Privacy Policy

This Privacy Policy explains how CurioCore ("Company," "we," "us") collects, uses, shares and protects personal information when you use Flowbase, SportsFlow, joinflowbase.com, sportsflow.ai, our apps and FlowCoach (the "Services"). Residents of certain places have additional rights, described in Sections 12 to 16. Health-related information is also covered by our Consumer Health Data Notice.

The short version.

• Coaches never see your questionnaire answers. You choose which scores a coach sees, and you can take that back at any time.
• Race results, rankings and league standings are public. You can shorten your displayed name.
• We do not sell your personal information, share it for targeted advertising, or use your health information to train AI models.
• You can download or delete your data at any time.

Flowbase and SportsFlow Accounts

Flowbase and SportsFlow each have their own accounts. If you use only one, the other does not receive your information. If you have both and choose to link them, your profile and sign-in are shared, and information moves between them only to show it where you use it. Your sharing settings, including what coaches can see, apply the same way in both. You can unlink or close either account at any time.

1. Who We Are

CurioCore, {ADDRESS}, is the controller of personal information processed through the Services. Our privacy officer is {PRIVACY_OFFICER}, reachable at {PRIVACY_EMAIL}. Our EU representative is {EU_REP}. Our UK representative is {UK_REP}.

2. Information We Collect

Wellbeing responses, wearable data and scores derived from them are health information. We treat them under the stricter rules in this policy and in our Consumer Health Data Notice.

3. How We Use Information

We use personal information to:

1. Provide the Services, including logging training, calculating results, rankings and handicaps, and running leagues, challenges, clubs, events, reservations and fundraisers;
2. Show your results and insights, and identify where to focus your attention;
3. Share information with coaches, clubs, guardians and the public as described in Section 4;
4. Operate FlowCoach and the library;
5. Process payments and donations, and manage subscriptions;
6. Send service messages and the reminders you enable;
7. Notify a club's Wellbeing Lead of a threshold event (Section 4.4);
8. Check the reliability of our questionnaires and improve the Services, using de-identified data;
9. Keep the Services safe, including preventing fraud, protecting minors and moderating content;
10. Comply with law and enforce our Terms.

We send marketing emails only with your consent where the law requires it, and never using health information. You can unsubscribe at any time.

4. How Information Is Shared

4.1 Public information. Race results, league standings, ranking entries and club rankings show your name, club, category and result. Certificates you choose to make public and reels you publish are public. You, or a guardian for a minor, can switch your displayed name to first name and last initial in settings.

4.2 Coaches, by your settings.

You always see what your coach sees, in the same words. A score you have not shared appears to coaches as "not shared." If you stop sharing, the coach loses access to that item's history. Sharing a score does not share the wearable data behind it. Support pod members see only pod-level summaries.

4.3 Multiple coaches. You may share with more than one coach and follow more than one program. Each coach sees only what you share with them.

4.4 Safeguarding notifications. Screening questionnaires are available only through clubs at this time. If your club uses the WHO-5 or GAD-7 and your result meets the threshold in the club's agreement with us, we tell the club's Wellbeing Lead that it happened. We never disclose the score or your answers. You are told at the same moment. For athletes under 18, the Lead may involve a parent or guardian unless that would put you at risk, and you are told before they do. See our Safeguarding Policy.

4.5 Service providers. We use service providers for hosting, storage, email, notifications, payments, subscription management, customer support and AI. They process information only on our instructions and under contract. The current list is in the Appendix.

4.6 Clubs. Clubs see roster, reservation, event and fundraising information for their own members and events. Clubs do not see wellbeing information except as described in 4.2 and 4.4.

4.7 Legal and safety. We may disclose information if required by law or legal process, or if we believe in good faith that disclosure is needed to prevent death or serious harm.

4.8 Business transfers. If we are involved in a merger, acquisition or sale of assets, personal information may transfer to the successor under this policy. We will tell you before it becomes subject to a different policy.

4.9 No sale, no targeted advertising. We do not sell personal information or share it for cross-context behavioral advertising, and have not in the past 12 months.

5. FlowCoach and AI

5.1 FlowCoach is powered by Claude, an AI model provided by Anthropic, PBC ("Anthropic"). When you or your coach use FlowCoach, we send Anthropic the question and the context needed to answer it, such as recent training, scores and readiness.

5.2 Before any request leaves our systems, we remove your name and direct identifiers. When a coach uses FlowCoach, information you have not shared with that coach is removed.

5.3 Our contract with Anthropic prohibits it from using our data to train its models and limits how long it may keep request data.

5.4 We keep your FlowCoach conversations so you can return to them. You can delete them at any time.

5.5 Our automated features, such as readiness indicators, rankings and handicaps, give information and suggestions. They do not make decisions with legal or similarly significant effects on you.

