Privacy

1. Who we are

twirlr is run by RTA Twirling & Events Ltd, a company registered in England and Wales (number 17174281), 128 City Road, London EC1V 2NX. In this notice "twirlr", "we" and "us" mean that company.

We have not appointed a data protection officer. Our privacy contact is privacy@twirlr.app. For anything about a child’s safety, use safety@twirlr.app.

2. Two kinds of information, two kinds of responsibility

twirlr is used by associations (federations and clubs for twirling, majorettes and pom) to run their membership, competitions, results, emails and payments. That means two different people can be responsible for your information, depending on what it is.

• Your association is responsible (it is the "controller", and twirlr is its "processor") for the information it keeps about its members to run the association: membership records, dancers’ details, family and emergency details, medical notes, photography and other consents, troupe records, entries, music, competition results, judges’ marks, safeguarding cases, DBS checks, invoices and payments to the association, the emails it sends you, and what its staff do with Polly, our assistant. We only use that information on the association’s instructions. Its own privacy notice applies, and questions about it go to the association first. We will help them answer.
• twirlr is responsible (we are the "controller") for your twirlr account and sign-in, the twirlr app itself, the feed (clips, comments, cheers, follows and how the feed is ordered), notifications, location and contact features in the app, keeping twirlr safe (reports, moderation and our Online Safety Act duties), the accounts of association staff on the console, our own records of fees, and the add-ons we sell to associations.

Every association’s information is kept apart from every other’s, by rules in the database itself. Staff of one association cannot see another’s.

3. What we collect

We do not collect race or ethnicity, religion, sexual orientation, political views or biometric data. The identity check for association founders compares a document photo with a selfie, but Stripe does that and keeps the images; we only learn whether it passed.

4. Information we get from other people

• Your association, your troupe leader or a parent may give us your details, or your child’s, to run membership and competitions.
• Judges give marks, and the results are worked out from them.
• Stripe tells us whether a payment or an identity check succeeded.
• Cloudflare, which carries traffic to twirlr, tells us the approximate town of an adult’s internet connection.
• If an adult uses Find friends, we receive scrambled versions of their contacts’ email addresses and phone numbers, including people who are not on twirlr. We only use them to look for matches and do not keep them. To make matching work, we keep a scrambled copy of each member’s own email address and phone number.

5. Why we use it, and our lawful basis

The law says we need a reason (a "lawful basis") for each use. For information we are responsible for:

Where we rely on legitimate interests, we have weighed them against your rights and freedoms, with extra weight for children. You can object (section 13).

For association data, the association chooses the lawful basis and tells you in its own notice. Usually it is the membership contract, its legitimate interests, a legal obligation, or your consent (for example for photography).

6. Health information and DBS checks

A medical note about a child and incident or first aid records are health information, which the law treats as special. They are association data. The association records them so a child can be kept safe at events, with the parent’s explicit consent or, in an emergency, to protect someone’s life. They are only shown to the people the association allows, and they are never sent to Polly.

DBS check records about troupe leaders and judges are criminal offence information. Associations record them to keep children safe, under the safeguarding conditions in the Data Protection Act 2018. Only association staff can see them; a leader can see their own.

7. Children

Many people on twirlr are children. We follow the UK Age Appropriate Design Code (the Children’s Code). In particular:

• Under 16s cannot have an account until a parent or guardian approves it, and their posts go to that grown-up before anyone else sees them.
• Under 13s are never visible outside their own association.
• From 13 to 15, a dancer’s profile and name can be seen outside their association only once a parent approves. From 16, the dancer or their parent can choose to make the profile public.
• For under 18s in the UK, the feed uses only what they choose to do (follows, cheers, Not interested, searches). We do not record their watch time, skips or how long they look at a clip.
• No location of any kind is used for under 18s, and Find friends is not available to them.
• Under 18s get no notifications designed to bring them back, quiet hours are always on, and they are offered a break after every 30 minutes of watching.
• No ads and no advertising ID, for anyone (see section 9).
• There are no messages between members. Children can only message their troupe leader, their association or its safeguarding officer.
• Under 16s cannot delete their own account; their parent can, in the app or at twirlr.app/delete-account.

We work out age from the date of birth given. If we do not know someone’s age, we treat them as under 13.

8. The feed, results and automated decisions

The For you feed is ordered automatically from the signals in section 3. How it works, and the controls you have, are on the How your feed works page. You can turn personalisation off and see the newest clips first. The feed decides what you see, not whether you can use twirlr.

Competition places are calculated from judges’ marks using the association’s rules, and the association checks and announces them. Our automatic comment check holds comments that contain links, contact details or certain words; a held comment is simply not shown, and nothing else happens to the account automatically. A person makes every decision to remove content or restrict an account.

We do not make decisions about anyone based solely on automated processing that have legal or similarly significant effects on them.

9. Ads

twirlr does not show ads and does not read your phone’s advertising ID. The app contains settings for ad choices for a possible future, but they are switched off and every choice is recorded as off. If that ever changes we will update this notice first and ask adults for consent. Never for under 18s.

We do not sell personal information.

10. Notifications

If you allow notifications, we keep your phone’s push token and send notifications through Expo, Google (Firebase Cloud Messaging) and Apple. They carry the title and text you see, and sometimes a link inside the app.

On competition day, some associations use live cards on Android phones: running order, "you are up next", hall delays, scores and places. A live card can show the dancer’s own profile photo and the association’s and troupe’s logos. The pictures are sent as links that stop working after about a day, and are kept on the phone to show the card.

