Privacy Policy

1. Who we are

RallyReel is made by Endevo, a sole proprietorship of Sergei Benjamin Tabañar, based in the Philippines. In this policy, "we" and "us" mean Endevo, and "the app" means the RallyReel application for iOS.

We are the data controller for the processing described here. Most of it is processing we never see, because recording, detection, and editing happen entirely on your phone. The exceptions are the optional features described in §3, §4, §8, §9, and §11, which you choose to use, and the subscription verification described in §10.

2. What the app stores on your phone

Everything below is stored in the app's own private directory on your iPhone, in Apple's standard app sandbox, whether or not you ever create an account. Nothing in this list leaves your phone unless you turn on cloud backup for a session (§4) or training contribution (§8). The device identifier in the last row never leaves it at all; only a one-way hash of it does, when you redeem a referral code (§11).

Deleting a session in the app deletes its video, clips and thumbnails from your device. Deleting the app removes all of it, except the device identifier in the Keychain, which iOS keeps after an app is deleted. If a session was also backed up to the cloud (§4), deleting it or one of its clips on your phone also deletes the cloud copy the next time you are signed in and online and cloud backup is running — see §15.

3. Accounts and sign-in

Creating an account is entirely optional. RallyReel's core — recording, on-device rally detection, editing, and exporting — works fully without one, and always will. Signing in exists for three things: keeping your subscription valid on a new device, turning on cloud backup (§4), and, if you choose, contributing to model training (§8).

You can sign in with Apple, Google, or an email address and password. Creating an account stores, on RallyReel's own servers:

• the email address tied to your account;
• if you sign in with Google, whatever basic profile information Google's standard sign-in exchange includes — typically your name;
• a unique account identifier used to link your data to you and to no one else.

Our hosting provider's sign-in records include the sign-in method, times, and network address.

Signing in, by itself, uploads none of your recordings. Nothing about your matches leaves your phone just because you have an account — cloud backup is a separate, explicit choice, described next.

4. Cloud backup — opt-in, per session

Cloud backup is off for every session by default. You turn it on individually, from that session's own screen — there is no setting that backs up your whole library at once. When you opt a session in:

• It only uploads over Wi-Fi. RallyReel never uses cellular data to back up, and checks your connection before every upload.
• It uploads that session's rally clips and their thumbnails, plus the session and clip details also listed in §2's table (timestamps, strike counts and their times, detector confidence, and any starred/manual/low-confidence flags, title, duration, file size, and rally count).
• The full, uncut recording is a second, separate opt-in. It is much larger than the clips, and turning on "back up this session" does not include it — you have to turn that on too, for that session, if you want it. Backing up the full recording is part of the RallyReel subscription.
• It can resume on its own. If a backup is interrupted — the app closes, you leave Wi-Fi — it continues automatically the next time you're on Wi-Fi with that session open, without you having to opt in again.

Backed-up material is stored in RallyReel's own Supabase project — a private database and private file storage, not a public CDN — restricted by row-level security so that only your own signed-in account can ever read it. No third party, advertiser, or analytics vendor receives it. We do not use your backed-up video to train any model, ours or anyone else's.

A session you never opt in stays exactly where it already was: on your phone only. So does everything while you're offline or on cellular.

We may pause or discontinue cloud backup at any time.

5. What we do not collect

To be specific, rather than reassuring:

• We do not use analytics, advertising, or attribution SDKs. The app contains no third-party code that reports your usage to anyone.
• We do not collect crash or failure reports unless you switch on Share diagnostics yourself, which is off by default and described in §9. There is no third-party crash-reporting SDK in the app either way.
• We do not track you across apps or websites, and we do not sell or share personal information. The app never reads Apple's advertising identifier. The one device identifier it uses is described in §11; it stays on your phone, and only a one-way hash of it reaches us, and only if you redeem a referral code.
• We do not receive a session's video, clips, thumbnails, or details unless you specifically opt that session into cloud backup (§4).
• We never receive anything just because you signed in, or just because you're using the app day to day — the only thing signing in adds is the referral code our server creates for your account while the referral program runs (§11). There is no telemetry reporting how often you use it, what you record, or what detection finds. With diagnostics on (§9) we receive something only when the app actually fails, and never a record of ordinary use.
• Card numbers, billing addresses, and your Apple ID never reach us — see §10.

A signed-out user with diagnostics never turned on sends us no personal data. The app does download a small configuration file from our server, and Apple notifies us of subscription changes, as described in §10.

6. Permissions the app asks for

The app requests add-only access to Photos. It does not request permission to read your photo library: choosing a video to import uses Apple's own picker, which hands the app only the one file you selected.

