Privacy Policy

Vibora Padel Tracker ("Vibora", "we", "our", or "the app") is a padel match tracker for iPhone and Apple Watch. This Privacy Policy explains what data Vibora collects, where it is stored, who it is shared with, and the choices you have. We've written it to be as specific as possible: every category below corresponds to actual data the app reads or stores.

Vibora is published by an independent developer. The data controller for the purposes of GDPR is the developer listed in the Contact section at the bottom of this page.

1. Data Stored Only on Your Device

The following data is processed by Vibora on your iPhone or Apple Watch and is not transmitted to our servers:

• Microphone audio. The Apple Watch microphone is used during a match to detect racket-ball contacts. Audio is processed in real time on the watch; no audio recording is saved or transmitted. Only a numeric amplitude value per detected contact is kept as part of the match log.
• Motion sensor data. Accelerometer and gyroscope readings are used on-watch to detect shots and are stored on your iPhone as part of the match recording. Raw sensor traces stay local to your devices.
• Raw HealthKit samples. Apple HealthKit heart-rate and active-energy samples are read on the watch to measure your session. The raw samples remain inside Apple's HealthKit on your device.

2. Data You Send to Our Servers (Cloud Sync)

When you sign in with Apple, Vibora connects to our cloud backend (hosted on Supabase) so your matches and profile are available across devices. While you are signed in, the following data is uploaded automatically:

2.1 Account & Profile

• Sign in with Apple identifier. A stable user ID issued by Apple, used to authenticate every backend request.
• Email address. If you allow Apple to share it, your email is stored on our authentication record. If you choose Hide My Email, only Apple's private relay address (...@privaterelay.appleid.com) is stored.
• Profile. Display name, nickname, avatar (emoji or uploaded photo), preferred hand, skill level, public-profile flag, and your selected racquet brand/model.
• Avatar image. If you upload a profile photo, it is stored as a JPEG in our private avatars storage bucket under a path keyed to your user ID.

2.2 Match & Session Data

Each match you record is uploaded to our matches table after it ends (or on the next launch if you were offline). Each row contains:

• Team and player names you entered for the match.
• Set scores, winner, score events, total shot count, and timestamp.
• Match duration, average heart rate, total active calories, and per-second heart-rate and calorie series, derived from Apple HealthKit. HR and calorie data leave your device as part of the match record.
• An is public flag — see §3 below.

Per-shot annotations (your text labels and notes) are stored in a separate shot_annotations table linked to the match.

2.3 Roster, Social & Competitions

• Player roster. Names of partners and opponents you add are stored in our players table under your account.
• Follows. If you follow another user, the follower-following pair is stored in our follows table.
• Competitions. If you create or join a competition, the competition title, format, dates, club name, and the public coordinates of the venue you selected (from Apple Maps search), plus the list of participants, are stored in our competitions and competition_participants tables. Vibora does not read your device GPS — the coordinates stored are for the venue you pick, not for you.

2.4 Subscriptions

If you purchase a Vibora Pro subscription, payment is processed by Apple's StoreKit. We never see your card details. After Apple confirms a transaction, we store the following on our subscriptions and subscription_events tables, keyed to your user ID, in order to validate Pro entitlement and reconcile receipts:

• Product identifier (e.g. vibora_pro_monthly), active/inactive flag, expiration date, original transaction ID.
• Per-event log entries (purchase, renewal, refund, etc.) including transaction ID, price (in cents), currency, and StoreKit environment (sandbox vs. production).

3. Public Matches and the Community Feed

By default, every match you sync is private to your account. You can opt in to publish an individual match to the Community feed via the "Publish to Community" sheet in the iPhone app. When a match is published:

• Its score, team names, duration, shot count, and the publishing user's profile name and avatar become visible to other Vibora users.
• Heart-rate and calorie metrics that are part of the match record are also accessible to other users in the published match's detail view.

You can unpublish a match at any time from the same sheet. Competitions and their participants are visible to all signed-in users by design.

