DropVolley Privacy Policy

Last updated: 15 September 2026

This Privacy Policy for Can Ayan ("we," "us," or "our") describes how and why we collect, store, use, and/or share ("process") your personal information when you use our services ("Services"), including when you download and use our mobile application DropVolley (the "App") or engage with us in any related way.

DropVolley is a tennis-IQ coaching and training application. We are the data controller of your personal data under the EU General Data Protection Regulation (GDPR) and the Irish Data Protection Act 2018, with the Irish Data Protection Commission acting as our lead supervisory authority.

Questions or concerns? Reading this Privacy Policy will help you understand your privacy rights and choices. If you do not agree with our policies and practices, please do not use our Services. If you still have questions, contact us at info@kalibrefin.com.

SUMMARY OF KEY POINTS

This summary provides key points from our Privacy Policy. You can find more detail on any topic using the table of contents below.

• What personal information do we process? We process account information from Sign in with Apple, your profile preferences, your Tennis Profile self-assessment answers, your usage data (quizzes, streak, training, mobility, check-ins), your AI Coach messages (only if you enable that feature), support and feedback content, aggregated device diagnostics, and your subscription status. If you buy a coach review, we also process the clip you send and the details you choose with it. Your fuel log stays on your device and never reaches us. See WHAT INFORMATION DO WE COLLECT.

• Do we process sensitive personal information? No — we do not ask for it. We do not collect your contacts, location, health data, facial data, Apple ID password, or payment instruments. The App uses your camera, microphone and photo library only when you start a swing recording, a coach review or a Wall practice session, and never in the background. Wall frames and voice-note audio are processed on your device and are never uploaded.

• Does a person ever watch my video? Only if you buy a coach review. That is the one feature where a human being opens your clip, and Section 6 says exactly who, what they can do, and for how long the clip is kept. Everything else — Wall counting, AI Swing Analysis — is automated.

• Do we sell your data or show ads? No. We do not sell or share your personal data, and we use no advertising SDKs.

• Do we offer AI features? Yes — several optional AI features, off until you consent in-app. They are powered by two third-party AI providers: Google LLC (Gemini API) powers AI Swing Analysis, AI Match coaching (pre-match plan feedback, post-match analysis, and a pre-match mental check), and Doubles compatibility analysis; Anthropic, PBC (Claude) powers the AI Coach chat. For AI Swing Analysis, the App compresses your swing video and sends the video itself to Google Gemini for analysis; the video is also saved on your device for your history and is not stored on our servers. For Match coaching, the mental check, and Doubles compatibility, the App sends text summaries to Google Gemini. See HOW DO WE HANDLE THE AI COACH.

• How do we keep your information safe? Through reasonable organizational and technical measures, including TLS in transit and encryption at rest where supported. No method is 100% secure. See HOW DO WE KEEP YOUR INFORMATION SAFE.

• What are your rights? Depending on where you live, you may have rights under the GDPR, UK GDPR, or the California Consumer Privacy Act (CCPA). See WHAT ARE YOUR PRIVACY RIGHTS.

TABLE OF CONTENTS

1. WHAT INFORMATION DO WE COLLECT?
2. HOW DO WE PROCESS YOUR INFORMATION?
3. WHAT LEGAL BASES DO WE RELY ON?
4. WHEN AND WITH WHOM DO WE SHARE YOUR INFORMATION?
5. HOW DO WE HANDLE THE AI COACH AND THIRD-PARTY AI?
6. HOW DOES THE PAID HUMAN COACH REVIEW WORK?
7. WHERE IS YOUR INFORMATION STORED AND HOW LONG DO WE KEEP IT?
8. INTERNATIONAL DATA TRANSFERS
9. HOW DO WE KEEP YOUR INFORMATION SAFE?
10. WHAT ARE YOUR PRIVACY RIGHTS?
11. DO WE COLLECT INFORMATION FROM MINORS?
12. DO CALIFORNIA RESIDENTS HAVE SPECIFIC PRIVACY RIGHTS?
13. DO WE MAKE UPDATES TO THIS POLICY?
14. HOW CAN YOU CONTACT US ABOUT THIS POLICY?
15. HOW CAN YOU REVIEW, UPDATE, OR DELETE THE DATA WE COLLECT?

