Comet Privacy Policy

Version 2026-10-en-v8.2. Last updated: 16 October 2026. In effect on 16 October 2026.

Beta programme: the beta programme ends on 15 October 2026 at 5:55 a.m., Montreal time. What remains of beta addendum A1 is in Section 8.4.

1. Who we are

The Comet app is developed and operated by Aerolith Technology Inc. ("Aerolith", "we", "us", "our"). Comet is a swim tracking application: it lets a swimmer record and follow their training, times and progress, and lets a swim club follow the swimmers who join it. This policy applies to the app (iPhone, iPad, Android and web) and to our website cometswim.com. It explains what personal information we collect, why, who we share it with, and the choices you have.

For any privacy question, or to exercise your rights, contact our Privacy Officer at privacy@aerolith.tech.

2. What we collect

We keep data collection to what Comet needs. We collect:

• Account information: full name, email address, date of birth and region (for example Quebec, another Canadian province, the United States, a European Union country or another country). The region is used to apply your region's age threshold (Section 7), to choose the swimming time standards and the help resources Coach+ offers (Section 6.5), and to suggest profiles to you (Section 6.4). For a swimmer under that threshold, we also collect the parent or guardian's email address and phone number, only to obtain and prove their consent, to have them confirm by text message any change to the account's email address, and to inform them of significant changes affecting their child's account.
• Swim and training data: the sessions, times, splits, distances and durations that you or your coach record; the notes, perceived effort and wellness signals (for example tiredness, pain, illness, lack of sleep or stress) that you choose to add to a session; your mood and notes in the daily training journal; your pools, schedules and training plans; the attendance and lanes your coach records for you; the swims you import from Apple Health and, for beta programme testers who connected it, from Strava (Section 6.6). Wellness signals and the journal may reveal information about your health; they are never required.
• Race category (optional): if you use the Standards feature, you can set your category (Male, Female, or Prefer not to say). It is used to compare your personal bests against official federation time standards, which are published by sex, and, if you use Coach+, to put your times in context: it is then sent to Coach+ with your age (Section 6.5). It is never required, it is never visible to your coach or your club, and you can change it or set it back to "Prefer not to say" at any time. For a swimmer under their region's age threshold, the category is entered by the swimmer after the account is activated; the parent or guardian's consent covering the account also covers this data.
• Public competition results: results published by federations and meet organizers (name, club, category, events and times). They feed your race history when you link them to your account and, if you turn on sharing, are visible to your club (Section 6.3); our results service lets anyone, even without an account, find them by searching a name.
• Import of your official results (iPhone, iPad and Android app): if you use this import, you sign in, in a window of the app, to the swimming results website that lists your times; the app then reads your personal-best and meet pages on that website and sends them as they are to our results service, which extracts your races from them. Those pages also contain the public results of other swimmers at the same meets.
• Public profile (if it is on; it is on by default for an account created at age 14 or older): the display name, short bio and specialties you choose to add, and the list of swimmers you follow and who follow you (Section 6.4).
• Subscription and purchase information: if you subscribe to Comet+, your plan type, subscription status, purchase channel and related dates, including the end of the current period. For a purchase on our website, we also receive the payer's name and email address from Stripe (Section 6.2). We never receive or store your card numbers.
• Profile photo (optional): a photo you choose to upload for your profile. It is never required; it is visible to you and to a coach who has you in their active group (Section 6.3), never to your club's account or to other swimmers, even on a public profile; and you can remove it at any time. For a swimmer under their region's age threshold, the parent or guardian's consent covers this photo.
• Coach+ content: your messages to Coach+ and its answers, the notes Coach+ keeps about you (for example an injury, a goal or your equipment) and the training photos or PDFs you submit to it (Section 6.5).
• Usage measurement and error reports: for every account, including minors' accounts, data about how the app is used and technical information about the device and the app, tied to your account through a pseudonym (Section 8.2), plus technical error reports linked to your account: an error code, where it happened in the code, the app version and technical indicators (screen, request type, HTTP code, duration), never any text you typed. Apple and Google may also provide us with crash and performance reports for the app, depending on your device's diagnostics sharing settings.
• Notifications: your device's notification token, if Comet's notifications are allowed on it (Section 8.3).
• Our website's forms: if you write to us through a form on our website (contact, support, ambassador clubs), we receive your message and the contact details you enter by email, sent by Resend after a Cloudflare Turnstile bot check, and you receive an acknowledgement; the form stores nothing in our database.
• Browsing on our website and web purchases (with your consent only): see Section 8.1.

