DropVolley Privacy Policy

Last updated: June 2026

This Privacy Policy for Can Ayan ("we," "us," or "our") describes how and why we collect, store, use, and/or share ("process") your personal information when you use our services ("Services"), including when you download and use our mobile application DropVolley (the "App") or engage with us in any related way.

DropVolley is a tennis-IQ coaching and training application. We are the data controller of your personal data under the EU General Data Protection Regulation (GDPR) and the Irish Data Protection Act 2018, with the Irish Data Protection Commission acting as our lead supervisory authority.

Questions or concerns? Reading this Privacy Policy will help you understand your privacy rights and choices. If you do not agree with our policies and practices, please do not use our Services. If you still have questions, contact us at info@kalibrefin.com.

SUMMARY OF KEY POINTS

This summary provides key points from our Privacy Policy. You can find more detail on any topic using the table of contents below.

• What personal information do we process? We process account information from Sign in with Apple, your profile preferences, your Tennis Profile self-assessment answers, your usage data (quizzes, streak, training, mobility, check-ins), your AI Coach messages (only if you enable that feature), support and feedback content, aggregated device diagnostics, and your subscription status. See WHAT INFORMATION DO WE COLLECT.

• Do we process sensitive personal information? No. We do not collect your contacts, location, health data, facial data, Apple ID password, or payment instruments. The App accesses your camera, microphone, and photo library only when you start an AI Swing Analysis (to record or pick a swing video); it does not access them otherwise.

• Do we sell your data or show ads? No. We do not sell or share your personal data, and we use no advertising SDKs.

• Do we offer AI features? Yes — several optional AI features, off until you consent in-app. They are powered by two third-party AI providers: Google LLC (Gemini API) powers AI Swing Analysis, AI Match coaching (pre-match plan feedback, post-match analysis, and a pre-match mental check), and Doubles compatibility analysis; Anthropic, PBC (Claude) powers the AI Coach chat. For AI Swing Analysis, the App compresses your swing video and sends the video itself to Google Gemini for analysis; the video is also saved on your device for your history and is not stored on our servers. For Match coaching, the mental check, and Doubles compatibility, the App sends text summaries to Google Gemini. See HOW DO WE HANDLE THE AI COACH.

• How do we keep your information safe? Through reasonable organizational and technical measures, including TLS in transit and encryption at rest where supported. No method is 100% secure. See HOW DO WE KEEP YOUR INFORMATION SAFE.

• What are your rights? Depending on where you live, you may have rights under the GDPR, UK GDPR, or the California Consumer Privacy Act (CCPA). See WHAT ARE YOUR PRIVACY RIGHTS.

TABLE OF CONTENTS

1. WHAT INFORMATION DO WE COLLECT?
2. HOW DO WE PROCESS YOUR INFORMATION?
3. WHAT LEGAL BASES DO WE RELY ON?
4. WHEN AND WITH WHOM DO WE SHARE YOUR INFORMATION?
5. HOW DO WE HANDLE THE AI COACH AND THIRD-PARTY AI?
6. WHERE IS YOUR INFORMATION STORED AND HOW LONG DO WE KEEP IT?
7. INTERNATIONAL DATA TRANSFERS
8. HOW DO WE KEEP YOUR INFORMATION SAFE?
9. WHAT ARE YOUR PRIVACY RIGHTS?
10. DO WE COLLECT INFORMATION FROM MINORS?
11. DO CALIFORNIA RESIDENTS HAVE SPECIFIC PRIVACY RIGHTS?
12. DO WE MAKE UPDATES TO THIS POLICY?
13. HOW CAN YOU CONTACT US ABOUT THIS POLICY?
14. HOW CAN YOU REVIEW, UPDATE, OR DELETE THE DATA WE COLLECT?

1. WHAT INFORMATION DO WE COLLECT?

In Short: We collect the information you provide to us and a limited set of information collected automatically. We do not collect sensitive personal information.

