Trophy — Privacy Policy

How Trophy collects, uses, and protects your information

Terms of Service

This policy is written to apply to Users wherever they are located; Sections 11.1–11.3 set out the specific rights that apply depending on where you live.

1. Who this policy covers and the laws it is built against

This Privacy Policy explains how we collect, use, disclose, and protect information in connection with the Service. Because Trophy is available to users globally, this policy is written to address, as applicable to you:

• the UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (“UAE PDPL”);
• the EU General Data Protection Regulation and the UK GDPR (together, “GDPR”), where you are located in the EU/EEA or UK;
• the California Consumer Privacy Act as amended by the California Privacy Rights Act (“CCPA/CPRA”), where you are a California resident; and
• other applicable data protection laws in your country of residence.

Where laws conflict, we apply the protection that is most favorable to you, to the extent permitted.

2. Information we collect

2.1 Account information

Email address, name, how you sign in (Apple, Google, or email), and any profile information you choose to provide, such as a photo, username, playing hand and side, level, and home club. Trophy uses the same sign-in as the Nua health app: if you use both, they share one account.

2.2 Recordings and content you create

Video and the accompanying audio of matches you record, including footage of other people who appear in frame (see Section 7). The sound is analyzed together with the picture, for example to detect when the ball is hit. We also keep any tags, names, notes, or comments you add, and your answers when the app asks you to review an uncertain moment of a match.

2.3 CV Output — motion, pose, and performance data

When we process a Recording, our computer-vision systems generate data describing each player’s movement, position, body pose, shot type, ball tracking, scores, and statistics. To tell the players in a Recording apart, we also compare their appearance (for example, clothing and build) within that Recording. We do not use facial recognition, and we do not use this data to identify people across different Recordings or to establish who someone is.

2.4 Wearable and health data

If you choose to connect Apple Health (HealthKit) or Android Health Connect, we read only the data types you authorize through that platform’s own permission screen. We currently read:

• heart rate (including heart rate during a recorded match);
• workouts / exercise sessions (type, duration, start and end time);
• active energy burned (calories).

If you use our Apple Watch app, it reads your heart rate and active energy during a match and, with your permission, saves the match to Apple Health as a workout.

Wearable accounts connected through the Nua app. If you use the same sign-in for the Nua health app and connect a wearable account there (Oura, WHOOP, Google / Fitbit, or Garmin), Trophy can read the daily summaries the Nua app has already synced to your account and show them alongside your matches. Depending on your device, these are: sleep (duration, stages, efficiency), heart-rate variability, resting heart rate, readiness or recovery scores, steps, distance and active minutes, strain or Body Battery, respiratory rate, skin-temperature deviation, blood-oxygen saturation (SpO2), VO2 max, and stress. Connecting Garmin asks for your Garmin Connect email and password, which are used only to connect your Garmin account and keep it connected. We read only the data types needed for the features described in Section 3.

2.5 Device and usage data

Device identifiers, app version, crash logs, and general usage/analytics data (for example, which features you use) to help us operate and improve the Service.

3. How we use information

We use information to: provide and operate the Service (recording, storage, playback); generate CV Output and statistics; let you connect and view Wearable Data alongside your matches; operate, secure, and improve the Service, including training and improving our CV/analytics models; communicate with you about your Account; and, for Recordings, CV Output (excluding Wearable Data), and Aggregated Data, for the broader commercial purposes described in our Terms of Service, Section 6, which you agree to when you accept those Terms.

Wearable Data is used only to deliver the specific features that depend on it — see Section 5 below. It is not used for the broader commercial purposes that apply to Recordings and CV Output.

4. Our legal basis for processing (GDPR/UK GDPR)

Where GDPR applies, we rely on the following legal bases:

• Contract — to provide the Service you sign up for (account creation, storing and displaying your Recordings and statistics).
• Consent — for connecting Wearable Data and for any marketing communications you opt into. You can withdraw consent at any time, without affecting processing that already occurred.
• Legitimate interests — for service security, fraud prevention, product analytics, and improving the Service, balanced against your rights; you can object to this processing (Section 11.2).
• Legal obligation — where we must retain or disclose information to comply with law.

Under the UAE PDPL, our equivalent grounds are your consent, necessity to perform our contract with you, and other grounds permitted under Article 4 of the PDPL (such as compliance with legal obligations). The UAE PDPL's Executive Regulations — which will set out further procedural detail (for example, response timeframes for data subject requests) — had not yet been issued as of this policy's last update; we will update this policy once they take effect.

