Privacy policy

1. Controller and scope

The controller for Split Step is Johannes Brunner, Auf den Höhen 15b, 93138 Lappersdorf, Germany. Privacy enquiries: appsupport.jb@proton.me. Telephone: + 49 (0) 15679 706909.

This notice applies to Split Step as a native iOS app. Split Step is a volleyball practice simulation with optional local camera recording and manual video self-assessment. The app and its bundled legal documents run on the device. Section 3 separately explains optional online access to the public legal document pages; no browser-based training application is offered there.

2. Overview: local processing, not uploads

Split Step does not require a user account. The app contains no advertising trackers, analytics SDK or cloud AI. It does not upload camera images, videos, training assessments or saved settings to the provider’s server. There is no facial recognition, biometric identification or automated decision-making with legal or similarly significant effects.

This does not mean that no personal data is processed: the hosting service receives technical connection data when the public legal document pages are accessed online. When you send a support enquiry or make an App Store purchase, the services involved process additional data. Simply reading the legal documents bundled in the iOS app does not require a request to the hosting service.

3. Public legal document pages and Firebase Hosting

The public legal document pages at split-step-volleyball.web.app are delivered through Google’s Firebase Hosting, only when accessed online. The installed iOS app contains its own local copies; camera use, practice and reading those copies transmit no data to Firebase Hosting. No public training service is provided there. Under the Google API terms applicable to Hosting, the service provider is generally Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA, unless applicable additional terms specify another Google company. The Firebase data processing terms also identify, among others, Google Ireland Limited and other affiliated Google companies.

Requests involve processing, in particular, the IP address, requested URL, time, connection and protocol data, and device/browser information sent by the browser. This is used for delivery, error handling and protection against abuse. The legal basis is Article 6(1)(f) GDPR: our legitimate interest in a securely accessible service. We do not use this information for advertising or to build training profiles.

Firebase Hosting uses globally distributed infrastructure. We do not promise processing exclusively within Germany or the EU. Google explains processing, retention and transfer arrangements in its Firebase privacy information and Firebase Data Processing and Security Terms, including the EU Standard Contractual Clauses provided there for covered transfers to third countries. Information about applicable safeguards can be requested through our privacy contact.

We do not establish a separate visitor database or additional visitor tracking. Technical data is retained only for the delivery and security purposes described, for as long as it is needed for those purposes. Google’s service-side retention follows the cited service information. Google states that Firebase Hosting retains IP data for a few months; we do not set our own different deletion period for these service-side logs.

4. Local settings and transient training state

The app uses local device storage (in particular localStorage) for language, training/display settings, enabled coaching cues and sounds. Current training state, attempt counts and review entries are kept only in memory for the current session; they are not persistently stored and are no longer available after reloading or closing the app. There is no synchronisation between devices and no access by the provider to this data through the app.

Program files and legal documents are installed on the device with the iOS app and can be read there without a hosting request. Saved settings remain until reset or deletion of app data. Updated program files and bundled legal documents are supplied through app updates.

This storage and access serve only the requested app functions, offline use and retention of chosen settings, not tracking. Necessary device access falls under section 25(2), no. 2 TDDDG. Where personal data is processed, the legal basis is Article 6(1)(b) GDPR for the requested functions. No analytics or advertising cookies are used.

To remove local app data, use the applicable iOS controls or delete the app. Merely offloading the app may retain data under iOS settings. Your device settings additionally govern deletion and operating-system backups; Split Step does not control external device backups.

5. Camera and video self-review

The camera is used only in connection with a recording feature that you activate and after permission is granted by iOS. You can practise without a camera. Split Step does not request microphone permission or record microphone audio.

Camera images, video clips and associated review markers are processed on the device. The review uses your own inputs; the app does not perform AI movement analysis. Videos are held only temporarily in memory or as local Blob objects, not stored by Split Step in a cloud or permanently in a photo/video library.

You can remove a recording using the provided delete function. Closing or reloading the app document, or terminating the app process, loses temporary clips; merely putting the app in the background may retain a clip. A new recording/training session may replace the existing recording. A language change that would delete a retained clip requires confirmation.