a. Information you provide to us

• Account information when you sign in with Apple: your Apple-provided user identifier, an optional email address (you can choose to hide it), and an optional display name.
• Profile preferences you set during onboarding: skill level, training frequency, focus area, and language.
• Tennis Profile self-assessment: when you complete the Tennis Profile, you answer about a dozen questions about your level, play style, stroke self-ratings, and goals. We use your answers to generate a personal tennis profile and development goals.
• AI Coach messages: if you choose to enable the optional AI Coach, the messages you type to it (see Section 5).
• Swing video (for AI Swing Analysis): if you choose to use the optional AI Swing Analysis, you record or pick a short tennis swing video. The App compresses that video (to roughly 720p) and sends the video itself to our AI provider (Google Gemini) to generate a 0–100 score and technique coaching. The video is also stored on your device (in the App's storage) so you can review it in your history; it is not stored on our servers — our backend forwards it to Google and does not retain it (see Section 5).
• AI Match coaching inputs (for Match coaching and the pre-match mental check): if you use these optional features, the App sends a text summary to our AI provider (Google Gemini) — for example opponent, surface, result, score, your self-ratings, notes, and plan; or, for the mental check, your energy/confidence/nerves inputs plus context (see Section 5).
• Doubles compatibility inputs: if you use the optional Doubles compatibility analysis, the App sends a text summary of both players' tennis profiles to our AI provider (Google Gemini) to generate a compatibility score and game plan (see Section 5).
• Support and feedback content you send via in-app feedback or email.

b. Information collected automatically

• Usage data: which quizzes you complete, your streak, training sessions you mark done, mobility flows you start, and weekly check-ins you submit.
• Device diagnostics: aggregated crash reports, hangs, and CPU/disk metrics provided by Apple's MetricKit framework, used to fix bugs and improve performance. These are not linked to your identity.
• Technical context: app version, iOS version, device model, and locale, included automatically in any feedback email you choose to send.

c. Information from third parties

• Apple App Store / StoreKit: your subscription status (active, lapsed, or refunded). Apple does not share your payment details with us.

d. What we do NOT collect

We do not collect your contacts, location, health data, or facial data, and we do not collect your Apple ID password or payment instruments. The App accesses your camera, microphone, and photo library only when you start an AI Swing Analysis — to record or pick a swing video — and does not access them at any other time. Because recording video captures audio, the recording may include sound, but the audio is not separately analyzed. As described in Section 1(a), the swing video is compressed and sent to our AI provider (Google Gemini) for analysis and is also kept on your device; it is not stored on our servers.

2. HOW DO WE PROCESS YOUR INFORMATION?

In Short: We process your information to provide and administer the Services, sync your progress, verify your subscription, fix problems, and respond to you.

We do not use your data for advertising, profiling, or sale to third parties.

3. WHAT LEGAL BASES DO WE RELY ON?

In Short: We only process your personal information when we have a valid legal reason to do so under the GDPR and UK GDPR.

• Contract performance (Art. 6(1)(b)): to run your account, deliver subscription content, sync your progress, and process purchases.
• Legitimate interests (Art. 6(1)(f)): to keep the App secure, prevent fraud and abuse, and improve performance via aggregated crash and diagnostic data. You can object at any time.
• Consent (Art. 6(1)(a)): for the health and safety acknowledgment; for the optional AI Coach (sharing your tennis context and messages with Anthropic to generate replies); and for our optional Google Gemini–powered AI features (sending your compressed swing video for AI Swing Analysis, and sending text summaries for AI Match coaching, the pre-match mental check, and Doubles compatibility analysis); see Section 5. You can withdraw consent at any time, which does not affect the lawfulness of processing before withdrawal.
• Legal obligation (Art. 6(1)(c)): to comply with tax, financial, and regulatory requirements.

4. WHEN AND WITH WHOM DO WE SHARE YOUR INFORMATION?

In Short: We share your information only with the limited service providers needed to run the Services. We do not sell or share your data for advertising.

We do not use third-party advertising SDKs. We may also disclose personal information where required to comply with applicable law, a legal process, or a governmental request, or to protect the rights, property, or safety of our users or others.

5. HOW DO WE HANDLE THE AI COACH AND THIRD-PARTY AI?

In Short: Our AI features are optional, off by default, and powered by two third-party AI providers — Google LLC (Gemini API) for AI Swing Analysis, AI Match coaching, the pre-match mental check, and Doubles compatibility; and Anthropic, PBC (Claude) for the AI Coach chat. Nothing is shared until you consent in-app. All requests are proxied through our Supabase backend, which forwards them to the relevant provider and does not retain the content. Both providers are used under their paid/commercial API terms, under which they do not use your content to train their models.

(a) AI Coach — Anthropic (Claude)

The AI Coach is an optional chat feature, included in your DropVolley subscription, powered by Claude, an AI service operated by Anthropic, PBC — a third-party company based in the United States.