We do not collect precise location, biometric identifiers, or government issued identifiers.

Account creation and sign-in

You create your account with an email address and a password. If you buy Comet+ on our website, your account is created from the email address entered at checkout, and you then complete it (swimmer's name, date of birth and password); if a Comet account already uses that address, the purchase is attached to that account once you sign in to it. If you already have an account, you can also sign in to it in the app with Apple (iPhone and iPad) or with Google (iPhone, iPad and Android); creating a new account with Apple or Google is not offered for now, and neither sign-in method is offered on the web. With Apple or Google, we receive only the information those services pass to us with your authorization: a sign-in identifier and, depending on your choice, your name and email address. If you hide your email with Apple ("Hide My Email"), we receive a relay address. Your date of birth is required: it determines your swimmer age category and the application of the protections for minors described in Section 7; if you turn on sharing, your club sees its month and year, never the day (Section 6.3).

3. Demo mode

Before an account is created, the app can be explored in a demo mode populated with fictional sample swimmers. In demo mode, we collect no personal information: no training data is recorded (the stopwatch runs without saving and no draft is kept on the device) and no browsing data is associated with an identifiable person. Nothing is measured in demo mode. The purchase, sign-up and sign-in screens are not part of demo mode: see Sections 6.2 and 8.2.

4. Why we use your information

• To create and secure your account, and confirm your email address.
• To show you your swim tracking and progress and, if it is on, your public profile.
• To process your purchases, manage your Comet+ subscription and give you access to the features it entitles you to.
• To provide Coach+, if you use it.
• To share your data with your club, if you join one.
• To run our competition results service, which lets anyone find public results by searching a name.
• To operate, secure, diagnose and improve the app, including through usage measurement (Section 8.2) and error reports.
• To send you the notifications you have allowed (Section 8.3).
• To communicate with you about your account.
• On our website only, and only with your consent, to measure our ads and show them on Facebook and Instagram (Section 8.1).

We use your information only for these purposes, or for a new purpose that we tell you about and, where required, obtain your consent for.

5. Our legal basis

Depending on the law that applies to you, we process your information on one of these bases: your consent, or that of your parent or guardian if you are under your region's age threshold (Section 7); the performance of our contract with you (our Terms and Conditions); our legitimate interest in operating, securing and improving the app, including through usage measurement and error reports; or compliance with a legal obligation. The Meta pixel on our website and the report of a web purchase to Meta rely on your consent only. You can withdraw your consent or object to usage measurement at any time (Section 10).

6. Who can see your data

Your swim data is visible to you and, depending on your choices, to your club and its coaches (Section 6.3); your public profile, if it is on (it is on by default for an account created at age 14 or older), is visible to other swimmers signed in to Comet (Section 6.4). We do not sell your personal information. Your swim and health data are never shared for advertising. On our website only, and only with your consent, we use the Meta advertising pixel; if you then buy Comet+ on the web, we report that purchase to Meta (Section 8.1).

Authorized members of our team can access your account when needed to help you, run Comet or handle a request, for example to change an account's email address, reset a password or resend a parental consent request. These actions go through an authorization check and are logged.

6.1 Service providers

We share information with service providers who help us run Comet. They act on our instructions, under contract, and only for the purposes described in this policy. They include:

• Supabase (database, authentication, photo storage and server functions); our main database is hosted in Canada (ca-central-1 region);
• PowerSync (syncing your data between your devices and our servers);
• Vercel (hosting of the web app and our website);
• Railway (hosting of our competition results service) and Supabase, for that service's database, hosted in the United States (us-west-2 region);
• Resend (email delivery) and Twilio (text message delivery of the verification code to the parent or guardian);
• Google (Firebase Cloud Messaging) and Apple (Apple Push Notification service), for notifications (Section 8.3);
• RevenueCat (status of subscriptions bought in the App Store and Google Play, Section 6.2);
• Stripe (payment for purchases made on our website, Section 6.2);
• Anthropic (Coach+ and reading training photos and PDFs, Section 6.5);
• Cloudflare (Turnstile, the bot check on our website's forms).

