Privacy Policy
FormCaddie is built to collect as little about you as possible. Swing analysis runs on your iPhone, and your videos are never uploaded.
Data controller
Nicolai Veyron Uberg (private individual), Norway.
Contact: ubergnicolai@gmail.com
What I process
- Account. When you sign in with Apple, the app asks Apple for no personal details at all. I do not request, and never receive, your name or your email address—not even a “Hide My Email” relay address. Your account is a Firebase user ID tied to the anonymous identifier Apple issues for FormCaddie.
- No golf profile. I store no profile about you or your game: no handicap, no experience level, no goals, no age. Handedness is detected automatically from each swing and is never sent anywhere.
- Subscription and usage. Whether you have an active Pro subscription, and how many of your ten weekly free analyses you have used, counted per account on my server together with short-lived records of each analysis attempt. This is needed to enforce the free limit and to give you the access you paid for.
- Optional product analytics. A random pseudonymous account ID and bounded events about the entry point and step reached in a flow, technical duration, error type, camera angle, club category, free/Pro state, screen name, the checkpoint being viewed or coached, the number of swings in a range session, and the overall score of an analysed swing. The ID is not your Firebase ID, Apple ID, or email address.
Your videos and analyses
The swing videos you record stay on your device. They are not uploaded to any server, and the analysis runs locally using Apple Vision and an on-device model. Analysis results are also stored only on your device. I cannot see your full videos or analysis reports. If you separately opt in to optional swing-image sharing, I can see the selected still images described below.
This includes Live Range. While a Live Range session is open, the camera runs continuously so swings can be detected, but nothing is written to disk except the short clip around a detected swing, and that clip is analysed on your device like any other. Clips you do not keep are deleted when you close the session summary; the ones you keep, and the session history, stay on your device until you delete them or uninstall the app. Live Range speaks its coaching out loud through the speaker. The microphone is never used, and the clips contain no audio.
Optional swing-image sharing
Adult free users can optionally contribute selected still images from new recordings made inside FormCaddie or Live Range. Imported videos and recordings made before consent are excluded. We collect at most three frames from one swing per selected session, no more than two contributions in seven days and eight in 30 days, with at least 72 hours between admissions. We do not upload full videos or audio. Uploads use Wi-Fi.
The images are used only to develop, label, train and evaluate FormCaddie's shaft and club-head tracking models. I and authorized processors may view and label them. They are not sold, used for advertising, published in public datasets or used to train unrelated models.
File metadata, including GPS location, recording date, device details and original filenames, is removed before upload. Visible faces, people and backgrounds remain: these images are not anonymous. Share only your own swings and only when you have permission from other identifiable people shown. You must confirm you are at least 18; we do not collect your date of birth.
To limit repetition and honor deletion, a restricted account mapping links your account to a random contributor ID. Training records contain random contributor/session/swing identifiers, image dimensions, selected club category, camera angle, available handedness, model and sampler versions and bounded sampling/failure categories. They exclude your name, email, original media metadata and analysis scores. Consent and server admission times are stored separately. Cloud infrastructure necessarily processes connection information such as IP addresses; this is not included in training datasets.
Processing is based on your separate consent (GDPR Article 6(1)(a)). Standard free access remains available without consenting. While enrolled, your weekly allowance rises from 10 to 15 analyses and from 15 to 22 minutes 30 seconds of Live Range. This does not depend on how many frames are selected or successfully uploaded. Collection may be paused without removing the bonus.
You can skip a session or turn sharing off under Profile → Privacy. Turning sharing off immediately returns your limits to standard free usage; already consumed usage remains counted and may leave no remaining allowance that week. We stop collection and exclude your contributions from new training datasets. Offline withdrawal stops collection on that device immediately and is sent to the server when a connection returns. Upgrading to Pro stops collection; rejoining after a downgrade requires a new explicit choice.
Images and annotations are retained for no more than 12 months, or deleted within 30 days of withdrawal or account deletion. Pending images on your phone expire after seven days and are excluded from device backups. Managed training/review downloads are temporary and removed when the process finishes. Deletion of source data cannot automatically undo its influence on an already trained model; affected model versions are assessed separately.
Google Cloud Storage and image-ingestion functions process the contributed images in Finland (europe-north1); the existing Firestore database is in Sweden (europe-north2). Google is our infrastructure processor. Existing account/subscription endpoints may run in the United States. The optional images are not sent to Amplitude, Crashlytics or a public annotation platform.
Payment
All purchases go through Apple's App Store. Apple is the seller and handles the payment. I never receive your card number or any other payment details—only a confirmation from Apple that the subscription is valid. See the Terms of Use for the subscription terms.
Legal basis
Your account, subscription, and usage limit are processed to perform the contract with you to provide the app (GDPR Article 6(1)(b)). Product analytics are processed for my legitimate interest in finding failures and improving the app flow (Article 6(1)(f)). The data is deliberately limited, and you can stop future product analytics at any time under Profile → Privacy.
Who sees your data
I do not sell your data and do not use it for advertising. I use Google Firebase (Firebase Authentication, Cloud Firestore, Cloud Functions, and Crashlytics) as a data processor for sign-in, for the account records listed above, and for anonymous crash reports. The database stores account, usage, entitlement and analytics identity records, plus the optional contribution consent and restricted training records described above. The Firestore database is in Sweden; existing Cloud Functions for account and subscription operations run in the United States, and the transfer relies on the European Commission's Standard Contractual Clauses and the EU–US Data Privacy Framework.
I use Amplitude with EU data residency for pseudonymous product analytics. Amplitude receives a random account ID, the bounded events described above, and the technical context its SDK collects by default: device model, operating system and app version, app language, session and app-lifecycle events, and an approximate location (country, region, city) derived from your IP address. The advertising-related device identifier (IDFV) is switched off. The account ID lets events from your devices form one usage history while product analytics are enabled.
Purchase events include the App Store product ID, the price, and the currency, so I can see revenue by plan. Renewals, refunds, and expiry are reported by my server from Apple's notifications and carry only the plan category and the event type. No Apple transaction ID or other Apple identifier is ever sent. Crash reports may include bounded technical context such as the feature, processing stage, recording/import, camera angle, club category, and free/Pro state. Your Firebase user ID, Apple identifiers, swing videos, file paths, raw error text, and individual swing measurements are not sent to Amplitude or Crashlytics. Apple handles sign-in and payment as an independent controller under its own privacy policy.
How long I keep it
Account data is kept for as long as you have an account. Product analytics are retained for no more than 14 months. If you delete your account in the app, account data is deleted immediately and a deletion request is submitted for product analytics; Amplitude completes such requests within 30 days. Videos and analyses stay on your device until you delete them or uninstall the app.
Your rights
You have the right to access, correct, and erase your data, to restrict or object to the processing, and to data portability. You can delete your account and all account data yourself under Profile → Delete account, stop future product analytics under Profile → Privacy, delete the videos stored on your device under Profile → Storage, or ask me by email.
If you believe I process your data unlawfully, you may lodge a complaint with the Norwegian Data Protection Authority (Datatilsynet).
Children
FormCaddie is not directed at children under 13, and I do not knowingly collect data about them.
Changes
If this policy changes, I update the date at the top. Significant changes will be announced in the app.