Privacy Policy

1. Introduction

Welcome to Cotra Limited ("Cotra", "we", "our", or "us").

This Privacy Policy explains how we collect, use, store, share and protect your personal information when you use our mobile application, our website and related services.

Cotra is an invite-only tool for sports coaches and the guardians they coach for. There is no public directory and no way to browse or discover other users.

2. Who We Are

Cotra Limited, a company registered in England and Wales, company number 17285541, registered office 65 Burgoyne Road, Sunbury-On-Thames, England, TW16 7PS.

For the purposes of UK data protection law, Cotra Limited is the data controller of your personal information.

Questions about this policy, or about your personal data: privacy@cotraofficial.co.uk

3. Information We Collect

Information you provide

• Email address — this is how you sign in. We do not use passwords.
• Your name
• Coaches only: a short profile description, and the name of your coaching space
• Coaches only: the sessions you offer — date, time, duration, number of places, and location
• Coaches only: your declaration that you hold the background checks, safeguarding training, governing-body clearance and insurance your coaching requires, recorded with the date you made it
• Guardians only: booking requests, including a label saying who the session is for
• Messages you send through the app
• Reports you submit about content or another user, including a copy of the message reported
• A record that you accepted this policy and our other terms, with the version and date
• If you enquire about coaching with Cotra before signing up: your name, email, phone number, sport and location

We ask for a name on a booking so the coach knows who is attending. Some guardians enter a child's first name here. We do not ask for, and do not hold, a child's date of birth, contact details or photograph, and children do not have accounts — see §10.

We do not collect your date of birth, your postal address, payment or card details, or copies of any certificate. We record a coach's declaration about their checks and insurance; we do not see or hold the certificates themselves.

Please do not enter health information into the app. Where an athlete has an injury, medical condition, allergy or access requirement, tell your coach directly rather than typing it into a message or a booking label. See §5 for why this matters.

Information collected automatically

• Crash and error diagnostics, if the app fails. These are stripped of identifying information before they leave your device — no email addresses, account identifiers or message content.
• A push notification token for your device, if you turn notifications on.
• Website only: our web server keeps ordinary request logs, including IP address and browser type, for security and reliability.

The app contains no analytics, advertising or tracking software of any kind, and our website sets no cookies.

Information about other people

If you name a child on a booking, that information comes from you, not from them. We hold nothing else about that child and have no way to contact them — which is why we give this notice to you rather than to them.

4. How We Use Your Information

• To create and run your account and sign you in
• To show a coach's sessions to the guardians they have invited, and to manage booking requests
• To deliver messages between a coach and a guardian
• To send notifications you have asked for
• To respond to reports about content or conduct, and to keep people safe
• To respond to your enquiries
• To fix faults and keep the service secure
• To meet our legal obligations

We do not profile you, advertise to you, or sell your data. We do not use your data to train machine-learning models.

5. Legal Basis for Processing

Data protection law requires us to have a lawful basis for each thing we do with your information. This is ours:

Where we rely on legitimate interests, we have weighed our interests against your rights and concluded that the processing is necessary and that you would reasonably expect it. You can object to any of it — see §12.

Health information

Sport involves telling a coach about injuries, medical conditions, allergies and access requirements. That is health information, which the law protects more strictly than ordinary personal data.

Give this information to your coach directly — in person, by phone, or however you and your coach normally arrange this — rather than through the app. Cotra does not ask for it, there is no dedicated field for it, and we do not want to hold it.

If you choose to include it in a message or booking anyway, you are explicitly agreeing that Cotra may process it for the sole purpose of delivering it to your coach. By sending a message or booking request that contains this kind of information, you give us your explicit consent under Article 9 of the UK GDPR to handle it for that purpose only. You can withdraw this consent at any time by asking us to delete the message — see §12 — though we cannot un-deliver something already sent to your coach.

We do not use health information for anything beyond delivering it to the person you sent it to, we do not analyse it, and it is deleted when you delete your account (see §8).

Safeguarding reports

A report about someone's conduct may contain information about a person's health, or about alleged criminal behaviour. Both need a specific condition in law beyond the bases in the table above.

We rely on the condition for safeguarding children and individuals at risk in the Data Protection Act 2018. That condition requires us to keep an Appropriate Policy Document explaining how we comply. It is held with our Safeguarding Policy and is available on request at privacy@cotraofficial.co.uk.

6. Sharing Your Information

Within the app

Your name is visible to the coach whose space you have joined, and to guardians only insofar as a coach's name is shown. Guardians in the same space cannot see each other. Messages are one-to-one between a coach and a single guardian — there are no group chats.

Our service providers

Coaches are independent and make their own decisions about who they coach. The exact data-protection relationship between Cotra and individual coaches is being confirmed and will be reflected here and in the Coach Agreement. In practice, if you ask us to delete information about you, we will action it — you do not need to approach your coach separately.