1. WHAT INFORMATION DO WE COLLECT?

In Short: We collect the information you provide to us and a limited set of information collected automatically. We do not collect sensitive personal information.

a. Information you provide to us

• Account information when you sign in with Apple: your Apple-provided user identifier, an optional email address (you can choose to hide it), and an optional display name.
• Profile preferences you set during onboarding: skill level, training frequency, focus area, and language.
• Tennis Profile self-assessment: when you complete the Tennis Profile, you answer about a dozen questions about your level, play style, stroke self-ratings, and goals. We use your answers to generate a personal tennis profile and development goals.
• AI Coach messages: if you choose to enable the optional AI Coach, the messages you type to it (see Section 5).
• Swing video (for AI Swing Analysis): if you choose to use the optional AI Swing Analysis, you record or pick a short tennis swing video. The App compresses that video (to roughly 720p) and sends the video itself to our AI provider (Google Gemini) to generate a 0–100 score and technique coaching. The video is also stored on your device (in the App's storage) so you can review it in your history; it is not stored on our servers — our backend forwards it to Google and does not retain it (see Section 5).
• AI Match coaching inputs (for Match coaching and the pre-match mental check): if you use these optional features, the App sends a text summary to our AI provider (Google Gemini) — for example opponent, surface, result, score, your self-ratings, notes, and plan; or, for the mental check, your energy/confidence/nerves inputs plus context (see Section 5).
• Doubles compatibility inputs: if you use the optional Doubles compatibility analysis, the App sends a text summary of both players' tennis profiles to our AI provider (Google Gemini) to generate a compatibility score and game plan (see Section 5).
• Coach review submissions: only if you buy a coach review, a human review of your technique. You send the video clip you choose, the stroke and handedness you select, an optional note, and the language your app is set to. This is the one feature where a person watches your video. See Section 6.
• Wall practice: during a Wall session the camera watches you play so the App can count your reps and judge the rung. Every frame is processed on your device and none is uploaded — we never receive the video. A Wall clip leaves your device only if you tap Save, which writes it to your own photo library.
• Match journal: the matches you log — opponent, surface, result, score, your self-ratings, your notes and takeaway — and any photos you attach. Voice notes you record are transcribed on your device by Apple's on-device speech recognition; the audio never leaves your iPhone.
• Fuel log (nutrition): what you ate before playing and how you rated your energy, legs, focus and stomach afterwards. This stays on your device only — it is not synced to your account and we never receive it. One exception, under your control: a switch on the Nutrition screen, off by default and available with Premium, sends a short plain-English summary (your averages, the comparisons that cleared our evidence bar, and your last five sessions — never your written notes, never the raw log) with each AI Coach message, to the provider that powers the Coach (see Section 5). Switch it off and nothing further is sent.
• Support and feedback content you send via in-app feedback or email.

b. Information collected automatically

• Usage data: which quizzes you complete, your streak, training sessions you mark done, mobility flows you start, and weekly check-ins you submit.
• Device diagnostics: aggregated crash reports, hangs, and CPU/disk metrics provided by Apple's MetricKit framework, used to fix bugs and improve performance. These are not linked to your identity.
• Technical context: app version, iOS version, device model, and locale, included automatically in any feedback email you choose to send.

c. Information from third parties

• Apple App Store / StoreKit: your subscription status (active, lapsed, or refunded) and, if you buy a coach review, a signed transaction record that we verify against Apple's certificate chain before we create your order. Apple does not share your payment details with us.

d. What we do NOT collect

We do not collect your contacts, location, health data, or facial data, and we do not collect your Apple ID password or payment instruments.

The App uses your camera, microphone, photo library and on-device speech recognition only in the moments you start these features, and never in the background:

• Camera: to record a swing video for AI Swing Analysis or a coach review, and during Wall practice to watch you swing. Wall frames are analysed on your device and are never uploaded.
• Microphone: the audio of a swing recording is analysed on your device to find the moment of ball contact, and match voice notes you record are transcribed on your device by Apple's speech recognition. Voice-note audio never leaves your iPhone.
• Photo library: to let you pick an existing video, and to save a Wall clip only when you tap Save.

