← Back

Privacy Policy

Effective 12 June 2026

Throughway ("Throughway", "we", "us") is a tool that helps coaches manage their throughway practice. We take a deliberately minimal approach to personal data: we collect only what is needed to run the service, we never sell it, and we never share it for advertising. This policy explains what we collect, why, the legal basis for using it, and the rights you have under the EU/UK General Data Protection Regulation (GDPR).

1. Who is responsible for your data

The data controller for the account data described below is Jeremy Lightsmith. You can reach us about any privacy matter at jeremy.lightsmith@gmail.com.

When you, as a coach, store information about your own clients in Throughway, you are the controller of that information and we act as a processor on your behalf, processing it only to provide the service to you and only on your instructions.

2. What we collect

  • Account data. When you sign in with Google we receive your name, email address, and Google account identifier. We use this to create and identify your account.
  • Content you create. Information you enter into Throughway — clients, sessions, notes, goals, and action items — including any personal details about your clients that you choose to record.
  • Technical data. A session cookie that is strictly necessary to keep you signed in, and basic server logs (such as IP address and timestamps) used for security and to keep the service running reliably.

We do not collect special-category data, we do not use tracking or advertising cookies, and we do not build advertising profiles.

3. Why we use it, and our legal basis

  • To provide and secure the service and let you sign in — performance of our contract with you and our legitimate interest in keeping the service safe.
  • To process the client information you enter — on your instructions as our customer (performance of contract), with you as the controller of that data.
  • To keep minimal security logs and prevent abuse — our legitimate interest in protecting the service and its users.

4. Who we share it with

We never sell your personal data, names, email addresses, or any other information, and we never share it for advertising. We share data only with the service providers strictly needed to operate Throughway, and only so they can perform services for us:

  • Google — for sign-in (authentication only).
  • Fly.io — our hosting and managed database provider, which stores the application data.

These providers act as our processors under contractual data-protection terms. We may also disclose data if required by law, or to protect the rights, safety, and security of our users and the service.

5. International transfers

Our infrastructure is hosted in the United States. Where personal data is transferred outside the EEA or the UK, that transfer is covered by appropriate safeguards such as the European Commission's Standard Contractual Clauses (and the UK Addendum where applicable).

6. How long we keep it

We keep your account data and content for as long as your account is active. If you ask us to delete your account, we delete your account data and the content you have stored within a reasonable period, except where we are required to retain limited information to comply with a legal obligation. Security logs are kept only for a short period.

7. Your rights

If you are in the EU or UK, you have the right to:

  • access the personal data we hold about you;
  • have inaccurate data corrected;
  • have your data erased ("right to be forgotten");
  • restrict or object to certain processing;
  • receive your data in a portable format;
  • withdraw consent at any time, where processing is based on consent.

To exercise any of these rights, email jeremy.lightsmith@gmail.com. You also have the right to lodge a complaint with your local data-protection supervisory authority.

8. Security

We use industry-standard measures to protect your data, including encryption in transit (HTTPS) and access controls that limit data to your own account. No system is perfectly secure, but we work to protect your information and limit what we collect in the first place.

9. Children

Throughway is intended for use by coaches and is not directed at children under 16. We do not knowingly collect personal data from children.

10. Changes to this policy

We may update this policy from time to time. When we do, we will revise the "Effective" date above and, for material changes, take reasonable steps to let you know.

11. Contact

Questions about this policy or your data? Email jeremy.lightsmith@gmail.com.