object storage service.

How Your Data Is Protected

Every table in our database has row-level security enabled, meaning access rules are enforced at the database layer, not just in application code. Coach profiles are private to their owner; athlete profiles are visible to signed-in users so they can be discovered, by design.

Data is encrypted in transit (HTTPS/TLS) between your device, AthlOS, and our infrastructure providers, and encrypted at rest by our database and storage providers.

Authentication (passwords, Google and Facebook sign-in) is handled by Supabase Auth — AthlOS never stores your password in plain text, and social sign-in never gives us your Google or Facebook password.

Data Retention & Deletion

We keep your account and content for as long as your account is active, so the platform can function — your profile, posts, and comments.

If you delete a post or comment, it's removed immediately, along with its likes and reactions.

If you delete your account, or ask us to, your profile and content are permanently removed from our active database. Contact us at support@athlosglobal.net to request account deletion.

Subprocessors

AthlOS relies on the following infrastructure providers to operate: Supabase (authentication and database), Cloudflare (media storage), Stripe (payment processing for coach subscriptions), Resend (transactional email), and Vercel (application hosting).

Changes to This Policy

If we make material changes to how we store or secure your data, we'll update the date below.