Usage measurement data is not passed to any third-party analytics tool. Apple, Google, Stripe, Strava and Meta also process information under their own privacy policies when you use their services (stores, sign-in, payment, Strava, social networks).

6.2 Subscriptions, payment, RevenueCat and Stripe

Comet+ can be bought in three ways:

• in the App Store: Apple is the seller and processes the payment;
• in Google Play: Google is the seller and processes the payment;
• on our website: Aerolith is the seller and the payment is processed by Stripe. Stripe collects the payer's name, email address, billing address and payment information, and keeps the proof that our Terms and Conditions were accepted before payment and, where applicable, your agreement to the purchase being reported to Meta (Section 8.1). We receive from Stripe the payer's name and email address, the Stripe customer and subscription identifiers, the plan, the subscription status and the end of the current period. Your Comet account is created from that email address; if an account already uses that address, the purchase is attached to it once you sign in to it.

We never receive or store your card numbers. For purchases in the App Store and Google Play, we use RevenueCat, Inc. as a service provider to manage the state of your subscription (trial, active, expired): RevenueCat processes on our behalf an identifier of your account, without your name or email, and the transaction information passed on by the store (plan type, dates, status), with no payment information. A data processing agreement governs this processing. Information related to your transactions is used only to give you the access your subscription entitles you to, to manage your subscription and to meet our legal obligations. Apple, Google and Stripe also process this information under their own privacy policies.

6.3 Sharing with your club

If you join a swim club, through its invitation link or later, the club gets access to some of your information:

• the club's account sees your first and last name, your age group, your shared sessions with their times, your training volume and, if sharing is on, your birth month and year and your official competition results, but never your notes, your perceived effort or your wellness signals;
• a coach of the club who has you in their active group (coach space) also sees your profile photo if you have one, whether you are a minor, the notes, perceived effort and wellness signals of your shared sessions, and the attendance and lanes they record for you.

The club never sees your email address or the day you were born. Consent to this access is given by accepting our Terms and Conditions, in the same way at any age; for a swimmer under their region's age threshold, the parent or guardian accepts (Section 7). Once you have joined, your new sessions are shared with your club by default, as announced at the moment you join. You can make a session you recorded yourself private in one tap, at any time; it then immediately disappears from the club's dashboard and statistics, including for the past. Sessions recorded by your coach stay visible to the club. You can leave your club at any time in your profile: the club's access stops at once. Swims imported from Strava are never shared with a club (Section 6.6).

Competition results and birth month. Sharing your official competition results and your birth month with your club is turned on when you join, on the screen that announces it, or later with a tap in the app. The club then sees every result linked to your account, including those from before you joined: the event, the pool, the official time, the date and the meet name, as published by federations, never your place or your points. It also sees your birth month and year and your age on 31 December, never the day. Like meet entry tools, it likewise sees the competition category published by the federation with each result (for example "Girls 13-14") and the standards reached. The category you enter yourself in Comet (Section 2) is never shown to it. For a swimmer under their region's age threshold, this sharing is possible only if the parent or guardian has accepted a version of this policy that provides for it (Section 7). You can stop this sharing at any time in your profile without leaving the club: this information then disappears from the club's dashboard at once, including for the past. Leaving the club also stops this sharing, and joining again needs a new tap.

6.4 Public profile and followers

Comet lets you have a public profile that other swimmers signed in to Comet can view, follow and find by searching a name or through suggestions (same club, same region or close age). The public profile shows your first and last name, your club, your age category (never your date of birth), your follower and following counts, your best times and your badges, as well as the display name, short bio and specialties you choose to add. Your public best times come from your imported races and the sessions shared with your club or, if you have not joined a club, from all your sessions. Your profile photo is never shown on it. An account created at age 14 or older is public by default; an account created before 14 stays private until you turn the profile on, even after you turn 14. You can turn your public profile on or off at any time in Settings. A private profile appears nowhere and is never suggested.