A video leaves your device in exactly two cases, both of which you start: an AI Swing Analysis (compressed and sent to Google Gemini, Section 5) and a coach review you have bought (Section 6). Nothing else you film is uploaded.

2. HOW DO WE PROCESS YOUR INFORMATION?

In Short: We process your information to provide and administer the Services, sync your progress, verify your subscription, fix problems, and respond to you.

We do not use your data for advertising, profiling, or sale to third parties.

3. WHAT LEGAL BASES DO WE RELY ON?

In Short: We only process your personal information when we have a valid legal reason to do so under the GDPR and UK GDPR.

• Contract performance (Art. 6(1)(b)): to run your account, deliver subscription content, sync your progress, and process purchases.
• Legitimate interests (Art. 6(1)(f)): to keep the App secure, prevent fraud and abuse, and improve performance via aggregated crash and diagnostic data. You can object at any time.
• Consent (Art. 6(1)(a)): for the health and safety acknowledgment; for the optional AI Coach (sharing your tennis context and messages with Anthropic to generate replies); and for our optional Google Gemini–powered AI features (sending your compressed swing video for AI Swing Analysis, and sending text summaries for AI Match coaching, the pre-match mental check, and Doubles compatibility analysis); see Section 5. You can withdraw consent at any time, which does not affect the lawfulness of processing before withdrawal.
• Explicit consent (Art. 9(2)(a)): only if a coach-review clip or note you send happens to reveal health information. We ask you not to include medical details; if you do, we process them solely to deliver your review and delete them with the clip (Section 6).
• Legal obligation (Art. 6(1)(c)): to comply with tax, financial, and regulatory requirements, including keeping purchase records.

4. WHEN AND WITH WHOM DO WE SHARE YOUR INFORMATION?

In Short: We share your information only with the limited service providers needed to run the Services. We do not sell or share your data for advertising.

We do not use third-party advertising SDKs. We may also disclose personal information where required to comply with applicable law, a legal process, or a governmental request, or to protect the rights, property, or safety of our users or others.

5. HOW DO WE HANDLE THE AI COACH AND THIRD-PARTY AI?

In Short: Our AI features are optional, off by default, and powered by two third-party AI providers — Google LLC (Gemini API) for AI Swing Analysis, AI Match coaching, the pre-match mental check, and Doubles compatibility; and Anthropic, PBC (Claude) for the AI Coach chat. Nothing is shared until you consent in-app. All requests are proxied through our Supabase backend, which forwards them to the relevant provider and does not retain the content. Both providers are used under their paid/commercial API terms, under which they do not use your content to train their models.

(a) AI Coach — Anthropic (Claude)

The AI Coach is an optional chat feature, included in your DropVolley subscription, powered by Claude, an AI service operated by Anthropic, PBC — a third-party company based in the United States.

It is off until you explicitly turn it on. The first time you open the AI Coach, the App shows a consent screen that explains exactly what will be shared, and nothing is sent to Anthropic until you agree. If you decline, no data leaves your device for this feature.

If you use the AI Coach, the App sends Anthropic:

• the messages you type to the Coach;
• your profile (skill level and focus);
• your Tennis Profile (level, play style, and goals), if you have taken it;
• your recent matches, scores, and self-ratings; and
• your quiz mistake patterns.

Anthropic processes this information only to generate the Coach's replies. Under Anthropic's paid/commercial API terms, your inputs and outputs are not used to train Anthropic's models. We do not use this data for advertising or profiling. You can stop using the AI Coach at any time, daily usage is capped, and our legal basis for this processing is your consent (GDPR Art. 6(1)(a)).

(b) AI Swing Analysis — Google Gemini

AI Swing Analysis is a separate optional feature, included in your DropVolley subscription, powered by the Gemini API, an AI service operated by Google LLC (United States).

It is off until you explicitly turn it on. Before anything is sent, the App shows a consent screen that explains exactly what will happen, and nothing leaves your device until you agree. If you decline, no data is sent for this feature.

