Privacy Policy
1. About this policy
This Privacy Policy explains how Athly Operations Pty Ltd (ACN 696 739 027 / ABN 59 696 739 027), trading as Athly ("Athly", "we", "us", "our"), collects, holds, uses, discloses, and protects your personal information. Our registered office is Level 2/315 Brunswick St, Fortitude Valley QLD 4006, Australia.
Athly operates a subscription platform on which elite athletes' coaching methodologies are delivered to you through an AI coaching experience (the "Service"), available at getathly.com and through our progressive web app.
We are bound by the Privacy Act 1988 (Cth) ("Privacy Act") and the Australian Privacy Principles ("APPs"). This policy is our APP 1 obligation: an openly available statement of how we manage personal information.
By creating an account or using the Service, you confirm you have read and understood this policy. If you do not agree with it, do not use the Service.
This policy does not cover:
- How athletes' own personal information (voice, likeness, methodology) is handled under their agreements with Athly. That is dealt with separately in the privacy notice annexed to each athlete's agreement.
- Third-party websites or services we link to. Their privacy practices are their own.
2. The kinds of personal information we collect
We collect only the information we need to provide the Service. Depending on how you use it, this includes:
a. Account and identity information
- Name and email address
- Password (stored only in hashed form; we never see it in plain text)
- Your self-declared age (see Section 9 — Age)
b. Onboarding and profile information
- Sport and position
- Competitive level
- Training goals
- Training days and current training setup
- The athlete you subscribe to
c. Content you generate when using the AI coach
- The text of messages you send to and receive from your AI coach
- Voice recordings you create when you use voice input. Voice input is transcribed to text on receipt and the raw audio is deleted within 24 hours (see Section 10).
- Your training progress, completed sessions, and tier progression
d. Sensitive information
The Service is a coaching product. In the ordinary course of using the AI coach, you may disclose information about your health, injuries, physical condition, or mental wellbeing (for example, telling the coach you are sore, injured, or struggling). Under the Privacy Act this is "sensitive information" and attracts higher protection.
Do not provide more health information than you choose to. The AI coach gives general fitness information, not personal medical advice. We ask you not to share detailed medical history, diagnoses, or clinical information. Where you do provide health information, you consent to us collecting and handling it for the purpose of operating the coaching Service. See Section 6 (Consent) and the Terms of Service for the limits of the coaching.
e. Payment information
Subscription payments are processed by Stripe. Stripe collects and processes your card details directly; Athly does not see, receive, or store full card numbers. We receive only a payment token and limited transaction metadata (for example, that a payment succeeded, the last four digits, and billing country).
f. Technical and usage information
- Device type, operating system, browser
- IP address and approximate location derived from it
- Server logs and records of your interactions with the Service, kept for security, troubleshooting, and service integrity
- Referral or attribution information recording which athlete's link, code, or landing page you signed up through (see Section 4)
- Cookies and similar technologies — see our separate Cookie & Tracking Notice
We use PostHog for product analytics, to understand how the Service is used so that we can improve it. We do not use advertising trackers, advertising pixels, or cross-site behavioural targeting, and we do not sell or share analytics data with advertising networks.
We do not intentionally collect sensitive information beyond what is described in (d). We do not collect government identifiers (for example, tax file numbers or Medicare numbers), and we ask that you do not provide them.
3. How we collect personal information
We collect personal information:
- Directly from you — when you create an account, complete onboarding, chat with the AI coach, use voice input, or contact us.
- Automatically — through strictly necessary cookies and server logs as you use the Service (see the Cookie & Tracking Notice).
- From our service providers — limited to what they tell us in order to run the Service, for example Stripe confirming a payment outcome.
Sign-up is by email address and password. We do not offer social or third-party login.
Where it is reasonable and practicable, we collect personal information directly from you (APP 3).
4. Why we collect, hold, use and disclose your information (purposes)
We use your personal information to:
- Create and administer your account and authenticate you
- Provide the core Service — deliver AI coaching, training programs, progress tracking, and tier progression personalised to your onboarding answers and chat history
- Process your subscription payments and manage billing (via Stripe)
- Attribute your subscription to the athlete whose link, code, or landing page you signed up through, so that we can calculate and pay that athlete's revenue share
- Respond to your enquiries and complaints
- Maintain the security, integrity, and performance of the Service
- Detect, prevent, and respond to fraud, misuse, and breaches of our Acceptable Use Policy
- Comply with our legal obligations
- Where you have consented, send you service-related and marketing communications (see Section 11)
We do not sell your personal information.