6. Children and Teens

The Services are not for children under 13. We do not knowingly collect their personal information, and delete it if we learn we have. Users aged 13 to 17 need a parent or guardian's approval before any information is stored. Teen accounts start with the most private settings. A guardian can review, download or delete the teen's information, or withdraw approval, at any time.

7. Your Choices and Rights

7.1 Everyone. Wherever you live, you can: access and download your data; correct it; delete it or your account; change what coaches see; disconnect devices; shorten your public name; withdraw consent; opt out of marketing. Most can be done in settings.

7.2 Requests. Email {PRIVACY_EMAIL} or use settings. We verify your identity before acting, respond within 30 days (45 in some US states), and may extend once where the law allows. An authorized agent may act for you with your signed permission. We will not treat you differently for exercising your rights.

7.3 Appeals. If we deny a request, reply to our decision to appeal. We respond within the time the law requires. If we deny the appeal, we will tell you how to contact your regulator.

8. Retention

We keep personal information while your account is open. We delete it within 90 days after closure, except for public results, records we must keep by law, safeguarding records held by clubs, and de-identified data. Raw wellbeing answers of users under 18 are deleted within 30 days after closure, or when they turn 18. Our Data Retention Schedule gives the detail.

9. Security

We use administrative, technical and physical safeguards, including encryption in transit and at rest, role-based access controls, access logging and staff confidentiality obligations. No system is completely secure. If a breach affects your information, we will notify you and regulators as the law requires, including under the FTC Health Breach Notification Rule where it applies.

10. International Transfers

We are based in the United States and process information there. For transfers from the EU/EEA, UK and Switzerland, we rely on the EU Standard Contractual Clauses, the UK International Data Transfer Addendum and, where our providers are certified, the EU-US Data Privacy Framework. We take reasonable steps to ensure overseas recipients protect information to the standard required by Australian, New Zealand and Canadian law.

11. Cookies and Similar Technologies

Our websites use:

We do not use advertising cookies. You can change your choices through the cookie settings link in each site's footer. We honor Global Privacy Control signals as an opt-out.

12. United States

12.1 California notice at collection. In the past 12 months we collected these categories of personal information under the California Consumer Privacy Act:

Sources, purposes and retention are in Sections 2, 3 and 8. We use sensitive personal information only to provide the Services you request and for other purposes permitted without a right to limit, so we do not offer a separate "limit" link. We do not sell or share personal information and have no actual knowledge of selling or sharing information of consumers under 16.

12.2 Your California rights. To know, access, correct and delete; to not be discriminated against; and, under the Shine the Light law, to ask whether we disclosed personal information to third parties for their direct marketing (we do not).

12.3 Other states. Residents of Colorado, Connecticut, Delaware, Iowa, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Tennessee, Texas, Utah, Virginia and other states with privacy laws have rights to access, correct, delete, obtain a portable copy, and opt out of targeted advertising, sale and significant profiling. We do not engage in those activities. We honor these rights for all US users.

12.4 Consumer health data. Residents of Washington, Nevada, Connecticut and other states with consumer health data laws: see our Consumer Health Data Notice.

13. EU, EEA and United Kingdom

13.1 Legal bases.

13.2 Your rights. Access, rectification, erasure, restriction, portability, objection (including to processing based on legitimate interests), and withdrawal of consent at any time without affecting earlier processing. You may complain to the supervisory authority where you live or work. In the UK, that is the Information Commissioner's Office.

13.3 Children in the UK. We apply the standards of the UK Age Appropriate Design Code to under-18 users, including high-privacy defaults, no nudging to share more, and no precise location by default.

14. Canada

We comply with PIPEDA and applicable provincial laws. Quebec residents have additional rights under Law 25, including to be informed of and object to technology used to profile them. Our readiness, scoring and ranking features analyze your data to generate insights. Wellbeing scoring is off until you choose to take a questionnaire, and ranking can be limited by shortening your public name or not submitting results. You may complain to the Office of the Privacy Commissioner of Canada or, in Quebec, the Commission d'accès à l'information.

15. Australia

We handle personal information under the Australian Privacy Principles. Where practicable, you may use a nickname for your public profile. Contact us first with any complaint. We will respond within 30 days. If you are not satisfied, you may complain to the Office of the Australian Information Commissioner at oaic.gov.au.

16. New Zealand

We handle personal information under the Privacy Act 2020. You may request access to and correction of your information. If you are not satisfied with our response, you may complain to the Office of the Privacy Commissioner at privacy.org.nz.

17. Changes to This Policy

We will post changes here with a new effective date. For material changes, we will notify you in the Services or by email before they take effect, and ask for your consent where the law requires.

18. Contact

CurioCore, {ADDRESS} · {PRIVACY_EMAIL} · Privacy officer: {PRIVACY_OFFICER} · EU representative: {EU_REP} · UK representative: {UK_REP}

Appendix: Service Providers

We update this list before adding a provider that receives health information.