If you use AI Swing Analysis, you record or pick a short tennis swing video. The App then compresses that video (to roughly 720p) and sends the video itself to Google Gemini to generate a 0–100 score and technique coaching shown to you. The video is also saved on your device (in the App's storage) so you can review it in your history. The video is not stored on our servers — our backend forwards it to Google and does not retain it. Although recording a video also captures audio, the audio is not separately analyzed. Under Google's paid/commercial Gemini API terms, the content we send and the analysis returned are not used to train Google's models. We do not use this data for advertising or profiling. You can stop using AI Swing Analysis at any time, and our legal basis for this processing is your consent (GDPR Art. 6(1)(a)).

(c) AI Match coaching and pre-match mental check — Google Gemini

AI Match coaching (pre-match plan feedback and post-match analysis) and the pre-match mental check are optional features, included in your DropVolley subscription, powered by the Gemini API, operated by Google LLC (United States).

If you use these features, the App sends Google Gemini a text summary — for example opponent, surface, result, score, your self-ratings, notes, and plan; or, for the mental check, your energy/confidence/nerves inputs plus context. Text only — no video is sent. Google processes this solely to generate the coaching text returned to you. Under Google's paid/commercial Gemini API terms, your content is not used to train Google's models. Our legal basis for this processing is your consent (GDPR Art. 6(1)(a)).

(d) Doubles compatibility analysis — Google Gemini

Doubles compatibility analysis is an optional feature, included in your DropVolley subscription, powered by the Gemini API, operated by Google LLC (United States).

If you use it, the App sends Google Gemini a text summary of both players' tennis profiles to generate a compatibility score and game plan. Text only — no video is sent. Google processes this solely to generate the output returned to you. Under Google's paid/commercial Gemini API terms, your content is not used to train Google's models. Our legal basis for this processing is your consent (GDPR Art. 6(1)(a)).

6. HOW DOES THE PAID HUMAN COACH REVIEW WORK?

In Short: If — and only if — you buy a coach review, a person watches the video you send. They can stream it inside our coach panel to write your review, and nothing else. The clip is deleted 90 days after your order, and every time it is opened is logged.

Nothing in this section applies unless you make that purchase. The automated AI Swing Analysis is a different feature and is covered by Section 5.

Who watches. One tennis coach acting for DropVolley. Today that is DropVolley's founder, Can Ayan, who is also the data controller. If we add independent coaches they will act as our data processors under a written contract meeting GDPR Art. 28(3) — confidentiality, no use beyond your review, no sub-processors, deletion on instruction — and, where they are outside the EEA, the safeguard described under Where the coach is. This policy will name the categories of coach we use, and its "Last updated" date will change, before any new coach can open a clip.

What they can do. Stream your clip inside our coach panel through a link that expires after 30 minutes and is re-issued only while your order is open. The panel offers no download and no export. Screen recording cannot be technically prevented on any device; it is prohibited by the coach's contract, and every link issued — and every claim, delivery and deletion — is logged with the coach, the action and the time, so any misuse is traceable to a named coach and a moment.

What they cannot do. Share, post, copy, keep, or use your video for anything other than your review — including their own marketing, or training any software.

What you receive and where it lives. A scorecard, written notes with timestamps, one prioritised correction with a drill, and a voice note. These are stored in your account and shown to you and to the coach who wrote them, until you delete your account or ask us to remove them.

Retention. The original video is deleted automatically 90 days after your order is created, or when you delete your account — whichever comes first; each deletion is logged. Your scorecard, notes and voice note stay in your account until you delete your account. The order record (order reference, purchase verification, timestamps) and the access log for your clip are kept for as long as your account exists and then for up to 6 years for tax and dispute purposes (GDPR Art. 6(1)(c)); the clip itself is never restored after deletion.

Age, and other people in your clip. This feature is for players aged 18 or over; you confirm this on the order screen, and we refund and delete a clip if we learn the player is under 18. Please film only yourself; if someone else is clearly identifiable, make sure they do not object.

Health information. A coach review assesses technique, not injury or fitness. Please do not include medical details in your note or your clip; the coach will not comment on injuries and will tell you to see a physiotherapist or doctor instead. If your clip or note nevertheless reveals health information, we process it only because you chose to send it, for the sole purpose of your review (GDPR Art. 9(2)(a)), and it is deleted on the same schedule as the clip.