Legal and regulatory authorities

Where required by law, court order or regulator, or to protect someone's safety. This includes referring a safeguarding concern to the police, a local authority or a governing body, which we may do without your agreement where a child may be at risk.

We do not sell, rent or trade your personal information.

7. International Transfers

Almost everything we hold stays in the United Kingdom or the European Economic Area. Your account, bookings and messages are stored in London.

One exception you should know about: push notifications. If you turn them on, the notification is sent through Expo and then Apple or Google, all in the United States, so that it can reach your device. A notification about a new message includes the first part of that message — this is how notifications work on every app and every phone, and it is why the message preview appears on your lock screen.

Where this data leaves the UK, we rely on:

• Expo — the UK Extension to the EU–U.S. Data Privacy Framework, under which Expo (650 Industries, Inc.) is self-certified.
• Google (push delivery via Firebase Cloud Messaging) — the UK Extension to the EU–U.S. Data Privacy Framework, under which Google LLC is self-certified.
• Apple (push delivery via APNs) — the UK Addendum to the EU Standard Contractual Clauses, which Apple uses for personal data transferred from the UK and EEA.

If you would rather this did not happen, turn off notifications in the app or in your device settings.

A second exception: email you send us. Addresses on our domain are forwarded to a mailbox held with a personal Google account, which means anything you email us — including a safety report — may be stored outside the UK. We have not yet put a transfer safeguard or data processing agreement in place for this route. This is a known gap, and we are working to close it. You can ask us for an update at the address below.

You can ask us for details of any of these safeguards at privacy@cotraofficial.co.uk.

8. Data Retention

A report that we have not yet dealt with is never deleted on a timer.

9. Data Security

Access to your data is enforced by the database itself, not only by the app: a guardian can see a coach's sessions, bookings and messages only while they are a member of that coach's space, and a coach can see only their own space. Data is encrypted in transit.

No internet service can promise absolute security, but we do not hold card details, and we do not store your data outside the providers listed in §6.

If a security breach affects your personal data and is likely to result in a high risk to you, we will tell you, and we will report it to the Information Commissioner's Office where the law requires.

10. Children's Data

Cotra accounts are for adults. We onboard coaches and guardians, both of whom must be 18 or over. Children do not have accounts, cannot sign in, and are not users of the app. You confirm this when you sign up.

The one place a child may be named is the label on a booking, where a guardian says who a session is for — see §3. That is a first name entered by an adult. We do not collect a child's date of birth, contact details, photograph, medical or any other information, and we ask guardians not to enter such details anywhere in the app.

We designed the app to support this. In particular, messaging is one-to-one only and there are no group chats, so information about a child is never broadcast to other families.

If you believe a child has created an account, contact safety@cotraofficial.co.uk and we will remove it.

11. Cookies

Our website does not use cookies. It sets no cookies of any kind, and contains no analytics or advertising trackers.

The app stores your sign-in session on your own device so you do not have to sign in each time. That is local to your phone and is cleared when you sign out.

12. Your Rights

Under UK GDPR you have the right to:

• Access a copy of your personal information
• Correct information that is wrong
• Have your information deleted
• Restrict or object to how we use it
• Receive your information in a portable format
• Withdraw consent where we rely on it

We do not make automated decisions about you. Nothing in Cotra profiles you or decides anything about you without a person involved.

Deleting your account you can do yourself, in the app under Settings, or from cotraofficial.co.uk/delete-account without signing in.

For anything else, email privacy@cotraofficial.co.uk and we will respond within one calendar month, free of charge. We handle these requests by hand — there is no automatic download button — so please tell us what you are looking for.

What happens when you delete your account

Your profile, messages, bookings, notification settings and device tokens are deleted.

Some things deliberately survive, and you should know which:

• If you are a coach, your coaching space is closed rather than erased, so the guardians you coached keep their own booking and message history. Your personal details are removed, but the name of the space remains.
• Reports about content or conduct are kept for the period in §8, with the link to you removed. A safety record that the person it concerns can delete on demand would not be a safety record.
• Records of payments are kept for tax purposes, with the link to you removed.

You also have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk.

13. Third-Party Links

Our website and app may link to other websites. We are not responsible for their privacy practices, and we encourage you to read their policies.

14. Changes to This Privacy Policy

We may update this policy. Changes are posted here with a new "Last Updated" date and a version number. Where a change materially affects how we handle your data, we will ask you to review and accept the new version in the app.

15. Contact Us

Cotra Limited (company number 17285541), 65 Burgoyne Road, Sunbury-On-Thames, England, TW16 7PS

ICO registration number: 00015217864

If you are not satisfied with our response, you may contact the Information Commissioner's Office at ico.org.uk.