Effective from 29 October 2026.
Privacy policy
Golpix · 2026-11-02
Summary
Recording a shot does not upload its video. Your private video library stays on your device and is not a cloud backup. Publishing a tutorial or adding a profile photo uploads that media. Community content and public profiles are visible to other members; your match journal is private. We do not sell personal data or use it for cross-app advertising. Optional sync, body-point sharing, usage analytics and crash reporting have separate controls; reading this policy is not consent.
Controller
SoloTechAI e.U., owner Yijie Liu
Walter-Zeman-Gasse 2/2
1220 Vienna, Austria
office@solotechai.com · +43 665 67221768
We are responsible for Golpix and golpix.app. See the imprint.
Recording and private videos
The camera captures your recording; optional voice-start requires microphone permission. Pose detection processes body landmarks, including some facial landmarks, on the device. Technique scoring is not medical assessment or biometric identification. Private clips, local results and unpublished drafts remain in app storage unless you choose sharing or upload. Removing the app or its data can erase local files; save important clips separately. Change device permissions in system settings. Recording and analysis provide the requested service (Article 6(1)(b) GDPR).
Account and profile
We process email, account identifiers, authentication/session records, required display name, age-eligibility confirmation, playing hand, language and your chosen country and photo. Password authentication stores a hash. Where shown in your app version, you can choose Google sign-in on Android and iOS or Sign in with Apple on iOS instead of a Golpix password. We receive a provider account identifier, verified email and authentication tokens; Google may also provide your name and profile image. Apple can provide a private relay email address when you choose Hide My Email. We never receive your Google or Apple password. We use these data to sign you in and link a verified matching email to your Golpix account. Apple revocation credentials are encrypted at rest and used to disconnect Apple access when you delete your Golpix account. Choosing social sign-in does not enable optional data sharing or the contributor promotion. Country can be suggested from device locale and changed or cleared; this is not precise location tracking. Account functions rely on Article 6(1)(b). Necessary access metadata, rate limits and security records protect accounts against abuse under our legitimate interest (Article 6(1)(f)).
History and match journal
Optional history sync sends scores, shot types, times and associated analysis details to restore your history. Sharing body points is a separate choice. These optional uses rely on consent (Article 6(1)(a)); switching them off stops future processing for that purpose. Use deletion controls or contact us about data already stored.
The private journal stores match dates, player names, scores and notes you enter to provide that feature (Article 6(1)(b)). Use nicknames where possible and inform the other players. People whose information another user enters can contact us to exercise their rights.
Helping improve scoring
With your opt-in, body points and associated analysis information can be uploaded to evaluate and improve scoring. They remain personal data without the original video. This does not authorise training general-purpose AI models on your tutorials or private clips. Withdraw consent in Privacy settings; earlier lawful processing is unaffected. Contact us to remove identifiable contributions.
For the optional contributor promotion, we store your account ID, participation choice and dates, consent version, qualifying upload paths, content fingerprints and receipt times, plus any earned reward. These records administer the promotion you request and prevent duplicate counting; the invitation receipt records when the one-time invitation was claimed, not consent. Declining the invitation does not enable sharing. Progress and earned rewards remain if you stop sharing or delete shared files. Participation records and up to 20 qualifying receipts remain until account deletion and are included in your account export. They follow the backup retention described below. Sharing body points remains a separate, withdrawable choice.
Community and uploaded media
We store posts, replies, move tags, tutorials and thumbnails, votes, bookmarks, follows, memberships, reports and blocks to operate the community (Article 6(1)(b)). Profile photos and tutorials use Cloudflare R2 and are served through our backend. Publishing a tutorial makes it visible in the selected community; saving a private clip does not.
Other members can see your public name, photo, posts and follower information. Country appears when country display is enabled; change the setting or clear your country to stop displaying it. The monthly practice board requires a separate participation choice. Bookmarks and your match journal are not public posts.
Moderation uses reports, relevant content, identifiers and decisions to protect users (Article 6(1)(f)). Blocking cannot retract screenshots or copies already made. Obtain the necessary permissions or legal basis before posting other people’s images or information.
Crews, sharing and notifications
Crew content is available to its members; private crews are not end-to-end encrypted messaging. Sharing through another app sends data to the recipient and service you choose.
If you enable reply notifications, we store an installation identifier, push token, language and its association with your account and session. We use Expo Push Service to deliver a generic reply alert through Apple Push Notification service (iOS) or Firebase Cloud Messaging (Android). Delivery includes account, post and reply identifiers so a tap can open the correct conversation; it does not include the reply text, recordings or photos. This optional delivery relies on your consent (Article 6(1)(a)). Turn it off in notification settings; signing out also unregisters the installation. In-app reply history remains available. Local reminders are scheduled on your device.
Payments
Paid plans are not enabled in this MVP. We do not collect card details. If subscriptions are introduced, prices, providers, data uses and terms will be disclosed before purchase. This policy does not activate a subscription.
Optional usage analytics
PostHog usage analytics is not enabled in this production release. If introduced, we will explain the data, recipient and transfer details and request consent before collecting optional analytics. This is separate from optional body-point contributions described above.
Optional crash reporting
Sentry crash reporting is not enabled in this production release. If introduced, we will explain the data, recipient and transfer details and request consent before collecting optional crash reports. Essential server security logging is separate.
Website and delivery
Website, API and download requests expose IP address, time and technical metadata to the relevant hosting/network providers for delivery and abuse prevention (Articles 6(1)(b) and (f)). The current marketing site has no advertising or analytics cookies. Stores and external sign-in providers have their own notices.
