Privacy Policy
Last updated 27 August 2026
Laps is a swimming app. To rank your swims and put you on a leaderboard with your friends, it has to store what you swim and who you are. This page says exactly what that means: what is collected, why, who else sees it, how long it is kept, and what you can make us do about it.
On this page
1. Who we are
Laps is operated by an individual based in the Netherlands, who is the data controller for the personal data described here under the EU General Data Protection Regulation (GDPR). The operator is named in section 13.
Contact for anything on this page, including any request about your data: help@laps-app.com.
We have not appointed a Data Protection Officer. We are not required to, and one person operates Laps.
2. What we collect
Almost all of it is data you type into the app yourself. We do not buy data about you, and we do not track you across other apps or websites.
Your account
- Your email address.
- A password, if you sign up with one. We never see it — it is hashed by our authentication provider before it is stored, and cannot be read back by us or by anyone else.
- If you sign in with Apple or Google instead: the account identifier they give us, and the email address they release to us. We never receive your Apple or Google password. If you use Apple's "Hide My Email", we only ever see the relay address.
- A six-digit code we email you to confirm the address is yours.
Your profile
- Your display name, your handle, and a short bio if you write one.
- A profile picture, if you upload one.
- Your sex as recorded for competition (male or female). This is not optional, because the World Aquatics scoring tables Laps ranks against are separate for each, and a swim cannot be scored without it.
- Your self-described swimming level, and your favourite stroke.
- A region, at continent level only, if you set one. We do not ask for or store your country, your city, or any GPS location.
- Your settings: language, theme, units, which notifications you want, and whether your profile is private.
Your swims
- Distance, duration, stroke, number of lengths, pool length, the date and time you swam, and whether it was a timed trial.
- A title, a description and a photo, if you add them.
- Who you chose to show it to: everyone, friends only, or nobody.
- Everything Laps works out from those swims: your points, your rank, your personal bests, your streak, and your progress through a training plan.
- If a timed trial is flagged for review, any evidence you choose to upload to support it.
Your connections
- Friend requests you send and receive, and who your friends are.
- Swims you like.
- Anyone you block, and any report you make about another swimmer.
Laps Pro
- Whether your subscription is active and when the current period ends.
- The subscription events the App Store or Google Play send us through RevenueCat — a purchase, a renewal, a cancellation, a refund — kept so that a billing question can be answered from a record rather than a guess.
- If you cancel: the reason you pick from the list, and anything you write in the box on the way out.
- We never see your card. Apple and Google take the payment and are the sellers. No card number, bank detail or billing address ever reaches Laps.
Technical data
- If the app crashes, a crash report: what went wrong, your device model, its operating system version, and which version of Laps you were running. This is used to fix the crash and nothing else.
- Ordinary server logs from the services below, including the IP address a request came from. These are used to keep the service running and to spot abuse.
What we do not collect
- No health or fitness data from your phone or watch. Laps does not connect to Apple Health, Google Fit, or any wearable. The only swims Laps knows about are the ones you enter yourself.
- No location. No GPS, no map, no country lookup.
- No advertising and no advertising identifiers. Laps carries no ads and no third-party advertising or analytics trackers.
- No contacts, photos library, or microphone recordings beyond the single photo you deliberately pick when adding one.
- No special category data as GDPR Article 9 defines it — no racial or ethnic origin, political opinions, religion, genetic or biometric data, or data about your sex life or sexual orientation.
3. Why, and on what legal basis
GDPR requires a lawful basis for each purpose. Ours are these.
| What for | Which data | Legal basis |
|---|---|---|
| Creating and running your account | Account, profile | Performance of a contract (Art. 6(1)(b)) — this is the service you asked for |
| Recording swims, scoring them, ranking you, keeping your streak | Swims, points, streaks, personal bests | Performance of a contract (Art. 6(1)(b)) |
| Showing your swims to the people you chose | Swims, profile, friends | Performance of a contract (Art. 6(1)(b)) |
| Confirming your email address is really yours | Email, verification code | Performance of a contract (Art. 6(1)(b)) and our legitimate interest in preventing fake accounts (Art. 6(1)(f)) |
| Running Laps Pro, and keeping a record of subscription events | Subscription state and events | Performance of a contract (Art. 6(1)(b)); legal obligation for accounting records (Art. 6(1)(c)) |
| Understanding why people cancel | Cancellation reason and feedback | Our legitimate interest in improving Laps (Art. 6(1)(f)). The written box is optional |
| Keeping leaderboards honest, and handling blocks and reports | Swims, reports, blocks, evidence | Our legitimate interest in a fair and safe service (Art. 6(1)(f)) |
| Fixing crashes and keeping the service up | Crash reports, server logs | Our legitimate interest in a working, secure service (Art. 6(1)(f)) |
| Sending you the notifications you switched on | Notification settings | Your consent (Art. 6(1)(a)), which you can withdraw in Settings at any time |
| Personalised training suggestions | Swims, plan progress | Your consent (Art. 6(1)(a)), given by the switch under Settings → Privacy |
Where we rely on legitimate interests, we have weighed ours against yours. In each case above the processing is what a swimmer would reasonably expect from a ranking app, the data involved is limited to what the purpose needs, and you can object at any time — see Your rights.
4. What other people can see
Laps is a social app, so some of your data is meant to be seen. This is the whole of it.
- Your public face — display name, handle, profile picture, level, rank, points and streak — is visible to other swimmers and appears on leaderboards.
- Each swim is shown to whoever you chose when you posted it: everyone, your friends, or nobody. You can change that afterwards by editing the post.
- A private account is private in the database, not just in the screen. If you switch your profile to private, your swims and your statistics are refused to anyone who is not an accepted friend — the app cannot ask for them and get them anyway. A private account also cannot post publicly, because that would promise something the rule would not honour.
