Privacy Policy
What we process, why, who receives it, and what you can do about it.
Effective: September 7, 2026 · Last updated: September 7, 2026
1. Who is responsible
Sebastian Burges
Wettmarser Weg 14
59846 Sundern, Germany
Email: info@customgolflab.de
This address is the contact for every privacy matter. We are not required to appoint a data protection officer.
2. What we process and why
2.1 Account and sign-in
- Email address and sign-in — via password or one-time code. If you sign in with Apple or Google, we receive only an identifier and, if you share it, your email address.
- Guest account — you can try the app without an email address. We then create an anonymous account with a random identifier. If you later convert it into a full account, your data stays with you.
- Profile — display name, handicap, right- or left-handed, home club, profile picture, your bag, goals and training preferences. All optional, all editable.
Purpose: running your account and personalizing the app. Legal basis: Art. 6(1)(b) GDPR (contract).
2.2 Swing analysis (camera and video)
- Video — recorded with the camera or uploaded from your library. It is sent to our analysis server at AWS in Frankfurt and evaluated there.
- Audio track — the sound in the video is used only to detect the moment of impact.
- Body points — from the video we compute the positions of joints and club. We do not identify you with them and do not compare you with other people.
- AI evaluation — individual frames and measured values are sent to Google's Gemini models. For the quick analysis, models from OpenAI and Anthropic evaluate the same frames as well, which makes the result more stable.
- Results — score, phases, metrics, fault patterns and drill recommendations. Video and results are then stored in your account; you can delete any video at any time.
- Calibration and grip photos — images you take for camera calibration or the grip analysis. Grip photos are evaluated by Google Gemini.
Video files on the analysis server are deleted after evaluation. Legal basis: Art. 6(1)(a) GDPR (consent, requested in the app before your first video).
2.3 Playing a round (GPS caddie)
- Location — continuously during a round, including in the background, so that distances, shot positions and the current course are right. Outside a round only when you search for a course nearby.
- Shots, scores, notes — club, position, lie, putts, results per hole, your hole notes and hole plans.
- Course data — holes, greens and hazards are requested through our server from iGolf. Only coordinates and the course identifier are sent, no account data.
- Weather and wind — from Open-Meteo, rain radar from RainViewer. Only the coordinates of the course are transmitted.
- Maps — map tiles and satellite imagery come from Mapbox, ArcGIS Online (Esri) and OpenStreetMap. These providers see the displayed map area and your IP address. Searching a course by name uses Nominatim (OpenStreetMap) with your search term.
Legal basis: Art. 6(1)(a) GDPR (consent, requested before your first round). The caddie does not work without location; you can revoke the permission at any time in your system settings.
2.4 Apple Watch and Wear OS
- Motion sensors — acceleration and rotation at the wrist to detect shots automatically. Evaluation happens on the watch; only the detected shot is sent to the phone.
- Microphone — the watch listens for the sound of the ball to confirm a shot. The audio is evaluated on the watch and is neither recorded nor transmitted.
- Location — for distances directly on the watch.
- Apple Health — the watch app starts a golf workout through HealthKit so it stays active during the round. That workout is stored in Apple Health on your devices. Whatever watchOS additionally records during a workout (such as heart rate) is governed by your Health permissions; we do not read those values and do not upload them to our servers.
- Wear OS — the app asks for the body sensors permission; we do not store a heart rate.
The watch caches the state of the current round locally so nothing is lost if the connection drops. Legal basis: Art. 6(1)(a) GDPR (consent, requested before you first use the watch).
2.5 Hosel — coaching, chat and voice
- Chat — your messages and the data needed to answer them (swing results, round statistics, goals, your bag, mental self-assessment, monthly plan) are sent to Google Gemini. Videos are not transmitted.
- Memory — we keep the wording of a conversation for 24 hours. After that only a condensed summary remains, written by an OpenAI model, so Hosel remembers what matters.
- Talking to Hosel — in voice mode your microphone audio goes directly to OpenAI (Realtime) and the answer comes back as speech. We store only the duration and cost of the session, no recording.
- Caddie voice on the course — speech recognition is done by your device (Apple or Google), the answer is generated by Google Gemini, and it is read aloud by ElevenLabs. ElevenLabs receives only the text to be spoken.
- Coaching and monthly plan — drills, progress and summaries are derived from your swing and round data; the accompanying texts are written by Google Gemini.
Legal basis: Art. 6(1)(a) GDPR (consent, requested before first use; separately for voice mode).
