Privacy policy

Effective 22 October 2026

Who is responsible

Racket Theory helps players record their tennis, understand their equipment and review their playing patterns. Racket Theory is operated from Mexico by Armando Vargas Garcia Figueroa, an individual trading as Racket Theory. The operator is responsible for personal information handled by the service.

Contact address: Avenida Santa Fe 482, Mexico City, 05348, Mexico.

Information used to provide the app

• Account information: your sign-in email and authentication identifiers. Authentication is handled through Supabase when you create an account.
• Your optional tennis profile: playing hand, experience, style, stroke choices, goals, rating, general playing location and equipment preferences.
• Your setups and match records: racket and strings, reference tension, playing time, match or practice details, your written observations and the reviews you choose to save.
• Technical information needed to operate and protect the service: request timing, status codes, account identifiers and network information. Hosting and security providers may process IP addresses.

You can leave optional questions blank or say that you are unsure. Use a general playing area instead of a home address. Avoid names, contact details or private information about opponents and other people. The app does not need your contacts, precise GPS location, microphone or camera for these features.

Racket Theory on Android uses the same information described in this policy. Crash reporting is turned off in the Android app; the crash-report section applies only to the iPhone app.

Comfort and injury-related information

Written reports of pain or injury can reveal health information. Do not include diagnoses, medical records or details you do not want processed. New Player DNA onboarding does not ask for pain. Optional health use has its own unchecked permission; structured health uploads and AI processing require server acknowledgement. You can allow optional health use without enabling AI. Declining leaves unrelated features available. Historical answers are preserved, and free text can still contain information you choose to include. Health-related information is processed only with your explicit consent, which you can withdraw in privacy preferences. Equipment suggestions are not medical advice.

AI-assisted features

When enabled, AI reviews can use the text you submit together with relevant saved questionnaire answers, equipment information, selected match records and earlier confirmed reviews. AI reviews are currently provided by OpenAI in the United States. Under OpenAI's API terms, this information is not used to train their models and may be kept by OpenAI for up to 30 days for abuse monitoring. Adding another AI provider requires a new disclosure and a new permission from you.

Before a live request, the app identifies configured recipients and requests separate permission. The server checks the current permission version, purposes, recipients and health choice before sending data. You can withdraw permission in privacy preferences; withdrawal stops future authorized requests but cannot recall information already sent. The service removes direct identifying fields and unnecessary structured health details from model context; this cannot guarantee that every sensitive detail in free text is detected. This app can connect to the live service. If you explicitly enable AI data sharing, an AI review can send the relevant information described above to the configured recipients shown in the permission screen. Declining AI sharing prevents these AI requests; it does not make signed-in account storage offline. Model conclusions can be wrong; they do not silently change the facts you entered. You choose whether to confirm a proposed Player DNA reading.

Optional analytics and device storage

This version of the app does not use product analytics. If optional analytics is added later, it will stay off until you allow it, and you will be able to withdraw that choice in privacy preferences.

Essential device storage keeps sign-in state, your choices and app data or drafts. Demo and local-preview data can remain on this browser. See Cookies & storage for the categories and controls.

Optional crash reports

If you allow crash reports, the iPhone app sends technical information about an app crash to Sentry, hosted in the European Union. A report contains only the technical location of the crash in the app's code and the app version. It does not contain your answers, notes, account identifier, device details, screenshots or a record of what you did before the crash. Sentry also receives your network address when the report is sent. Crash reporting is off until you allow it, can be withdrawn in privacy preferences, and the choice expires after 180 days. Sentry keeps crash reports for up to 90 days.

Subscriptions

If you subscribe to Plus, Apple (App Store) or Google (Google Play) handles the payment. We never see your card details. The store sends us a purchase record (a purchase code, order number, plan and dates such as start, renewal and end) so we can confirm your subscription and your AI allowance. We store the purchase code encrypted. When you delete your account, these records are deleted, except a minimal record no longer linked to you, kept only so the same purchase can't be claimed by another account.

Why information is processed

Providing the account and features you request can rely on performing the service contract. Proportionate security and abuse prevention can rely on legitimate interests, subject to an assessment of your rights. Optional analytics relies on consent. Any health-related processing needs an applicable sensitive-data condition, such as explicit consent, as well as a general lawful basis. These purposes must remain separate; accepting terms is not consent to tracking.

Providers and international transfers

We use these providers to run the service: Supabase for sign-in and the database (London, United Kingdom); Render for the app server (Frankfurt, Germany); OpenAI for AI reviews (United States); Sentry for optional crash reports (European Union); Cloudflare for the sign-in security check; Apple and Google when you choose to sign in with them; and Apple or Google for subscription payments, depending on where you subscribe. Each provider processes information only to supply its service to us, under its data processing terms. Where information is transferred to another country, such as the United States, it is protected by those terms, including standard contractual clauses where applicable. External merchant pages have their own privacy practices.

How long information is kept

Saved profile and match information is retained to provide your account until you remove it or request account deletion, subject to documented legal or security exceptions. Local drafts remain on the device until cleared. The DNA review implementation keeps the latest confirmed reading and up to ten earlier readings; this count is not a time-based retention policy.

The local implementation purges expired server DNA drafts and rate-limit records. After 90 days it removes account associations from settled AI budget records while retaining the cost ledger. It keeps at most 100 consent-change records per account and removes those records on account deletion. When you request account deletion, your account and the information linked to it are deleted from our database within 30 days. Server logs are kept for up to 30 days. Database backups are kept for up to 7 days and then deleted. Information held by providers follows the periods described above, such as up to 30 days at OpenAI and up to 90 days for crash reports at Sentry. Inactive accounts are kept until you delete them.

Your choices and rights

You can edit your original answers in Settings, decline optional questions, withdraw optional analytics, crash and AI permissions, download server account data from Settings, and request account deletion. Device-only drafts and schedules are separate from the server export. Where applicable, you can request access, correction, erasure, restriction, objection and a portable copy of your personal data. Withdrawal does not undo processing that was lawful before it. You may complain to the supervisory authority in your country of residence, work or the alleged infringement.

For support or a privacy request, email hello@rackettheory.com. Say whether you need help with the app or want to access, correct, export or delete information. We may need proportionate verification to avoid disclosing your information to someone else. Do not send passwords, authentication codes, identity documents or medical records with your initial request. We reply within 20 business days.

Requests under Mexican privacy law

You may request access, rectification, cancellation or objection (ARCO), revoke consent, or ask to limit use or disclosure through hello@rackettheory.com. The operator handles these requests. Include your name, a reply address and what you want us to do. For corrections, describe the change. We will explain the identity or representative verification needed through an appropriate secure channel; do not attach identity documents to your first email.

For an applicable ARCO request, Mexican law generally requires a decision within 20 business days of receipt and implementation within 15 business days after a favorable response. A justified extension may apply. You may seek protection from Mexico’s Secretaría Anticorrupción y Buen Gobierno. These rights do not replace protections available in your country.

Children and policy changes

Racket Theory accounts are for people aged 16 and over. If we learn that an account belongs to someone younger, we will delete it. Updates will appear on this page with a revised date. Material changes to purposes or providers will also be explained in the app before they take effect; new optional purposes require a new choice.