Privacy Policy

01Who we are

Whistle is a coaching and academy-management platform built by School of Sports and operated by Rush Hour Sports Private Limited ("we", "us", "our"). This policy explains how we handle personal data in the Whistle mobile app for Android and iOS and the Whistle web console at www.sos-whistle.com, together called the "Service".

For any privacy question or request, write to support@schoolofsports.co.in.

02Who uses Whistle, and our role

Whistle is used by sports academies and the adults connected to them:

• Academy owners and administrators run their academy, centres, batches, fees and staff.
• Coaches take sessions, mark attendance and record player progress.
• Parents and guardians follow their child's schedule, attendance, progress and fees.

Students, who are often children, do not sign in to Whistle. Their records are created by their academy, or by a parent linking their child. For those records, the academy decides what to collect and why. We process that data on the academy's behalf and under its instructions. If you have a question about a student's record, you can contact the academy directly or contact us and we will help.

03Information we collect

Account information

• Name, email address and, optionally, phone number.
• Your password, stored only as a secure one-way hash.
• Your role (admin, coach or parent) and the academy you belong to.

Student information, provided by the academy or a parent

• Name, date of birth and gender.
• Optional contact email and phone number.
• Parent or guardian name and email.
• Centre, batch and enrolment details.
• Attendance, skill level, assessment and drill results, coach notes, ratings and match statistics.
• Records of in-app games such as chess and Scrabble.
• Participation in inter-school events, including whether parental consent was confirmed.

Coach and staff information

• Session check-in and check-out times, and the device location recorded at those two moments (see section 04).
• Attendance records.
• Skills and reporting line.
• Payroll and expense records that the academy enters.

Payment information

• Invoices, amounts, payment status and the transaction reference returned by our payment partner.
• Payments are processed by Razorpay. We never collect or store card numbers, UPI PINs or bank account credentials.

Messages and content

• Messages you send in in-app chats and event chats.
• Notice-board posts.

Device and technical information

• A push-notification token, your device's brand, model and operating system, and when the app was last active.
• Basic server logs, such as IP address and request time, which we use for security and troubleshooting.

04App permissions

Location (precise and approximate)

We use location for coaches only, to confirm they are at the venue when they check in to a session:

• Location is read only while a coach has a session's check-in screen open.
• It is saved only at check-in and check-out, together with the distance from the venue.
• Whistle does not access location in the background.
• Parents are never asked for location.

You can deny or revoke this permission in your device settings. If you do, location-verified check-in will not be available.

Biometrics (fingerprint or face unlock)

Coaches may be asked to confirm a check-in with their device's fingerprint or face unlock. Your phone's operating system handles the check entirely on the device. Whistle only receives a yes or no result.

Notifications

We use notifications to send session reminders, attendance updates, fee reminders and academy announcements. You can turn them off in the app's settings or your device settings.

05How we use your information

• To run the Service: accounts, scheduling, attendance, assessments, progress tracking, leaderboards and in-app games.
• To let parents follow their child and let coaches and academies manage their players.
• To bill and collect fees on behalf of academies.
• To send service messages: login credentials, password resets, reminders and announcements.
• To keep Whistle secure, prevent misuse, fix problems and improve features.
• To meet legal obligations, such as tax and accounting record-keeping.

We do not sell or rent personal data. We do not use personal data for advertising. We do not build advertising profiles of children.

06Who can see your information inside Whistle

07Service providers we share data with

We share only the data each provider needs to deliver its part of the Service. Each provider is bound to protect it.

We may also disclose information:

• When the law requires it, or to protect the rights and safety of users and the public.
• As part of a merger or acquisition. If that happens, this policy will continue to apply to your data.

08Children's privacy

Whistle is meant for adults. Only people aged 18 or over can create an account. Children's information enters Whistle only through their academy or their parent or guardian. Academies are responsible for obtaining a parent's or guardian's consent before adding a child, as required by India's Digital Personal Data Protection Act, 2023.

With children's data, we do not:

• Use it for advertising.
• Track children's behaviour for advertising or marketing.
• Sell it.

A parent or guardian can ask to review, correct or delete their child's data at any time, through the academy or by writing to us.

09Where and how we store data

Data is stored on Amazon Web Services servers in India (Mumbai region). We protect it with reasonable security practices, including:

• Encryption in transit (HTTPS/TLS).
• Encrypted file storage.
• Passwords stored only as hashes.
• Login tokens kept in your device's secure storage.
• Role-based access, so users see only what their role permits.

No system is completely secure. If a breach affects your data, we will notify you and the authorities as the law requires.

10How long we keep data

• Account and student data is kept while the account, or the student's enrolment with the academy, is active.
• After you delete your account, we delete or anonymise your personal data within 30 days.
• Backups containing your data are overwritten within a further 30 days.
• Invoices and payment records are kept for up to 8 years, as required by Indian tax and accounting law.
• Push tokens are removed when you log out or when a token stops working.

11Your rights

You can ask us to:

• Access your personal data, or a summary of it.
• Correct or update it.
• Delete it.
• Withdraw consent you have given.
• Nominate someone to exercise these rights for you.
• Resolve a complaint (see section 13).

To make a request, email support@schoolofsports.co.in. We will respond within 30 days. If the request concerns a record your academy controls, we will work with the academy to fulfil it.

12How to delete your Whistle account

1. From the email address registered to your Whistle account, send an email to support@schoolofsports.co.in with the subject "Delete my Whistle account".
2. We will confirm the request with you. We then delete your account and its personal data within 30 days.

What is deleted:

• Your profile (name, email, phone, password).
• Your push tokens and notification settings.
• Your messages.
• If you are a parent, the link to your children.

What is kept:

• Invoices and payment records, for up to 8 years as required by law.
• Records your academy needs to keep, such as attendance registers. Where possible, these are anonymised.

To delete a child's records, parents can ask their academy, or email us and we will coordinate with the academy.

13Grievance Officer

This section is provided under the Information Technology Act, 2000, its rules, and the Digital Personal Data Protection Act, 2023.

Grievance Officer: Siddarth Krishnamoorthy
Rush Hour Sports Private Limited
Email: siddarth.krishnamoorthy@gmail.com

We acknowledge complaints within 48 hours and aim to resolve them within 30 days.

14Changes to this policy

We may update this policy from time to time. The latest version will always be on this page, with the "Last updated" date. If we make significant changes, we will notify you in the app or by email.