Privacy Policy — Striped

1. Who we are

Striped is a golf swing-training app for iPhone, Apple Watch and motion-capable AirPods. It is developed and operated by Mongo Technologies LLC, a Wyoming limited liability company ("Striped," "we," "us" or "our").

This Privacy Policy explains what the Striped app (including its Apple Watch app and Lock Screen Live Activity) and the website at stripedgolfapp.com collect, how we use and share that information, how long we keep it, and the choices you have. It covers both the App Store version of Striped and beta versions distributed through Apple's TestFlight. Where a feature exists only in beta versions, we say so. Our Terms of Use also apply to your use of Striped.

2. The short version

You sign in with Apple to use Striped. We receive an identifier Apple creates for Striped and, if Apple shares them, your email address (which may be an Apple private relay address) and your name.
Your recordings live on your iPhone. They are copied to our servers only if you turn on automatic backup, tap Back up now, or share a session with Striped Lab.
Video and audio stay on your iPhone unless you choose to include them for a particular session.
Striped Lab sessions are kept anonymously after you delete your account. Sessions you share with Striped Lab help us improve swing detection. If you delete your account, we keep them as anonymous training data, without your name, account, device identifiers, voice, video or notes, and you can no longer access them.
Apple handles payments. Striped subscriptions are bought and billed through Apple, and we never see your payment card.
No ads, no tracking and no Health data. Striped has no advertising, no analytics or tracking SDKs and no location data. We do not sell your data or share it for advertising. Striped does not read your Health data.
The waitlist is only for telling you when Striped is available. If you join it on our website, we keep your email address and a few details about your sign-up for that purpose, and we delete the list once we have launched and let you know.

This summary is for convenience. It does not replace the full policy below.

3. Information we collect

3.1 Your account (Sign in with Apple)

Striped requires Sign in with Apple. When you sign in, Apple sends us the following, and we store it on our servers:

a stable user identifier that Apple issues for Striped, which is how we recognize your account;
your email address, if Apple shares it. If you choose Hide My Email, this is a private relay address that forwards to you. We also record whether it is a relay address and when Apple verified it;
your name, if you choose to share it the first time you sign in. If you don't, your account is simply called "Golfer."

We also create a random Striped account ID. Your backups, club bag, settings and subscription are tied to it.

Earlier versions of Striped could be used without signing in. When you sign in, recordings made that way on the same iPhone are attached to your account on that iPhone. The app may also offer to add other earlier recordings. If you confirm, it adds them and backs them up. Recordings attached to your account then follow the same backup choices as your other sessions (see 3.6). Nothing is deleted.

3.2 Device and security information

To protect your account, Striped uses Apple's App Attest service to confirm that requests come from a genuine copy of the app on your device. For each device you sign in on, our servers keep:

the public key and attestation record that App Attest provides;
a request counter;
the device type, for example "iPhone";
hashed forms of your sign-in tokens.

Your sign-in credentials are stored in the iOS Keychain on your iPhone. Your connection reaches our servers through Cloudflare's network (see Section 6). Cloudflare and our servers process your IP address and connection details to deliver requests and to protect the service from abuse.

3.3 Motion and swing data

Measuring motion is the core of Striped. With your Motion & Fitness permission, the app reads the following while a session is recording:

iPhone motion sensors: the accelerometer, gyroscope and device motion, usually with the phone in your pocket.
Head motion from compatible AirPods or Beats headphones.
Wrist motion from the Striped Apple Watch app, if you use it. The Watch sends this only to your iPhone, over Bluetooth or Apple's Watch connection. It never sends anything to us directly.

From these streams, the app works out your swings and their measurements on your iPhone. Motion data is not used to determine your location.

3.4 What a session file contains

Each recording is saved as a file on your iPhone. It contains:

the sensor data;
a log of what happened during the session, such as start and stop, detected swings, device connections and any spoken shot labels;
a technical "provenance" block, described below.

The provenance block lets us tell sessions and hardware apart when diagnosing problems. It holds:

a random installation ID that the app creates;
the first eight characters of Apple's identifier for vendor;
the profile name you typed, if any;
your golf handedness;
your iPhone model, iOS version, Striped version, locale and time zone;
your Apple Watch model, watchOS version and which wrist you wear it on;
what the app can detect about your headphones: whether they stream head motion, and the Bluetooth audio route, which can include a name you gave your AirPods.

The session file leaves your iPhone only as described in Sections 3.6 and 3.7. You can see this list in the app under Profile → Data & privacy → What gets sent.

