Kaddie is a golf shot tracer and swing-analysis app. This policy explains what data we handle, why, what our legal basis is, who else sees it, and what rights you have. We have written it in plain language and tried not to hide anything.
Flom Ventures AS, a company registered in Norway, is the data controller for the processing described in this policy.
| Data | Why | Legal basis (GDPR Art. 6) |
|---|---|---|
| Anonymous account identifier (a random ID, created automatically; no name, email or password) | To keep your uploads separate from other users' and to enforce access rules on our server | Legitimate interest (Art. 6(1)(f)) — running the service securely |
| A short section of your video, including its audio track, uploaded only when you choose automatic tracing | To analyse the footage and return the ball's flight path. The audio lets us pin the moment of impact to the exact frame. See section 4. | Performance of a contract (Art. 6(1)(b)) — delivering the feature you asked for |
| A short, compressed copy of your swing clip (or, as a fallback, a small number of still frames from it), together with the measurements Kaddie computed from your movement on your device (shoulder and hip turn, lead-arm angle, spine-tilt change, hip sway and rise, swing timing, and how far your head moved), uploaded only when you choose "Analyze the swing" | To have our AI provider read your movement and return coaching feedback, and to keep it factually anchored to what was actually measured | Performance of a contract (Art. 6(1)(b)) — delivering the analysis you asked for. We also show a just-in-time notice and ask you to continue before the first upload. See section 4b. |
| Precise location contained inside your video file, plus the course name derived from it | To label and group your shots by golf course and date | Legitimate interest (Art. 6(1)(f)) — organising your own library. See section 5. |
| Clips and details you submit through "Feature my shot" | So we may publish the clip in our marketing | Your consent (Art. 6(1)(a)) — freely given, and withdrawable |
| The consent record for a featured clip (the exact wording shown, its version, the time, your confirmation, any handle) | So we can demonstrate that permission was given for anything we published | Legitimate interest and legal obligation (Art. 6(1)(f), 6(1)(c)) — evidencing consent |
| Clips you chose to donate for tracer training (off by default; a one-time in-app ask, or the toggle in Settings) | To train and evaluate Kaddie's ball-tracking model, and nothing else. See section 4c. | Your consent (Art. 6(1)(a)) — freely given, and withdrawable |
| The consent record for a donated clip (the policy version in force, the time, and how the tracer performed on that clip) | So we can demonstrate that permission existed for anything we retained | Legitimate interest and legal obligation (Art. 6(1)(f), 6(1)(c)) — evidencing consent |
| Usage analytics — a random analytics ID stored on your device, which screens and actions occurred, and your app version, iOS version, device model and language. See section 6b. | To see where the app is failing people and fix it | Your consent (Art. 6(1)(a)) — asked on first launch, refusable at no cost, and withdrawable at any time in Settings |
| Advertising measurement — Apple's vendor identifier for this device (an ID that is specific to Kaddie and that no other company can hold), the same random analytics ID, your device model, OS and app version, the time of install, and five events: first-run registration, paywall view, trial start, purchase, and first completed analysis. See section 6c. | To know which advertising campaign an install came from, so we stop paying for ads that do not work | Your consent (Art. 6(1)(a)) — the same first-launch question as usage analytics, refusable at no cost, and withdrawable at any time in Settings |
| Technical metrics about a tracing or analysis job on our server — how well the ball could be detected, how long processing took, whether it succeeded. These describe how the software performed, not what your shot was. | To find and fix problems, and to measure whether the tracer is getting better | Legitimate interest (Art. 6(1)(f)) — improving reliability of a job you asked us to run |
| Subscription status received from Apple | To unlock paid features | Performance of a contract (Art. 6(1)(b)) |
| Notification permission, if you grant it | To remind you locally before a free trial ends | Your consent (Art. 6(1)(a)) |
Kaddie can analyse a golf swing as well as trace a ball. When you choose "Analyze the swing" on an imported clip:
api.kaddie.net, to Google's Gemini AI service for processing. Google returns text describing what it sees; Kaddie shows that to you.If you say yes to donating your clips — via the one-time card the app shows after you have traced a shot, or the "Donate my trace clips" toggle in Settings — we keep a copy of the clips you upload for automatic tracing, including the ones the tracer struggled with, and use them for one purpose: training and evaluating Kaddie's ball-tracking model.
