Privacy

Your privacy is critically important to us. At Swimtopia, we have a few fundamental principles:

• We don’t ask you for personal information unless we truly need it.
• We don’t share your personal information with anyone except to comply with the law, develop our products, or protect our rights.
• We don’t store personal information on our servers unless required for the ongoing operation of one of our services.

Scalability

The Swimtopia service is hosted at Heroku, one of the largest and most advanced cloud application platform providers, which is in turn underpinned and complemented by Amazon Web Services, the world's largest cloud computing provider.

Swimtopia is designed to take full advantage of the scaling capabilities of the Heroku platform. Swimtopia is served by multiple application servers at all times. Request rates, response times, and server processing load averages are all continuously monitored and used to dynamically increase or decrease server capacity in real-time to adapt to bursts of high traffic and to ensure consistent levels of performance.

Security and Compliance

We take the security and privacy of the data we manage very seriously. We appreciate that we are being entrusted with private information including names, birth dates, and email addresses. While Swimtopia makes it easy for teams to collect payments online, at no time do any of our systems come in contact with private customer payment information, including credit card numbers.

All traffic on Swimtopia is encrypted using the secure HTTPS protocol to protect the security of password-protected pages and sensitive data collected during registration or other times. This ensures that no one on the same network will be able to snoop to see your password or other private information.

Our payment processing providers provide protection for all credit card information. Stripe is a Level 1 PCI-compliant payment provider (the highest possible level).

We partner with cloud platform providers to store and process customer data, and do not directly manage physical server hardware. Heroku and Amazon Web Services provide multiple levels of protection, at the operating system, network, and physical hardware layers. Both platforms are fully PCI- and SOC-certified.

More information:

• Heroku: Security | Compliance
• Amazon Web Services (AWS): Security | Compliance
• Stripe: Security & Compliance

System Monitoring and Uptime

Swimtopia is monitored 24/7 by a third-party service to measure performance and uptime and to provide immediate notification in the event of an outage. We make our performance and uptime history available publicly at http://status.swimtopia.com.

You can't manage what you don't measure. In addition to monitoring overall service availability, we also use application performance monitoring tools to measure performance and overall system health.

Safeguards to Prevent Data Loss

Swimtopia employs multiple layers of safeguards to prevent loss of data, including: 

1. Our primary database is replicated in real-time to a standby server in a geographically separate data center, so we always have a failover ready in case of an emergency.
2. We maintain daily, weekly, and monthly backups of the entire database. We regularly test these backups. 
3. We maintain a continuous up-to-the-minute log of database changes so that even in the unlikely case we had to restore from a previous backup, we’d be able to restore data all the way up to within one minute of the point of failure.

At the most basic level, for nearly all data — and especially including registrations and payments -- we employ a technique called "soft delete" to enable recovery of deleted data. Like the trash can on Windows or Mac OS, when you delete something, it is moved out of the way and marked as "trash" but can still be restored if needed. We do this to protect against accidental deletions.