Club Data Processing Agreement
Invert Systems — Rotation Scheduler, ChalkScore, GymBux, Invert Eye and Invert Core Version 2, 13 October 2026.
The short version
- The club's information stays the club's. We hold it only to run the software the club has chosen, and we do only what the club asks of it.
- It is stored in Australia. The databases are in Sydney, and the code that reads them runs in Sydney.
- The club can see what we hold, take it all out any day, and see every time it left the system — including when we took it.
- When the club leaves, it gets a complete copy and we delete the rest 90 days later.
- A recorded refusal of consent cannot be overridden — not by a coach, not by club staff, not by us.
1. Who this agreement is between
Invert Systems, a business operated by Vaughn Ray Edmonds as a sole trader, ABN 44 869 392 328, Goulburn, New South Wales, Australia — "we" and "us" below. Contact: vaughn@invertsystems.com.au.
The club named in the acceptance at the end of this agreement — "the club" below.
This agreement covers the personal information that the club, its staff and its members' families put into, or that is created in, the Invert Systems products the club uses. It forms part of the arrangement under which the club uses those products, and where the two disagree about personal information, this agreement applies.
2. Whose information it is
The club decides what information about its gymnasts goes into our software, and the club is responsible for it. We hold and use that information on the club's behalf, under the club's instructions, and only to provide and support the products the club uses. In the language of privacy law, the club is the party that controls the information and we handle it on the club's behalf.
The club's instructions are given by using the products — importing a roster, recording consent, inviting a coach — and by asking us in writing. If we believe an instruction would break Australian privacy law, we will tell the club rather than act on it.
Staff accounts are different. For the accounts that coaches and club administrators use to sign in, we are responsible for the account itself (the sign-in, its security, the emails we send about it), and the club is responsible for deciding who should have one.
3. What information is involved
Schedule 1 lists every kind of information, product by product. In summary:
- Gymnasts (children, in most cases): name, preferred name, date of birth, the classes and competitions they are enrolled in, consent decisions for photos, video and public use of their name, and — in the products that need them — scores, points, badges and clip labels.
- Families: no addresses or phone numbers. If the club's roster export includes the family's primary contact email, we keep only a keyed one-way check made from it (Schedule 1), never the address. A parent who makes their own account, to see their child in the club's apps, gives us their name and email address (Schedule 1).
- Club staff: name, email address, role, and the security records of their account.
- Competitions (ChalkScore only): for each club that enters gymnasts in the club's competition, the name, email address and phone number of the person making the entry, the entered gymnasts' names, dates of birth, levels and photo consent, and the coaches coming with them, with each coach's Working With Children Check number; and the names and email addresses of the competition's judges. If the club collects entry fees through ChalkScore: the entering club's contact name and email address, and the amounts paid or owed.
We do not hold home addresses, phone numbers, medical information, allergies, fees or payment details for gymnasts or families. Those stay in the club's own enrolment system.
4. What we will and will not do with it
We will use the information only to provide, secure, support and repair the products the club uses, and to meet our obligations in this agreement.
We will not:
- sell it, rent it or give it to anyone for their own use;
- use it to advertise anything to anyone;
- profile a child, score a child for any purpose of ours, or make automated decisions about a child. Where the software is unsure who a person is — two similar names, a changed surname — it does not decide. It stops and asks a person at the club, and records that it did;
- combine one club's information with another club's. Each club's records are kept separate in the software, and that separation is tested automatically on every change we make (Schedule 3);
- copy it anywhere it does not need to be.
5. Where it is stored, and who helps us
Children's information is stored and processed in Australia. Our
databases are in Sydney (Amazon Web Services ap-southeast-2, through
Neon), and the code that reads and writes them runs in Sydney (Vercel's
syd1 region). ChalkScore runs on its own server in Oracle Cloud's Sydney
region (ap-sydney-1), which holds its database and its nightly backups,
and GymBux's application server runs there too.
In normal operation, a request carrying a child's name does not leave the
country.