Use of your content to train or improve AI models
We do not currently use your conversations, voice recordings, or profile information to train or fine-tune AI models. Your content is used to generate responses to you and to deliver the Service to you, not as training data for any model, whether ours or a third party model.
This may change in the future. If we later use your content to help train or improve AI models, it will first be de-identified — your name, email address, and any other detail that could reasonably identify you removed — so that the training data is anonymous and cannot be traced back to you. We will not use raw voice recordings for training. They are deleted within 24 hours of transcription in any event (see Section 10).
If we ever propose to train a model on information that still identifies you, we will ask for your express opt-in consent first. Either way, we will update this policy and give you reasonable notice before any such change takes effect (see Section 15).
Disclosure to the athlete you subscribe to
Only if you separately opt in, we will provide the athlete whose coaching you subscribe to with your name and email address.
This is entirely optional. It is not required in order to subscribe, it is asked for separately from your acceptance of the Terms of Service, and it is switched off unless you actively turn it on. You can withdraw it at any time by emailing contact@getathly.com.
If you do opt in:
- The athlete receives your name and email address only. Nothing else.
- The athlete may use it to promote their own professional activities.
- Under our agreement with the athlete, they must not use it to promote a competing coaching product, and they must comply with the Privacy Act and the Spam Act 2003 (Cth), including the requirements to identify themselves and to offer an unsubscribe option in any marketing message.
If you do not opt in, the athlete receives nothing that identifies you.
Separately, and regardless of whether you opt in, we may share aggregated and de-identified insights with the athlete — for example, how many subscribers completed a program. This never identifies you.
We never disclose the content of your conversations with the AI coach to the athlete.
5. Who we disclose your information to (service providers and subprocessors)
To run the Service we use third-party providers who process personal information on our behalf under contract. Each is engaged only for the function listed, is bound by written terms no less protective than our own obligations, and is required to protect your information.
| Provider | Function | Data involved | Location |
|---|---|---|---|
| OpenAI, Inc. / Anthropic PBC | AI model inference (generating coach responses) | Your messages and relevant profile context | United States |
| ElevenLabs, Inc. | Voice synthesis of coach responses | Text to be voiced; voice interaction data | United States |
| Supabase | Database and authentication | Account, profile, chat, and progress data | United States |
| Amazon Web Services, Inc. | Cloud hosting and storage | Most categories of data we hold | United States |
| Vercel Inc. | Application hosting and delivery | Technical and server log data | United States |
| Stripe, Inc. | Payment processing | Payment and billing data | United States / Ireland |
| PostHog | Product analytics | Usage and interaction events, device and browser information, IP address | United States |
| Resend | Transactional and marketing email | Name, email | United States |
We also use third-party tools to produce the athletes' promotional content. Those tools process the athlete's own material and do not receive or process your personal information.
We disclose personal information to these providers only as needed to operate the Service. We do not otherwise disclose your personal information except:
- With your consent (including the optional athlete disclosure in Section 4)
- Where required or authorised by law (for example, a court order, or to a regulator such as the OAIC)
- To protect the safety of a person, or to prevent or investigate a serious crime or serious threat
- To a buyer or successor in the event of a sale, merger, or restructure of Athly, subject to this policy continuing to apply
6. Consent and sensitive information
We collect sensitive information (health-related disclosures in chat, and voice recordings) only with your consent and only where reasonably necessary to provide the coaching Service (APP 3.3). You provide that consent by choosing to share health information with the coach or by using voice input.
You can withdraw consent at any time by ceasing to provide that information, deleting relevant content where the Service allows, or closing your account. Withdrawing consent may mean we cannot provide parts of the Service.
7. Cross-border disclosure (APP 8)
All of the service providers listed in Section 5 store or process personal information outside Australia, principally in the United States (and, for Stripe, also Ireland).
By using the Service, you acknowledge and consent to your personal information being disclosed to and processed in these locations.
Where we disclose personal information overseas, we take reasonable steps to ensure the recipient handles it consistently with the APPs, including through contractual terms. However, you acknowledge that overseas recipients may be subject to foreign laws, and that if your information is handled by an overseas recipient in breach of the APPs, the mechanisms available to you may differ from those under Australian law.