It is off until you explicitly turn it on. The first time you open the AI Coach, the App shows a consent screen that explains exactly what will be shared, and nothing is sent to Anthropic until you agree. If you decline, no data leaves your device for this feature.

If you use the AI Coach, the App sends Anthropic:

• the messages you type to the Coach;
• your profile (skill level and focus);
• your Tennis Profile (level, play style, and goals), if you have taken it;
• your recent matches, scores, and self-ratings; and
• your quiz mistake patterns.

Anthropic processes this information only to generate the Coach's replies. Under Anthropic's paid/commercial API terms, your inputs and outputs are not used to train Anthropic's models. We do not use this data for advertising or profiling. You can stop using the AI Coach at any time, daily usage is capped, and our legal basis for this processing is your consent (GDPR Art. 6(1)(a)).

(b) AI Swing Analysis — Google Gemini

AI Swing Analysis is a separate optional feature, included in your DropVolley subscription, powered by the Gemini API, an AI service operated by Google LLC (United States).

It is off until you explicitly turn it on. Before anything is sent, the App shows a consent screen that explains exactly what will happen, and nothing leaves your device until you agree. If you decline, no data is sent for this feature.

If you use AI Swing Analysis, you record or pick a short tennis swing video. The App then compresses that video (to roughly 720p) and sends the video itself to Google Gemini to generate a 0–100 score and technique coaching shown to you. The video is also saved on your device (in the App's storage) so you can review it in your history. The video is not stored on our servers — our backend forwards it to Google and does not retain it. Although recording a video also captures audio, the audio is not separately analyzed. Under Google's paid/commercial Gemini API terms, the content we send and the analysis returned are not used to train Google's models. We do not use this data for advertising or profiling. You can stop using AI Swing Analysis at any time, and our legal basis for this processing is your consent (GDPR Art. 6(1)(a)).

(c) AI Match coaching and pre-match mental check — Google Gemini

AI Match coaching (pre-match plan feedback and post-match analysis) and the pre-match mental check are optional features, included in your DropVolley subscription, powered by the Gemini API, operated by Google LLC (United States).

If you use these features, the App sends Google Gemini a text summary — for example opponent, surface, result, score, your self-ratings, notes, and plan; or, for the mental check, your energy/confidence/nerves inputs plus context. Text only — no video is sent. Google processes this solely to generate the coaching text returned to you. Under Google's paid/commercial Gemini API terms, your content is not used to train Google's models. Our legal basis for this processing is your consent (GDPR Art. 6(1)(a)).

(d) Doubles compatibility analysis — Google Gemini

Doubles compatibility analysis is an optional feature, included in your DropVolley subscription, powered by the Gemini API, operated by Google LLC (United States).

If you use it, the App sends Google Gemini a text summary of both players' tennis profiles to generate a compatibility score and game plan. Text only — no video is sent. Google processes this solely to generate the output returned to you. Under Google's paid/commercial Gemini API terms, your content is not used to train Google's models. Our legal basis for this processing is your consent (GDPR Art. 6(1)(a)).

6. WHERE IS YOUR INFORMATION STORED AND HOW LONG DO WE KEEP IT?

In Short: We keep your information only as long as needed to provide the Services or to comply with law.

• On your device: a local SwiftData database holding your progress, preferences, and cached content, plus any swing videos you record or pick for AI Swing Analysis (kept on your device for your history).
• Our backend (Supabase): only the data needed to sync your account across devices. When you use an AI feature, our backend proxies your request to the relevant AI provider and does not retain the swing video or text summaries forwarded to them.
• Our AI providers (Google LLC and Anthropic, PBC): receive only the inputs described in Section 5 to generate the AI output, under their respective API terms; we do not direct them to retain your content beyond what is needed to return a response.
• Apple's infrastructure: subscription receipts and Sign in with Apple identifiers, governed by Apple's privacy policy.

We retain account data while your account is active. When you delete your account (Profile → Delete account), we delete server-side records within 30 days, and local data is wiped immediately. When we have no ongoing legitimate or legal need to process your personal information, we delete or anonymize it.

7. INTERNATIONAL DATA TRANSFERS

In Short: Some of our providers process data outside the European Economic Area under appropriate safeguards.

Some of our service providers (for example, Apple, Supabase, Google LLC, and Anthropic) may process your personal data outside the European Economic Area, including in the United States. Where this happens, we rely on the safeguards published by those providers — typically the European Commission's Standard Contractual Clauses or an applicable adequacy decision. You may request details of these safeguards by emailing info@kalibrefin.com.