4. How We Use Your Data

• Authenticate your session and scope every request to your account.
• Display your match history, statistics, profile, and roster across iPhone and Apple Watch.
• Provide social features (community feed, competitions, follows) when you opt in.
• Validate your Vibora Pro entitlement and respond to purchase, renewal, and refund events.
• Diagnose support requests you submit through the Support page.

We do not use your data for advertising, marketing, profiling, behavioral analytics, or any form of cross-app or cross-website tracking. Vibora contains no advertisements and integrates no third-party analytics, attribution, or advertising SDKs.

5. Sharing With Third Parties

We do not sell, rent, or share your personal data for marketing or advertising. Limited sharing happens only with the following processors that are necessary to run the app:

• Apple Inc. — Sign in with Apple authentication, App Store In-App Purchase, HealthKit (on-device only), iCloud Push (notifications). Apple handles your data per the Apple Privacy Policy.
• Supabase Inc. — Hosts our authentication, database, and storage layers on AWS infrastructure. Supabase processes data per the Supabase Privacy Policy. Database rows are protected by row-level security so users can only access their own data, plus public matches and competition data they participate in.

We may also disclose data if compelled by valid legal process (e.g. a subpoena or court order), or when necessary to protect the safety, rights, or property of users or the developer.

6. Data Retention

We retain your account, profile, matches, roster, annotations, follows, competitions, and subscription records for as long as your account is active. If you delete your account (see §8), all rows keyed to your user ID are deleted from our database, and your avatar JPEG is removed from storage. Backups may retain the data for up to 30 days before being overwritten.

7. Security

Data is transmitted between your device and Supabase over TLS. At rest, our database and storage buckets are encrypted by Supabase using AWS-managed encryption. Access to production data is restricted to the developer. Authentication tokens are stored in the iOS Keychain on your device.

8. Your Rights and Choices

• Access & export. You can request a copy of all data we hold about you by emailing the address in the Contact section.
• Correction. You can edit your profile, roster, racquet preferences, and annotations directly in the app. Email us if you need help correcting other fields.
• Delete cloud data. Email the address in the Contact section requesting account deletion. We will remove your account, profile, matches, roster, annotations, follows, avatar, and subscription history within 30 days.
• Delete local data. You can delete all on-device match recordings from the iPhone app's settings.
• HealthKit. You can revoke Vibora's HealthKit permissions at any time via the iPhone Settings app → Privacy & Security → Health → Vibora.
• Microphone & Motion. You can revoke microphone and motion permissions for the watch app via the Watch app on your iPhone.
• Sign in with Apple. You can disconnect Vibora from your Apple ID via Settings → [your name] → Sign in with Apple → Vibora.
• Hide your matches. Match records default to private. You can unpublish any previously-published match from its detail screen.

If you are in the EEA, UK, or Switzerland, you have additional rights under GDPR (right to object, right to data portability, right to lodge a complaint with your local supervisory authority). If you are a California resident, you have additional rights under CCPA/CPRA. To exercise any of these rights, email the address in Contact.

9. International Transfers

Our backend is hosted on AWS infrastructure. Depending on the Supabase region, your data may be processed in the United States or the European Union. Where applicable, transfers from the EEA, UK, or Switzerland rely on Standard Contractual Clauses.

10. Children's Privacy

Vibora is not directed at children under 13, and we do not knowingly collect personal information from children under 13. If you believe a child has provided personal data, contact us and we will delete it.

11. HealthKit-Specific Disclosures

Vibora reads heart rate and active energy from Apple HealthKit on the Apple Watch and writes a workout summary back to HealthKit when you finish a match. Aggregated metrics derived from HealthKit (average HR, total calories, HR series, calorie series) are uploaded to our servers as part of each synced match, as described in §2.2. We do not use HealthKit data for advertising, marketing, sharing with data brokers, or behavioral analytics. We do not share HealthKit-derived data with third parties other than the storage processor described in §5.

12. Changes to This Policy

We may update this Privacy Policy when the app changes the data it handles. The "Last updated" date at the top of this page reflects the most recent revision. Material changes will be communicated in-app or via the App Store release notes.

13. Contact

For privacy questions, data access requests, or account deletion requests, email k@lptec.com.ua or use our Support page.