The providers we use are listed in Schedule 2, with exactly what each one receives. The providers outside Australia receive no information about children, with one exception that is deliberate: our daily backups are encrypted in Australia, with a key only we hold, before they are stored with GitHub. GitHub holds that encrypted file and nothing else, and cannot read it.
Changes to Schedule 2. We will tell the club at least 30 days before we start using a new provider that would receive information about the club's gymnasts. If the club objects, we will discuss it, and if it cannot be resolved the club may end its subscription before the change takes effect and receive its information under section 13.
6. Who can see it
At the club. Staff the club has invited, with the role the club gave them:
- Owner — manages the club's staff, imports the roster, exports the club's information, and sees the club's history.
- Editor — works with the club's information in the products.
- Viewer — reads it.
Each product applies these roles in its own way. A person the club removes loses access to the club in Invert Core at once, and the products that sign in through Invert Core remove them when they next check the club's staff list. The club is responsible for removing staff who leave.
Parents. A parent sees only the children linked to them, in the club's apps (Schedule 1, GymBux). A link is made in one of two ways:
- the parent's email address, which they have proved is theirs, matches the family contact the club imported from its enrolment system; or
- one of the club's owners or editors approves the parent's request, and chooses the gymnast it is for.
Links are never made by matching names. Approving parents is the one club job open to editors as well as owners. The club can remove a link at any time. A removed link stays removed, even if the parent's email matches, until the club approves a new request. The club's history records every link made, removed or declined.
Nobody at another club can see the club's information, with two exceptions that are part of how a competition works, both in ChalkScore:
- a club that enters gymnasts in the club's competition sees, through its own private entry link, only the entry it made; and
- a competition's results are public (below).
The public — ChalkScore results. A competition's results are shown to anyone who has its results link or QR code, and on the club's projector and announcer screens: each gymnast's name, club, level and scores, and the placings and awards once the club publishes them. Where public use of a gymnast's name is not allowed (section 8), every public screen shows only the first name and the first letter of the last name. Dates of birth, contact details and judges' details are never shown publicly. The club decides when to publish placings, and is responsible for telling families that results are published.
At the gym — the GymBux TV board. Anyone at the gym who can see the club's TV sees what Schedule 1 lists for it. That is each gymnast's first name and last initial (their full name where public use of the gymnast's name is allowed, section 8), with their points, character and classes. The board needs the club's private TV link, which the club controls.
A gymnast's own GymBux page, and the family app, show what Schedule 1 describes for them.
At Invert Systems. Only Vaughn Ray Edmonds, and only as far as is needed to run, support and repair the service. That access is protected and recorded:
- it requires a named account on a fixed list, two-step sign-in, and a fresh code from an authenticator app at least every 12 hours;
- every time a gymnast's record is opened, or looked up by its id, it is logged, by the record's id rather than the child's name;
- every change made this way — recording consent, importing a roster for the club, closing a flagged record — is logged;
- every export of the club's information, whoever made it, appears in the club's own history, where the club's owners can see it.
ChalkScore is different in one respect. Its server is reached only by Vaughn Ray Edmonds and by our own automated jobs that install updates and collect the encrypted backup, always through an encrypted connection that accepts a security key and never a password. The server records each such connection, but not which records were looked at during it. Every change to a score in ChalkScore, whoever makes it, is recorded in the competition's score history (who, when, the old and new score, and the reason given), which the club's staff can read.
Nobody else. If we receive a legal demand for the club's information, we will tell the club before responding, unless the law forbids us from telling it.
7. Getting the roster in
The club's roster is imported from the club's own enrolment system. For iClassPro, the club exports its Student List and uploads it on its settings page. Before the file leaves the club's computer, the page removes every column the software does not use — guardians' names, phone numbers, the instructor and the rest — and our server refuses any file that still carries one. Only the gymnast's name, birthday, classes, class schedule and level, and (if the club includes it) the family's primary contact email reach us, and the uploaded file itself is not kept.