8. How we hold and secure your information (APP 11)
We take reasonable steps to protect personal information from misuse, interference, loss, and unauthorised access, modification, or disclosure. Our security program includes:
- AES-256 encryption of personal information at rest
- TLS 1.2 or higher for data in transit
- Multi-factor authentication on all administrative and privileged access
- Role-based access control with least-privilege defaults, limiting staff access to personal information on a need-to-know basis
- Hashing of passwords
- A documented incident response procedure with defined internal escalation timeframes (see Section 13)
- Regular vulnerability assessment of production systems
- Written security requirements flowed down to our material vendors and subprocessors
No method of transmission or storage is completely secure. If we suffer an eligible data breach, we will respond in accordance with the Notifiable Data Breaches scheme (Section 13).
9. Age — you must be 16 or over
The Service is for users aged 16 and over. We do not knowingly create accounts for, or collect personal information from, anyone under 16.
We ask for your age at the start of sign-up, before we collect any other personal information. If you are under 16, we will not create an account, and we do not retain the information you entered.
If you are 16 or 17, you may use the Service, but we encourage you to involve a parent, guardian, or coach, particularly regarding any physical training.
If we become aware that we have collected personal information from a person under 16, we will delete it. If you believe a person under 16 has provided us personal information, contact us at contact@getathly.com and we will remove it.
10. Data retention
We keep personal information only for as long as we need it for the purposes in this policy, or as required by law, then we delete or de-identify it. Our retention periods are:
| Data | Retention |
|---|---|
| Account and profile information | For the life of your account, then deleted within 90 days of account closure |
| Chat messages and coaching history | For the life of your account; you may delete individual content where the Service allows |
| Voice recordings (raw audio) | Transcribed on receipt; raw audio deleted within 24 hours |
| Voice transcriptions | Treated as chat content, above |
| Payment records | 7 years, to meet tax and financial-records law |
| Server and security logs | 12 months |
11. Direct marketing and communications
We may send you:
- Service messages (for example, billing, security, or changes to the Service) — these are part of providing the Service and you cannot opt out while you hold an account.
- Marketing messages — only where you have consented. Every marketing message includes an unsubscribe option, consistent with the Spam Act 2003 (Cth). You can opt out at any time at contact@getathly.com or via the unsubscribe link.
If you have opted in to share your details with your athlete (Section 4), that athlete may also send you marketing messages. They are required to include an unsubscribe option. Unsubscribing from the athlete does not unsubscribe you from Athly, and unsubscribing from Athly does not unsubscribe you from the athlete — they are separate senders. You can also ask us to stop sharing your details with the athlete at any time by emailing contact@getathly.com.
We do not use sensitive information for direct marketing.
12. Accessing and correcting your information (APPs 12 & 13)
You may request access to the personal information we hold about you, and ask us to correct it if it is inaccurate, out of date, incomplete, irrelevant, or misleading.
To make a request, email contact@getathly.com. We will:
- Verify your identity before releasing any information
- Respond within a reasonable period (we aim for 30 days)
- Provide the information free of charge, unless the request is complex or repetitive, in which case we may charge a reasonable cost-based fee and will tell you before proceeding
- Give you written reasons if we refuse access or correction, and explain how to complain
13. Data breaches
We maintain a documented Data Breach Response Plan. If we suffer a data breach that is likely to result in serious harm to you, and we cannot prevent that harm through remedial action, we will notify you and the Office of the Australian Information Commissioner (OAIC) as soon as practicable, in accordance with the Notifiable Data Breaches scheme under Part IIIC of the Privacy Act.
Notification to you will be by email and, where appropriate, in-app.
14. Complaints
If you think we have breached the Privacy Act or this policy:
- Email contact@getathly.com with "Privacy Complaint" in the subject line.
- We will acknowledge within 2 business days and aim to resolve within 30 days.
- We will tell you the outcome and our reasons.
If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner:
- Online: oaic.gov.au
- Phone: 1300 363 992
15. Changes to this policy
We may update this policy as the Service, our providers, or the law change. The current version is always at getathly.com. Where a change is material, we will give you reasonable notice (for example, by email or in-app) before it takes effect.
16. Contact
Athly Operations Pty Ltd (ABN 59 696 739 027)
Level 2/315 Brunswick St, Fortitude Valley QLD 4006
contact@getathly.com