Review language. Reviews are written in English, whatever language your app is set to. This is stated on the order screen before you pay.

Marketing. We do not use coach-review clips or reviews in marketing. If we ever offer that, it will be a separate, per-video, off-by-default permission you can withdraw in the app, and this policy will change first.

Legal basis. Performance of the contract you enter when you buy the review (GDPR Art. 6(1)(b)). No automated decision with legal or similar effect is made about you (Art. 22): the assessment is a human judgement.

Where the coach is. Your clip is stored on our EU-hosted infrastructure (Supabase Inc., EU region, Stockholm, Sweden) and the coach reviews it from Ireland; it is streamed — not downloaded — through a 30-minute link, and access is logged. If we ever engage an independent coach located outside the EEA, that is an international transfer: we will sign the European Commission's Standard Contractual Clauses (GDPR Art. 46(2)(c)) with that coach before they receive a single link, and we will update this section first.

If something goes wrong. If a clip is accessed outside the logged review window, we will tell you within 72 hours of learning of it.

Türkiye'deki kullanıcılar için aydınlatma (KVKK m.10). Veri sorumlusu: Can Ayan (DropVolley), Dublin, İrlanda. İşleme amacı: satın aldığınız antrenör incelemesinin hazırlanması. Toplama yöntemi: uygulama içinden yüklediğiniz video ve notunuz (elektronik ortam). Hukuki sebep: KVKK m.5/2-c (sözleşmenin ifası). Aktarım: video AB'de (İsveç) barındırılır ve İrlanda'daki veri sorumlusu tarafından yalnızca inceleme amacıyla izlenir; bu, KVKK m.9 kapsamında yurt dışına aktarımdır ve sözleşmenin ifası için zorunludur; ileride sözleşmeli bir antrenöre aktarım gerekirse yeterli güvence (standart sözleşme) ile yapılır. Haklarınız: KVKK m.11 kapsamındaki haklarınızı info@kalibrefin.com adresine başvurarak kullanabilirsiniz; başvurular 30 gün içinde yanıtlanır.

7. WHERE IS YOUR INFORMATION STORED AND HOW LONG DO WE KEEP IT?

In Short: We keep your information only as long as needed to provide the Services or to comply with law.

• On your device: a local database holding your progress, preferences, and cached content; any swing videos you record or pick (kept on your device for your history); your fuel log, which is stored only here; and Wall practice frames, which are analysed and discarded as you play.
• Our backend (Supabase): only the data needed to sync your account across devices. When you use an AI feature, our backend proxies your request to the relevant AI provider and does not retain the swing video or text summaries forwarded to them.
• Our AI providers (Google LLC and Anthropic, PBC): receive only the inputs described in Section 5 to generate the AI output, under their respective API terms; we do not direct them to retain your content beyond what is needed to return a response.
• Coach review clips (Supabase, EU region — Stockholm, Sweden): stored only while your review is open and in any case deleted 90 days after your order, or when you delete your account, whichever comes first (Section 6).
• Apple's infrastructure: subscription receipts and Sign in with Apple identifiers, governed by Apple's privacy policy.

We retain account data while your account is active. When you delete your account (Profile → Delete account), we delete server-side records within 30 days, and local data is wiped immediately. When we have no ongoing legitimate or legal need to process your personal information, we delete or anonymize it.

8. INTERNATIONAL DATA TRANSFERS

In Short: Some of our providers process data outside the European Economic Area under appropriate safeguards.

Coach-review clips are deliberately kept inside the EU and are watched from Ireland (Section 6). Some of our service providers (for example, Apple, Supabase, Google LLC, Anthropic, and Resend) may process your personal data outside the European Economic Area, including in the United States. Where this happens, we rely on the safeguards published by those providers — typically the European Commission's Standard Contractual Clauses or an applicable adequacy decision. You may request details of these safeguards by emailing info@kalibrefin.com.

9. HOW DO WE KEEP YOUR INFORMATION SAFE?

In Short: We use reasonable organizational and technical security measures, but no system is perfectly secure.

We use TLS in transit and encryption at rest where supported, and we have implemented appropriate and reasonable technical and organizational measures designed to protect your personal information. However, no electronic transmission over the internet or information storage technology can be guaranteed to be 100% secure. If we discover a breach affecting your personal data, we will notify you and the relevant supervisory authorities as required by law.