The club may also upload iClassPro's Class List Report, its timetable. The page removes ages, gender, prices and enrolment counts before the file leaves the club's computer, and our server refuses any file that still carries them. Only each class's name, program, level, day, times, zone, instructors' names, maximum size and dates reach us. The file holds no information about gymnasts, and is not kept.
Where we import a roster on the club's behalf, the export is handled on our own computer in Australia and deleted once the import is done.
8. Consent
Consent for photos, video and the public use of a gymnast's name is recorded per gymnast and per purpose, and every product reads the same record. Three rules are built into the software, not left to policy:
- A refusal always wins. A recorded "no" cannot be overridden by the club's default, by a coach or by us.
- If the software cannot tell, it refuses. A missing or unreadable record, or a check that cannot complete, is treated as a no.
- History is kept, not overwritten. A change of mind adds a new record, so it is always possible to know what was true when a photo was taken.
ChalkScore reads this shared record for the club's own gymnasts, and follows the rules above: a family's recorded decision first, then the club's default. For a gymnast another club enters in the club's competition, the entering club records one decision on its entry: whether their full name may appear on public results. Where it is "no", every public screen shows only the gymnast's first name and last initial. Every name on ChalkScore's public screens is shown with its competitor number, and results are grouped by level, so two gymnasts are never told apart by showing a surname.
GymBux reads this shared record every hour for its TV board, and follows the rules above: a family's recorded decision first, then the club's default. Where it cannot reach Invert Core, the board shows the first name and last initial. Where the full name may not be shown and two gymnasts would then look the same, the board tells them apart by class, never by showing the surname.
The club sets a default for each kind of consent, which applies only where no decision has been recorded for a gymnast. The club is responsible for its defaults matching the consent it actually holds from families.
9. Requests from families and individuals
A parent or a staff member may ask to see, correct or delete information about themselves or their child.
- Requests made to the club are the club's to answer; most can be handled immediately in the products or the club's own enrolment system. We will help with anything the club cannot do itself.
- Requests made to us about a gymnast will be passed to the club, and we will tell the person we have done so. We will act on the club's instruction.
- We will respond to any request within 30 days, and we do not charge for it.
A parent can delete their own Invert account at any time, at core.invertsystems.com.au/account. Their account, their links to children and any requests waiting with a club are deleted at once. Records that belong to the club, such as a child's points or results, stay with the club.
10. If something goes wrong
If we become aware that information we hold for the club has been accessed, disclosed or lost without authority:
- we will tell the club without undue delay, and within 72 hours of becoming aware of it, with what we know at the time and what we are doing about it, and keep the club updated as we learn more;
- we will take immediate steps to contain it;
- we will assess, with the club, whether serious harm is likely, and where the Notifiable Data Breaches scheme would require notice to the Office of the Australian Information Commissioner and the people affected, we will give it — whether or not the scheme applies to a business of our size;
- we will keep a record of what happened and what was done.
11. Keeping it safe
The measures we use are described in Schedule 3. We will keep measures at least as strong as those for as long as we hold the club's information. No system is perfectly secure, and we will not pretend otherwise; what we commit to is the measures, testing them, and telling the club when something fails.
12. What the club is responsible for
- Collecting the information lawfully and telling families how it is used, including that the club uses Invert Systems products. Our privacy policy, at www.invertsystems.com.au/legal/privacy, is written for parents and the club may point families to it.
- Keeping the roster current by importing it regularly. Gymnasts who join appear in the products after the next import, and gymnasts who leave are marked as left by it.
- Recording consent accurately, and keeping its consent defaults true to what families have agreed to.
- Managing its staff: inviting only people who need access, giving the least role they need, and removing people who leave.
- Protecting what it takes out: exported files and roster exports hold every gymnast's name and birthday, and are the club's to store securely and delete when no longer needed.