2.6 Fitting
For the club fitting you enter body measurements, your playing profile, your current clubs and, optionally, physical complaints. These entries are sent to an Anthropic model (Claude), which produces the recommendation. Legal basis: Art. 6(1)(a) GDPR (consent, requested before your first fitting).
2.7 Statistics and journey
From rounds, shots and analyses we compute your statistics, your history and your range progress. This happens on our side, without third parties. Legal basis: Art. 6(1)(b) GDPR.
2.8 Usage events
We log which features you open and which actions you trigger (event, screen, app version, platform) and the time of your last activity. This helps us improve the app and support you. There are no advertising profiles and no sharing. You can switch both off in your profile under "Privacy & consents". Legal basis: Art. 6(1)(f) GDPR (legitimate interest), with an opt-out switch.
2.9 Error reports
If the app crashes or an error occurs, a report goes to Sentry (data center in the EU): error message, app version, device type, operating system. We remove email and IP address beforehand, and paths to your videos are redacted. Legal basis: Art. 6(1)(f) GDPR.
2.10 Purchases and subscriptions
Subscriptions are purchased in the App Store or on Google Play; payment is handled entirely by Apple or Google. We hold no payment data. RevenueCat manages the subscription status and reports it to us under a pseudonymous user identifier. Legal basis: Art. 6(1)(b) GDPR.
2.11 Offers and news (newsletter)
Only if you agree — in the app under "Offers and news" or via the form on our website — do we send you news and offers by email. Delivery runs through Resend. We store your email address and the time and version of your consent. You can unsubscribe at any time via the switch in the app or a short email to us. Legal basis: Art. 6(1)(a) GDPR.
2.12 When you write to us
Emails to info@customgolflab.de are sorted automatically: sender, subject and text are sent to an Anthropic model that classifies the message and summarizes it in a few sentences. This lets us answer faster. The summary and any PDF attachments are stored in our mailbox archive at Supabase. Your message is not used for anything else. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in orderly handling). If you prefer otherwise, say so in your email and we will handle it manually.
2.13 Website and server logs
When you open the website or the app, our servers briefly store IP address, time, requested address, browser and operating system to keep the service secure. These logs are not linked to your account. Legal basis: Art. 6(1)(f) GDPR.
2.14 Improving the analysis (optional, off by default)
Only with your separate consent may we use video frames, body points and metrics of your swings — without any link to your name or account — to train our own analysis models. Audio, locations and account data are never included. Training runs on our servers in Germany and Frankfurt, with no sharing. Legal basis: Art. 9(2)(a) GDPR (explicit consent, since body points may count as biometric data). You can withdraw in your profile at any time; from then on your data is no longer used for training.
3. Cookies and storage on your device
We use no tracking cookies, no third-party analytics and no advertising cookies. On your device the app stores only what it needs to work:
- Sign-in session — so you stay logged in
- Settings — language, appearance, course and round settings, last selected clubs, calibration, free allowances
- Consents — which permissions you granted, and in which version
- Drafts — such as an unfinished fitting or the current round state on the watch
This data stays on your device until you sign out or delete the app.
4. Who receives your data
We work with the following service providers. Each receives only what it needs for its task and may not use the data for its own purposes.
| Provider | Purpose | Location / processing | Data |
|---|---|---|---|
| Supabase Inc. | Database, sign-in, file storage, server functions | USA; data hosted in the EU (Frankfurt) | Account, profile, videos, analyses, rounds, chat, events |
| Hetzner Online GmbH | Website, web app, backup analysis server | Germany (Nuremberg) | Server logs, videos temporarily |
| Amazon Web Services (AWS) | GPU servers for video analysis | EU (Frankfurt, eu-central-1) | Videos temporarily, metrics |
| Google (Gemini API) | AI models for analysis, coaching, Hosel, grip analysis | USA | Frames, metrics, conversation text, profile details |
| Google (Play, Google sign-in, Google Fonts) | App distribution and subscriptions on Android, sign-in, fonts in the app | USA | Purchase and account data held by Google; identifier; IP address when fonts load |
| OpenAI, L.L.C. | Hosel voice mode, memory summaries, quick analysis | USA | Microphone audio in voice mode, conversation text, frames |
| Anthropic PBC | Fitting, quick analysis, sorting our inbox | USA | Fitting entries, frames, emails sent to us |
| ElevenLabs Inc. | Speech output of the caddie voice | USA | Text to be spoken |
| RevenueCat, Inc. | Subscription status | USA | Pseudonymous user identifier, purchase status |
| Apple | App Store and subscriptions on iOS, Sign in with Apple, Apple Watch, Apple Health | Ireland / USA | Purchase and account data held by Apple; identifier; workouts in Apple Health |
| Sentry (Functional Software, Inc.) | Error reports | USA; data hosted in the EU | Error message, device, app version |
| iGolf | Course data | USA | Coordinates, course identifier |
| Resend, Inc. | Email delivery | USA | Email address, message |
| Mapbox, Inc. · Esri (ArcGIS Online) · OpenStreetMap Foundation | Maps, satellite imagery, course search | USA · USA · United Kingdom | Map area, IP address, search term |
| Open-Meteo · RainViewer | Weather, wind, rain radar | Public APIs | Coordinates only, no account |
| jsDelivr · unpkg | Delivery of program libraries used by the app | Global networks | IP address when loading |
4.1 Transfers to the United States
Several of these providers are based in the United States or process data there. We base these transfers on the EU Standard Contractual Clauses or the EU-U.S. Data Privacy Framework where the provider is certified. Under their API terms, the AI providers (Google, OpenAI, Anthropic) do not use our requests to train their models.
