Train Wizard
← Back

Privacy Policy

Last updated: 10 November 2026

Athletes: there's a short version of this policy written for you at Privacy for athletes.

Who we are

Train Wizard is run by Limitless Garage Doors & Gates Pty Ltd (ABN 36 681 742 567), Queensland, Australia (“Train Wizard”, “we”, “us”, “our”). That company is responsible for your personal information. This Privacy Policy explains how we collect, use, store and disclose personal information when you use our website at trainwizard.com.au, the Train Wizard iPhone app, and our strength-and-conditioning services for rugby league and rugby union athletes aged 11 to 18 (the “Service”). By using the Service, you agree to this Privacy Policy.

Who this policy covers

Train Wizard is built for rugby league and rugby union athletes aged 11 to 18. Because athletes under 18 are minors, accounts should be created and managed with a parent or legal guardian (“Parent”). A subscription is always bought by an adult from their own Parent account. When we refer to “you”, we mean the account holder. We refer to the athlete as the “Player”.

What information we collect

When you create an account: name and email address, and a password (stored only in hashed form. We never see your actual password). About the Player: first name or nickname, date of birth (asked at sign-up, so we know which rules apply to them), playing position and training level, and optionally height, weight and goals.

Health information: daily check-ins, height and weight are health information, which the Privacy Act treats as sensitive information. We only collect it with consent. For a Player under 15, a linked Parent gives that consent in My family. A Player aged 15 or over can give it themselves by ticking the box at their first check-in. Until there is consent, check-ins stay on the Player's phone and height and weight aren't saved. Consent can be withdrawn at any time (the Parent in My family, or by emailing us); after that, we stop saving new health information. We keep a record of each consent: who gave it, for whom, what it covers, which version of this policy it was given under, and when.

Generated through use: which sessions were completed and when, progress and streaks. Collected automatically: device and browser type, IP address and basic log data.

Daily check-ins: if the Player does the daily recovery check in (sleep, soreness, mood and hydration, each from 1 to 5), it is saved to their account once there is consent (see above), so their linked parent can see it. Their coach and team can't see it. The first time, the app explains what is kept and why before anything is saved. On a “Test it out” account, check-ins stay on the phone and are not sent to us.

Apple Health: in the Train Wizard iPhone app, the Player can choose to connect Apple Health so the app can show their heart rate and resting heart rate (for example from an Apple Watch or AirPods), including during a session. Train Wizard only reads these, never changes anything in Apple Health, and the heart rate stays on the Player's phone: we don't upload it, store it, share it, or use it for advertising. It can be turned off at any time in the Health app.

Notifications for parents

In the iPhone app, a Parent with linked athletes can choose to turn on notifications. They are off until the Parent turns them on, and athletes never get them. They can tell the Parent when an athlete finishes a session, give a summary of the athlete's week on Sunday, and give a heads-up if an athlete hasn't trained for 5 days. Nothing is sent between 8pm and 7am; it waits until morning.

To send them, we store the phone's push token (a code from Apple that lets us reach that phone), the phone's time zone (for the quiet hours and the Sunday summary), and which notifications the Parent chose. Notifications are delivered through Apple Push Notification service and include the athlete's display name and details of their training, such as the session they finished. The Parent can switch each type off in Settings, or turn them off on that phone. Signing out also stops them on that phone.

Other iPhone app features

Training reminders: if the Player turns them on, reminders for their training days are set on their phone, between 7am and 8pm. The reminder settings are saved on the phone, not sent to us.

Lock Screen timer: during a session, the app can show the session, the current exercise and the timer on the Lock Screen and in the Dynamic Island. This happens on the phone and isn't sent to us. Anyone who can see the phone's Lock Screen can see it.

“Today's session” widget: for Players, the app shares today's session (or the next one) with the Home Screen widget. It is shared on the phone only, through an Apple App Group, and is cleared when the Player signs out.

Siri and Shortcuts: “Start training” and “Recovery check-in” only open the app at the right screen. We don't receive anything from Siri.

Payments in the iPhone app

In the iPhone app, subscriptions are bought through Apple In-App Purchase. Apple handles the payment, so we never see your card or payment details. We use RevenueCat to check the status of Apple subscriptions. RevenueCat receives your Train Wizard account ID (a random code, not your name or email) and the purchase details Apple gives it, such as which pack you have and when it renews. We use this only to switch your access on or off.