13. The club's information, out — any day, and when it leaves
Any day. A club owner can export the club's information from the club's settings page as five spreadsheet files: every gymnast (current and left) with their consent and classes, every enrolment, every consent decision ever recorded, the club's staff, and the club's full history. Exporting asks for the owner's password again, and appears in the club's history.
ChalkScore keeps its own records, so it has its own way out: any of the club's staff can download each competition's results as a spreadsheet or PDF at any time, and on request we give the club a complete copy of its ChalkScore information within 14 days.
When the club stops using our products:
- We give the club a complete copy of its information, in the format above.
- We delete the club's information 90 days after its subscription ends. In ChalkScore, the club is read-only during those 90 days: its staff can still view, print and download everything, and renewing brings it all back. Ninety days is deliberate: long enough that a club leaving in a hurry, or changing its mind, is not punished for it; short enough that we are not holding children's records for a club we no longer work with. The club may ask us in writing to delete sooner, and we will.
- Our encrypted backups are kept for 30 days, so the last backup holding the club's information expires no more than 30 days after the deletion. Backups are never restored to bring back a deleted club.
- We confirm the deletion to the club in writing.
- Every product deletes its own copy. Invert Core tells each of our products when a club has been deleted, and each deletes everything it holds for the club, normally within a few days. Each keeps only a record that it did: the club's Invert Core reference, when its information was deleted, and how many records of each kind went. No names.
- Coaches' Working With Children Check records from the club's competitions are the one exception. They are kept for 45 years after each competition (Schedule 1, ChalkScore).
- Payment records, meaning the club's invoices and receipts, stay with our payment provider, Stripe, for as long as Australian tax law requires us to keep them.
Video taken with Invert Eye is saved on the club's own devices and never reaches us, so it is the club's to delete there. Until the club's information is deleted, a club whose Invert Eye subscription has ended keeps its records, but its devices can no longer read the roster or add to them.
14. Information we will provide
On request, once a year or after anything in section 10, we will give the club a written account of how its information is held and protected, including the club's history, the record of our access to the club's records, and the results of our backup restore tests and separation tests.
15. Changes to this agreement
We will give the club at least 30 days' notice of a change to this agreement. A change that would let us handle a gymnast's information in a genuinely different way does not apply to the club unless the club agrees to it.
16. Law
This agreement is governed by the law of New South Wales, Australia. It is written to the standard of the Australian Privacy Principles in the Privacy Act 1988 (Cth), whether or not the Act applies to either party, because a document about children's information should not depend on an exemption.
Schedule 1 — The information, product by product
Invert Core — the shared record every product reads
| About | What is held |
|---|---|
| Each gymnast | First name, last name, preferred name, date of birth, status (current or left), the class they are in, every class and competition entry from the roster (class name, level, schedule), the date each one started and ended as far as our imports saw it, the date they were added and last updated, and the id the products use to refer to them |
| The club's timetable | Each class's name, program and level, and each time it runs each week: the day, start and end, zone, the instructors' names, the maximum size and the dates it runs between, as the club's enrolment system lists them. Kept when a class stops, marked as retired, so past enrolments still say where a gymnast trained |
| Each gymnast's consent | Every decision for each of: public use of their name, photos, video — the answer, when it was recorded, who recorded it and where it came from (a signed form, a phone call) |
| The family | Only a keyed one-way check made from the primary contact email, when the club's roster export includes that column. The address itself is never stored. The check is made with a secret key held only on our servers, cannot be turned back into the address, and exists so that a parent who later signs in with that same address can be linked to their child. Nothing is sent to that address |
| Club staff | Name, email address, role at the club, when they joined and were last seen, their password (stored only as a one-way scrypt hash), their two-step sign-in secret (stored encrypted), and their sign-in sessions (stored only as one-way hashes) |
| The club's history | Every staff change (invited, joined, role changed, removed), every roster and timetable import (when, by whom, the file's name, and what it added, changed, retired or marked as left), every consent decision, every export |
| Import checks | Records the software would not decide on by itself — a possible name change, a birthday that disagrees — held for a person at the club to check |