6.5 Coach+ and Anthropic

Coach+ is Comet+'s training assistant. Its answers are produced by artificial intelligence models of Anthropic, PBC, a United States company acting as our service provider. Coach+ is optional: if you do not use it, nothing is sent to Anthropic. Before your first question to Coach+ or your first import of a photo or PDF, the app shows you this information and asks for your agreement; if you do not give it, nothing is sent to Anthropic. When you write to Coach+, we send Anthropic, to produce the answer:

• your message and the previous messages of the conversation;
• your training profile (reference paces, pool length, equipment, goals, language, and whether you are a minor);
• your age and your race category, to put your times in context;
• up to 15 notes Coach+ has kept about you, including injuries;
• what is on screen (for example a workout);
• your best times, their dates and your standards;
• the names of your pools;
• your recent and upcoming sessions (date, session type, title or the start of the note, distance, duration, and whether it is shared with your club).

When you submit a training photo or PDF to Coach+ (for example your coach's whiteboard), the file is sent to Anthropic to be read; we do not keep the file, only the result of that reading, and nothing is added to your workout library before you confirm. We never attach your name, email address or date of birth to what we send Anthropic, unless you write them yourself in a message, and we never send swims imported from Strava. This information is processed in the United States (Section 9).

At your request, Coach+ can move, correct or delete one of your training sessions, or add a time slot to your calendar; the app asks you to confirm a deletion, and Coach+ never changes a race result or a session recorded by your coach. Coach+ also keeps useful notes about you on its own (for example an injury, a goal or your equipment); to have these notes deleted, write to us at privacy@aerolith.tech. Coach+ is offered from age 13: it is never offered to an account under 13, and nothing is sent to Anthropic for that account. For a minor swimmer aged 13 or over, the dryland routines it suggests are limited to bodyweight or a light elastic band, supervised by an adult or their coach. If a message suggests distress, Coach+ offers help resources chosen for your region.

Coach+'s answers are generated automatically by artificial intelligence and may contain errors: they are neither coaching nor medical advice, and they do not replace a coach or a health professional (Terms and Conditions, Section 12).

We keep your conversations and Coach+'s notes in our database until your account is deleted. You can review your past conversations in Coach+ ("Your conversations"). An account under 13 has no access to Coach+, and so not to this history in the app. To get a copy of your conversations or have them deleted, write to us at privacy@aerolith.tech.

6.6 Apple Health and Strava

Apple Health (iPhone and iPad). If you allow it, Comet reads your swim workouts, swimming distance and stroke count from Apple Health, to add them to your history. Comet writes nothing to Apple Health. These swims are then handled like your other sessions, including by Coach+ (Section 6.5). They are never used for advertising or sent to Meta.

Strava (beta programme testers only). The Strava connection is not offered to the public: it was offered only to beta programme testers, aged 13 and over. For a tester who connected it, Comet reads the list of their Strava activities and keeps only their swims (start date and time, name, distance, moving time and activity link); the access tokens Strava gives us are kept on our servers only. If the tester turned on sending to Strava (off by default), Comet creates there an activity for each training recorded in Comet after it was turned on, with the session's title or the start of its note (up to 100 characters), its date, its distance and its duration. Swims imported from Strava are never shared with a club or coach, never sent to Coach+ and never count as races. When the beta programme ends for an account, Comet stops importing from Strava and sending activities to it for that account. The tester can disconnect at any time in Comet; when Strava notifies us that the tester removed Comet's access from Strava, the effect is the same. In both cases, the swims imported from Strava are deleted from Comet, and the activities Comet created on Strava stay in their Strava account. When Strava notifies us that a swim imported from Strava was deleted there, it is also deleted from Comet. Until Strava notifies us, access removed from Strava or a swim deleted on Strava changes nothing in Comet: the swims already imported stay there until the tester disconnects in Comet or their account is deleted. Strava processes this data under its own privacy policy. If we offer Strava to the public, we will update this policy first.

