Tennis Time Privacy Policy

Operator: Webecy ("we", "us"), Israel. Contact: Hello@tennistime.app

Tennis Time is an Apple Watch app that keeps the score of a tennis match, with an iPhone app that shows, sets up and scores matches too. This policy describes what information the apps handle, where it is kept, with whom it is shared and how you control it. It is written to match what the apps actually do; if they change, this policy changes with them and the effective date above is updated.

1. The short version

• Tennis Time has no accounts, no servers of our own, no analytics, no advertising and no third-party SDKs. We do not sell, rent or trade any information.
• Everything the app records stays on your watch and your iPhone and, if you use iCloud, in your own private iCloud storage (including the small iCloud key-value store that keeps your trial, your match count, your format presets and your settings the same on both), which we cannot read.
• The only information that leaves your devices is what you choose to share: a live match shared by code with another watch (player names and the score), or the matches you record with a friend you have connected (player names and the score, to that friend's iPhone). Both travel through Apple's CloudKit public database and carry no health data.
• Health data is read and written only through Apple Health, with your permission. Its summary goes from your watch to your own paired iPhone directly, and is never sent to iCloud, to a friend or to anyone.

2. Information the app handles

2.1 Information you type

• Your name and the names of the people you play with, as you enter them. Names are used to label sides on the score cards, in History and in Statistics. They stay on the watch, on the iPhone and in your private iCloud, unless you share a match or connect a friend (sections 4 and 5).
• A player's level (beginner to pro), if you set one, used only to seed the in-app ratings on your own devices.
• Your gender (female or male), if you choose to give it when you set the app up on your iPhone. It is optional: "Prefer not to specify" stores nothing. The app does not use it yet; it is kept for features to come, such as leagues. It is stored with your player in your private iCloud and in the records of the matches you play.

Levels, gender and favourites never leave your devices and your private iCloud: every copy that travels to someone else carries only the players' names as typed, nothing else about them.

2.2 Match records

• The score and timing of each match: every point, game and set, pauses, who served, when the match began and ended, the format chosen, and the result. These records stay on the watch, on the iPhone and in your private iCloud so your history follows you to a new device.
• A match a connected friend recorded with you (section 5) is kept in your History like your own, marked "Recorded by" that friend's name.

2.3 Health and fitness data (Apple Health)

With your permission, granted through the Apple Health permission sheet, the watch app:

• reads your heart rate and active energy during a warm-up or match, to show them on your wrist and in the result, and your date of birth, used only to compute your heart-rate zones from your age (the date itself is not stored), and the tennis workouts it saved there itself, only to restore a match's summary when the app's own storage has lost it (for example after reinstalling the app);
• writes each warm-up and match to Apple Health as a tennis workout, with its heart-rate samples and active energy, so it appears in your Fitness rings and Health history.

The summary the app keeps of a match (average, lowest and highest heart rate, time in each zone, active calories) is stored only on your watch and on the iPhone paired with it. The watch hands it to that iPhone directly, over the private link between the two devices (Apple's WatchConnectivity), so the iPhone app can show your heart rate and calories in its statistics. It is never uploaded to iCloud, never included in a shared match or a friend's feed, and never sent to us or to anyone else. We do not use health data for advertising, marketing, data mining or any purpose other than showing it to you. You can withdraw Health access at any time on your iPhone (Settings › Privacy & Security › Health › Tennis Time); the app keeps working and simply shows no heart rate or calories.

The iPhone app asks for no Health permission and reads or writes no health data. It holds Apple's HealthKit capability only to open Tennis Time on your watch when you start a match on the iPhone; the watch then records that match as described above.

2.4 Motion data

With the hands-free option on, the app reads the watch's accelerometer and gyroscope during a match to recognise wrist gestures. This processing happens entirely on the watch, in real time; motion data is not stored and not transmitted.

2.5 Purchases

Pro is bought through Apple's App Store. Apple handles payment, receipts, renewals and refunds under Apple's own privacy policy; we never see your card, your Apple ID or your billing details. The app keeps only Apple's confirmation of which purchase is in force, on the device, to unlock Pro features. The free trial is timed by the app itself: the day of your first completed match and your match count are kept on your devices and in your iCloud key-value store, so the trial is the same on your watch and your iPhone.