Processing serves only the recording and review function you request (Article 6(1)(b) GDPR, where applicable). Device permission does not replace general consent to other uses. You can block camera access in iOS settings at any time. Record other people only with their permission and avoid sensitive content. Clips are not transmitted to the provider.

6. Native iOS app and Apple purchases

In the iOS app, Split Step Pro can be unlocked through Apple StoreKit as a one-time purchase with no automatic renewal. The app requests available product information, verified transactions and existing purchase entitlements from Apple and supports restoring purchases.

Apple processes, in particular, Apple account, payment and transaction data under its own terms. Through the native purchase integration, Split Step receives product- and transaction-related information such as product/transaction identifiers, purchase status and verified entitlement. Your name, full payment details and Apple account password are not sent to the provider. Split Step has no purchase/receipt server of its own and uses no third-party billing SDK.

The legal basis for local entitlement checks is Article 6(1)(b) GDPR where personal data is involved. Entitlement is checked against verified StoreKit information on the device; an ordinary local-storage entry is not proof of purchase. Retention of Apple’s purchase history follows Apple’s policies. Apple is independently responsible for its store/payment processing; see Apple’s privacy information.

Downloading through the App Store, using TestFlight or voluntarily sharing diagnostic/crash information with Apple may involve additional processing under your Apple/device settings. This is separate from an analytics function built into Split Step.

7. Email contact

If you contact us, we process your email address, message content, attached files and communication data needed to handle your enquiry. Please provide only information necessary for your request and do not send sensitive training videos or medical information.

Our contact mailbox uses Proton Mail from Proton AG, Route de la Galaise 32, 1228 Plan-les-Ouates, Geneva, Switzerland. The message and related email metadata are processed through this mail service. Switzerland is covered by an EU adequacy decision. Ordinary email transmission is not automatically end-to-end encrypted throughout; this also depends on your email service and chosen delivery method. Further information: Proton’s privacy information.

The legal basis is Article 6(1)(b) GDPR for contract/purchase enquiries and otherwise Article 6(1)(f) GDPR for our interest in answering enquiries and resolving problems. Messages are deleted once the enquiry is resolved and they are no longer needed for outstanding follow-up questions, statutory retention obligations or the establishment, exercise or defence of legal claims. Where statutory retention obligations apply, retention is based on Article 6(1)(c) GDPR until those obligations expire.

8. Recipients and external links

Apart from the services described in this notice, third parties receive data only where necessary for the stated purposes or required by law. We do not sell personal data. The app does not send camera or training data to the hosting, email or purchase services described.

Links to privacy information and store help open external services only when you choose them. Those services’ own information governs their processing. If you send us an attachment yourself, it forms part of your support message and is processed under section 7.

9. Your rights

Subject to the statutory conditions, you have rights of access (Article 15 GDPR), rectification (Article 16), erasure (Article 17), restriction of processing (Article 18) and data portability (Article 20). You may withdraw any consent at any time with future effect; processing that took place lawfully before withdrawal remains unaffected.

Objection: Where we process data on the basis of Article 6(1)(f) GDPR, you may object under Article 21 GDPR on grounds relating to your particular situation. Please use the privacy contact above.

You may complain to a data protection authority, particularly in the place of your habitual residence, place of work or alleged infringement. The authority responsible for the provider is the Bavarian State Office for Data Protection Supervision (BayLDA): contact and complaint options, Postfach 1349, 91504 Ansbach, Germany.

The provider cannot remotely access data stored exclusively on your device. You can delete it locally. We do not require additional identification data solely to associate such local data with a person.

10. Optional features, minors and security

Camera use and email contact are optional. The camera-free training simulation is available without camera access. Without an Apple purchase, only the offered free functionality is available. There is no mandatory profile and no request for dates of birth or health data. Public legal document pages can be delivered online only if necessary technical connection data is processed; the bundled copies remain independently readable on the device.

Minors should set up camera access with their parents or guardians and make purchases only with the required permission. The app does not ask them to submit personal information. Online connections to the legal document pages use HTTPS. Protect your device and keep iOS and the app up to date; other people with access to your device may also access local data.

11. Changes to this notice

This notice describes the functions of the stated version. Changes to processing will be explained in an updated notice. A new notice is not consent to additional processing. New features requiring consent would require separate prior consent.