7. Children and minors

We take young swimmers' privacy seriously. The following rules apply:

• Age threshold and parental consent. At sign-up, you enter your date of birth and your region. The age threshold Comet applies follows the region you enter: 14 in Quebec, 13 elsewhere in Canada and in the United States, 16 in the European Union (15 in France, 14 in Spain) and 16 in other countries, including the United Kingdom and Australia. From that threshold, the swimmer consents for themselves. Under that threshold, the account is activated only after the parent or guardian consents: the young swimmer enters their parent or guardian's email address, and the parent or guardian receives a link, gives consent and confirms their phone number with a code received by text message. Until then, we keep the name, date of birth, region and email address entered by the swimmer, only to complete the registration. Without the parent or guardian's consent, the account is never activated: the name and date of birth entered are deleted no later than 30 days after the consent request expires, and the inactive account that remains (name, email address and region) is deleted on simple request to privacy@aerolith.tech. Consent is timestamped and kept as proof. The parent or guardian is the account holder of record and the swimmer is an authorized user under that account.
• Joining a club. There is a single path, at every age: by accepting our Terms and Conditions, the swimmer, or under the threshold their parent or guardian, consents to the club access described in Section 6.3. Sharing of competition results and birth month follows the rules of Section 6.3.
• Purchases. In the app, Comet+ is bought before the account is created, with no age check, or from an account whose age of 13 or over is established; the purchase screen is never shown to an identified account under 13. In the App Store and Google Play, the store's parental controls apply when they are turned on (for example Apple's "Ask to Buy" or Google's Family Link). On our website, the purchase is made by the person who pays, and no store parental control applies. For a swimmer under the threshold, the account is activated only after the parent or guardian consents, even if the subscription was already bought.
• Advertising. The Comet app contains no third-party advertising, no pixel and no advertising tool; only a purchase made in our web app can be reported to Meta, and only if the person agreed to it on our website (Section 8.1). Our ads on Facebook and Instagram target people aged 18 and over only. A swimmer's swim and health data, minor or not, is never used for advertising.
• Usage measurement. The usage measurement described in Section 8.2 applies to every account, including those of minors. It is used only to operate, fix and improve the app, never for advertising or commercial solicitation. You can object to it by writing to privacy@aerolith.tech; for a minor's account, their parent or guardian can also do so.
• Public profile and Coach+. An account created at age 14 or older is public by default, including where the region's threshold is higher (for example at 14 or 15 in the European Union); an account created before 14 stays private until the profile is turned on (Section 6.4). Coach+ is offered from age 13, with the limits described in Section 6.5.

A parent or guardian may review, correct, or request deletion of their child's information at any time by contacting us.

8. Cookies, usage measurement and notifications

App. The Comet app contains no pixel, no advertising cookie and no third-party advertising tool, and does not track you across other companies' apps or websites. The one exception, on the web: if you accepted Meta advertising on our website and then buy Comet+ in our web app, we report that purchase to Meta (Section 8.1). The app uses your device's storage to work: your sign-in session, a copy of your data for offline use, your preferences, the email address of a sign-up waiting for confirmation (7 days at most) and temporary queues before they are sent (usage measurement, 30 days at most, and error reports).

Website. On cometswim.com (outside the web app), essential local storage remembers your theme, your currency and your cookie choices, and Cloudflare Turnstile protects our forms against bots. Every other cookie is off by default and turns on only after your consent, given in our cookie banner. You can change or withdraw that consent at any time with the "Cookie settings" link at the bottom of every page; we ask for your choice again at least every six months. If your browser sends the Global Privacy Control signal, we treat it as a refusal, unless you then expressly accept in our cookie banner or panel.

8.1 Meta pixel and web purchases (with your consent)

If you accept, our website loads the Meta Platforms pixel (Facebook and Instagram) on its presentation pages, never on a page with a form or on our legal pages. Meta then receives:

• the address of the pages you view, your IP address and information about your browser and device;
• an identifier stored in a cookie (_fbp and, if you arrive from a Facebook or Instagram link, _fbc, up to 90 days each);
• four kinds of events: a page view, seeing our prices, a click to the App Store or Google Play, and a click to our web app's checkout.

If you then buy Comet+ on the web, we report that purchase to Meta through its Conversions API: the amount before taxes, the currency, a transaction identifier and your email address in hashed form (SHA-256), which Meta may match to a Facebook or Instagram account. We do not report web purchases with a United States billing address.

We use this to measure how well our ads work and to show our ads on Facebook and Instagram to adults who visited our site. We never send Meta your name, your date of birth, or any data about your swims, your health or your club. Meta also processes this data for its own purposes under its privacy policy, and may process it outside Canada, including in the United States.

