Privacy policy (draft)

Last updated: DECISION: effective date and version, set when the owner publishes it.

1. Who we are

DECISION: legal name and address of the controller (the owner as an individual or a company) ("we", "us") publishes the EZQPool mobile app (DECISION: final store name, DL-80; internally "RailAim") for iOS and Android. This policy explains what the app does with your data. Contact for every privacy question and request: [email protected] (DECISION: the real domain, DL-31).

The app is a training tool for pool players: you photograph a table, and it shows an aim line and a chalk spot. You do not give us your name, e-mail address or phone number, and the app works without an account. An optional sign-in with Apple or Google, only so that invite rewards follow you to a new phone, is described in Section 3A.

2. The short version

Your photo is analysed on your phone. Nothing is uploaded unless you agree.
At first launch you are asked, on a separate screen, whether you want to contribute photos to improve the app ("Share photos" or "Not now"). You can change this at any time in Settings. Nothing is collected for this before you agree.
Crash reports are always on (they contain no photos). Usage analytics are on only if you agree (a separate switch, off by default).
If something goes wrong you can tap Report a problem and Send: only then is that report (with its photo, location removed) uploaded.
If you use Invite a friend, we store random IDs (not names or contacts) to link you and your friend and to grant the reward (Section 3A).
We do not sell your data, we do not show ads and we do not track you across other apps or websites.
You can delete the photos you contributed from inside the app, or ask us by e-mail.

3. What we collect, why, and for how long

Data	When	Why	Kept
Camera image and photos you take or pick	Always, only on your phone	To find the table and balls and compute the aim line	On your phone only (the app does not upload it unless you contribute it, Section 3 below)
Contributed sessions: the photo (original JPEG, GPS location removed; the camera's focal length, lens and orientation stay) and a file with what the app found (table corners, balls, the shot shown, what you corrected, how long it took) plus the app version, device model, OS version and language	Only after you tapped "Share photos"; uploaded over Wi-Fi	To improve the ball and table detection (training and testing our models)	At most 2 years, then deleted automatically; earlier on request (Section 7)
Install ID: a random number the app makes on the first upload	Only if you contribute or send a problem report	To check that an upload comes from the app, to limit abuse, and to find and delete your sessions on request. It is not linked to your name, e-mail or any account	While your contributed sessions or reports exist; the server keeps only a one-way hash of it
Problem reports you choose to send: a file with the photo (GPS location removed; left out when the photo is already in a contributed session), screenshots of the screen (they may show people), what the app found (the same scene file), the app's last log lines, device model, OS, language, screen size and app version, the category and note you wrote, and the install ID's token	Only when you tap "Report a problem" and then Send; uploaded over any network. If the upload is not available, you can share the file yourself instead (then it goes where you send it, with the photo as taken)	To find and fix the problem you reported (not used to train models)	90 days after we receive it; deleted earlier by "Delete my photos" or on request
Crash reports (Firebase Crashlytics): the crash's technical details (stack trace, app version, device model, OS version, free memory and storage state) and a random Firebase installation ID	Always on	To find and fix crashes	Per Google's Crashlytics settings (about 90 days)
Usage analytics (Firebase Analytics): events such as app opened, photo taken or picked (camera or gallery), photo cancelled, table and balls found or the photo needs retaking (with the reason and how long it took), result shown (shot type and time), another pocket chosen, new photo, report opened or sent (screen and category), paywall shown; plus Firebase's automatic events (first open, session start, screen view) and the same device and app details as above. Never a photo, never your location, never anything you typed, no advertising ID	Only if you agree: a separate switch on the first-launch screen (off by default) and in Settings; turning it off stops it at once	To see which features are used and where the app fails	DECISION: Analytics retention; proposed 14 months, the console setting in analytics.md (Google's default is 2 months)
Purchase information (only if premium is on sale at launch): the store's purchase receipt or token and your install ID. The App Store and Google Play process the payment; we never receive your card or payment details	When you buy or restore premium	To unlock premium and prevent fraud	While premium is active, then DECISION: how long (tax and dispute rules)
Daily photo count	On your phone	To apply the free daily limit	On your phone only
IP address	When the app contacts our server (registering an install ID, uploading, asking for a deletion)	To limit abuse (rate limits)	Not stored with your sessions; short-lived counters only

What we do not collect: your name, e-mail, phone number, contacts, location, advertising ID, or anything from other apps. The camera is used only while the app is open and only to show the preview and take your photo.

