Comet Privacy Policy

Version 2026-08-en-v5. Last updated: 2 August 2026.

1. Who we are

The Comet app is developed and operated by Aerolith Technology Inc. ("Aerolith", "we", "us", "our"). Comet is a swim tracking application that lets a swimmer view their own training data. This policy explains what personal information we collect, why we collect it, and the choices you have.

For any privacy question, or to exercise your rights, contact our Privacy Officer at privacy@aerolith.tech.

2. What we collect

We keep data collection to a minimum. We collect:

• Account information: full name, email address, and date of birth. For an account belonging to a swimmer under 14, the account holder of record is the parent or guardian, and we also collect the parent or guardian's name and contact details for consent purposes.
• Swim data: training sessions, times, splits, and related performance metrics that you or your club record.
• Subscription information: if you subscribe to Comet+, your plan type, subscription status, and related dates. We never receive or store your card numbers or payment details (see Section 6).
• Profile photo (optional): a photo you choose to upload for your profile. It is never required, it is visible to your coach and your club where you have consented to joining a club (see Section 6), and you can remove it at any time. For an account belonging to a minor, the parent or guardian's consent covers this photo.
• Technical and usage data: limited app and device information and behavioral analytics, collected only where you have given consent (see Section 8). We do not collect this from any account belonging to a minor.

We do not collect precise location, biometric identifiers, or government issued identifiers.

Account creation and sign-in with Apple or Google

You can create your account with an email address and password, or through Apple ID or Google. When you use Apple or Google, we receive only the information those services pass to us with your authorization: a sign-in identifier and, depending on your choice, your name and email address. If you choose to hide your email with Apple ("Hide My Email"), we receive a relay address. We then ask you to complete your profile (first name, last name, date of birth, and your real email if you used a relay address). Your real email is used to recover your account and your data; you may choose not to provide it. Your date of birth is required: it determines your swimmer age category and the application of the protections for minors described in Section 7.

3. Demo mode: no collection before an account

Before an account is created, the app can be explored in a demo mode populated with fictional sample swimmers. In demo mode, we collect no personal information: no training data is recorded (the stopwatch runs without saving and no draft is kept on the device) and no browsing data is associated with an identifiable person.

4. Why we use your information

• To create and secure your account.
• To show you your own swim tracking and progress.
• To manage your Comet+ subscription and give you access to the features it entitles you to.
• To operate, maintain, and improve the app.
• To communicate with you about your account.

We use your information only for these purposes, or for a new purpose that we tell you about and, where required, obtain your consent for.

5. Our legal basis

Where the GDPR applies, we rely on your consent and on our legitimate interest in operating the app. Where Quebec's Law 25 applies, we rely on your consent. For a swimmer under 14, we rely on the consent of the parent or guardian. You can withdraw consent at any time (see Section 10).

6. Who can see your data

Swimmer accounts are read-only and show only that swimmer's own data. We do not sell your personal information, and we do not share it for advertising.

6.1 Service providers

We share data only with service providers who help us run the app, for example hosting, authentication, email delivery, and analytics. These providers act on our instructions, under contract, and only for the purposes set out above.

6.2 Subscriptions, payment, and RevenueCat

Comet+ subscriptions are billed by Apple (App Store) or Google (Google Play) depending on your device. We never receive or store your card numbers or payment details: they are processed exclusively by Apple or Google under their own privacy policies. To manage the state of your subscription (trial, active, expired), we use RevenueCat, Inc. as a service provider. RevenueCat processes on our behalf an anonymous identifier for your account and the transaction information passed on by the app stores (plan type, dates, status), with no payment information. A data processing agreement governs this processing. Information related to your transactions is used only to provide you the access your subscription entitles you to and to meet our legal obligations.

6.3 Sharing with your club (consented club membership)

If you sign up through a swim club's invitation link, or if you join a club later, you can consent to that club seeing some of your information: first name, last name, age group, and performance data (times, sessions, progress). This sharing requires your explicit consent, given when you join; it is never on by default. The club never sees your email address or your date of birth. You can withdraw your consent and leave the club at any time in your profile: the club's visibility into your information stops immediately. For users under 14, joining a club requires the consent of the parent or guardian, following the mechanism described in Section 7.

7. Children and minors

We take children's privacy seriously. Two distinct protections apply, independently of each other:

1. Consent to collection (under 14). A swimmer aged 14 or over may consent for themselves. For any swimmer under 14, creating the account and any collection of personal information require the consent of a parent or guardian before the account is activated, obtained, timestamped, and kept under our parental consent process. The parent or guardian is the account holder of record and the swimmer is an authorized user under that account. Joining a club requires additional parental consent (see Section 6.3).
2. Commercial communications (under 13). For users identified as under 13, no commercial solicitation is shown in the app; the information from those accounts is not used for any advertising or commercial purpose.

The consent threshold of 14 is the most protective of the standards that apply to us, and meeting it also satisfies the United States standard (the Children's Online Privacy Protection Act, which concerns children under 13) and the European Union standard (the General Data Protection Regulation, where member-state thresholds range from 13 to 16). The threshold of 13 for commercial communications derives from Quebec's Consumer Protection Act.

A parent or guardian may review, correct, or request deletion of their child's information at any time by contacting us.

8. Cookies, analytics, and behavioral data

We use a consent tool to manage cookies and similar technologies. Non essential analytics run only after you consent, and you can change your choice at any time. Behavioral tracking is defaulted to off for any account belonging to a minor.

9. Data sharing and international transfers

If we store or process data outside your region, for example with a hosting provider, we take steps to ensure it receives a comparable level of protection, consistent with Law 25 and the GDPR.

10. Your rights

Depending on where you live, you have the right to:

• Access the personal information we hold about you.
• Correct inaccurate information.
• Delete your information.
• Receive a copy of your information in a portable format (export).
• Withdraw consent at any time.
• Object to or restrict certain processing (EU).

For a swimmer under 14, these rights are exercised by the parent or guardian who holds the account. To exercise any right, contact us at privacy@aerolith.tech. We respond within the timelines required by applicable law.

11. How long we keep your data

We keep your information while your account is active. When you close your account, withdraw consent, or ask us to delete your data, we delete or anonymize your personal information and swim data within 30 days, consistent with your right to erasure, with one exception: billing and subscription records (transactions, subscription statuses, related tax information) are kept for seven (7) years to meet our legal accounting and tax obligations (the Income Tax Act and Quebec tax laws). Those retained records are used for no other purpose.

We also keep a minimal record that consent was given, with identifying details removed, so we can demonstrate compliance.

If your subscription expires without the account being deleted, your training data remains stored and becomes accessible to you again if you resubscribe.

12. Security

We use reasonable technical and organizational measures to protect your information against loss, misuse, and unauthorized access. No system is perfectly secure, and we cannot guarantee absolute security.

13. Changes to this policy

We may update this policy. We will post the new version with an updated date and version number, and where the law requires, we will ask for your consent again.

14. Contact and complaints

Privacy Officer: reachable at privacy@aerolith.tech.

If you are in Quebec, you may also contact the Commission d'accès à l'information du Québec. If you are in the European Union, you may contact your local data protection authority.