If you refuse, the pixel does not load and nothing is sent to Meta, including when you buy. If you withdraw your consent, the pixel no longer loads, we delete our site's _fbp and _fbc cookies from your browser, and your later purchases are no longer reported; data already sent remains processed by Meta under its policy. If you are under 14, leave advertising off.

8.2 Usage measurement in the app

To operate, secure and improve Comet, we measure how the app is used for every account, including those of minors. Measurement changes nothing you see in the app.

What is measured. The screens opened, the features used and the errors encountered, plus technical information: platform, app and system version, device model, language, theme, notification permission, access type (free, trial or subscription), local hour, weekday, time zone, network type and a visit number that groups the events of one use. For swim sessions and workouts, only figures or categories (for example distance, duration, stroke, pool length, a personal best or the mood chosen after a session), never a title or a note. No text you type, no advertising identifier, no device identifier and no precise location.

Link to your account. This data is tied to your account through a pseudonym, never your name or email, and is processed in our own database. No third-party analytics tool receives it. It is neither sold nor used for advertising or to build an advertising profile. Our staff's accounts are not measured, and an account is not measured until its registration is complete, for example while waiting for a parent's consent.

Before sign-in. While no account is signed in on the device (for example on the purchase, sign-up or sign-in screens, including a failed sign-in attempt), events stay on the device; they are attached to the first measured account that signs in on that device within 24 hours, and deleted otherwise. In demo mode, nothing is measured.

Retention. On the device, events waiting to be sent are kept for 30 days at most. In our database, detailed events are deleted after 90 days, or with your account. We keep daily totals that are tied to no account and no pseudonym.

Objection. You can object to this measurement at any time by writing to privacy@aerolith.tech; for a minor's account, their parent or guardian can also do so. Measurement then stops for your account, with no effect on features; the events already collected are deleted when they reach 90 days, or sooner if you ask.

8.3 Notifications

Comet sends you two kinds of notifications:

• reminders prepared and scheduled on your device (local notifications), without going through our servers;
• notifications sent by our servers (remote notifications), about your progress or Comet news depending on the categories you turn on in Settings > Notifications ("Your highlights" and "Comet news", off by default).

For remote notifications, we use Firebase Cloud Messaging, a Google service, and, on iPhone and iPad, the Apple Push Notification service. If Comet's notifications are allowed on your device, we store the device's notification token on our servers, with the platform, the language and the dates it was registered and last used. The text of a remote notification stays neutral: it contains neither your name, nor your times, nor your events. Firebase may create an installation identifier and a token for your device as soon as the app opens, even if notifications are not allowed; we store that token only if they are.

When you sign out, we delete the device's token from our servers and ask Firebase to invalidate it. An invalid token is deleted as soon as Firebase reports it to us, and all your tokens are deleted with your account. You can turn off notification categories in Settings > Notifications, or all Comet notifications in your device settings.

8.4 Beta programme (17 September to 15 October 2026)

From 17 September to 15 October 2026, beta testers agreed in writing, and for each minor tester a parent or guardian agreed, that we measure how they use the app and that Gabriel Laliberte and Mathias Roy read their conversations with Coach+ to improve the app and the coach (beta addendum A1 of 27 September 2026). The programme ends on 15 October 2026 at 5:55 a.m., Montreal time. From then on, former testers are measured like every account (Section 8.2) and their free access to Comet+ ends.

What remains:

• Conversations with Coach+ held during the programme may be read by Gabriel Laliberte and Mathias Roy until 2 January 2027; those held after the programme ends are not.
• A pseudonymous copy of the events collected during the programme, and the feedback, notes and review notes about a tester, is kept in our database, with no fixed end date, for the exclusive use of Gabriel Laliberte and Mathias Roy, for the analysis of the programme and the improvement of the coach. After 2 January 2027, this copy keeps our review notes on the coach's answers, but not the conversations themselves. Excerpts with nothing about the tester in them may be kept to evaluate the coach.
• Only Gabriel Laliberte and Mathias Roy can access this data and its copy, and every change and every download is logged.
• Per-tester daily totals computed during the programme are deleted with the account.
• These copies are deleted with the account or on request to privacy@aerolith.tech, within 30 days.

