Privacy policy

1. Who is responsible for your data

The data controller is [to be filled in]. For anything about your data, write to kontakt@mkgolfvoice.pl.

This policy covers the Spiral by MK Golf app (formerly Player zone; spiralgolf.app) and the forms on mkgolfvoice.pl (enquiries and newsletter).

2. What we store

• Account: email address, name, app language, role (player or coach), the invite code you joined with.
• Practice: drill sessions (which drill, when, score, place and green speed if you give them), every logged stroke (distance, line, holed or not, miss side and pace), your notes, plans and workouts from your coach, levels worked out from your scores, logged rounds on the course (day, holes, score, course name) and gym sessions (kind, time, effort on a 1–10 scale). If you turn on “Plan for me”: your answers (handicap, areas to work on, season and tournament date, practice time, where you practise, rounds and gym) and the draft plan.
• Coach: notes and comments on players' sessions, groups (name and logo), workout templates, own drills and invite codes.
• Technical: the sign-in log kept by the database provider (IP address, browser, time), a log of app errors (error message, screen, time, your account) used only to fix them, aggregate visit statistics with no cookies and no identification of people (Vercel Web Analytics), and the two cookies described in section 8. With no internet, logged strokes wait in your phone's storage and are sent when the connection is back.
• mkgolfvoice.pl: name, email and message from the enquiry form; email address from the newsletter sign-up.

Health data only if you connect WHOOP yourself and give your explicit consent: recovery (score, heart rate variability HRV, resting heart rate), sleep performance and day strain, one entry a day, the last 8 days at each fetch. Your coach sees it only if you turn sharing on in Account. Basis: your explicit consent (Art. 9(2)(a) and Art. 6(1)(a) GDPR). You withdraw consent by disconnecting WHOOP in Account: we then delete this data and our access to WHOOP at once.

We don't collect GPS location or payment details. We use no advertising or tracking tools.

3. Why, and on what legal basis

• To run the app: sign-in, saving practice, progress, levels and working with your coach. Basis: the contract to use the app (Art. 6(1)(b) GDPR).
• To keep the app secure and to find misuse and bugs. Basis: our legitimate interest (Art. 6(1)(f) GDPR).
• To answer an enquiry from the form. Basis: your request and our legitimate interest in replying (Art. 6(1)(b) and (f) GDPR).
• Newsletter: only with your consent (Art. 6(1)(a) GDPR). You can withdraw it at any time; this doesn't affect anything before.

Levels, hints and “Plan for me” are worked out automatically from your scores and answers, by fixed rules (no outside AI model). They are for practice only and have no legal or similarly significant effects. If you have a coach, your coach sees and approves the draft plan.

4. Who sees your data

• The coach (or coaches) you joined: they see your name, sessions, strokes, progress and levels. That is how working together in the app works.
• Other players in your group see only the group's name and logo, not your scores.
• You see your coach's notes and comments on your sessions.
• The app's administrator has technical access to the database and uses it only to fix something or to handle your request.

We don't sell data or pass it to anyone for marketing.

5. Services we use

These providers process data on our behalf under data processing agreements:

• Supabase Inc.: database, sign-in and file storage. Data is kept in a data centre in Frankfurt (EU).
• Vercel Inc.: hosting of the app and the website (servers in Frankfurt, a worldwide content delivery network).
• Google Ireland Ltd. (Google Workspace): sending the emails with the sign-in link and code, and our email.
• GitHub Inc.: the private repository holding the app's code and the nightly database backups.

WHOOP Inc. (USA) does not process data on our behalf: if you connect WHOOP, we fetch your data from it at your request, and WHOOP processes it under its own privacy policy. Your WHOOP access keys are stored encrypted.

Supabase, Vercel and GitHub are US companies. Where data leaves the European Economic Area, this is based on the European Commission's standard contractual clauses or the EU-US Data Privacy Framework.

6. How long we keep data

• Account and practice data: as long as you have an account. When you delete it, it is removed from the database at once.
• Database backups: each night's copy is kept for 90 days, and the copy from the first day of each month for about 13 months. They are used only to restore data after a failure; nobody uses them day to day. If we ever restore the database from a backup, accounts deleted earlier are deleted again.
• A coach's drill that their players have played stays, without the coach's data, after the coach deletes their account, so the players keep their history.
• Sign-in log: for the period the database provider uses, usually a few days.
• App error log: up to 12 months.
• WHOOP data: while WHOOP is connected; deleted at once when you disconnect it or delete your account.
• Enquiries: up to 12 months after the last message.
• Newsletter: until you unsubscribe.

7. Your rights

You have the right to access, correct and delete your data, to restrict its processing, to data portability and to object to processing based on legitimate interest.

• Download your data: Account → Your data → Download my data (JSON file).
• Correct your name and language: Account.
• Delete your account: Account → Delete account. It takes effect at once.
• Anything else: write to kontakt@mkgolfvoice.pl. We reply within a month.

You can also complain to the Polish data protection authority, Prezes Urzędu Ochrony Danych Osobowych (ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl).

8. Cookies

The app uses only two cookies, both needed for it to work: the sign-in session cookie (so you don't have to sign in every time) and a cookie with the language you chose. We use no analytics or advertising cookies, so we don't ask for consent.

9. Young players

A person under 16 may use the app with the consent of a parent or guardian. The parent or guardian can exercise the rights in section 7 on their behalf.

10. Changes to this policy

Before the app starts collecting new kinds of data (for example from training devices and apps you connect yourself), we will update this policy first, and tell you in the app about important changes.