Waitlist and contact
The waitlist stores email, experience level, playing location, language and consent record for requested beta communications (Article 6(1)(a)). Withdraw by replying or contacting office@solotechai.com. Entries are kept while the requested invitation programme is active or until withdrawal, then deleted unless a specific legal need requires a limited record. Support correspondence is used to answer requests and, where needed, handle claims (Articles 6(1)(b) and (f)).
Recipients
When you send an in-app bug report, we send your description, chosen language and verified account email to support@golpix.app so we can investigate and reply. You can include app/build version, device model, operating system and scoring version using the optional technical-details control. Reports do not automatically attach recordings or logs. Resend delivers the report to our support mailbox, hosted by Zoho Mail. This is support correspondence under the purposes and retention rules described here.
Authorised staff and providers process information needed for hosting, database, media, transactional email and notifications. Active providers include Hetzner, Cloudflare R2 and Resend. Google and Apple also process sign-in information when you choose their login methods, under their own privacy notices. Optional reply notifications are delivered through Expo Push Service, Apple Push Notification service and Firebase Cloud Messaging, as described above. Processors require appropriate contracts. Authorities/advisers may receive information required by law or necessary for claims.
Website, API and database hosting: Hetzner Online GmbH, Falkenstein, Germany. This deployment stores account records, optional synced analysis, match journals, community records and uploaded body-point files.
Media and email: Uploaded media uses a private Cloudflare R2 bucket with EU jurisdiction. Transactional login and verification emails use Resend, configured in its Ireland sending region. A selected storage or sending region does not mean all provider processing takes place in that region.
Backups and diagnostics: Encrypted daily backups are stored on an operator-managed NAS in Austria. PostHog and Sentry are not enabled in this production deployment. Our processing arrangements are covered by the Hetzner data-processing agreement and the data-processing addenda incorporated into Cloudflare’s and Resend’s service terms.
International transfers
Cloudflare and Resend may process personal data outside the EEA, including in the USA. Resend identifies the USA as its primary processing location; the Ireland setting selects the sending region, not all processing locations. Their data-processing agreements include EU standard contractual clauses for applicable restricted transfers and additional safeguards. See Cloudflare’s DPA and Resend’s DPA. You may request information or copies of applicable safeguards from office@solotechai.com. EU jurisdiction is configured for our R2 media bucket; this does not promise EU-only processing by every provider.
For optional social sign-in, Google and Apple may process authentication information internationally, including in the USA. Their notices explain their processing and applicable transfer safeguards: Google sign-in data and Sign in with Apple & Privacy. You can manage the connection in the provider account settings; disconnecting it there does not by itself delete your Golpix account.
For optional push notifications, Expo, Apple and Google may process delivery data outside the EEA, including in the USA. See Expo Privacy, Apple Privacy and Firebase privacy information. Push tokens remain registered while enabled for an active account/session and are removed when unregistered or reported invalid. Undelivered jobs older than 24 hours are discarded; notification messages are sent with a one-hour delivery lifetime.
App updates: The app checks Expo for compatible, digitally signed updates at startup. Requests include an installation identifier, app/runtime version and network metadata such as IP address. This technical processing supports app delivery and maintenance, separately from optional usage analytics (Article 6(1)(f)). Notification infrastructure may also process installation identifiers to provision delivery; enabling reply alerts remains optional. Expo and platform providers may process these data internationally under their privacy notices linked above.
Retention
Account, journal and saved content remain while needed for the service or until deletion. Publications remain until you remove them, delete the account or moderation removes them. Database deletion removes access and queues associated object deletion; temporary storage errors can delay physical removal and are retried.
Scheduled jobs clean expired sessions and verification records. Reports, security records and correspondence may be kept with restricted access for a documented investigation, legal obligation or claim, only as long as that purpose requires.
The backup policy retains the last two snapshots plus 14 daily, eight weekly and 12 monthly snapshots. Older snapshots are pruned after successful backups. Application container logs rotate by size (three files of up to 10 MB per container). System and authentication text logs rotate weekly with four archived copies. The system journal uses storage-based rotation without a fixed age limit; retention therefore depends on log volume and available storage. Records preserved for a specific investigation or legal obligation follow the limited-purpose retention described above. We do not promise immediate deletion from every backup. Restores must honour prior deletion requests. Truly anonymous aggregate statistics may remain.
Export and deletion
Use Profile → Privacy and data or the deletion instructions. Account deletion removes the active profile, synced history, private journal and associated community data, and queues media deletion. It does not automatically remove independent posts by others, lawfully retained report records or external copies. Crew ownership may transfer to another member.
Your rights
Subject to legal conditions, you can request access, correction, erasure, restriction and portability; withdraw consent; and object to legitimate-interest processing, including on grounds relating to your situation. Email office@solotechai.com. Proportionate identity verification may be needed. GDPR requests are normally answered within one month; permitted extensions will be explained.
US state rights may include access, deletion, correction, portability and appeals, depending on applicable law and thresholds. You or an authorised agent can contact us. Ordinary requests are free and we do not discriminate for exercising applicable rights. We do not sell personal information or share it for cross-context behavioural advertising. Browser Do Not Track signals do not change processing; this site has no advertising tracking. Technique scores are practice guidance, not solely automated decisions with legal or similarly significant effects.
Complaints
You can complain to your local supervisory authority without contacting us first. Austria: Datenschutzbehörde, Barichgasse 40–42, 1030 Vienna. Spain: Agencia Española de Protección de Datos.
Age and changes
Golpix is for people aged 16 and over. Do not register if younger. If we learn of child data held contrary to this rule, we will investigate and remove it as appropriate; contact us to report it. We date policy changes and notify material changes. New optional purposes need a separate choice where consent is required.