Kaddie does not ask for location permission and does not track where you are. However, iPhones normally save the exact GPS coordinates of where a video was filmed inside the video file itself. Kaddie uses that to name the golf course for you. Specifically:
Precise location is treated as sensitive information. If you do not want any location processed, remove location data from the clip before importing, or disable Camera location in iOS Settings — Kaddie works fully without it, and simply will not show a course name.
If you submit a clip through "Feature my shot", we store: the clip itself, the exact consent wording you were shown and its version, the date and time, your confirmation (that everyone shown is you or has agreed to be featured, and that everyone shown is 18 or over or has guardian consent), and any social handle you provided so we can credit you.
We keep the consent record even after you withdraw a clip, because we must be able to demonstrate that permission existed for anything already published. Withdrawing removes the clip from our pool immediately and flags anything already posted for removal. See our Terms of Use for the licence this grants and its limits.
We would like to know where the app is failing people, so we can fix it. That means recording which screens were opened and whether things worked. This is off until you turn it on.
We buy advertising to get Kaddie in front of golfers. To avoid pouring money into ads that do not work, we need to know roughly which campaign an install came from. This is covered by the same first-launch question as section 6b: say no there and none of it happens either.
We keep the list of third parties deliberately short:
| Who | What they handle |
|---|---|
| Apple | All payments and subscriptions (we never see your card details), Apple Maps course lookups, App Store delivery, SKAdNetwork install measurement (section 6c) and the aggregate analytics Apple provides to all developers |
| AI swing analysis. When you use "Analyze the swing", the swing clip (or still frames) and measurements described in section 4b are processed by Google's Gemini AI service to return coaching text. Google acts as our processor for this and handles them under its own terms. | |
| PostHog | Usage analytics, and only if you have turned it on (section 6b). Processed on PostHog's EU infrastructure in Frankfurt, Germany. |
| AppsFlyer | Advertising measurement, and only if you have turned it on (section 6c). They tell us which campaign an install came from. Processed on AppsFlyer's EU infrastructure. They receive no advertising identifier, because we never ask for one. |
| RevenueCat, Inc. | Subscription bookkeeping and analytics. When you buy, start a trial, renew or get a refund through Apple, RevenueCat receives the App Store transaction identifiers and receipt data together with the pseudonymous identifier we already hold for you, so we can see whether a subscription is active, in trial, renewed or refunded. It receives no advertising identifier and is not used for advertising. Processed in the United States under the European Commission's Standard Contractual Clauses. |
| Hetzner Online GmbH | Hosting our servers, located in Finland (EU) |
| Modal | Runs the extra automated pass that some difficult traces get — a GPU re-detection of the ball in the same clip you uploaded for automatic tracing. We pin this processing to EU infrastructure, it returns only ball coordinates, and nothing is stored there. Only clips the normal analysis struggled with take this path. |
We show no advertisements inside Kaddie, we do not sell or rent personal data to anyone, and we use no data brokers and no social-media pixels. Our one advertising-related processor is AppsFlyer, described above and in section 6c; it measures which campaign an install came from, and nothing more. When an install or one of the five measurement events (section 6b) is traced back to an advertisement, AppsFlyer confirms that to the network that showed the ad (Meta, Apple Search Ads) so we are charged correctly and the ad is judged on results. That confirmation carries the event and Apple's privacy-preserving SKAdNetwork attribution only — never your clips, your swing data, or an advertising identifier, because we hold none.
