Privacy Policy

The short version

• You can use everything in the app without an account. An account just saves your progress.
• If you create one, we store your email, an optional name, a securely hashed password and your practice results.
• Your camera is processed only on your device. Video is never recorded or uploaded.
• We use anonymous analytics to improve the app. They never include your name or email, and you can switch them off.
• We don't sell your information, show ads, or share it for marketing.
• You can download or delete your data at any time from your Account page.

What we collect

If you create an account

• Email address: to sign you in and contact you about your account.
• Name (optional): shown in the app, e.g. on your dashboard.
• Password: stored only as a one-way bcrypt hash; we can't see it.
• Practice results: for each signal you practise, the signal, the mode (Identify or Perform), whether you got it right, and when.
• Test scores: for each acronym or radio test you finish, which test (and which acronym or call), your score, mistakes, and when.
• Consent record: when you agreed to these terms and which version.

If you don't have an account

Your practice results are kept only in your browser's local storage on your device. If you later sign up or sign in on that browser, they're added to your account.

Camera (Perform mode)

If you turn the camera on, your video is analysed entirely in your browser to find your arm positions. It is never recorded, stored or sent to us or anyone else. To do this, your browser downloads a pose-detection model file from Google's servers (storage.googleapis.com), so Google receives your IP address for that download, as with any website request.

Usage analytics

To understand how the app is used and improve it, we collect anonymous usage data: pages viewed, which buttons and links are tapped, how far pages are scrolled, how quickly pages load, which exercises are started and finished, scores, the type of device and browser, and an approximate country. Nothing is collected on your Account page or on admin pages. We use:

• Vercel Web Analytics: aggregated page views, without cookies.
• PostHog: anonymous events linked to a random ID stored in your browser (not a cookie). We never send your name, email or account ID, nothing you type is captured, there's no screen recording, and IP addresses are discarded.

Analytics are switched off if your browser sends a Do Not Track signal, and you can turn them off here at any time:

Security and technical data

Our hosting provider records standard server logs (such as IP address, browser and time of request) to keep the service secure and working. To stop password guessing, we keep a short-lived count of sign-in attempts per email address and IP address, deleted after 24 hours.

Embedded videos

Official SLS demonstration videos are embedded from YouTube in privacy-enhanced mode (youtube-nocookie.com) and only load when you choose to watch one. YouTube's own privacy policy then applies.

Why we use it

• To provide the app: sign-in, saving and showing your progress.
• To keep it secure and prevent misuse.
• To improve it, using anonymous analytics.
• To contact you about your account or important changes to these policies.

We don't use your information for advertising and we don't sell it.

Who we share it with

Only the service providers that run the app for us, under their own security and privacy commitments:

• Supabase: database for accounts and practice results, hosted in Australia (Sydney).
• Vercel: website hosting, with our servers in Sydney; also Vercel Web Analytics and image storage.
• PostHog: anonymous analytics, hosted in the United States.

Your account and practice results are stored in Australia. Anonymous analytics are processed by PostHog in the United States, and some of Vercel's services may process data overseas. We choose providers with strong security practices and only share what each needs. We may also disclose information if required by law.

How long we keep it

• Account and practice data: until you delete your account. It's then deleted straight away, apart from routine backups, which expire on their normal schedule.
• Sign-in rate-limit records: 24 hours.
• Anonymous analytics: kept to understand trends over time; they can't be linked back to you.

Keeping it secure

Passwords are hashed with bcrypt, all connections are encrypted, sign-in attempts are rate-limited, access to the database and admin tools is restricted, and we only collect what the app needs. No system is perfectly secure. If a data breach is likely to cause you serious harm, we'll tell you and, where required, the Office of the Australian Information Commissioner (OAIC).

Young people

Many surf lifesaving members are under 18. You can use the app without an account and without giving us any personal information. To create an account you must be 16 or older, or have a parent or guardian's permission. We collect only the minimum needed, and never use it for advertising. A parent or guardian can contact us to access or delete their child's account.

Your choices and rights

• Access: download all your data from your Account page.
• Correction: contact us to correct your details.
• Deletion: delete your account and all its data from your Account page at any time.
• Analytics: switch anonymous analytics off (above, or on your Account page).

If you're in the EU or UK, you also have rights under the GDPR, including to object to processing and to complain to your local data protection authority.

Contact and complaints

For privacy questions, requests or complaints, contact Tom Allen at hello@patrolready.au. We aim to reply within 30 days. If you're not satisfied with our response, you can complain to the OAIC at oaic.gov.au.

Changes to this policy

If we make significant changes, we'll update the date above and ask signed-in users to review and accept the new version.