10. WHAT ARE YOUR PRIVACY RIGHTS?

In Short: Depending on where you live, you have rights to access, correct, delete, port, restrict, or object to the processing of your personal data, and to withdraw consent.

If you are located in the EEA or UK, you have the following rights under the GDPR and UK GDPR. You can exercise any of them by emailing info@kalibrefin.com; many are also available directly in the App.

• See your data — most of it is shown in the App (Profile, Progress, and History tabs).
• Access and portability (right of access) — request a copy of your data; we will respond within 30 days.
• Rectification — correct inaccurate or incomplete data.
• Erasure ("right to be forgotten") — delete your data via Profile → Delete account, or email us.
• Restriction and objection — restrict or object to specific processing (including processing based on legitimate interests).
• Reset local data without deleting your account — via Profile → Reset local data.
• Withdraw consent at any time — for example, by disabling the AI Coach, signing out, or deleting the App. Withdrawing consent does not affect the lawfulness of prior processing.

Lodging a complaint

If you believe we have processed your personal data unlawfully, you have the right to lodge a complaint with a data protection authority:

• Our lead supervisory authority is the Irish Data Protection Commission (DPC), 21 Fitzwilliam Square South, Dublin 2, D02 RD28, Ireland. Web: https://www.dataprotection.ie. Phone: +353 (0)761 104 800.
• If you live elsewhere in the EU/EEA, you may also contact your national data protection authority.
• If you live in the UK, you may contact the Information Commissioner's Office (ICO): https://ico.org.uk.

11. DO WE COLLECT INFORMATION FROM MINORS?

In Short: No. DropVolley requires users to be at least 16 years old.

DropVolley requires users to be at least 16 years old — the strictest GDPR consent threshold — and we do not knowingly collect data from anyone under 16. The paid coach review has a higher bar: it is for players aged 18 or over, which you confirm on the order screen (Section 6). If you believe a child under 16 has provided us with personal information, or that a coach-review clip shows a player under 18, please contact info@kalibrefin.com; we will deactivate the account or refund and delete the clip, and delete the data.

12. DO CALIFORNIA RESIDENTS HAVE SPECIFIC PRIVACY RIGHTS?

In Short: Yes. If you are a California resident, the California Consumer Privacy Act (CCPA/CPRA) gives you additional rights.

If you are a resident of California, you have the right to request access to and details about the personal information we maintain about you and how we have processed it, to correct inaccuracies, to obtain a copy of it, and to request its deletion. You also have the right not to be discriminated against for exercising these rights.

• We do not sell or share your personal information as those terms are defined under California law, and we do not process it for targeted advertising or for profiling that produces legal or similarly significant effects.
• The categories of personal information we collect are described in Section 1. We do not collect biometric information, geolocation, or browsing history across other services.
• To exercise your rights, email us at info@kalibrefin.com. We will verify your identity using information already in our system before acting on your request, and we will respond within the timeframe required by law.

13. DO WE MAKE UPDATES TO THIS POLICY?

In Short: Yes, we will update this policy as necessary to stay compliant with relevant laws.

We may update this Privacy Policy from time to time as the App evolves. The updated version will be indicated by an updated "Last updated" date at the top of this policy. If we make material changes, we will announce them in-app before they take effect. We encourage you to review this policy periodically.

14. HOW CAN YOU CONTACT US ABOUT THIS POLICY?

If you have questions or comments about this policy, you may email us at info@kalibrefin.com or contact us by post at:

Can Ayan Dublin, Republic of Ireland

(We are not currently required to appoint a Data Protection Officer under GDPR Art. 37. If that changes, we will update this policy with the DPO's contact details.)

15. HOW CAN YOU REVIEW, UPDATE, OR DELETE THE DATA WE COLLECT?

You have the right to request access to the personal information we collect from you, to correct inaccuracies, or to delete it, and you may withdraw your consent to our processing. Most of your data is visible directly in the App (Profile, Progress, and History tabs). To export your data, email info@kalibrefin.com and we will send a copy within 30 days. To delete your data, use Profile → Delete account, or contact us at the same address.