3.5 Things you add: names, notes, clubs, video and audio

Session names, private notes and excluded swings are saved on your iPhone, and are backed up whenever that session is backed up.
Your club bag: the club types, numbers and lofts, plus any names you give your clubs. While you are signed in, your bag syncs to your account so it is available on your other devices. This happens separately from session backup.
Your settings: your golf handedness, the devices you use, your audio and practice settings (for example the metronome, spoken results and which stats are read out, and whether other audio is lowered while Striped speaks) and your personal targets. While you are signed in, they sync to your account so they come back if you reinstall Striped or sign in on another iPhone. The name you give in the app stays on your iPhone.
Video: you can attach a clip from your photo library to a session. Striped can open only the clip you pick. It makes its own copy on your iPhone and removes the camera-roll metadata from that copy, which can include GPS location and device details. The clip is uploaded only if you include video when backing up that session or sharing it with Striped Lab.
Audio and spoken shot labels: "Record spoken labels" is off by default. If you turn it on, the iPhone's microphone records audio during the session. Speech recognition runs entirely on your iPhone to pick out golf words, such as a club or a shot result, and nothing is sent to Apple for recognition. The recognized labels and their text are saved with the session. The audio recording is uploaded only if you include audio when backing up that session or sharing it with Striped Lab.

3.6 Private cloud backup

Backup is optional and stays off until you turn it on in Profile → Account & Backup.

Automatic backup: while Striped is open, the app uploads each session's data, including the session file, your spoken-label results and your edits (name, private note, swing exclusions, and the session's recorded settings such as club and handedness).
Back up now does the same whenever you tap it, even if automatic backup is off.
Video and audio are included only when you add them for a specific session.
Depth recordings are never part of a private backup.

We use your private backups only to keep your sessions safe and to restore them to your devices. They are not shared with Striped Lab, are not used for research, and Striped Lab reviewers cannot open them. If you delete a backed-up session on your iPhone, the app also tells our servers to delete the backed-up copy.

3.7 Striped Lab (beta versions only)

Striped Lab is our program for testing and improving how Striped detects and measures swings. It is available only in beta versions of Striped. The App Store version does not offer Striped Lab and never sends sessions to it.

In a beta version, a session is shared with Striped Lab only when you choose to share it:

you tap Share with Striped Lab for a session. You choose whether to include video and audio, and you can add a note;
you send it from a Test Center test; or
you turn on Auto-send to Striped Lab, which is off by default. While it is on, every session you record is shared automatically shortly after you stop, together with its attachments.

A Lab share can include:

the session file described in 3.4;
a summary of the session's swings;
your spoken-label results;
your Lab or test notes;
diagnostic logs about device connections;
session audio, attached video and depth recordings, when the session has them.

Sharing a session also saves a private backup of it. In the Test Center, a beta version can use your iPhone's rear camera, its motion sensors and, if you allow it, the microphone to make video and depth reference recordings. These stay on your iPhone until you choose to share them.

Authorized Striped reviewers can view and download shared sessions to analyze them, including on computers operated by Mongo Technologies LLC. They may send a review result back to you in the app. Earlier beta versions sent shared sessions directly to one of those computers.

3.8 Subscriptions

The Striped subscription is an auto-renewing subscription sold through Apple's App Store. Apple handles payment, and we never receive your card or billing details.

When you buy or restore a subscription, the app sends Apple's signed transaction to our server, which confirms it with Apple's App Store Server API.
Apple sends our server notifications about renewals, expirations, refunds and similar changes.

We store only what we need to know whether your account has a Striped subscription:

a token that links the purchase to your Striped account;
Apple's transaction identifiers and the product you bought;
the subscription's status and key dates;
a record of each notification Apple sent.

We do not store price history.

3.9 Apple Watch and Health

The Watch app starts a golf workout session because that is how watchOS lets an app read motion data at the high rates Striped needs. watchOS requires Health permission for this, so Striped asks only for permission to write workouts.

Striped requests no read access to Health. It cannot see your heart rate, workouts, activity, body measurements or any other Health data. It does not save workouts or other records to the Health app, and no Health data is ever sent to us.

If that ever changes, we will update this policy first. Any Health data Striped handled would never be used for advertising or marketing, would never be sold, and would not be shared with third parties except as you direct. We apply the same commitments to all the motion data Striped collects.