9. Data sharing and international transfers

Our main database is hosted in Canada (Supabase, ca-central-1 region). We and our providers (Section 6.1) also process information outside Quebec and Canada, including in the United States: for example Anthropic for Coach+, the database of our competition results service (us-west-2 region), Google and Apple for notifications, Stripe for web payments, RevenueCat for subscriptions bought in the stores, Resend and Twilio for emails and text messages and, with your consent, Meta for our website. If you live outside Canada, your information is transferred to Canada and, depending on the service, to the United States. We govern these transfers by contract and, as applicable law requires, we assess beforehand the protection your information will receive there.

10. Your rights

Depending on where you live, you can, among other things:

• access the personal information we hold about you;
• correct inaccurate information;
• delete your information (Section 11);
• receive a copy of your information in a portable format (export);
• withdraw your consent at any time;
• object to usage measurement (Section 8.2) or to certain other processing, or ask that it be restricted;
• withdraw your consent to the Meta pixel and to the report of your web purchases with the "Cookie settings" link on our website (Section 8.1);
• file a complaint with a data protection authority (Section 14).

You can ask for your account to be deleted in the app (Settings › Privacy › Delete my account) or, without the app, by writing to privacy@aerolith.tech from your account's email address. The steps are also described at https://cometswim.com/en/support. To exercise any other right, write to us at privacy@aerolith.tech. We respond within the timelines required by applicable law. For a swimmer under their region's age threshold (Section 7), these rights are exercised by the parent or guardian who holds the account.

If your account is linked to Sign in with Apple and you delete it in the app on iPhone or iPad, Apple asks you to confirm, then we ask Apple to remove Comet's access to your Apple ID. If you delete your account another way, you can remove Comet yourself in your device settings, under your name, then Sign in with Apple.

11. How long we keep your data

We keep your information while your account is active, then according to the following rules.

Account deletion. When you ask for your account to be deleted, withdraw your consent or ask us to delete your data, your account is deactivated at once and your request is handled by our team: we delete or anonymize your personal information and swim data within 30 days, except:

• your name and the sessions you shared with a club, with their times and their note but without the perceived effort or wellness signals, which remain in that club's history, as well as notes written by your coaches;
• billing and subscription records (transactions, subscription statuses, related tax information), kept for seven (7) years to meet our legal accounting and tax obligations (the Income Tax Act and Quebec tax laws), and used for no other purpose;
• a pseudonymous record that consent was given, with identifying details removed, kept for seven (7) years so we can demonstrate compliance;
• public competition results published by federations, which do not depend on your account;
• your daily training journal (mood and notes), the details added to your calendar time slots and, if you had connected Strava, the Strava access tokens and connection status, which our deletion process does not erase yet.

Specific periods.

• Detailed usage measurement events: 90 days; daily totals tied to no account: no time limit.
• Technical error reports: 30 days.
• Coach+ conversations and notes: until the account is deleted.
• Notification tokens: until you sign out on the device, the token becomes invalid or the account is deleted.
• Registration of a swimmer waiting for parental consent: see Section 7.
• Profile photo: until you remove it or the account is deleted.
• Swims imported from Strava by a beta programme tester: until Strava is disconnected in Comet, Strava notifies us that Comet's access was removed, or the account is deleted (Section 6.6).
• Beta programme sign-up form: 90 days after the programme ends.
• Cookie choice on our website: 180 days in your browser; Meta's _fbp and _fbc cookies: up to 90 days.
• Backups: our daily backups are erased automatically on our hosting provider's retention cycle; deleted data may remain in them until then.
• Beta programme: see Section 8.4.

If your subscription expires without the account being deleted, your training data is kept; the features reserved for Comet+ become available to you again if you resubscribe.

12. Security

We use reasonable technical and organizational measures to protect your information against loss, misuse, and unauthorized access. No system is perfectly secure, and we cannot guarantee absolute security.

13. Changes to this policy

We may update this policy. We will post the new version with an updated date and version number, and we will tell you about any significant change by email or by a notice in the app before it takes effect. Where the law requires, we will ask for your consent again.

14. Contact and complaints

Privacy Officer: Gabriel Laliberte, reachable at privacy@aerolith.tech.

If you are in Quebec, you may also contact the Commission d'accès à l'information du Québec. Elsewhere, you may contact the data protection authority of your country or region.