7. Learning from your corrections

Rally detection is not perfect. When you delete a clip that was not really a rally, star one that was, or hand-cut a point the app missed, RallyReel can use that feedback to adjust its detector for your court, your camera position, and your camera angle.

This adjustment happens entirely on your phone. What it produces is a small set of numeric weights — on the order of a hundred numbers — stored in the app's own data on your device, alongside a few counts and an accuracy comparison that record why the app did or didn't use it. Your video is not used to train any model of ours, no footage or derived data is transmitted, and nothing about your corrections is visible to us. This is unchanged by accounts or cloud backup: even for a session you back up, the learned adjustment itself never uploads — only the plain clip/session data described in §4 does.

The app only adopts an adjustment if it measurably performs better than the default detector on your own corrections. You can turn this off in Settings at any time; doing so does not delete an adjustment already made, it just stops the app from using it until you turn it back on. You can also reset it separately, which clears the learned adjustment and its numbers back to the shipped detector — this does not touch your corrections, clips, or sessions, which stay exactly as they are.

8. Contributing to central model training — opt-in, off by default

Separately from cloud backup (§4) and from the on-device personalization described in §7, you can choose to contribute data that helps us train future versions of RallyReel's detector for every player, not just your own. This is off for every account by default, lives in its own row in Settings, and turning on backup or personalization does not turn it on — nor does turning it on affect either of those.

If you turn it on, what leaves your phone for a rally is not video, audio, or a thumbnail. For each sampled video frame in that rally, it is the same 128 numbers the on-device detector already computes internally to decide whether a stretch of footage is a rally — a compressed description of what that frame looked like to the detector, computed on your phone, not the image itself — plus the label (rally or not) that comes from your own use of the app: a clip you deleted, starred, or hand-cut. Each contribution also carries the clip's start and end time within its session. There is no picture in it, no sound, and nothing that identifies you or anyone else who appears in your recording.

Contributing requires being signed in (§3): each contributed row is tied to your account, specifically so it can be found and deleted if you ask. That also means it is not anonymous — we can and do connect a contributed row back to the account that sent it, even though the row itself carries no imagery or identifying detail. We are not going to call it anonymised when it isn't.

Turning this off in Settings stops RallyReel sending any further rows straight away, and asks us to delete the rows you already contributed. That deletion needs a connection: if your phone is offline when you turn it off, the request is kept and retried until it goes through, so it is never dropped — but it is not always instant either. What it cannot do is remove your data's influence from a model we have already trained using it. Once contributed rows have gone into a training run and produced a set of model weights, that training is done — deleting the source rows afterward deletes the rows, not the effect they already had on that finished model. The way to have zero influence on any past training run is to never turn this on; the way to stop having any influence going forward is to turn it off. Both are always available to you, and neither is undone by the other.

We use this only to train and evaluate RallyReel's own rally-detection model. We do not use it to build a profile of you, and we do not sell it or share it with advertisers or any other third party.

9. Diagnostics — opt-in, off by default

Some of the ways this app can fail are invisible to us and confusing to you: a recording interrupted by a phone call, or the on-device detector quietly falling back to a weaker method because part of it could not start. From the outside both just look like the app being bad at its job. If you turn on Share diagnostics in Settings, the app sends a short technical record when one of those failures happens. It is off unless you turn it on, and it is separate from backup (§4), personalization (§7) and training contribution (§8) — none of those switches turns this one on.

What a report contains is a list of at most a couple of hundred short event names describing what the app was doing — things like record.stop-failed or detect.fallback — each with a timestamp and, sometimes, a small number or fixed word such as reason: background. Alongside them it carries your app version and iOS version, and counts of any crashes or freezes iOS itself reported to the app.

What it does not contain: no video, no audio, no thumbnails, no rally or clip data, no session names, no file paths, no account details, no email address, and no device identifier. The app enforces this by only allowing a fixed list of permitted fields into a report and discarding everything else, rather than by trying to remove sensitive values afterwards.

Diagnostic reports are anonymous, and unlike training contributions (§8) we mean that literally: a report is sent without your account, and the record we store has no column that could tie it to you. That also means we cannot find yours to delete it on request — there is nothing to search by. The trade is deliberate: we would rather hold something unlinkable than hold something we could link.

Reports are written on your phone first and sent later, so a failure that happens with no signal is not lost. If you turn diagnostics off, anything still waiting to be sent is deleted rather than kept for the next time you turn it on. Consent is read when a report is about to leave, not when it was recorded. Reports are deleted after 30 days.

10. Subscriptions and payments

RallyReel offers an auto-renewing monthly subscription. Purchases are handled entirely by Apple through the App Store. We never see your card details, billing address, or Apple ID.