2.6 Notifications on the iPhone

With the trial or Pro, the iPhone app can remind you of your own tennis: a summary two hours after a day's matches, a monthly report, a nudge after two weeks without a match, the trial's last days, and one suggestion to invite friends. Each is worked out on your iPhone from the matches already on it and scheduled there as a local notification; nothing is sent to us or to anyone else to do it. Each can be switched off in Settings → Notifications, and all of them in the iPhone's own Settings → Notifications.

2.7 Bug reports

Settings → Report a Bug lets you describe a problem and add screenshots or videos you choose. Nothing is sent by the app itself: Send opens an email (or the share sheet) addressed to Hello@tennistime.app with your words, the files you picked, and the app version, iOS version, iPhone model and the app's language, all shown in the form first. It reaches us only if you send it. The photo picker gives the app only the items you select, never your library, and the app keeps no copy after the report closes. We use a report only to find and fix the problem, and delete it once it is resolved.

2.8 Information we do not collect

No location, no contacts, no access to your photo library (beyond the items you pick for a bug report), no microphone, no device identifiers, no usage analytics, no crash reports from third parties, no advertising identifiers, no tracking across apps or websites. The app makes no network requests other than to Apple's iCloud (CloudKit) and App Store services described here. If you have chosen in your iPhone settings to share analytics with app developers, Apple may show us a crash report of the app in Apple's own tools; that is Apple's programme, under Apple's privacy policy, and it contains no match or player data.

3. Where information is stored

• On your watch and your paired iPhone, in the app's own storage. The health summary of each match reaches the iPhone straight from the watch, never through iCloud. The iPhone also keeps, on the phone alone, the list of friends you follow and which of their matches it has already brought in.
• In your private iCloud (CloudKit private database), if iCloud is enabled on your devices: player names, player levels, your gender if you gave it (with your player and in your match records), match records, and the matches friends recorded with you. Health figures are excluded. This storage belongs to your Apple ID; it is protected by Apple and we have no access to it.
• In your iCloud key-value store: the day the trial started, your completed-match count, whether you finished setting up, your format presets and your settings. Yours alone, under Apple's protection.
• In Apple's CloudKit public database, only what you share or connect (sections 4 and 5). These records sit in Tennis Time's CloudKit container. We can see them in Apple's developer console, as any developer can see their container; we do not read them except to investigate a problem you report to us, and we never export, analyse or sell them.
• Apple Health, for workouts, under Apple's protection.

4. Sharing a live match by code (Pro)

When you tap Share match on the watch, the app publishes a copy of that match to Apple's CloudKit public database under a random six-character code, so that one other watch can join by typing the code. The copy contains the player names, the point log, the format and the serving settings. It does not contain any health data, your favourites, players' levels, your gender or any information about who you are beyond the names as typed.

• Anyone who knows the code can read that copy while the sharing lasts. Share the code only with the person you play with.
• The copy is deleted when the host taps Stop sharing or finishes the match. If that delete fails (no network, the app closed), the watch remembers the code and deletes the copy the next time it opens. A guest who leaves keeps nothing on the server.
• The guest's watch keeps its own copy of the match in its own History, as you keep yours.
• Please share a match only with the agreement of the people whose names it carries.

5. Connecting a friend (Pro)

Connect lets a friend follow, on their iPhone, every match you record with them. You open the friend's page in the iPhone app, tap Connect, and send them a link (or show it as a QR code). The link holds a random identifier and nothing else.

What the connection publishes. Connecting creates a record for that friend in Apple's CloudKit public database. It holds your name as you typed it for yourself, the friend's name as you typed it, and copies of the matches you recorded with that friend: at first the last matches already in your History (up to twenty), then every new match as it is scored, live, from the watch or the iPhone. Each copy is the same as a shared match: the names of everyone in the match, the point log, the format and the serving settings, with the warm-up's duration if there was one. No health data, no levels, no gender, no favourites. The record keeps at most the twenty most recent matches, and a short list of the matches you deleted, so that a deleted match does not come back.

Who can read it. Anyone who knows the link's identifier can read the record; only your devices can change it. Send the link only to the friend it is for. A link works for one person: the first phone to accept it claims it, and any other phone that opens it afterwards is turned away.