Photos may show people standing near the table. If you contribute photos, please do not include people who have not agreed, and do not photograph anything private. We do not try to identify anyone, and we use contributed photos only to improve the app's table and ball detection (not for advertising, not to identify people).

3A. Invite a friend (referral programme)

The app can give you a personal invite code. When a friend enters it and then really uses the app, you both get free premium days (the rules, such as the number of days and the limits, are in the EULA, Section 7A). The programme is optional: nothing here is collected about you unless you open the invite screen, share a code or enter one.

Data	Why	Kept
Install ID (a random number) and your invite code	To know who invited whom	While the install is in use; deleted 2 years after the last request, or on request
Account ID: a one-way hash of your Apple or Google sign-in identifier, only if you choose to sign in (no name, no e-mail is stored)	So your days and code follow you to a new phone	Until you delete the account in the app, or 2 years after the last request
The link between the inviter and the friend (two random IDs), the reward days granted and the reason for any limit applied	To grant the reward once, apply the limits and prevent abuse	2 years after the referral closes (it closes when the friend activates, the 14-day window ends, or it is revoked)
Refused attempts (for example a code that does not exist or a phone that already used one)	To spot abuse	90 days
Device check: on Android, a one-way hash of a device key (a keyed hash of the Android ID), after Google Play Integrity's verdict has been checked (the verdict itself is used when the code is entered and is not kept); on iOS, Apple DeviceCheck's two per-device bits, which are held by Apple and contain no identifier	To make sure one phone redeems only one code, and to stop reinstall loops. Done only when a code is entered, not at every launch	The hash, like the link: 2 years after the referral closes. Apple's and Google's bits are kept by them
Day stamps of your use (which days the friend had a result, with the server's receipt times and a count)	To decide whether the friend really used the app (activation)	Deleted when the referral closes
IP address	Rate limits	Held only inside short-lived rate-limit counters, not linked to the ledger; deleted after about 24 hours

No names, e-mail addresses, phone numbers or contacts are collected for this, and the app never reads your address book: you share a code through your phone's own share sheet. The inviter sees only counts (how many friends joined, how many days earned).
Cloudflare (Workers and D1, the same processor as in Section 4) stores this ledger for us. Apple and Google provide the device checks.
Separate purpose: this is not part of "Share photos" or usage analytics and does not depend on them. The invite screen and the code field show a short notice and link to this section; if you do not use them, none of this is collected. The Firebase events about the invite screen are part of usage analytics and are sent only if you agreed to analytics (no code value is ever sent).
Deletion: deleting your account in the app, Delete my photos and a request by e-mail (Section 7) delete your referral rows and grants too (the Worker route and the 2-year purge are built, RA-397; the app calls the route in a later task, open point 6). Rows where you are the other side of someone else's referral are kept with your ID replaced by deleted, so that person's earned days stay valid.

We use a small number of service providers who process data for us, under their terms:

Provider	What for	Data
Cloudflare (R2 storage and Workers; servers worldwide, bucket in Asia-Pacific)	Receives contributed sessions, problem reports and deletion requests; checks purchases	Contributed sessions, problem reports, install ID hash, IP address (momentarily), purchase receipts, the invite ledger (Section 3A)
Google (Firebase Crashlytics and Analytics)	Crash reports; usage analytics if you agree	As in Section 3
Apple App Store / Google Play	Download, updates and payments; the device checks for invite codes (Apple DeviceCheck, Google Play Integrity and Install Referrer)	They handle your purchase under their own policies; for the device checks they receive the request from your phone and keep the bits described in Section 3A

We do not sell your personal data and do not share it for advertising (including "sale" and "sharing" as defined in the California CCPA/CPRA). We may disclose data if the law requires it, or to protect our rights, and in a sale or transfer of the app's business (the buyer must respect this policy).

5. Where data goes (international transfers)

Cloudflare and Google run servers in many countries, so your data may be processed outside the country where you live, including the United States and Singapore. Where the law requires it, we rely on standard contractual clauses or an equivalent safeguard. DECISION: confirm the providers' data-processing terms are accepted in each account.