| The club's plan and payments | The club's price category (standard or member), and its customer reference with our payment provider, Stripe. For each subscription: what it covers, its price, whether it is active, on trial or ending, when its paid period ends, and any change of period waiting. For each single-competition purchase: the amount, the competition's date, and when it was credited or refunded. Card details are entered on Stripe's own page and never reach us (Schedule 2) |
| Acceptance of our terms | Who accepted our Terms of Service for the club, which version, when, and where: when signing the club up, or when choosing a plan |
| Reads by our products' shared keys | When a product's shared key (Invert Eye's, and ChalkScore's), which can read any club that holds that product, last read the club's information, and how many times, so its access can be checked |
| Parents | A parent's own account: their name; their email address, proved by a link we email to it; their password, stored only as a one-way scrypt hash; and their sign-in sessions, stored only as one-way hashes. Which of the club's gymnasts they are linked to, and as what (parent, carer or other family member). How each link was made, and who at the club approved it. When a link was removed, and by whom. A parent has no role at the club and cannot reach any of the club's screens |
| Parents' requests | A parent's request to be linked to a child: the child's name and date of birth as the parent typed them, the relationship, and the club's answer. Deleted 30 days after the club answers |
| Link changes, for our products | For 90 days, which parent accounts were linked to, or removed from, which gymnasts. These are stored as reference numbers only, so that the club's apps act on a removal within the hour |
What each product receives from Invert Core about a gymnast: their names, preferred name, date of birth, class, status and consent decisions. About staff: their name, email address and role.
ChalkScore — competitions
ChalkScore keeps its own records, on its own server (Schedule 2). It reads the club's gymnasts from Invert Core: their names, preferred name, date of birth, classes, status and consent decisions. It also uses Invert Core to sign in the club's staff.
| About | What is held |
|---|---|
| Each competition | Name, date, venue, sessions, the running order, apparatus, scoring settings and the club's logo |
| Each gymnast entered | First name, last name, preferred name, competitor number, level, division, the club and coach they compete for, their team, whether they were present or withdrew, and the photo-consent decision (section 8) |
| The club's competitor list | Each gymnast's first name, last name, date of birth, club, level and status (current or left), so a gymnast is recognised from one competition to the next |
| Scores | Every apparatus score, the all-around, finals, team scores, ranks and bands, and the score history: for each change, who made it (their email address or the station's name), their role, when, the old and new score, and the reason given |
| Entries from visiting clubs | The entering club's name. Its contact person's name, email address and phone number, and any notes they add. Each entered gymnast's name, date of birth and level. The coaches coming with its gymnasts: each coach's name, accreditation, and Working With Children Check number with its expiry date. Any judges the entering club offers: their name, email address and phone number. The entering club's declaration, with who made it and when. Withdrawals and the reason given, and a record of each change to the entry |
| Judges | Name, email address, the apparatus they judge, and the PIN they sign in with at the competition (stored as entered, so the club's admins can read it out to the judge) |
| Club staff | Name, email address and role at the club (from Invert Core), and their sign-in sessions, which last at most 7 days. Staff who sign in with a ChalkScore admin PIN or password have it stored only as a one-way bcrypt hash |
| Scoring stations | The club's station link key, and the scorer PIN, stored only as a one-way bcrypt hash |
| Entry fees | For each payment: how it was paid (by card, by invoice, or marked as paid by hand), its status, the amount, the GST, any amount refunded, the invoice number, the email address it was sent to, Stripe's references for it, and who marked it paid and when |
| Floor music | If the host club collects it for a competition: an audio file for a gymnast's floor routine (up to 20 MB); its original file name, which may include the gymnast's name; its length and size; when it was uploaded and by whom (the entering club through its entry link, or the host club); and which gymnasts in the competition it is for. A track several gymnasts use is stored once |
| The club's payment details | If the club collects entry fees: its legal name, ABN and GST status; the bank account name, BSB and account number its invoices show; its invoice number prefix; and its Stripe account reference and whether that account is ready to take payments |
Coaches' Working With Children Check records are kept for 45 years after the competition, even after the rest of the club's information is deleted (section 13). The record is each coach's name, accreditation, check number and expiry, the competition, and the club that entered them. This follows the minimum period that the Royal Commission into Institutional Responses to Child Sexual Abuse recommended for records relating to child sexual abuse: at least 45 years. The records are kept so they are available if the Office of the Children's Guardian, or another authority, needs them. They are used for nothing else.