11. Emails

We send emails through Resend: sign-in codes and account emails from twirlr, and emails your association sends you (entries, invoices, results, news). An association can send its members news under the "soft opt-in" rule unless they have opted out; anyone else needs to have said yes. Children under 16 are never emailed directly; their parent is. Every marketing email has an unsubscribe link, and unsubscribing from one association does not affect another.

We do not currently track whether you open our emails or click their links.

12. Polly, our AI assistant

Polly is an assistant that association staff can choose to pay for in the console. She helps them find information and draft emails and tasks. Members do not talk to Polly.

When a member of staff asks Polly something, the question and the information needed to answer it (for example names of members and dancers, troupes, entries and invoices) are sent to an AI model provider to produce the answer. Polly is never given safeguarding records, email addresses, phone numbers, home addresses, dates of birth, medical notes or emergency contacts.

The model providers are Google (Gemini) by default; Anthropic, OpenAI or OpenRouter can be used instead for some associations. OpenAI is told not to store what it is sent, and OpenRouter is limited to providers that keep nothing. Polly’s conversations are saved in twirlr so staff can pick up where they left off, visible only to the person who had them, and deleted after 12 months without use.

13. Your rights

You have the right to:

• get a copy of your information (a "subject access request");
• have it corrected if it is wrong;
• have it deleted;
• object to how we use it, including to the feed using your activity;
• ask us to limit how we use it while a question is settled;
• take a copy of information you gave us in a common format (data portability);
• take back any consent you gave, at any time, without affecting what happened before.

How to use them: in the app, Settings, Account, Your data has "Download my twirlr data" for what twirlr holds as controller, and a button to ask your association for what it holds. You can delete your account in the app or at twirlr.app/delete-account. Or email privacy@twirlr.app. A parent can do these things for a child.

We reply within one month (sometimes longer for complicated requests, and we will tell you why). For association data we pass your request to the association and help it answer.

If you are unhappy with how we have handled your information you can complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113. We would like the chance to put it right first.

14. Who can see what

• Other members of your association can see your profile and the clips you share with them. Outside your association, only what the privacy rules in section 7 allow.
• Published results (category, troupe, place and mark) can be seen by anyone once an association announces them. Individual judges’ score sheets are not public.
• Certificates can be checked by anyone with the certificate number at twirlr.app/c. The check shows the award, place, event and association, and the dancer’s name only if the dancer may be shown on twirlr (13 or over and, under 18, with a parent’s approval). It never shows scores or contact details.
• Association staff see their own members’ information, as their roles allow. Only the association’s safeguarding officer and its chair can read safeguarding records (twirlr staff with platform access can too, to support the association).
• A small number of twirlr staff can see association information to support associations and keep twirlr running, including by signing in to an association’s console for a limited time when asked. Each time is recorded in that association’s own log.

15. Who we share it with

We only share information with service providers that run twirlr for us, under contracts that limit what they can do with it:

We may also share information when the law requires it, to protect a child or anyone else from harm (for example with the police or the Internet Watch Foundation), with professional advisers, or with a buyer if twirlr is sold, who would have to keep to this notice.

16. Information sent outside the UK

Our database is in London. Some providers above are based in, or reach their systems from, other countries, mainly the US and the European Economic Area. When information leaves the UK we make sure it is protected as UK law requires: the country has UK "adequacy" (the EEA does, as do US companies certified under the UK Extension to the EU-US Data Privacy Framework), or we use the UK International Data Transfer Agreement or Addendum with the provider. You can ask us for details at privacy@twirlr.app.

17. How long we keep it

We keep your information while your account is open, and delete it when your account is deleted, except for the things below. We have not yet built automatic deletion for every kind of older information; until we have, it is kept while the account is open. The Data retention page lists each kind of information.

• Account deletion: completed within 30 days of your request. Until then you can cancel.
• Competition results stay on the association’s record, because a published place is part of every competitor’s result.
• Financial records: kept for 6 years for tax law.
• Safeguarding records: kept for as long as the association’s safeguarding policy requires, which for children is usually 25 years or until the person is 25.
• Your interest list fades over about two weeks of not using twirlr.
• Polly conversations: deleted after 12 months without use.
• Clips we take down: deleted 90 days later unless a report about them is still open.
• Near you: your rough position is kept until you turn Near you off, which clears it.
• Records of who asked for their account to be deleted, so we can show we did it.

18. Keeping it safe

Information is encrypted in transit. Each association’s information is walled off from every other’s by the database itself. Sign-in uses one-time codes, and staff can turn on two-step sign-in; erasing an account needs it. Staff actions in the console are logged. Tokens for connected services are encrypted. Your sign-in on the app is kept in your phone’s encrypted storage.

19. Cookies and storage on your device

twirlr.app sets no cookies. It keeps your sign-in, the answers you have typed while setting up an association, and a count of failed sign-in attempts in your browser’s storage, because the site needs them to work. The console uses sign-in cookies only. The app keeps your sign-in and settings in your phone’s encrypted storage. None of these is used for advertising or analytics by anyone else. See Cookies and tracking for the full list.

20. Changes to this notice

When we change this notice we update the date at the top. If a change matters to you, we will tell you in the app or by email before it takes effect.

21. Contact

Email privacy@twirlr.app, or write to RTA Twirling & Events Ltd, 128 City Road, London EC1V 2NX. For child safety: safety@twirlr.app. If a child is in immediate danger, call 999.