Data & privacy

What stays on the phone, and what doesn't

Most of the athletes on TWO6 are minors. This page says, in plain words, what the platform stores, what it never sees, and who can get to what. It describes how the software works today; it is a working description, not a legal document.

Who runs it

TWO6 is operated by D6 Training & Performance in Rock Hill, South Carolina, the program that built it and runs its athletes on it. Questions about your data go to info@d6.team.

Accounts

You sign in with an email and password, or with Google. The account record holds your name, email address and role (athlete, parent, coach, mentor, sponsor or admin) plus the profile details you or the program enter: for an athlete, things like age, sport and the parent they belong to.

  • Athletes, parents, mentors and sponsors create their own accounts.
  • Coach and admin accounts are created by invitation from the program only. Nobody can promote their own account; role changes happen on the server, by an admin.
  • Sign-in attempts are rate-limited per connection to slow down password guessing.

Form Check

Form Check uses the phone's camera, and this is the part people ask about most, so here it is exactly:

The camera feed is processed on the device. The pose model is downloaded to the browser and runs there. No video and no camera frames are uploaded to TWO6, to D6, or to anyone else.

What a saved session contains:

  • The exercise, when it started and ended, and who recorded it.
  • The rep ledger: for each rep, the depth reached, the turnaround angle and whether it was full or shallow. For holds, the time.
  • Which coaching cues fired and how many times.
  • A summary of the muscles worked and the strain at the end of the set.
  • An optional coaching note, and the athlete or session the workout was assigned to.

Sessions are saved to the signed-in account's name. The per-exercise Tune settings (depth target, strictness) are stored in the browser on that device only.

Face ID

In coach mode a coach can tag athletes by tapping them on the video. Face ID is an optional extra that lets the app recognise an enrolled athlete so the coach does not have to tap every time.

  • Opt-in, by the program. A face is enrolled by a coach or admin from the tag dialog, and the dialog requires a consent name: a parent or guardian for a minor, or the athlete for an adult. That name is stored with the enrolment.
  • No photo is stored. Enrolment keeps a 128-number face descriptor, the mathematical signature the recogniser compares against. It cannot be turned back into a picture.
  • Recognition also runs on the device. The face model is downloaded to the browser like the pose model.
  • It is cautious by design. Automatic tagging needs repeated matching votes and a clear margin over the runner-up before it names anyone, and a coach's tap always overrides it.
  • It can be removed. Ask the program and the enrolment is deleted. A deleted face is gone from recognition immediately.

Who can see what

  • Parents see their own athletes and nothing about anyone else's.
  • Coaches see the athletes on their roster.
  • Mentors see the athletes they are paired with. Sponsors see sponsorship and impact information, not family data.
  • Admins run the program and can see its records, and can preview the portal as another role to check what that role sees.

Underneath, every table in the database has row-level security switched on, and browsers have no direct write access to the database at all. Every change goes through the platform's own API, which checks who you are and what your role allows before it touches a record.

Staying signed in

Your sign-in token expires every hour. The app holds a refresh token on the device and uses it to renew the session quietly in the background, so an installed app on a coach's phone does not log out in the middle of a set. Signing out clears both tokens from that device.

Installed home-screen apps also check a small version file when they open, so they can reload themselves when a new build of TWO6 is live. That check carries no personal data.

This website

The pages on two6.app load no analytics and set no tracking cookies. The only form on this site, For programs, sends the details you type (name, organization, role, email, phone, athlete count and message) by email to D6 at info@d6.team and a copy to you. It is not stored in a database. Submissions are rate-limited and a hidden field catches automated spam.

Questions or removal requests

Email info@d6.team. For a Face ID removal, say which athlete; the program can delete the enrolment from the admin side.

Last reviewed 29 October 2026, against the version of TWO6 live that day.