Entry fees. A club hosting a competition can collect entry fees from the clubs that enter it, by card or by an emailed invoice. Card payments are made on the host club's own Stripe account, which only the club's owner can connect or disconnect. The host club is Stripe's customer, and the money, Stripe's fees and any refunds are the club's. Neither a payment nor an invoice carries a gymnast's name. Entry-fee records are deleted with the competition, or with the club. The club's Stripe account and its records stay the club's, under Stripe's terms.
Floor music. A host club can collect each gymnast's floor music for its competition. An entering club uploads music only for its own gymnasts, and can play only its own. The host club's staff play it at the competition from a "music desk". The music desk keeps the competition's music on that device, so it plays without the internet, and replaces it with the next competition's. The music is never public. It is deleted 30 days after the competition's last day, or with the competition or the club if sooner. Reminder emails about music that is due give counts only, never a gymnast's name.
Public results show only what section 6 lists. ChalkScore holds no gymnast's address, phone number, email address, medical information or photograph.
GymBux — rewards
GymBux reads the club's gymnasts from Invert Core and keeps its own record of their points.
| About | What is held |
|---|---|
| Each gymnast | Name, date of birth, points balance, what they have earned and spent, badges awarded, the character and background they have chosen, and the classes they are in. No email address and no photograph |
| The club's classes | Each class's name, level, description, day and times, and which gymnasts are in it |
| The club's shop | The rewards on offer (name, description, price in points, stock), and each request: which gymnast it is for, which reward, when it was asked for, and when a coach handed it over |
| Club staff | First and last name, email address (optional), role (staff or admin), and their Invert Core account if it is linked. Their PIN is stored only as a one-way scrypt hash, never as entered. Their sign-ins on the GymBux app are stored only as one-way hashes, and last at most 30 days |
| Parents using the family app | Their Invert Core account reference, and the name and email address from that account. For each child Invert Core links them to: the child's Invert Core reference and first name, the club, and the relationship. Their sign-ins are stored only as one-way hashes, and last at most 30 days |
| The club's devices | The name the club gave each device it has paired, and when the device was set up, last used and removed. Each device's credential, and each pairing code, is stored only as a one-way hash. Pairing codes made in the club's settings expire after 24 hours |
| The TV board and settings | The club's private TV link, and its display settings: messages, slides, timings, award buttons, and the characters and backgrounds on offer. No personal information |
The TV board shows gymnasts' points at the gym. It shows the gymnasts in the classes on now, or otherwise the top 100. For each, it shows their first name and the first letter of their last name, their points balance, character, background and classes. It shows a full last name where public use of the gymnast's name is allowed (section 8). The TV board works only through the club's private TV link, on a device paired to the club, or for a signed-in coach. The club's admins can replace the link at any time, which cuts off every screen still using the old one.
Staff names and roles show on GymBux's PIN sign-in screen. That screen works only on a device paired to the club, or for someone already signed in to it.
A gymnast's own page. A gymnast has no account. They find their name by typing at least three letters of it, then confirm their birthday's day and month. The page can be opened from anywhere at the club's GymBux address, so that families can use it at home, and it does not limit how many birthdays are tried. Someone who knew a gymnast's first name could therefore reach that gymnast's page, which shows:
- their first name and surname initial;
- their balance and recent awards;
- their badges;
- the club's shop.
From the page, they could spend only that gymnast's own points: on a shop request that a coach hands over in person, or on a character. The page shows no birthday, contact details or address, and nothing about any other gymnast. Nobody can give or take points there.