5. Apple Health, Health Connect, and other health data — Limited Use disclosure

Health data is subject to specific platform rules. Our use and transfer of information received from Google APIs, including Health Connect, adheres to the Google API Services User Data Policy, including the Limited Use requirements, and our use of HealthKit data follows Apple’s App Store Review Guidelines. This section explains what that means in practice.

5.1 What we collect

See Section 2.4 above for the specific data types we read from Apple Health, Health Connect, our Apple Watch app, and wearable accounts connected through the Nua app.

5.2 Limited Use commitment

We use Wearable Data, and any data aggregated, anonymized, de-identified, or derived from it, solely to provide or improve user-facing features of the Service that you have requested (for example, displaying your heart rate alongside a match highlight). We do not, and will not:

• sell Wearable Data, or any data derived from it, to any third party;
• use Wearable Data, or any data derived from it, for advertising or targeted/behavioral marketing, including by any third party;
• transfer Wearable Data to any third party except a service provider processing it on our behalf to deliver the feature you requested, for security or legal compliance purposes, or with your explicit prior consent in connection with a merger, acquisition, or similar transaction; or
• allow human review of Wearable Data except where necessary for security purposes, to comply with law, with your explicit consent, or where the data has been aggregated and anonymized for internal operations.

This Limited Use commitment applies independently of, and in addition to, the broader commercial license described in our Terms of Service — that broader license does not extend to Wearable Data.

6. How we share information

• Service providers — companies that host, store, process, and deliver the Service for us under contract: Google Firebase (accounts, database, cloud functions, notifications), Cloudflare R2 (storage and delivery of videos and images), RunPod (cloud GPU processing of Recordings), Resend (email), and Expo (push notifications), plus the analytics providers named in Section 14 once they are in use.
• Third-Party Platforms — Apple and Google, to operate sign-in, purchases, notifications, and the health integrations you authorize.
• Legal and safety — where required to comply with law, legal process, or to protect the rights, property, or safety of the Company, our Users, or the public.
• Business transfers — in connection with a merger, financing, acquisition, or sale of assets, subject to this policy (and, for Wearable Data, subject to Section 5).
• With your direction — if you choose to share a Recording or highlight outside the app.
• Other users, according to your sharing settings — each match has a visibility setting: Only me, Participants, Anyone with the link, or Public. Participants are the people you add or invite to the match. “Anyone with the link” lets anyone who has the link view the match, including on the web without an account; “Public” also lists the match in the in-app Community. A shared match shows its video, highlights, statistics, court positions, the player photos the app cuts from the video, the names given to the players, and the club, court, and date. Your player card (name, photo, username, level, and home club) is visible to other signed-in users. Health data is never shown to other users.
• Email invitations — when you invite someone to a match by email, we store their email address and send them an email on your behalf with your name, the club and date of the match, and a link; your email address is used as the reply-to address.

We do not sell Wearable Data, and we do not sell or share any User's personal information for cross-context behavioral advertising. Where we license or otherwise provide Recordings, CV Output, or Aggregated Data to a partner for valuable consideration in a way that CCPA/CPRA defines as a “sale” or “sharing,” California residents have the opt-out right described in Section 11.3; you can exercise it at any time, and we will not apply it retroactively to disable features that depend on data already processed before you opt out.

7. Recordings that include other people

A Recording you make will often include other identifiable people. We process that information under this Policy in the same way as any other content you submit. As explained in our Terms of Service, Section 5, it is your responsibility, not the Company's, to obtain any consent required from people who appear in your Recordings before you record or share them. If you are a person who appears in someone else's Recording and you have concerns about it, you may contact us at apps@nuawellness.ai and we will respond within 14 days, consistent with Terms of Service Section 5.4.

8. International data transfers

We are based in the United Arab Emirates and use service providers in other countries. Where we transfer personal data out of the EEA/UK, we rely on an adequacy decision, Standard Contractual Clauses (and the UK International Data Transfer Addendum), or another lawful transfer mechanism. Where we transfer personal data out of the UAE, we do so in accordance with Article 22 of the UAE PDPL (for example, to a country with an adequate level of protection, under appropriate contractual safeguards, or with your explicit consent).

Where the GDPR or UK GDPR requires it, we will appoint a representative in the EU and/or UK under Article 27 and name them in this policy. Until then, you or a regulator may contact us directly at apps@nuawellness.ai.