3.10 Live Activities, Bluetooth and notifications

While you record, Striped can show a Live Activity on your Lock Screen. It is normally updated on your iPhone itself. When you start a session from your Apple Watch while your iPhone is locked, the app sends our server a one-time push token issued by Apple and the session card's starting details (a random session ID, start time and practice mode). We pass them to Apple's Push Notification service once to show the card on your Lock Screen and do not store or log them. Bluetooth is used only to receive live motion from your Apple Watch during a recording. Apart from starting that card, Striped does not send push notifications.

3.11 Information we receive from Apple

As the app's developer, we receive some information from Apple:

the names and email addresses of people we invite to beta versions;
aggregate App Store statistics and sales reports;
crash logs and diagnostics, if you have chosen to share them with app developers in your device settings.

What Apple collects and shares is governed by Apple's privacy policy. The Striped app itself contains no crash-reporting or analytics code.

3.12 Support email

If you email support@stripedgolfapp.com, we receive your email address and whatever you include in your message.

3.13 Website visits

The stripedgolfapp.com website sets no cookies. It runs no analytics, advertising or tracking scripts, and it loads no third-party fonts or scripts. Our hosting provider, Cloudflare, processes standard request information, such as your IP address and browser type, to deliver the site and protect it from abuse. The waitlist form sends what you enter only to our own servers, and only when you submit it (see 3.14).

3.14 Waitlist

If you join the waitlist on our website, we store:

your email address;
the date and time you joined;
a tag for where on the website you joined, for example the home page;
your browser's user-agent string (its first 256 characters), which identifies your browser and operating system;
an identifier derived from your IP address with a keyed cryptographic hash (HMAC). Your IP address reaches our servers through our network provider, Cloudflare (see Section 6). We store only the hashed identifier, never the IP address itself, and we do not log the IP address. We use the identifier and the user-agent string only to prevent abuse, such as automated or repeated sign-ups;
whether and when we have emailed you.

We use your email address only to confirm that you joined and to tell you when Striped is available. We send one confirmation email for each sign-up; if you sign up again with the same address, we do not send another. We send these emails through our email provider, Resend.

You can unsubscribe with the link in any waitlist email, or ask us at support@stripedgolfapp.com to delete your sign-up. When you unsubscribe, we erase your email address, user-agent string and hashed identifier. We keep only a dated record that a sign-up was unsubscribed, which we use to count unsubscribes and which does not identify you. Otherwise we keep waitlist records until Striped has launched and we have let you know, and then we delete the list.

4. What we do not collect

No advertising. The app has no ads and no advertising SDKs.
No third-party analytics or crash reporting. The app contains no analytics, attribution or crash-reporting SDK.
No tracking. We do not use the advertising identifier, and we do not combine your data with other companies' data for advertising. Because we do not track you, the app never shows an App Tracking Transparency prompt.
No location. The app does not use Location Services and does not derive your location from motion data. The time zone and locale in a session file are device settings, not a location.
No Health data. See 3.9.
No contacts or calendars, and no photo-library scanning. Striped opens only a video clip you pick yourself.
No payment information. Apple processes all purchases.

5. How we use information

We use the information described above only to:

Provide Striped: sign-in, recording and analysis, session history, backup and restore, club bag and settings sync, data export and your subscription.
Keep Striped secure: authenticate devices, prevent fraud and abuse, and enforce upload and rate limits.
Improve Striped: we use sessions shared with Striped Lab to develop, test, train and validate our swing detection and measurement. Private backups are never used for this.
Diagnose and fix problems: we use diagnostics in sessions you share with us and crash reports Apple provides.
Communicate with you: we reply to your messages and contact you about your account, your subscription or a request you made. If you join the waitlist, we email you to confirm it and to tell you when Striped is available (see 3.14). We do not send other marketing email.
Meet legal obligations and enforce our Terms of Use.

We do not use your information to build advertising profiles. We do not make automated decisions about you that have legal or similarly significant effects. We do not use your data for any purpose unrelated to developing and operating Striped.

We do not sell your personal information, and we do not share it for cross-context behavioral advertising. We share information only in these cases:

Service providers that process data for us, under their terms with us:
- Apple: Sign in with Apple, App Attest, App Store purchases and subscription verification, TestFlight, and app distribution.
- Hetzner: hosts our servers and our encrypted backup storage in the European Union. Our primary server is in Helsinki, Finland.
- Cloudflare: hosts the website, provides our DNS, and carries the app's and the website's connections to our servers to protect them from attacks. Our servers mark their responses as not to be cached.
- Google Workspace: hosts our support email.
- Resend: sends our waitlist emails.
Legal requirements: we may disclose information where we believe in good faith that the law, legal process or an enforceable government request requires it, or to protect the rights, property or safety of our users, the public or us.
Business transfers: if Mongo Technologies LLC is involved in a merger, acquisition or sale of assets, information may be transferred as part of it. We will give notice before your information becomes subject to a different privacy policy.
De-identified findings: we may publish or share statistics and findings that do not identify any individual, such as how accurately a detection method performs across many sessions.
At your direction: for example, when you use the iOS share sheet to send a session, a report or your data export somewhere yourself.