Version history

• 2026-10-en-v8.2 (16 October 2026, in effect on 16 October 2026): optional sharing with the club of official competition results, history included, and of the birth month and year, never the day, turned on with a tap and revocable without leaving the club (Sections 2, 6.3 and 7); the club also sees the competition category published by the federation with each result and the standards reached, never the category entered in Comet (Section 6.3). Section 13: important changes are announced by email or by a notice in the app. No other changes.
• 2026-10-en-v8.1 (13 October 2026, in effect on 15 October 2026): Coach+ is offered from age 13, never to an account under 13, and nothing is sent to Anthropic for such an account (Sections 6.5 and 7); a copy or deletion of your Coach+ conversations on request (Section 6.5). This version replaces version 2026-10-en-v8 before it takes effect. No other changes.
• 2026-10-en-v8 (12 October 2026, in effect on 15 October 2026): public launch. Section 1: scope (app on every platform, website, clubs). Section 2: region and its uses, parent or guardian contact details (email and phone), session journal (notes, effort, wellness signals) and daily training journal, race category sent to Coach+, public competition results, import of your official results, public profile, web purchase, Coach+ content, usage measurement for every account, including minors' accounts, error reports, notification token, website forms; account creation (web purchase, sign-in with Apple or Google for an existing account). Section 3: demo mode. Sections 4 and 5: purposes and legal bases updated. Section 6: access by our team; named providers, including Supabase (Canada), Stripe, Anthropic, Twilio, Resend, PowerSync, Vercel, Railway, RevenueCat, Firebase and Cloudflare Turnstile (6.1); web purchase with Stripe (6.2); access by the club and its coaches at any age through accepting the Terms (6.3); public profile and followers (6.4); Coach+ and Anthropic, in the United States, with your agreement before first use, and conversation history (6.5); Apple Health read only, and Strava for beta programme testers only (6.6); swim and health data are never shared for advertising. Section 7: age thresholds applied by region, parental consent, purchases and store parental controls, advertising for people 18 and over only, removal of the "no commercial solicitation under 13" commitment. Section 8: removal of the mention of a consent management tool in the app; cookies and the Meta pixel on the website only, with consent (8.1); usage measurement for every account, with a right to object (8.2); notifications (8.3); end of the beta programme and what remains of addendum A1 (8.4). Sections 9 to 11: transfers, rights (account deletion in the app or by email, steps at cometswim.com/en/support) and retention periods. Section 13: notice by email. Section 14: named privacy officer and authorities outside Quebec.
• Beta addendum A1 (27 September 2026): added to Section 8 the addendum on the beta programme (testers' usage measurement, reading of Comet+ conversations, retention and archive before deletion, withdrawal), based on the written consent signed on paper by each tester and, for a minor tester, by a parent or guardian. Pointer added in Section 2. Version 2026-08-en-v7 is unchanged.
• 2026-08-en-v7 (15 August 2026): added the optional race category (Section 2) for the Standards feature: comparing your personal bests against official federation time standards, which are published by sex. Never required, never visible to your club, changeable at any time; for a minor, entered by the swimmer after the account is activated, under the parental consent covering the account. No other changes.
• 2026-08-en-v6 (10 August 2026): clarified the sharing default after joining a club (Section 6.3): the explicit membership consent, announced in plain words at the moment you accept, turns on sharing of new sessions by default; each session can be set back to private individually, with immediate and retroactive effect on the club's dashboard and statistics. No other changes.
• 2026-08-en-v5 (2 August 2026): integration of the AER-88 clause pack. Entity updated: Aerolith Technology Inc. (previously CometSwim Inc.); privacy contact unchanged (privacy@aerolith.tech). New content: account creation and sign-in with Apple or Google (Section 2), demo mode with no collection (Section 3), subscription information (Section 2), subscriptions and RevenueCat (Section 6.2), sharing with your club on explicit consent (Section 6.3). Minors section restructured as two independent protections: parental consent under 14 (Law 25) and no commercial solicitation under 13 (Quebec Consumer Protection Act). Retention: seven (7) year exception limited to billing and subscription records; training data retained when a subscription expires. Sections 3 through 11 renumbered.
• 2026-07-en-v4 (19 July 2026): version prior to the Comet+ launch.

Request a copy of my data