The app stores only whether your subscription is currently active and when the current period ends, so it can unlock features while you are offline. Apple's own handling of your purchase is covered by Apple's Privacy Policy.

If you're signed in, RallyReel can also confirm a purchase or restore with our server, which independently verifies the transaction directly with Apple and records your subscription status, which product, when it expires, and Apple's transaction ID for it — never your payment details. This is what lets a subscription bought on one device carry over when you sign into the same account on another.

Apple also notifies our server directly when a RallyReel subscription starts, renews, lapses, or is refunded, whether or not you ever signed in. We keep these notifications for 180 days, then delete them automatically.

Promo codes. RallyReel's promo codes are App Store offer codes, and Apple handles them. You redeem one in Apple's own redemption sheet, opened from the app, or on Apple's redemption page. Our page at rallyreel.endevo.info/redeem only shows the code and links to Apple's; it sends the code nowhere. Apple checks the code and starts the subscription, and the app then receives it like any other purchase, as described above. Apple's handling of a redemption is covered by Apple's Privacy Policy.

11. Referrals — optional

RallyReel has a referral program. Once your lifetime free exports are used, the free plan gives one export a day; every five people who join with your code add one more a day, up to ten a day, while you're signed in. Taking part needs an account, and it is optional: you never have to share your code or enter anyone else's, and the app works the same without it. We may pause or end the program at any time; while it is paused, the app hides it.

What we store on our servers:

• Your referral code. While the program runs, our server creates one for each signed-in account, the first time the app asks for that account's referral status, and links it to your account.
• Each successful referral: which account the code belongs to, which account redeemed it, when, and a device hash (below). Only a new account, under 14 days old, can redeem a code, and only once.
• Failed attempts to redeem a code: which account tried, why it failed (for example, no such code), and when.

The device hash. When you redeem a code, the app reads the identifier iOS assigns on your phone to apps from the same developer (identifierForVendor). It is not Apple's advertising identifier. The app keeps the first one it reads in your phone's Keychain, on this device only, because iOS changes that identifier when the app is deleted and installed again. Only a salted SHA-256 hash of it leaves your phone. We never receive the identifier itself, and the hash cannot practically be turned back into it. It is used for one thing: counting each phone at most once, so one person cannot make extra accounts to credit themselves or someone else. It is not used for tracking or advertising, it is not combined with data from other apps or companies, and it is not shared with anyone.

Why, and on what basis. We use this data to run the program you chose to take part in, crediting the person who referred you and showing you your own count and allowance, and to prevent fraud: one redemption per account, one per phone, no redeeming your own code, and at most ten failed attempts an hour, so codes cannot be guessed. Where privacy law asks us to name a legal basis, it is running the program you joined, and our legitimate interest in keeping it free of abuse. A referrer sees only how many people have joined with their code, never who they are.

How long we keep it.

• Your code and the referrals credited to you are kept while your account exists. Deleting your account deletes your code, every referral credited to it, and your failed attempts.
• If you joined with someone else's code and later delete your account, that referral is kept with your account removed from it, so the person who referred you keeps the credit. What remains is their account, the time, and the device hash. The hash is kept so the same phone cannot be used to make a new account and redeem again. The record no longer names your account.
• Failed attempts are deleted after 30 days.

12. When video leaves your device

Video and clips leave your device only in these ways, and you initiate each one:

• Save to Photos. The clip is written to your own photo library on the same device.
• Share. The clip is handed to Apple's system share sheet, and you choose where it goes — Messages, a social app, AirDrop, or anywhere else. Once it reaches that destination, that service's privacy policy applies, not ours.
• Cloud backup. Only for a session you've specifically opted in, only over Wi-Fi, to RallyReel's own servers — see §4 for exactly what that includes.

Outside of these, the app does not upload video or clips. Separately, if you turn them on, training contribution (§8) and diagnostics (§9) send, in the background, only the non-video data those sections describe. Redeeming a referral code (§11) sends the code and a one-way device hash, never video.

13. Filming other people

Pickleball is played with other people, usually in shared or public spaces. Those people have not agreed to appear in your recording.

RallyReel reminds you to ask the players on court before you record, and that reminder is genuine rather than decorative: whether you have their consent is your responsibility, and it depends on where you are and who you are filming. Some venues and some countries have specific rules about recording in public. Please respect them, and respect anyone who asks not to be filmed. This applies whether or not you later back that footage up to the cloud.

14. Children

RallyReel is not directed at children under 13. We do not knowingly collect personal information from anyone under 13, including through account creation or cloud backup. If you are a parent or guardian and believe a child has created an account, contact us and we will delete it.

