Temporary Media Policy

This Policy explains the temporary-media feature in plain language. It should be incorporated into the Privacy Policy and Gym agreement after counsel confirms the statements and operational controls.

Who May Upload and View

• An active Coach may upload media only for an active athlete currently assigned to that Coach.
• A guardian may view an item only while their own relationship to that athlete remains authorized.
• A Coach or guardian cannot gain access by possessing an athlete ID, media ID, prior link, or another Gym's identifier.
• Removing a Coach assignment or guardian relationship immediately removes access even when the media has not reached its scheduled expiration.

Accepted Media and Storage

The current API accepts JPEG and PNG photos up to 10 MB and MP4 or MOV videos up to 50 MB and 30 seconds. The server chooses the Gym, athlete, uploader, upload time, and expiration time. Media bytes are stored in private object storage rather than the database, and public responses do not reveal the storage key.

Twenty Four Hour Access

Access ends exactly 24 hours after the successful upload. The API checks the expiration on every view and save request, so delayed cleanup does not extend access. Expiration and physical deletion are separate events.

Physical Cleanup

The cleanup job marks due media expired, deletes the private object, records deletion time, and writes lifecycle audit events. The operation is designed to be safe to repeat and not to delete unexpired objects. Missing objects are treated as already removed, while other failures remain retrievable.

Operational status at drafting: compatible cleanup code is deployed to staging, but the recurring job remains suspended pending a controlled provider-deletion and alert acceptance test. CGDS must not promise a production deletion interval until scheduling, failure alerts, object-store behavior, backups, and run monitoring are accepted. The proposed duration is a clean-up attempt will be made within 8 hours after the media is marked as expired.

Withdrawal and Relationship Changes

Withdrawal of guardian authorization or removal of a guardian relationship immediately revokes that guardian's access to protected athlete media. It does not alter the media's original expiration time or automatically remove access for other authorized recipients.

A verified safety or privacy concern may result in restriction of access before the scheduled expiration. The Gym Administrator may authorize early removal of media associated with their gym, subject to applicable retention requirements, investigations, and evidence-preservation obligations.

CGDS may independently restrict media access when reasonably necessary to address an urgent security or privacy concern.

Permanent deletion will be performed only after applicable legal holds, investigation requirements, and retention obligations have been evaluated.

Copies Outside TumbleTrust

Temporary media is not copy-proof. Authorized users may be technically able to create screenshots, screen recordings, external photographs, downloads, or other copies of media displayed through TumbleTrust.

Coaches may retain the original uploaded files on their own devices. Device operating systems and backup services may also retain temporary files or copies outside CGDS control.

The technical ability to create or retain a copy does not constitute permission to reuse or distribute it. Users must comply with applicable Gym policies, TumbleTrust’s Terms of Service, and applicable privacy requirements.

TumbleTrust cannot guarantee the removal of copies stored outside systems under CGDS’s control.

Proposed Premium Media Save

TumbleTrust's backend includes a MEDIA_SAVE entitlement that is separate from a user's Gym role.

If this feature is approved and enabled in the future, a Parent with an active premium entitlement and the required athlete-specific authorization may download eligible media to their device before the media expires.

A premium entitlement does not grant access to athletes or media the Parent is otherwise unauthorized to view.

Saving media to a personal device does not extend the availability of the original media through TumbleTrust. Server-hosted media remains subject to its existing 24-hour expiration and deletion lifecycle. TumbleTrust does not provide permanent cloud storage for saved media.

Premium subscription billing, Apple and Google purchase validation, entitlement restoration, refunds, family sharing, and production entitlement activation have not yet been implemented.

This feature remains proposed and unavailable for commercial purchase until the required technical approvals are completed.

Media Rules for Users

• Upload only media reasonably necessary for coaching and only for athletes the Coach is authorized to serve.
• Do not upload medical documents, identity documents, custody records, financial information, or unrelated personal information.
• Do not share, repost, publish, market, sell, use to train AI models, or otherwise reuse private media outside its authorized coaching purpose.
• Do not download, copy, or distribute private media except where expressly authorized by TumbleTrust's applicable features and policies.
• Promptly report incorrect uploads, suspected unauthorized access, suspected copying, or other media-related privacy concerns using the Contact Gym Admin feature when available, or the designated Gym contact method provided during enrollment.