8. HOW DO WE KEEP YOUR INFORMATION SAFE?

In Short: We use reasonable organizational and technical security measures, but no system is perfectly secure.

We use TLS in transit and encryption at rest where supported, and we have implemented appropriate and reasonable technical and organizational measures designed to protect your personal information. However, no electronic transmission over the internet or information storage technology can be guaranteed to be 100% secure. If we discover a breach affecting your personal data, we will notify you and the relevant supervisory authorities as required by law.

9. WHAT ARE YOUR PRIVACY RIGHTS?

In Short: Depending on where you live, you have rights to access, correct, delete, port, restrict, or object to the processing of your personal data, and to withdraw consent.

If you are located in the EEA or UK, you have the following rights under the GDPR and UK GDPR. You can exercise any of them by emailing info@kalibrefin.com; many are also available directly in the App.

• See your data — most of it is shown in the App (Profile, Progress, and History tabs).
• Access and portability (right of access) — request a copy of your data; we will respond within 30 days.
• Rectification — correct inaccurate or incomplete data.
• Erasure ("right to be forgotten") — delete your data via Profile → Delete account, or email us.
• Restriction and objection — restrict or object to specific processing (including processing based on legitimate interests).
• Reset local data without deleting your account — via Profile → Reset local data.
• Withdraw consent at any time — for example, by disabling the AI Coach, signing out, or deleting the App. Withdrawing consent does not affect the lawfulness of prior processing.

Lodging a complaint

If you believe we have processed your personal data unlawfully, you have the right to lodge a complaint with a data protection authority:

• Our lead supervisory authority is the Irish Data Protection Commission (DPC), 21 Fitzwilliam Square South, Dublin 2, D02 RD28, Ireland. Web: https://www.dataprotection.ie. Phone: +353 (0)761 104 800.
• If you live elsewhere in the EU/EEA, you may also contact your national data protection authority.
• If you live in the UK, you may contact the Information Commissioner's Office (ICO): https://ico.org.uk.

10. DO WE COLLECT INFORMATION FROM MINORS?

In Short: No. DropVolley requires users to be at least 16 years old.

DropVolley requires users to be at least 16 years old — the strictest GDPR consent threshold — and we do not knowingly collect data from anyone under 16. If you believe a child under 16 has provided us with personal information, please contact info@kalibrefin.com and we will deactivate the account and delete the data.

11. DO CALIFORNIA RESIDENTS HAVE SPECIFIC PRIVACY RIGHTS?

In Short: Yes. If you are a California resident, the California Consumer Privacy Act (CCPA/CPRA) gives you additional rights.

If you are a resident of California, you have the right to request access to and details about the personal information we maintain about you and how we have processed it, to correct inaccuracies, to obtain a copy of it, and to request its deletion. You also have the right not to be discriminated against for exercising these rights.

• We do not sell or share your personal information as those terms are defined under California law, and we do not process it for targeted advertising or for profiling that produces legal or similarly significant effects.
• The categories of personal information we collect are described in Section 1. We do not collect biometric information, geolocation, or browsing history across other services.
• To exercise your rights, email us at info@kalibrefin.com. We will verify your identity using information already in our system before acting on your request, and we will respond within the timeframe required by law.

12. DO WE MAKE UPDATES TO THIS POLICY?

In Short: Yes, we will update this policy as necessary to stay compliant with relevant laws.

We may update this Privacy Policy from time to time as the App evolves. The updated version will be indicated by an updated "Last updated" date at the top of this policy. If we make material changes, we will announce them in-app before they take effect. We encourage you to review this policy periodically.

13. HOW CAN YOU CONTACT US ABOUT THIS POLICY?

If you have questions or comments about this policy, you may email us at info@kalibrefin.com or contact us by post at:

Can Ayan Dublin, Republic of Ireland

(We are not currently required to appoint a Data Protection Officer under GDPR Art. 37. If that changes, we will update this policy with the DPO's contact details.)

14. HOW CAN YOU REVIEW, UPDATE, OR DELETE THE DATA WE COLLECT?

You have the right to request access to the personal information we collect from you, to correct inaccuracies, or to delete it, and you may withdraw your consent to our processing. Most of your data is visible directly in the App (Profile, Progress, and History tabs). To export your data, email info@kalibrefin.com and we will send a copy within 30 days. To delete your data, use Profile → Delete account, or contact us at the same address.