How we use your information

To provide and personalise the Service to the Player's age, position and level; to keep training safe and age-appropriate; to send service-related emails; to provide support; to improve the product; and to meet legal, safety and security obligations. If you tap “Tell me when it's open”, we email your account's address once when payments open; tap it again to undo. We do not sell your personal information, and we don't use it to train artificial intelligence (AI) models.

Automated decisions: the app picks sessions from the Player's quiz answers (for example their age, position and gym), and the Player or Parent can change those answers at any time. We don't use a computer program to make any decision that significantly affects anyone's rights or interests.

Cookies and tracking

We don't use advertising or analytics trackers. Your browser or phone only stores what Train Wizard needs to work: your sign-in, and settings such as the theme and text size. Because nothing is used to track you, there's no cookie banner. Exercise videos are shown with YouTube's privacy-enhanced mode (youtube-nocookie.com); when a video plays, YouTube (Google) may store information on your device under Google's own privacy policy.

Who we share information with

We share information only with providers that help us run the Service, and only what they need. These are our providers (subprocessors):

We also share information with our professional advisors where needed, and may disclose it where required by law. We require each provider to handle your information consistently with this policy and Australian privacy law. If we add a provider, we'll update this list.

Where your information is stored

Our database, with your account and training data, is stored by Supabase in Sydney, Australia. Some of our other providers store and process data overseas. The country for each one is shown in the list above: all except Supabase and Crazy Domains are in the United States, and some also use data centres in other countries. Where personal information is transferred overseas, we take reasonable steps to ensure it is handled consistently with the Australian Privacy Principles.

How long we keep information

We keep account data while your account is active. When an account is deleted, we keep it for 30 days so it can be recovered, then delete or anonymise it (subject to any legal retention requirements). Technical logs are kept for up to 12 months.

Accounts nobody uses: a “Test it out” account is deleted, with everything in it, 30 days after it was last used. Any other account that hasn't been used for 24 months is deleted too. We email the account's address first, 30 days before, and signing in before then keeps the account. Accounts with an active subscription are never deleted this way.

Security

We use reasonable technical and organisational measures to protect personal information, including encryption in transit and encrypted storage. No online service can guarantee absolute security, so please use a strong, unique password.

Data breaches: if there is a data breach that is likely to cause serious harm to anyone, we will tell the people affected (for a Player, their linked Parent too) and the Office of the Australian Information Commissioner, as the Notifiable Data Breaches scheme requires, and say what happened and what to do next.

Your rights

Under the Privacy Act 1988 (Cth) you can access and correct your information, delete your account, withdraw consent to marketing, and make a complaint. You can delete your account at any time in the app: Players from Profile, Parents from My family or Settings. A subscription paid on the website is cancelled straight away. If you pay through Apple, deleting your account doesn't stop the subscription: cancel it on your iPhone in Settings, then your name, then Subscriptions. Your account and training data are permanently removed 30 days later. Until then you can sign in and keep your account. You can download a copy of your data at any time in Settings on the website (Download my data). You can also ask us for access to the personal information we hold about you or the Player, or ask us to correct anything that is wrong, out of date or incomplete. Most details can be changed in the app; for anything else, email hello@trainwizard.com.au. We will respond within 30 days and won't charge for this. If we can't give access or make a correction, we'll tell you why in writing. To exercise any other right, email hello@trainwizard.com.au. If you're not happy with our response, you can complain to the Office of the Australian Information Commissioner (oaic.gov.au).

Privacy for athletes under 18

Our Service is designed for Players aged 11 to 18, with a Parent involved. If you believe someone under 18 has created an account without a Parent's involvement, contact us at hello@trainwizard.com.au and we will delete it.

A Player links to a Parent with a family code or an email invite. The link only counts once the Parent has confirmed their email address and said yes in My family; this is also where the Parent gives consent for the Player's account and, if they choose, their health information. A linked Parent can see the sessions the Player has done, the teams they're in, their height and weight, and their daily check-ins. If the Player joins a team, the team's coach can see the sessions they've done, and team members see a leaderboard with display names and session counts.

While a Player is under 15, or if we don't know their date of birth, the link to their Parent stays in place. Neither the Player nor the Parent can remove it; only Train Wizard can, for example if it was made by mistake (email hello@trainwizard.com.au). From 15, either the Player or the Parent can remove it.

Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will post the updated version on this page and update the date above.

Contact

For any questions about this Privacy Policy, or about your personal information, email hello@trainwizard.com.au. We are Limitless Garage Doors & Gates Pty Ltd (ABN 36 681 742 567), Queensland, Australia.

© 2026 Limitless Garage Doors & Gates Pty Ltd · ABN 36 681 742 567