Almost everything stays in Europe. Our servers are located in Finland, within the EU/EEA. Usage analytics, if you have enabled it, is processed by PostHog in Frankfurt, Germany. Advertising measurement, if you have enabled it, is processed by AppsFlyer on their EU infrastructure. The extra GPU pass some difficult traces get runs on Modal's EU infrastructure (we pin the region). All of these are inside the EEA.
There is one exception, and it is swing analysis. When you use it, the swing clip (or still frames) and measurements are sent to Google's Gemini AI service, which may process them on infrastructure outside the EEA (for example in the United States). That transfer takes place under the safeguards in our agreement with Google, such as the European Commission's Standard Contractual Clauses. Apple may also process data outside the EEA under its own safeguards and privacy policy. Subscription bookkeeping (section 7) is processed by RevenueCat in the United States under the European Commission's Standard Contractual Clauses; it sees transaction data and a pseudonymous identifier, never your clips. Aside from these named providers, we do not transfer your data outside the EEA.
| What | Kept for |
|---|---|
| Clips uploaded for automatic tracing, including their audio | Only as long as processing requires, then deleted — unless you donated the clip (the rows below, and section 4c) |
| Clips you donated for tracer training (section 4c) | Until you remove them with Delete my data or ask us to — at most 3 years, then deleted |
| Consent records for donated clips | Retained as proof that permission was given |
| Swing clip / still frames and measurements uploaded for swing analysis | Sent to the AI provider only to produce your feedback for that request; we do not retain them on our servers afterwards. The provider handles them under its own retention terms. |
| Usage analytics events (only if you enabled them) | Up to 12 months, then deleted |
| Advertising measurement data (only if you enabled it) | Up to 24 months, then deleted — the longest AppsFlyer's own terms permit them to hold it. Used only to measure the campaign that produced the install; we keep no separate copy. |
| Technical metrics about a tracing job (how well the ball was detected, how long it took, whether it succeeded, the clip's frame rate and length — not the video, and not what the shot was) | Kept after the clip is deleted, so we can measure and improve how well the tracer works |
| Featured clips in the marketing pool | Until you withdraw them or we remove them |
| Consent records for featured clips | Retained after withdrawal as proof that permission was given |
| Anonymous account identifier | Until you delete the app or ask us to erase it |
| Your saved shots, coordinates and course names | On your device, until you delete the shot or the app |
Traffic between the app and our servers is encrypted in transit (HTTPS). Uploaded clips are stored in private buckets that are not publicly readable, with access rules that scope each user to their own files. Our servers are access-controlled and backed up. No system is perfectly secure, but we take this seriously; if a breach occurs that is likely to put your rights at risk, we will notify the relevant authority and affected users as required by law.
Under the GDPR you have the right to: access your data; have it corrected; have it erased; restrict or object to processing; receive a copy in a portable format; and withdraw consent at any time (withdrawal does not affect processing already carried out).
Because Kaddie accounts are anonymous by design, we may not be able to link data to you from your name or email alone. To act on a request we may need something that identifies the records, such as a featured-clip submission reference. This is a consequence of collecting as little as possible, not a way to avoid your rights.
Email privacy@kaddie.net and we will respond within 30 days. You may also lodge a complaint with the Norwegian Data Protection Authority (Datatilsynet, datatilsynet.no) or your local supervisory authority.
Each of these is as easy to undo as it was to grant.
Kaddie is not directed at children under 13, and we do not knowingly process their personal data. If you believe a child's data has reached us, contact privacy@kaddie.net and we will delete it. When submitting a clip to be featured you must confirm that everyone shown is 18 or over, or has guardian consent.
We do not carry out automated decision-making or profiling that produces legal or similarly significant effects. Automatic ball tracking and AI swing analysis are image analysis of the clip you submitted; they describe your shot or your movement and make no decisions about you.
If this policy changes materially we will update the version and date at the top of this page, and where the change concerns something you consented to, we will ask again.
Flom Ventures AS — privacy@kaddie.net