Legal
Privacy policy
Last updated 12 September 2026
The short version
Your video never leaves your phone. Pose detection and scoring run on the device. If you create an account, only the numeric results of an analysis sync — under two kilobytes per stroke — so your history survives a new phone. Crash reports go to Sentry whether or not you have an account. There is no advertising, no analytics SDK, no data broker, and nothing is sold or shared for anyone else's purposes.
Who is responsible for your data
FormCourt is a trading name. The data controller is Avihai Hemo, an individual developer based in Israel, reachable at support@formcourt.com — for privacy questions, rights requests and anything else on this page.
If you need a postal address to send a formal notice, ask at that address and it will be given to you.
What stays on your device, always
- Every video clip you record or import, stored in the app's private container.
- Every pose track — the per-frame joint coordinates extracted from a clip.
- Contact-frame thumbnails.
- Your profile photo, if you set one.
- Any injuries you flag. The app asks which areas to protect so it can keep loaded drills out of your plan. That answer is health information, it is used only by the planner on your phone, and it is stripped from everything that syncs.
- Which days you opened the app (the last 90), the timestamps of your recent analyses, and which drills you ticked off and when.
None of these are ever uploaded to FormCourt, by any code path, in any tier of the product. There is no server that has ever received one.
They are also excluded from your device's iCloud and iTunes backups, so a backup of your phone does not carry your footage either. The app sets that exclusion on every launch and again after every save. The trade-off, deliberately: restoring a phone from an iCloud backup brings back no FormCourt history for someone who never made an account.
Two things about your own device are worth saying plainly. If you record inside the app and grant permission, the clip is also saved to your iOS Photos library. That copy is yours and lives outside the exclusion above, so if you have iCloud Photos switched on, Apple syncs it like any other video in your library. And the count of analyses you have used this month is kept in the iOS Keychain, which means it deliberately survives deleting the app; it is a number and a month, tied to no identifier, and it exists so a free month cannot be reset by reinstalling.
What syncs, only if you make an account
- Scores and measured checkpoint values, as numbers and short generated sentences.
- A content fingerprint of the source video — a hash, never the video — so the same clip analysed twice is not stored twice.
- Your training profile: goal, court days, power days, session length. Not your injuries.
- Logged games and recurring coach sessions. If you name a coach, a hitting partner or a venue on a session, that text syncs with it — please do not enter anyone else's full name.
- Your display name, your hitting hand, your XP, your email address, and which sign-in provider you used.
- Your training log: which drills you ticked off and when, which weekly challenges you have claimed, and which badges and levels you have already been shown. This is exercise data. It syncs so that a new phone brings back your workout calendar and your streak rather than an empty one beside your old XP — and because it is a log rather than a preference, it is merged with whatever the server already holds instead of replacing it, so two phones cannot erase each other's week. It does not include your injuries, which never leave the device at all.
This exists so that a lost phone does not mean a lost history. You can use the entire app without an account, and then nothing leaves the device except crash reports.
Sign-in
Sign in with Apple or Google. There are no passwords and no email sign-in. We receive your email address — including Apple's private relay address, if that is what you chose to share — and, on a first sign-in, the display name the provider supplies. We never receive your password. Our authentication provider also records the ordinary metadata of a sign-in, including the IP address the request came from.
Crash and error reporting
The app sends crash reports and handled errors to Sentry, and a sample of performance traces (about one session in five) so slow screens can be found. These carry the device model, the OS and app version, a Sentry-generated installation identifier, and the stack trace. They are configured not to attach your identity, and the app strips file paths, account identifiers and request parameters from them before they are sent — file paths in particular, because they contain your own filenames. Sentry necessarily sees the IP address the report came from. Reports are sent whether or not you have an account. Crash reporting cannot currently be switched off inside the app.
Notifications
Reminders are scheduled by the app on your own phone. There is no push server and no push token; nothing about your schedule is transmitted to arrange them.
The website
This site sets no cookies, uses no local storage, loads no third-party scripts and embeds nothing. Fonts are served from this domain. See the cookie policy for the detail. There is no form anywhere on this site: the beta signup form was removed on 11 September 2026, and nothing here now asks you for, or collects, a single detail about you.
Processors
- Supabase — authentication and the results database. Hosted in East US (North Virginia), us-east-1. There are no read replicas elsewhere.
- Sentry — crash, error and performance reports. From the next app release these carry your account identifier, so a crash can be traced to the person it happened to and fixed; they never carry your name, your email, your video or your pose data. Crash reports are not covered by the usage-data switch in Settings — they are what makes a broken build fixable, and they describe the failure, not your behaviour.
- Netlify — hosts this website. Netlify keeps standard server access logs, which include IP addresses. That is the whole of it: no form on this site ever received a submission, so Netlify holds nothing else about you.
- Apple / Google — only if you use their sign-in, and under their own privacy policies.
- RevenueCat — subscription state. It receives your account identifier and what Apple says you have bought; it never sees your payment details, because Apple takes the payment and we never see them either.
- PostHog — product analytics, from the next app release onwards. It receives a short list of named events (an onboarding step finished, the paywall opened, an analysis completed and whether it was partial) with counts, durations and your account identifier attached — and nothing else. No video, no pose data, no name, no email, nothing you flagged as an injury, and no free text of any kind. There is no session recording: this app puts your own video on the screen, and no recording of that screen is ever made or sent. You can switch this off in Settings → Privacy → Share usage data, and doing so also discards anything already queued on the phone.