The family app. A parent signs in with an Invert Core account. They see only the children Invert Core links them to: where the email they sign in with matches the one the club holds for the child, or where a coach at the club approves the link. They see the balance, what it was earned for, badges, and the club's shop, where they can ask for a reward for a coach to hand over. Nobody can give or take points in it. If the club removes a link, the child disappears from the app at the parent's next sign-in. A parent can delete their GymBux account in the app. That removes their links and every sign-in, and never changes the child's record.
Invert Eye — video review
The footage is not held by us. Video is saved in the club device's own photo library, and Invert Eye stores a pointer to it, never a copy. It does not travel to us.
For each clip we hold a small text record: which gymnast it is of, the coach's label for it, drawings made on the frame (as coordinates), when it was recorded, and the pointer to where the video sits on the device. To show coaches a list of gymnasts, Invert Eye reads each gymnast's name, class and video consent from Invert Core. Invert Core's roster includes dates of birth; Invert Eye's server removes them as it receives them, and never stores them or shows them in the app.
Devices and the club code. A club's coaches connect their phones and iPads to the club with the club code. The club's owner makes this short code on Invert Eye's setup page and gives it to their coaches.
- The club code is never stored. We keep only a one-way hash of it (SHA-256), which lets us check a code someone types without keeping the code itself. The code is shown once, to the club's owner, when it is made. Making a new code replaces the old one, which then stops working for new devices at once.
- For each device the club has set up, we hold: the name it was given when it was set up, when it was set up and last used, and whether its access has been removed. The coach chooses the name, for example "Beam iPad", and it may include a first name if they choose one. We also hold a one-way hash of the device's own credential, never the credential itself. We hold nothing else about the device: no serial number, no phone number, no location.
- Why: so the club's owner can see every device using the club's records and remove any one of them, for example a lost phone or a coach who has left. A removed device loses the club's roster, consent answers and tagged clips the next time it connects.
The club's owner reaches the setup page by signing in to Invert Core. Invert Eye checks with Invert Core who is signed in, and whether they own a club with Invert Eye. It stores no account, password or sign-in of its own.
When someone sets up a new device, we briefly record the internet address the request came from, and a one-way hash of the code they typed, only to stop automated guessing of club codes. These records are deleted after a day.
Rotation Scheduler — timetables
No information about gymnasts. Classes, apparatus, timetables, and coaches' names as labels on a schedule.
Schedule 2 — Providers we use
| Provider | What they do for us | Where | What they receive |
|---|---|---|---|
| Neon | Database hosting for Invert Core and other products | Sydney, Australia (AWS ap-southeast-2) |
Everything in Schedule 1 held in those databases, encrypted at rest |
| Vercel | Runs Invert Core and other products' servers | Sydney, Australia (syd1) |
Requests as they are handled; nothing is stored there |
| Oracle Cloud | Runs ChalkScore's server, its database and its nightly backups, and GymBux's application server | Sydney, Australia (ap-sydney-1) |
Everything in Schedule 1 under ChalkScore, on storage encrypted at rest; and GymBux's requests as they are handled (GymBux's database is with Neon) |
| GitHub | Holds our source code, runs our automated tests, and stores our daily backups, including ChalkScore's | United States | Encrypted backups only, which it cannot read. Our automated tests use invented gymnasts, never real ones |
| Resend | Sends emails: to club staff (invitations, password resets, reminders); to parents with an account (a sign-up link, a club's answer to a request, a deletion receipt); ChalkScore's emails (a visiting club's entry link, entry confirmation and entry-fee invoice, copied to the host club); and notices to us when someone registers interest on our website | United States | The recipient's email address, the club's and competition's names, and the private entry link. An entry confirmation gives only the number of gymnasts at each level, never their names. An entry-fee invoice gives the host club's legal name, ABN and bank details, the entering club's name and contact person, the competition, the number of gymnasts and the amounts. No information about gymnasts |
| Google Fonts, and cdnjs (Cloudflare) | Supply the typefaces and icons ChalkScore's pages are displayed with | United States, and Cloudflare's worldwide network | The visitor's IP address and browser details when a page loads. No information about gymnasts, families or staff |
| Stripe | Subscription payments, invoices and receipts | Global | The club's name, the email address of the owner who chooses a plan, and the club's card, which is entered on Stripe's own page and never reaches us. No information about gymnasts or families |
| Stripe, on the club's own account | ChalkScore's entry fees by card, when a host club connects its own Stripe account. The club is Stripe's customer, not us | Global | When the club's owner connects: the club's name, the owner's email address, what the club sells and its industry, and its legal name and ABN if the club has saved them. For each payment: the entering club's contact email address, the competition, the number of gymnasts and the amount. Card and bank details are entered on Stripe's own pages and never reach us. No information about gymnasts |
| Netlify | Our public website | United States | Standard website visit information. No information about gymnasts, families or staff |
Schedule 3 — How the information is protected
Separation between clubs. Every request is answered only from the asking club's records. Automated tests try to read one club's records as another club, and they run on every change we make.