What the friend's phone sends. When your friend taps Connect, their phone writes a claim next to your record carrying the name they gave themselves in their own app and the time. Your player page shows it ("Opened by Shai on 29 Oct"), so you can see whom the link reached and take it back if it reached the wrong person. When your friend's app can share matches too, the claim also carries the identifier of their own record of matches with you, so that your phone follows it back and the connection goes both ways; that record is theirs, under the same rules as yours. The claim carries no other information about your friend; Apple attaches to it, as to every public record, an identifier of the iCloud account that wrote it, which the app uses only to recognise the same person on another of their devices and which we cannot turn into a name or an address.

What your friend receives. Their phone reads the record while the app is open (every few seconds during a live match). The finished matches land in their History, marked "Recorded by" your name, where you are a named player and they are themselves; those matches then count in their statistics and sync to their own private iCloud like their own. They are offered the players of those matches they do not yet have (by name only) and can add or skip them. A match in play shows on their Home, read-only, and is not saved until it ends.

Notifications. When your friend accepts the link, their phone asks whether it may show notifications. To make one possible, your devices write a small public signal record when a match with that friend starts and when it ends: a code derived from the link (which cannot be turned back into it), the word started or finished, and the match's identifier. No names, no score, not the link. Apple delivers a push for that record to your friend's phone, where the app reads your record as usual and writes the notification's words itself, your name and the score; neither Apple's notification service nor we receive them. Signal records carry nothing readable and are not removed with the record.

Deleting and ending.

• A match you delete in the iPhone app is removed from every connected friend's record. Your friend is told, and chooses whether to delete their copy too; it is theirs to keep. A match deleted on the watch is not yet removed from the record this way; it leaves when it is older than the twenty most recent, or when you disconnect.
• Disconnect on the friend's page, or under Settings → Connections, deletes the record from the public database at once. The friend's phone notices the next time it reads and stops following; the matches already in their History stay theirs. The claim record (their name and the time) is not deleted with it.
• Take Link Back (the link reached the wrong person) empties the record of every match and marks it closed; it keeps only the two names so that a phone that opens the link later is told it is closed. The phone that had followed it deletes every match the link brought and stops following.
• Your friend can stop following you at any time under Settings → Connections on their phone. That removes their claim and their notification subscription, and stops their phone reading the record.
• Please connect a friend only with their agreement and the agreement of the other people whose names appear in your matches with them.

6. Your choices and rights

• Delete a match: swipe a row in History, or select several and delete them. This removes the match from the watch and from your iCloud, and its health summary with it: at once on the device you delete it on, and on the other one (the watch, or the paired iPhone) the next time Tennis Time opens there (the iPhone first gives a summary a week for its match to arrive through iCloud). Deleted on the iPhone, it also leaves your connected friends' records (section 5).
• Delete a player: in Settings → Players. Past matches keep the name as it was typed.
• Stop sharing or connecting: Stop sharing on the watch; Disconnect on a friend's page or under Settings → Connections on the iPhone.
• Delete everything: delete the app from the watch and the iPhone; to remove iCloud copies as well, delete the app's data under iCloud settings on your iPhone (Manage Storage → Tennis Time). Disconnect each friend first, so their records leave the public database.
• Health access: change or revoke it on iPhone (Settings › Privacy & Security › Health › Tennis Time) at any time.
• Access and portability: all your information is already on your own devices and in your own iCloud; nothing is held by us beyond the shared and connected records described above, which you remove yourself by stopping the sharing or disconnecting.
• If you live in a jurisdiction that gives you rights over personal data (for example the EU, the UK, California or Israel), those rights apply. Since we hold no copy of your data beyond those records, they are exercised directly on your devices as described above. If you appear in someone else's shared match or connection and want that copy removed, write to us at Hello@tennistime.app and we will remove it from the public database.

7. Children

Tennis Time is not directed to children under 13, and we do not knowingly collect information from them. The app collects no personal information on our side at all; a child using a watch under a family's Apple ID is covered by Apple's family protections.

8. Security

Information stays within Apple's platforms: the watch's and the iPhone's encrypted storage, the encrypted link between them, iCloud and Apple Health, which use Apple's transport and at-rest encryption. We operate no server, so there is no database of ours to breach. The copies that travel, a shared match and a friend's connection, carry no health or account data; a shared match is removed when the sharing ends and a connection when you disconnect. Share codes and connection links are random and unguessable in practice, and only the device that created a record can change it.

9. Changes

We may update this policy when the app changes. The effective date at the top shows the latest version; the app's About screen links to the current text.

10. Contact

Webecy, Israel. Hello@tennistime.app