9. Data retention

We retain information for as long as reasonably necessary for the purposes described in this policy:

• Account information — for as long as your Account is active, and for 90 days afterward in case you wish to reactivate it, after which it is deleted or anonymized.
• Recordings and CV Output — for as long as your Account is active, unless you delete specific content sooner; deleted content is removed from active systems within 30 days and from routine backups within 90 days, subject to Section 6.2 of our Terms of Service.
• Wearable Data — for as long as the relevant integration remains connected; deleted within 30 days of your disconnecting it or deleting your Account.
• Aggregated Data — retained indefinitely, because it no longer identifies you.

We may retain information for longer where required to comply with a legal obligation, resolve a dispute, or enforce our agreements.

10. How we protect information

We use administrative, technical, and physical safeguards designed to protect your information, including encryption in transit and industry-standard access controls. No system is completely secure, and we cannot guarantee the absolute security of your information. We will notify affected users and the relevant regulator where required by applicable law (including the UAE PDPL and GDPR breach-notification requirements) in the event of a data breach that creates a risk to your rights.

11. Your rights

11.1 If the UAE PDPL applies to you

• the right to be informed of how your data is processed;
• the right to access your data;
• the right to request correction or erasure;
• the right to restrict or object to processing in certain circumstances;
• the right to data portability, where processing is based on consent or contract;
• the right to withdraw consent at any time;
• the right to lodge a complaint with the UAE Data Office.

11.2 If GDPR/UK GDPR applies to you

You have the rights listed in 11.1, plus the right to object to processing based on legitimate interests (including profiling), the right not to be subject to solely automated decisions with legal or similarly significant effects (see Section 12), and the right to lodge a complaint with your local supervisory authority (in the UK, the ICO).

11.3 If the CCPA/CPRA applies to you (California residents)

• Right to know the categories and specific pieces of personal information we have collected about you, and the categories of sources, purposes, and third parties involved.
• Right to delete personal information we have collected from you, subject to certain exceptions.
• Right to correct inaccurate personal information.
• Right to opt out of sale or sharing of personal information. You can exercise this right at any time by emailing apps@nuawellness.ai with the subject line “Do Not Sell or Share My Personal Information,” or through the control in the app’s privacy settings; we will action a verified request within 15 business days.
• Right to limit use of sensitive personal information (which includes precise location, and may include health and biometric data) to what is necessary to provide the Service.
• Right to non-discrimination for exercising any of these rights.

11.4 How to exercise your rights

Contact us at apps@nuawellness.ai. You can also download a copy of your data from the app at any time; the export is delivered as a link that stays valid for 7 days. We may need to verify your identity before acting on a request. We will respond within the time required by the law that applies to you, and in any case within 30 days.

12. Automated processing and profiling

CV Output (statistics, highlights, performance scores) is generated through automated processing, but is informational only: it does not gate your access to the Service, determine eligibility for anything, or otherwise produce a legal or similarly significant effect on you. If we introduce a feature that uses CV Output to make this kind of decision (for example, automated matchmaking or ranking that restricts access to part of the Service), we will update this policy and provide the safeguards GDPR Article 22 requires, including a right to request human review of that decision.

13. Children's privacy

The Service is intended for Account holders who meet the age requirement in our Terms of Service (18, or the age of majority in your jurisdiction) and is not directed to children. We do not knowingly collect personal information directly from a child to create their own Account. Where a Recording made by an adult User includes a Minor, that information is handled under Terms of Service Section 3.2 — including the parent/guardian consent requirement, the restriction on using a Minor's likeness in marketing without separate consent, and the parent or guardian's right to request access to, correction of, or deletion of that Minor's data by contacting us at apps@nuawellness.ai.

14. Cookies and tracking technologies

The app and any companion website use: (a) strictly necessary cookies/identifiers required for the Service to function (for example, keeping you signed in); and (b) analytics identifiers that help us understand how the Service is used. We do not use non-essential cookies or SDKs for cross-site advertising. Where you are located in the EU/UK, we request your opt-in consent before activating any non-essential analytics identifier, through an in-app or on-site consent prompt, and you can withdraw that consent at any time through your device or browser settings. We will name our analytics providers in this section before they are enabled.

15. Changes to this policy

We may update this Privacy Policy from time to time. Where a change is material, we will give you at least 30 days' notice before it takes effect (for example, by in-app notice or email), consistent with Terms of Service Section 15.

16. Contact us

Questions about this Privacy Policy, or requests to exercise your rights, can be sent to apps@nuawellness.ai.