Privacy Policy

Version: August 2026

1. Privacy at a glance

schwunganalyse provides a personal video analysis of your golf swing. For that we process mainly three kinds of data:

• Account data — name, e-mail address and credentials, so that submission, payment and result can be assigned.
• Videos and form details — the two swing recordings plus handicap, club, ball flight, quality of contact and the description of the problem.
• Payment data — amount, transaction identifier and status; complete card data never reaches us.

We use no advertising networks, no analytics or tracking services, no social media plugins and no newsletter systems. There is no profiling and no automated decision-making. Videos are not published and not sold to third parties.

2. Controller

The controller is the natural or legal person who alone or jointly with others determines the purposes and means of the processing of personal data.

Legal bases

We process personal data on the basis of Art. 6(1)(b) GDPR (performance of the user contract, see Terms), Art. 6(1)(f) GDPR (legitimate interest in secure, trouble-free operation), Art. 6(1)(c) GDPR (statutory retention obligations for payments) and, where consent has been given, Art. 6(1)(a) GDPR. Consent given can be withdrawn at any time with effect for the future.

SSL/TLS encryption

This site and all interfaces of the service are delivered exclusively over an encrypted connection (recognisable by https:// in the address bar). Data transmitted cannot therefore be read by third parties.

3. Hosting

schwunganalyse runs on a server in a data centre within the European Union. All application data — accounts, submissions, uploaded videos and the analyses returned — is held on that server. No content delivery network is used; fonts, icons and scripts are also delivered from our own server and not loaded from external hosts.

4. Website access data

When a page is requested, your browser transmits technically necessary information that the server records in log files:

• the address requested, date and time of the request
• the amount of data transferred and the HTTP status code
• browser type and version, operating system
• the referring page, where transmitted
• IP address

The legal basis is Art. 6(1)(f) GDPR; the legitimate interest lies in secure operation and the defence against attacks. This data is not merged with other data sources. Logs are deleted after 30 days at the latest, unless they are needed to investigate a specific case of abuse.

To fend off automated attacks we store the IP address of suspicious requests in a block list for a limited time.

Contacting us

If you write to us by e-mail, we process your details in order to handle the enquiry and in case of follow-up questions. The legal basis is Art. 6(1)(b) or (f) GDPR. Messages remain with us until the purpose ceases to apply and no statutory retention periods stand in the way.

5. Account and sign-in

The account is created with the first submission. In doing so we process:

• name and e-mail address
• the password — solely as a non-reversible hash, never in plain text
• a session identifier by which the app recognises you on each request
• timestamps of creation and last change
• time-limited identifiers for the confirmation e-mail and for resetting the password

The legal basis is Art. 6(1)(b) GDPR. The account is valid for schwunganalyse only. Other applications of the provider maintain separate accounts with their own records, even for the same e-mail address; no comparison takes place between them.

6. Submissions, videos and analysis

Every submission creates the following on the server:

• the two video files (front view and down the line)
• handicap, club, ball flight, quality of contact and the description of the problem
• time of submission, processing status and payment status
• the analysis produced by the golf professional and the link at which it can be opened

The legal basis is Art. 6(1)(b) GDPR — without this data the analysis ordered cannot be provided. Only the user and the golf professional carrying out the review have access; the files reside in a directory assigned to the account and cannot be fetched freely over the web.

Videos that recognisably show third parties should only be submitted with their agreement. On request we delete a submission early; the analysis can then no longer be produced.

7. E-mail

The service sends e-mail only in response to an event: confirmation of a submission, payment receipt, notice that the analysis is ready, and password reset. Dispatch is handled by the provider's mail server. There is no advertising or newsletter mailing.

8. Payment providers

Payment per submission is processed by one of the following providers — which one is your choice during checkout:

• Stripe — Stripe Payments Europe Ltd., Dublin, Ireland
• PayPal — PayPal (Europe) S.à r.l. et Cie, S.C.A., Luxembourg

Payment details are entered with the respective provider; complete card data never reaches our server. What is transmitted is the amount due and a transaction identifier. The legal basis is Art. 6(1)(b) GDPR (performance of contract) and Art. 6(1)(c) GDPR for retention under commercial and tax law. The privacy notices of the respective provider apply in addition.

9. Storage on the device

The app stores data in the device's local storage. These entries stay there and are not transmitted to us:

• the session (account identifier, session identifier, display name)
• the view last opened and the state of a form not yet submitted
• the light/dark setting

The legal basis is Art. 6(1)(b) GDPR; the storage is necessary for operation. Signing out and clearing the app data removes these entries. We set no cookies for advertising or analytics.

10. Push messages in the app

If you allow notifications, the operating system generates, via Firebase Cloud Messaging (Google Ireland Limited), a device identifier that we assign to your account in order to inform you about the processing status and the finished analysis. The legal basis is your consent under Art. 6(1)(a) GDPR. You can withdraw it at any time in your device settings; the stored device identifier is then no longer used and is removed when the account is deleted.

11. Retention and deletion

• Account data — until you delete the account.
• Videos and submissions — until you delete them or your account; we do not delete them on our own initiative but will remove them on request at any time.
• Access logs — after 30 days at the latest.
• Payment records — for the statutory retention periods, as a rule six to ten years.

You delete your account yourself in the app. All submissions, videos and analyses are removed from the server and the account is deactivated. The action cannot be reversed — a backup of important content should be created beforehand. Accounts with other applications of the provider are unaffected.

12. Your rights

You have the right at any time to free information about your stored personal data, its origin and recipients and the purpose of the processing (Art. 15 GDPR), to rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on a legitimate interest (Art. 21). Consent given can be withdrawn at any time with effect for the future.

Please contact [email protected].

Without prejudice to other remedies, you have the right to lodge a complaint with a data protection supervisory authority, in particular in the member state of your residence, your place of work or the place of the alleged infringement.

13. Changes to this policy

We adapt this policy when the service or the legal situation changes. The version published here at the time applies. In the case of substantial changes we additionally inform account holders in the application or by e-mail.