Inner Athlete
How we handle your data, and your child’s · Last updated 4 October 2026
Almost everyone whose data we hold is a child.
PIPEDA does not have a separate children's regime the way COPPA does in the
US, but the Office of the Privacy Commissioner has been consistent that
consent from a minor is generally not meaningful, and that organisations
collecting children's data are held to a higher standard. The practical
consequence runs through everything below: **the account belongs to the
parent, the child never holds one, and we collect as little about the child as
the product can function on.**
Inner Athlete, operating in Ontario, Canada.
Contact for any privacy question or request: hello@innerathletes.ca
Handled entirely by Stripe. We never see or store a card number.
Birth year, not date of birth. We need the age band — 7–11, 12–15, 16–18 —
and nothing finer. A birth year gives us that. A full date of birth is a
building block of identity theft and we have no use for one.
First name only. We have no need for a child's surname, so we do not ask
for it. A breach of this database does not produce a list of identifiable
children.
| Purpose | Data used | |
|---|---|---|
| Assign the right programme | birth year, sport, level | |
| Show progress to the parent | logged sets, completions | |
| Account access and security | parent email, password hash | |
| Service email — confirmation, password reset, renewal notice | parent email |
| Payment and refunds | handled by Stripe |
|---|
We do not sell data, share it with advertisers, use it to train anything,
or profile children for marketing.
| Processor | Holds | Where |
|---|---|---|
| Supabase | database, authentication | Canada (ca-central-1) |
| Vercel | website hosting | global edge |
| Resend / Amazon SES | service email | United States |
| Stripe | payments | United States |
|---|
The database is hosted in Canada, deliberately. Email and payments route
through US providers, which means some data crosses the border and is subject
to the laws there. You have a right to know that, which is why it is here
rather than in a footnote.
Permission to use a child's image in marketing is a separate tick box from
permission to take part, and is optional. Declining it changes nothing
about the programme.
If you granted it and change your mind, email us and we will stop using the
material going forward. Where something has already been published we will
remove it, though we cannot claw back copies other people have made.
There is no messaging between coaches and children in the product. Any
feedback or communication goes through the parent's account. This protects
the child and the coach equally.
On that last point: in Ontario, the limitation clock on a minor's own claim does not start until they turn 18. A seven-year-old today could bring a claim as late as roughly 2039. Destroying the consent record would leave both the family and us without the evidence of what was actually agreed, so we keep those records — and only those — for that period.
You may:
Email hello@innerathletes.ca. We respond within 30 days, as PIPEDA
requires.
If a breach creates a real risk of significant harm, we notify affected
parents and the Privacy Commissioner, as PIPEDA requires. We will tell you
what happened and what we are doing, promptly and in plain language.
Material changes are emailed to account holders, not quietly posted.
Questions: hello@innerathletes.ca