- Blocking is mutual and immediate. A blocked swimmer cannot see you and you cannot see them.
- Reports are not shown to the person reported, and are read only by us.
- Your email address is never shown to other swimmers, and neither is your sex, your date of birth, or anything you have set to private.
5. Who we share it with
We do not sell your data. We have never sold it and there is no arrangement under which we would. It is shared only with the companies that run parts of Laps for us, each of them under a contract that limits them to acting on our instructions.
| Who | What they do for us | Where |
|---|---|---|
| Supabase | The database, sign-in, and storage for pictures. Almost everything above lives here | European Union (Ireland) |
| Resend | Sends the emails Laps has to send you — the verification code, a password reset | United States |
| RevenueCat | Manages Laps Pro subscriptions and tells our server when one starts, renews or ends | United States |
| Sentry | Receives crash reports so we can fix what broke | United States / European Union |
| Cloudflare | Serves this website and routes email sent to laps-app.com | Global network |
| Apple and Google | Distribute the app and take the payment for Laps Pro. They are the sellers, and they decide independently what they collect from you | Global |
Apple and Google act as their own controllers for what they collect when you download the app or buy a subscription. That is covered by their privacy policies, not this one.
We would also disclose data if the law genuinely required it — a valid order from a court or a competent authority — or where it is necessary to establish or defend a legal claim, or to protect someone's safety.
6. Where it goes
Your Laps data is stored in the European Union, in Ireland.
Some of the providers above are based in the United States. Where personal data reaches them, the transfer is covered by the European Commission's Standard Contractual Clauses, or by the provider's certification under the EU–US Data Privacy Framework where they hold one. You may ask us for details of the safeguards in place at help@laps-app.com.
7. How long we keep it
- Your account and everything in it — for as long as you have an account.
- When you delete your account, it is really deleted. Settings → Account → Delete account removes your profile, your swims, your personal bests, your points, your streak, your friendships and your pictures. It is not hidden behind a flag and it cannot be undone.
- Backups may still hold a copy for up to 30 days after deletion, after which they roll off. Backups are only ever restored to recover from a failure.
- Records of subscription payments are kept for up to seven years, because Dutch law requires business records to be retained for that long. These are kept separately from your profile and reduced to what the obligation needs.
- Crash reports — up to 90 days.
- Reports about other swimmers, and blocks — kept while needed to keep Laps safe, and reviewed periodically. A report may outlive the account that made it, because deleting it would defeat the purpose of having made it.
8. Your rights
Under GDPR you have the right to:
- Access the personal data we hold about you.
- Correct anything that is wrong.
- Delete it — the right to erasure.
- Restrict how we use it, in certain circumstances.
- Take it with you — receive it in a portable, machine readable form.
- Object to processing we base on legitimate interests.
- Withdraw consent at any time, where consent is what we relied on. Withdrawing it does not undo what was done beforehand.
Two of these you can exercise yourself, immediately, in the app:
- Export — Settings → Statistics → Export my swims gives you your swim history as a file.
- Delete — Settings → Account → Delete account.
For anything else, email help@laps-app.com. We will answer within one month, as GDPR requires. If a request is unusually complicated we may extend that by two further months, and we will tell you if so. We will not charge you for it.
We may need to confirm you are who you say you are before acting on a request, so that nobody can use these rights to reach someone else's data.
If you are unhappy with how we have handled your data, you can complain to the Dutch data protection authority, the Autoriteit Persoonsgegevens, or to the authority in the EU country where you live or work. We would rather you told us first, at help@laps-app.com, so we can put it right.
9. Age
Laps is for people aged 16 and over. In the Netherlands, the age at which someone can consent to an online service for themselves is 16, and Laps is built for swimmers who can.
We do not knowingly collect data from anyone under 16. You confirm your age when you create an account. If you are a parent or guardian and believe your child under 16 has an account, email help@laps-app.com and we will delete it and everything in it.
10. Security
We do not ask you to take this on trust, so here is what actually protects it:
- Everything is encrypted in transit, and encrypted at rest by our database provider.
- Access rules are enforced by the database itself, not by the app. Every table refuses rows the requester is not entitled to, so a modified copy of the app cannot ask for someone else's private swims and be given them.
- Passwords are hashed. Nobody at Laps can read yours.
- Points, ranks and streaks can only be written by the server. The app is physically unable to award them, so nobody can edit a request to promote themselves up a leaderboard.
- Whether you have Laps Pro is decided by the store, not by your phone. Our server checks with RevenueCat directly.
- The keys that could change anyone's data are held only on our server and are never shipped inside the app.
No service can promise it will never be breached. If one happens and it is likely to put your rights at risk, we will notify the Autoriteit Persoonsgegevens within 72 hours of becoming aware of it, and tell you directly where the risk to you is high.
11. Automated decisions
Laps calculates your points, your rank, your personal bests and your streak automatically, from the swims you enter and the published World Aquatics scoring tables. That is arithmetic, applied the same way for everyone, and it is the service itself.
We do not carry out profiling or automated decision-making that produces legal effects for you or similarly significantly affects you, within the meaning of Article 22.
A timed trial can be flagged for manual review if it looks implausible. That review is done by a person, not by a machine, and you can contest the outcome at help@laps-app.com.
12. Changes
If we change this policy we will update the date at the top. Where a change materially affects you — new kinds of data, a new purpose, a new company we share it with — we will tell you in the app or by email before it takes effect, and where the law requires your consent we will ask for it rather than assume it.
13. Contact
Laps
Operator and data controller: Oxana Galitskaya, Netherlands
help@laps-app.com
Write to that address for anything at all — a data request, a question about this page, or a mistake you have spotted in it.