7. Data retention and deletion

7.1 On your iPhone

Your recordings and settings stay on your iPhone until you delete them or delete the app. Signing out, or deleting your account, does not delete recordings stored on your iPhone.

7.2 Backups and deleted sessions

We keep your private backups while your account exists. When you delete a backed-up session, it is hidden right away and erased from our servers after 30 days. It then disappears from our encrypted backup copies as they age out, normally within a further 90 days.

Deleting a session does not withdraw it from Striped Lab. If you shared that session, the shared copy stays until you withdraw the share (see 7.4) or delete your account.

7.3 Deleting your account

You can delete your account in the app at Profile → Account & Backup → Your data → Delete cloud account. Apple asks you to confirm it's you first. Once you confirm:

your account is disabled, all of its sign-ins are revoked, and we revoke Striped's Sign in with Apple authorization with Apple;
we erase from our servers:
- your Apple identifier, email address and name;
- your devices;
- your private backups, including video and audio;
- your club bag;
- your app settings;
- your data exports.
we keep a minimal disabled record of the account ID, the deleted session IDs and the deletion itself. This stops a device from restoring the deleted data;
encrypted backup copies of the erased data age out on a rolling schedule, normally within 90 days;
recordings on your iPhone are not touched.

Sessions you shared with Striped Lab are kept as anonymous training data. For each Lab share you have not withdrawn, we keep a de-identified copy that contains only:

the motion sensor data;
the session's structured context, such as device model, OS and app build, test, practice type, handedness, Watch wrist, and club type, number and loft;
your spoken-label results reduced to structured values (for example club, contact or shot, with timing), with no transcript.

Before we keep it, we remove:

your name, email address, account and Apple identifier;
the installation ID, device identifier and profile name in the session file;
device names, such as your AirPods' name;
your locale and time zone;
spoken-label transcripts and club names you typed;
any other place your name appears;
all audio, video and depth recordings;
all notes, Lab notes, reports, diagnostic logs and summaries.

The copy is filed under a single anonymous contributor that no one can sign in as. You lose access to these sessions. Because nothing in them points back to you, we will not be able to find or delete them for you later. We use them only to develop, test and train Striped's swing analysis.

"Anonymous" has one limit. The motion data and its timing are kept as recorded, so someone who already has your original file, such as the copy on your own iPhone, could recognize the same session by its contents.

If you don't want a shared session kept, ask us to withdraw it before you delete your account. Withdrawn shares are erased with your account. Copies that reviewers downloaded to our own computers before your deletion are not changed automatically. Email us and we will delete them or remove the same details from them.

Subscription records. If you ever subscribed to Striped, we keep the minimal subscription records described in 3.8 after your account is deleted, for as long as we need them for accounting, tax, refunds and legal obligations. Deleting your account does not cancel your subscription. Cancel it in your Apple Account settings (see our Terms of Use).

7.4 Other information

Lab shares while your account exists: kept for research for as long as they are useful to Striped. To withdraw a share, email us. A withdrawn share is removed from reviewer access and from research use.
Data exports: the archive the app prepares for you is deleted from our servers after 24 hours.
Support email: kept as long as needed to resolve your issue and to maintain a reasonable record of support history.
Waitlist: kept until Striped has launched and we have let you know, then deleted. If you unsubscribe, we erase your email address, user-agent string and hashed identifier and keep only a dated unsubscribe record; if you ask us to delete your sign-up, we delete it (see 3.14).
Server logs: our app server keeps no request access logs. Limited operational logs rotate automatically.

8. Security

We take reasonable measures to protect the information we hold:

The app connects only to Striped's own servers and to Apple, always over encrypted HTTPS.
Every account is protected by Sign in with Apple, and every device by App Attest. Access tokens expire after 15 minutes, and credentials are kept in the iOS Keychain.
Uploaded files are checked by size and cryptographic hash. Their contents are examined in an isolated environment with no network access.
Each private backup can be read only by its own account. Striped Lab reviewers have no access to private backups.
Off-server backup copies are encrypted.
Location metadata is removed from attached video on your iPhone, before the video can be uploaded.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If a breach affects your information, we will notify you and the relevant authorities as applicable law requires.