15. Deleting your account and your data

You can delete your account from inside the app at any time — Settings → Account → Delete account — you never need to email us to do this. Deleting your account:

• permanently removes every clip, thumbnail, and full recording you ever backed up, from every storage bucket we use;
• permanently removes any rows you contributed under §8's training setting, from every system we use;
• permanently removes your account row and every session/clip record tied to it from our database;
• permanently removes your referral code, every referral credited to it, and your failed attempts to redeem a code. If you joined with someone else's code, that referral is kept without your account, so they keep the credit, together with its device hash (§11);
• signs you out and cannot be undone.

Recordings, clips, and sessions already saved on your phone are not touched by deleting your account — deletion only reaches what was on our servers. You don't need to delete your account to remove a single backup: deleting a backed-up session or clip on your phone also deletes its cloud copy the next time you are signed in and online and cloud backup is running. Apple's subscription notifications we received (§10) are deleted automatically within 180 days. As with turning §8's setting off on its own, deleting your account deletes your contributed rows going forward but cannot reach into a model already trained using them.

16. Your rights and choices

Privacy laws including the GDPR and the CCPA give you rights to access, correct, delete, and port your personal information, and to object to its processing.

If you've never created an account, those rights are simple to state: we hold no personal information we can tie to you. The app sends us none, apart from anonymous diagnostics (§9) if you turn them on. All of your data lives on your own device and is under your direct control. You can delete any session inside the app, and deleting the app removes everything it created.

If you have created an account, deletion is available directly in the app (§15) and takes effect immediately. For access, correction, or a copy of what we hold about you beyond what deletion already covers, contact us at the address below and we will respond.

We do not sell or share personal information as those terms are defined under the CCPA, and we have never done so.

17. Changes to this policy

What's new in version 3.3 (17 October 2026): added §11, covering the optional referral program: your referral code, which account referred which, when, failed attempts to redeem a code, and a salted one-way hash of an identifier for the phone a code was redeemed on, used only to count each phone once and never for tracking or advertising. §11 also sets out why we keep each of these and for how long, including why a referral and its device hash outlive the referred account. §2 lists the referral status and the device identifier the app keeps on your phone, and §5, §12, and §15 account for them. §10 now explains that promo codes are App Store offer codes, redeemed and processed by Apple. The table of contents now lists §9. Sections previously numbered §11–§17 were renumbered §12–§18 to make room; no other content in them changed. Section numbers in the notes for earlier versions below are those versions' own.

What was new in version 3.2 (14 October 2026): no new kind of data is collected; this version corrects and completes what the policy says. Deleting a backed-up session or clip on your phone now also deletes its cloud copy (§2, §14). Backing up a full recording is part of the subscription, and cloud backup may be paused (§4). §3 notes the sign-in records our hosting provider keeps. §8 describes contributed feature rows more precisely: they are computed per video frame, carry the clip's start and end time, and come only from clips you deleted, starred, or hand-cut. §9 states that diagnostic reports are deleted after 30 days. §10 now covers Apple's transaction ID and the subscription notifications Apple sends us, kept for 180 days. §5, §11, and §15 now account for every opt-in that sends data, and §1 names who we are. No sections were renumbered.

What was new in version 3.1: added §9, an all-new opt-in that is off by default: sending a short technical record when something in the app fails. It carries no video, no rally data and nothing identifying, it is sent without your account, and turning it off deletes anything not yet sent. It does not change what §4's cloud backup, §7's personalization or §8's training contribution do, and turning it on does not turn any of those on. Sections previously numbered §9–§16 were renumbered §10–§17 to make room; no other content in them changed.

What was new in version 3.0: added §8, an all-new opt-in — off by default for every account — to contribute feature-level rally data (never video, audio, or thumbnails) to help train future versions of RallyReel's detector. It does not change what §4's cloud backup does or what §7's on-device personalization does, and turning it on does not turn either of those on. §14 (account deletion) now also covers deleting contributed rows. In that version, sections previously numbered §8–§15 were renumbered §9–§16 to make room; no other content in them changed.

What was new in version 2.0: RallyReel added optional accounts (Apple, Google, or email) and optional, opt-in cloud backup of a recording session, described in §3 and §4. In-app account deletion was new (§13). Everything version 1.0 said about on-device recording, detection, and personalization is unchanged — see §7, which still applies exactly as written, including its anchor link from Settings.

If we change how RallyReel handles your information again, we will update this policy, change the version and date at the top, and disclose the change inside the app before the new behaviour takes effect. We will not quietly begin collecting something this policy says we do not collect.

18. Contact

Questions about this policy, or about privacy in RallyReel, can go to solutions@endevo.info. We read everything sent there.