Consent (Article 6(1)(a)): contributing photos, usage analytics, sending a problem report (tapping Send). You can withdraw at any time without any effect on the rest of the app; data already processed stays lawful until then, and you can ask for it to be deleted.
Legitimate interests (Article 6(1)(f)): crash reports, abuse limits and security (keeping the app stable and the service safe).
Contract (Article 6(1)(b)): checking a purchase and unlocking premium; granting the invite reward you asked for (Section 3A).

The fraud checks of the invite programme (device check, limits) rest on legitimate interests. Where a law such as Vietnam's Personal Data Protection Law asks for consent per purpose, the invite notice names this purpose separately from photo contribution and analytics.

7. Your choices and rights

Contribution: Settings has a switch. Turning it off stops uploads and deletes the sessions waiting on your phone at once.
Delete what you contributed, in the app: Settings → Delete my photos. The app asks the server to delete every session and every problem report from this install and tells you when it is done; reports waiting on your phone are cleared too.
Delete or ask about your data by e-mail: write to [email protected] with the device ID shown in Settings (it is how we find your sessions; without it we cannot, because we hold no name or e-mail). We answer within 30 days (DECISION: confirm the period; GDPR allows one month).
Invite a friend: you can stop at any time by not sharing or entering a code. Deleting your account or using Delete my photos removes your referral rows (Section 3A, open point 6); days already granted to another person stay valid.
Analytics: the switch on the first-launch screen and in Settings turns it off. Crash reports are not optional in the app; on iOS and Android you can also limit diagnostics sharing in the system settings.
Your rights, where the law gives them: access, correction, deletion, restriction, objection, portability, withdrawal of consent (EU/UK GDPR); know, delete, correct, opt out of sale or sharing (California CCPA/CPRA, which we do not do) and not be discriminated against; the rights in Vietnam's Personal Data Protection Law, the Philippines' Data Privacy Act and similar laws. If you are in the EU/UK you can complain to your data protection authority.
Because we do not know who you are, we can act on a request only for data tied to your device ID.

8. Retention in one place

Data	Kept
Contributed sessions	at most 2 years; deleted on request
Problem reports we received	90 days (earlier on deletion)
Invite ledger (IDs, link, grants, device-key hash)	2 years after the referral closes; deleted on request
Refused invite attempts	90 days
Day stamps of the friend's use	deleted when the referral closes
Crash reports	about 90 days (Firebase)
Analytics	DECISION (Section 3); proposed 14 months
Your phone's data	until you delete the app or clear its data

9. Security

Uploads use encrypted connections (HTTPS) to short-lived, single-purpose links; we keep data in access-controlled cloud storage; the install ID is stored hashed; there are no passwords to steal (the optional sign-in uses Apple or Google, and we keep only a one-way hash of its identifier). No system is perfectly secure, and we will tell users and authorities about a breach as the law requires.

10. Children

The app is not directed to children. DECISION: minimum age (13 is the usual worldwide minimum; some countries require parental consent below 16; it must match the store age rating and the EULA, Section 16). If you believe a child under that age contributed data, write to us and we will delete it.

11. Changes

When we change this policy in a meaningful way we will update the date above and, for changes to what we collect or why, ask again for your consent in the app. DECISION: how else to notify (in-app message, store listing).

12. Contact

[email protected] (DECISION: the real domain). Postal address: DECISION: whether to publish one. EU/UK representative or data protection officer: DECISION: needed only if the legal advice says so.

---

Beta waitlist (this website)

Notice version waitlist-v2.

When you join the beta list we store your email address, when you agreed (date and time), which wording you agreed to, the language of the page, the features you switched on as wanted, the campaign tags of the link you came from (utm_source, utm_medium, utm_campaign) and an optional referral code (ref).
We also count visits per day and campaign tag. The count has no IP address, device details, cookie or anything that identifies a visitor. Browsers that send "Do Not Track" are not counted.
We use your email only to write to you about the EZQPool beta invite and the launch (including your founding-member offer). The basis is your consent, given by switching on the agreement. We do not sell or share your email.
The page and the list are hosted on Cloudflare (Pages and D1 database), which may process data outside your country. No analytics, advertising or tracking service is used on this website.
We keep the address until 12 months after the public launch, or until you ask us to delete it, whichever is first.
You can withdraw consent, unsubscribe, ask what we hold, or ask for deletion at any time by writing to [email protected]. Withdrawing does not affect anything done before.