9. Your rights and choices

9.1 Controls in the app and on your devices

Permissions: turn Motion & Fitness, Microphone, Speech Recognition, Bluetooth and (in beta versions) Camera on or off in iOS Settings. Health permission for the Watch can be revoked in the Health app. Striped cannot record a given device's motion without that device's permission.
Backup: turn Automatic backup on or off, and choose for each session whether to include video and audio.
Spoken labels: "Record spoken labels" is off unless you turn it on.
Striped Lab (beta): nothing is shared unless you share it or turn on Auto-send to Striped Lab.
Export: download a ZIP file of your account data and backed-up files in Profile → Account & Backup → Your data.
Delete: delete individual sessions, or your whole account (see 7.3). You can also sign out at any time.
Waitlist: unsubscribe with the link in any waitlist email, or email us to delete your sign-up.
Apple settings: if you stop using Sign in with Apple for Striped in your Apple Account settings, Striped signs out on your devices. This does not delete your account. Use Delete cloud account, or contact us, to delete it.

9.2 Requests to us

Depending on where you live, you may have the right to:

access, correct or delete your personal information;
receive a copy of it;
object to or restrict certain processing;
withdraw consent.

To make any of these requests, email support@stripedgolfapp.com. To verify that a request comes from you, we may ask you to send it from the email address linked to your account, or to confirm it in the app. We respond within the time the law requires, generally within 30 days. If we decline a request, we will explain why, and you may appeal by replying to our decision. We will not treat you differently for exercising these rights.

10. California and other U.S. state privacy rights

If you live in California or another U.S. state with a consumer privacy law, you have rights over your personal information. In the past 12 months, we have collected the following categories of personal information:

Identifiers: your Apple user identifier, email address, name, Striped account ID, device and installation identifiers, and IP address.
Customer records: your name and email address.
Commercial information: subscription transaction records.
Audio and visual information: session audio and video you choose to include.
Internet or other electronic network activity: the motion, session and diagnostic data described in Section 3, and the browser user-agent string and hashed network identifier stored with a waitlist sign-up (see 3.14).

We collect these from you, from your devices and from Apple, for the purposes in Section 5. We disclose them only to the service providers listed in Section 6, and we keep them as described in Section 7.

We have not sold personal information, and we have not shared it for cross-context behavioral advertising. We do not knowingly sell or share the personal information of anyone under 16. We do not use or disclose sensitive personal information for any purpose that would give you a right to limit it.

You may ask to know, delete or correct your personal information through the contact details in Section 14. You may use an authorized agent; if you do, we may ask for proof of their authority and for verification of your identity.

11. International users

Mongo Technologies LLC is based in the United States. Our servers and encrypted backup storage are hosted by Hetzner in the European Union, with our primary server in Helsinki, Finland. We access and administer that data from the United States. Our support email (Google), our email provider (Resend) and Cloudflare may process information in the United States and other countries. Where the law requires a safeguard for these transfers, we rely on the mechanisms it provides, such as the European Commission's Standard Contractual Clauses in our service providers' data processing terms.

If you are in the European Economic Area, the United Kingdom or Switzerland, our legal bases for processing are:

Contract: to provide your account, the backups you ask for and your subscription.
Consent: for motion, microphone and speech access, for including video or audio, for sharing sessions with Striped Lab, and for the waitlist emails. You may withdraw consent at any time; this does not affect processing that already took place.
Legitimate interests: to secure the service, prevent abuse, fix defects, improve Striped, and keep de-identified Lab data after account deletion.
Legal obligation: for example, keeping billing records.

You also have the right to lodge a complaint with your local data protection authority.

12. Children's privacy

Striped is not directed to children under 13, and our Terms of Use require users to be at least 13, or older where local law sets a higher age. We do not knowingly collect personal information from children under 13. If you are a parent or guardian and believe a child has given us information, contact support@stripedgolfapp.com and we will delete it.

13. Changes to this policy

We will update this policy as Striped changes, and we will revise the "Last updated" date above when we do. If a change is material, we will tell you before it takes effect, through a notice in the app or by email. If we want to use information we already hold in a materially different way, we will tell you in advance and ask for your consent where the law requires it.

14. Contact us

For questions, requests or concerns about this policy or your information, contact:

Mongo Technologies LLC, a Wyoming limited liability company

Striped privacy inquiries: support@stripedgolfapp.com

Please include enough detail for us to understand and act on your request. We aim to reply within 30 days.