4.2 No other sharing
We do not sell your data and do not share it for advertising. We disclose data to authorities only when legally required.
5. Consents and withdrawal
Before first use we ask for your consent for: swing analysis (video), rounds (location), Hosel (coaching and voice mode), fitting, watch (motion sensors, microphone, Apple Health), offers and news, and improving the analysis. You can withdraw any consent at any time — in your profile under "Privacy & consents" or by email to info@customgolflab.de. The feature concerned is then no longer available; what was processed before remains lawful.
6. How long we keep data
| Data | Retention |
|---|---|
| Account, profile, consents | Until you delete your account |
| Videos, analyses, rounds, shots, statistics, fitting, drill progress | Until you delete them or your account |
| Video files on the analysis server | Deleted after evaluation |
| Wording of Hosel conversations | 24 hours, then only the condensed summary |
| Voice sessions with Hosel | No recording; duration and cost until you delete your account |
| Statistics views | Rolling 30 days |
| Usage events, error reports | Until you delete your account |
| Subscription status | Until you delete your account; receipts stay with Apple/Google under their rules |
| Emails to us | Until the request is resolved and statutory retention periods have expired |
| Server logs | Briefly, only to secure the service |
7. Deleting your account and taking your data with you
Delete account: in the app under Profile → "Delete account" — or by email to info@customgolflab.de. We delete your account together with videos, analyses, rounds, chat and profile. Backups are overwritten within 30 days at the latest.
Take your data: in the app under Profile → "Privacy & consents" you can export your data as a file.
Anonymous figures with no link to you (such as overall usage numbers) are kept.
8. Your rights
- Access (Art. 15 GDPR) — what data we hold about you
- Rectification (Art. 16) — correct inaccurate data
- Erasure (Art. 17) — have your data deleted
- Restriction (Art. 18) — have processing restricted
- Data portability (Art. 20) — receive your data in a common format
- Objection (Art. 21) — to processing based on legitimate interest
- Withdrawal — of any consent, at any time, without giving reasons
An email to info@customgolflab.de is enough. We respond within one month.
Right to complain: You can lodge a complaint with a data protection supervisory authority. The authority responsible for us is the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia (LDI NRW), Kavalleriestraße 2–4, 40213 Düsseldorf, Germany, www.ldi.nrw.de. You may also contact the authority where you live.
8.1 If you live in California or another U.S. state with a privacy law
You have the right to know what personal information we collect and how we use it, to delete it, to correct it, and not to be discriminated against for exercising these rights. We do not sell your personal information and do not share it for cross-context behavioral advertising, so there is nothing to opt out of. Health-related data is not collected by us (see section 2.4). The categories we collect are: identifiers, account details, commercial information (subscription status), internet activity within the app, precise geolocation during rounds, audio and video you record, and inferences derived from your swing and rounds. To exercise your rights, email info@customgolflab.de with the subject "Privacy Request". We respond within 45 days.
9. Security
- All connections are encrypted (TLS).
- In the database every user sees only their own data (row-level access rules).
- Keys for AI and third-party services live only on our servers, never in the app.
- Passwords are stored only as hashes; one-time codes expire after a short time.
10. Minimum age
TheLAB is intended for people aged 16 and over (13 and over in the United States). If you are younger, you need a parent's or guardian's consent. If we learn of an account belonging to a younger child without such consent, we delete it.
11. Changes
When the app or the law changes, we update this policy. The current version is always available here; we inform you of material changes in the app or by email.