If a processor is added or replaced, this list changes before the change takes effect.
Where your data goes
The account database sits in Amazon's East US (North Virginia) region, us-east-1 — verified in the Supabase dashboard on 10 September 2026, with no read replicas anywhere else. The crash-reporting service is also US-hosted. If you are in the UK, the EEA or Switzerland, your account data is therefore transferred out of your country.
The safeguard for those transfers is the Standard Contractual Clauses — the controller-to-processor terms (Module Two) annexed to the European Commission's Implementing Decision (EU) 2021/914. They are in force with every processor named above through that provider's data processing agreement, each of which forms part of its terms. For the UK, those clauses are amended by the International Data Transfer Addendum issued by the Information Commissioner's Office; for Switzerland, by the modifications that put the Swiss FADP and the Federal Data Protection and Information Commissioner in place of the GDPR and the EU authorities.
Two of them carry a second safeguard as well: Sentry and Netlify are certified under the EU–US Data Privacy Framework and its UK Extension and Swiss counterpart, and rely on the Clauses above if that framework ever ceases to be available. Supabase and RevenueCat rely on the Clauses alone.
You can ask for a copy of the clauses that apply to your data at support@formcourt.com.
Why we are allowed to hold it
For readers in the UK and the EEA, the legal bases are: performance of a contract for your account, your scores, your training plan and your subscription, because they are the service you asked for; legitimate interests for crash and error reporting, security and preventing abuse of the free tier, because a product that cannot see its own failures cannot be fixed; and consent, which you give and can withdraw in iOS Settings, for notifications, the camera and your photo library.
How long we keep it
- Your analyses, on a free account: the server keeps the most recent 200, and nothing older than 180 days. A nightly job enforces both. Your phone keeps its full history regardless — the trim is a limit on the backup, not on you. A paid account is not trimmed.
- Your account, while you are subscribed: kept for as long as the subscription is active. You are paying for a service that needs it, and no clock runs against you.
- An account nobody comes back to: with no active subscription, the account and everything attached to it is deleted after 24 months with no sign-in — or 36 months if you have ever held a subscription, because that relationship was real and a player who sits out a season should not come back to nothing. Signing in resets the clock. You can always delete it yourself, sooner, from inside the app.
- Worth knowing before any of that worries you: your phone keeps its own copy regardless. Deleting a dormant account removes the backup, not your history — the only case where it bites is arriving on a new phone years later.
- Crash and performance reports: Sentry expires them on its own schedule — at most 90 days, and 30 days on the free tier. We keep no separate copy and do not extend it.
- Beta-list email addresses: there are none. The site carried a beta signup form until 11 September 2026, when it was removed; it was checked against Netlify's records on the day it went, and not one address was ever submitted through it. Nothing was collected, so there is nothing being kept and nothing to ask us to delete.
- Product analytics events: kept by PostHog for 12 months, then dropped. Switching off Settings → Privacy → Share usage data stops any new ones; ask at support@formcourt.com and the events already recorded against your account identifier will be deleted too.
- Website server logs (IP address, page, time, browser), kept by Netlify: under 30 days, on their schedule rather than ours.
Your rights
Wherever you are, you can delete your account and everything attached to it from inside the app, in two taps, without emailing anyone. If you are in the UK or the EEA you also have the right to access a copy of your data, to correct it, to have it erased, to restrict or object to processing, to receive it in a portable form, and to withdraw any consent you have given. Ask at support@formcourt.com and we will answer within one month. You also have the right to complain to your national data protection authority.
If you are in California, we do not sell your personal information and we do not share it for cross-context behavioural advertising, so there is no "Do Not Sell or Share" link to offer. You have the right to know, to delete and to correct, and you will not be treated differently for exercising any of them.
If you are in Israel, you have the right to inspect the information held about you and to ask for it to be corrected or deleted.
Scoring is automated, and it decides nothing about you
Your scores are produced by rules running on your phone against published biomechanical ranges. Nobody reviews them, and they produce no legal or similarly significant effect — they are a training aid, not an assessment. FormCourt is not medical advice.
Security
Everything travels over TLS. Account data is protected by row-level security so one account's token cannot read another's rows, and the subscription tier is writable only by the server. On the phone, your history is stored in the app's private container, which iOS keeps out of reach of other apps.
Deleting everything
Settings → Clear this phone signs you out and erases the local history, the saved clips, the cover stills and your profile photo from this device. It does not touch the copies you chose to keep in your own Photos library, and it does not reset the monthly analysis count in the Keychain.
Account → Delete account erases your account and every row attached to it — analyses, games and coach sessions — and then clears this phone. It cannot be undone. Crash reports already sent to Sentry are not linked to your account and expire on their own schedule.
Children
FormCourt is for players aged 13 and over. It is not directed at younger children and we do not knowingly collect their data. Where local law sets the age of digital consent above 13 — up to 16 in parts of the EEA — a parent or guardian has to consent on the child's behalf.
If you believe a child has given us data, write to support@formcourt.com and it will be deleted.
One thing worth a parent knowing: a junior's clips and pose tracks stay on the phone like anyone else's, and an account syncs only scores and training answers. The camera is the part to supervise, not the backup.
Changes
The date at the top of this page changes whenever this policy does. Material changes will be announced in the app before they take effect.