Staff accounts. Passwords are stored only as one-way scrypt hashes. Two-step sign-in with an authenticator app is available to every account, and is required for our own access. Repeated wrong passwords are slowed down. Sessions last at most 14 days, are stored only as one-way hashes, and can be ended on every device at once by the staff member, or by us on the club's request. When that happens, the products that sign in through Invert Core are given the time it happened so they can end their own sessions too.
Products. Each product, at each club, has its own key, which can be withdrawn on its own. The keys are stored only as one-way hashes, live only on our servers and never inside an app, and give a product only the fields it is allowed to read.
In transit and at rest. Everything travels encrypted (TLS), and the databases are encrypted at rest.
Backups. A backup is taken every day, restored into a separate database and compared table by table every time to prove it works, then encrypted with AES-256 using a key we hold and kept for 30 days.
Imports. Roster files are reduced to the columns the software uses before they leave the club's computer, and refused if they arrive carrying anything else (section 7).
Records of access. Every staff change, import, consent decision and export is recorded in the club's history, which the club's owners can read. Our own access to the club's records is recorded as described in section 6.
Monitoring. Invert Core's availability is checked automatically several times a day, and it confirms that it is still running in Sydney each time.
ChalkScore. ChalkScore applies the same principles on its own server:
- Separation between clubs. Every record a request names is checked against the asking club before it is read or changed, and a request for another club's record is answered as if it did not exist. An automated test fails if any part of ChalkScore skips that check, and it runs on every change we make. Before each release, a test with several invented clubs tries to reach each one's records from the others.
- Scoring stations. A judge's or scorer's PIN works only on a device that has opened the club's private station link, so a PIN alone is useless elsewhere. The club can replace the link at any time, which signs out every station. Repeated wrong PINs or passwords are blocked: 15 wrong attempts in 15 minutes stops further tries for that time. Judges' stations stop working when the club's ChalkScore ends.
- The server. Its database cannot be reached from the internet, only by ChalkScore itself, and the server accepts only key-based connections (section 6). The web server keeps no record of visitors' requests, and ChalkScore's own logs are capped in size and replaced as they fill.
- Backups. A backup is taken every night, read back to prove it is complete, and kept for 30 days on the server. Each night's backup is also encrypted with AES-256, using a key held only on the server and by us, and that encrypted copy is stored with GitHub for 30 days. Every week the newest backup is restored into a separate database and checked against the live one.
Acceptance
Signed for the club by a person authorised to sign for it.
| Invert Systems | The club | |
|---|---|---|
| Name of business | Invert Systems (Vaughn Ray Edmonds, sole trader) | |
| ABN | 44 869 392 328 | |
| Signed by | Vaughn Ray Edmonds | |
| Signature | ||
| Date |
Previous versions of this agreement are kept, so it is always possible to establish what it said on a given date.