Security, Privacy & Data Handling

Parent and swimmer accounts sign in with email and password. Passwords are checked against a public database of known-leaked passwords during sign-up and password changes; commonly leaked passwords are rejected.

Administrative access is restricted to authorised IB Aquatics staff and is enforced server-side, not just in the user interface.

We collect the information you provide during enquiry and registration (parent and swimmer name, contact details, program selection, and payment confirmation evidence). We use it solely to operate the swim program — to communicate about training, manage registrations, and confirm payment.

Application data is stored in our managed backend with row-level access controls so that records are only readable by the account that owns them or by authorised IB Aquatics admins. Payment screenshots are stored in a private bucket and are not publicly accessible.

We use Lovable Cloud (managed Supabase) for database, authentication, and file storage; and Lovable's hosting platform for the website. Email is sent through our configured transactional email provider.

Registration and account records are retained while the account is active and for a reasonable period afterwards for accounting and continuity. To request access, correction, or deletion of your personal data, contact us at the address below.

To report a security concern or vulnerability, email coach@ibaquatics.com. Please include steps to reproduce so we can investigate quickly.

IB Aquatics is responsible for how this application is configured and how your data is used within it. Our hosting and backend providers are responsible for the underlying platform. You are responsible for keeping your account password secret and notifying us if you suspect unauthorised access.