Privacy policy

At a glance

Preamble

This policy applies to the For the Real (FT Real) mobile app and to the forthereal.app website. For the Real is a video-analysis golf coaching app: you film your swing, submit it to a professional coach, and receive a tailored analysis.

By using the app, you acknowledge that you have read this policy and accept the processing described, within the limits set by applicable regulations.

1. Data controller

Jules Artale — professional golf coach and content moderator.
Jules Artale (sole proprietorship) — SIREN 813 972 361 / SIRET 813 972 361 00022.
Impasse Saint-Louis, 83270 Saint-Cyr-sur-Mer, France.
Email: privacy@forthereal.app · Website: forthereal.app

2. Data Protection Officer (DPO)

A Data Protection Officer is in the process of being designated. Once appointed, their contact details will be published here and in the app. In the meantime, any question about your data can be sent to privacy@forthereal.app.

3. Data collected

3.1 Identification and account

• Full name
• Email address
• Password (hashed, never stored in plain text)
• Role: student or coach
• Date of birth (verification of the minimum age of 15)
• Date and time of account creation

3.2 Sports and performance data

• Golf handicap (self-reported)
• Round scores entered by the user
• Game statistics: fairways, greens in regulation, putts, etc.
• History of coaching sessions and coach annotations

3.3 Swing videos — sensitive data

Videos are particularly sensitive data: they are comparable to behavioral biometric data insofar as they allow the analysis of the body movement of an identifiable person.

What we collect: swing videos filmed by the user or in their presence, their technical metadata (date, duration, camera angle, file size) and the coach’s annotations.

Consent: explicit, freely given, informed and unambiguous consent is obtained at sign-up (Art. 6(1)(a) and Art. 9(2)(a) GDPR). It covers image rights, the coach’s access to the videos solely for coaching purposes, and their retention for the periods set out in section 7.

What we never do: your videos are never published on any external medium (social networks, website, marketing materials) without separate, documented consent; never shared with any third party other than the designated coach; never used to train artificial intelligence without specific consent.

3.4 Location data

With your consent (which you can withdraw at any time in the app’s settings or your phone’s settings), the app collects your precise GPS location, only while the app is actively in use (never in the background). It is used exclusively for the GPS caddie: calculating distances to the green and hazards, club recommendations and displaying the current hole. Your location is processed on your device, is not kept in a movement history and is never passed on to third parties for advertising purposes.

3.5 Community content (For Real network)

• Posts, photos and videos shared on the For Real feed
• Comments and “likes”
• Friendships, blocks and reports
• Conversations with the chat assistant (sent in minimized form to our AI provider to generate the response, see section 6)

3.6 Subscription data

Subscriptions are managed through RevenueCat: we collect your subscription status (active, expired, trial), its type (monthly, annual) and the transaction history. Your banking details never pass through us: they are handled exclusively by Apple’s App Store.

3.7 Technical data and logs

• IP address at sign-in
• Device type, operating system, app version
• Error and performance logs
• Sign-in and sign-out timestamps
• Significant actions (video submission, coaching request, etc.)

3.8 Notifications

If you turn them on (never without your consent: the app asks you, and you can turn them off at any time in the app or iPhone Settings), we store your device’s push token, its platform and your language. It is used only to tell you about a new review, a new message or, for the coach, a new video. The content of your messages never appears in a notification. Legal basis: your consent (Art. 6(1)(a) GDPR). Retention: until you turn notifications off, sign out or delete your account (at most 180 days without use). Notifications are sent directly through Apple Push Notification service (APNs), with no other intermediary.

4. Legal bases

5. Purposes

1. Creating and managing your account: identification, authentication, personal settings.
2. Providing the coaching service: coach access to your videos to carry out analyses and recommendations.
3. Tracking your progress: statistics, scores, session history.
4. Managing subscriptions: access to features according to the plan you subscribed to.
5. Moderating content: checking that videos comply with the rules of use (section 8).
6. Securing the platform: detecting unauthorized access, preventing fraud.
7. Providing support: handling your requests and complaints.
8. Meeting our legal obligations: accounting, tax and regulatory.

6. Recipients of the data

6.1 Internal access

Jules Artale (coach and moderator) has access to profile data, sports data, videos and annotations, strictly for the purposes of coaching and moderation, and in accordance with the principle of least privilege.

6.2 Technical processors

6.3 What we do not do

We do not sell, rent or otherwise commercialize your personal data. We do not share it with any advertising partner.

7. Retention periods

7.1 Active account

The purge of videos older than 24 months is automated and runs periodically on the server. This period can be configured by the app’s administrator; any change will be reflected in this policy within 30 days.

Clarification on video retention: the 24-month period runs from the upload of the video, regardless of the account’s status. It is brought forward neither by the account being made dormant nor by the purge of an inactive account (section 7.2); only the deletion of your account at your request (section 7.4) erases them immediately.

Subscriptions and accounting records: accounting records and proofs of payment are issued and held by Apple and RevenueCat, which act as payment intermediaries. On our side, we only keep the status of your subscription (active, trial, access granted by the administrator and its expiry date), for accounting integrity purposes.

7.2 Inactive accounts

An account is considered inactive when no sign-in or interaction has been recorded for 24 months (default period, configurable, minimum 12 months). Simply signing in again before the period expires resets the inactivity counter to zero.

No prior notice: at present, no warning is sent before the purge of an inactive account. The app does not yet have a system for sending reminder emails or notifications. We prefer to tell you this rather than promise a warning you would not receive. Introducing prior notice is being considered; this policy will be updated once it is in place.

What the purge of an inactive account erases, and what it does not:

1. Erased: all the personal data in your profile — last name, first name, email address displayed in the app, username, profile photo, date of birth, language preference, consent choices, and your entire golf profile (handicap index, gender, usual tee, measured distances, typical misses, goals, availability, reference scores). Your name is replaced by “Deleted user” on content left on other members’ pages. The media you posted on For Real and your profile photo are deleted from storage.
2. Kept but dissociated from your identity, and hidden from other users: your posts, comments, rounds, scores and videos are not erased at this point. Your swing videos follow their own deadline (section 7.1): they are deleted 24 months after their upload, not on the date the account was made dormant.
3. Kept, with justification: your technical identifier, the account creation date and the date of your last activity (proof that the purge criterion was met), the timestamped proof of your consents (Art. 7(1) GDPR) and the status of your subscription (accounting integrity).
4. Your real email address remains in the authentication service: the automatic purge neutralizes the address displayed in the app, but does not delete the authentication account itself. Deleting it is a manual operation. You can obtain it at any time, either by deleting your account yourself from the app (section 7.4), or by writing to privacy@forthereal.app.

7.3 Withdrawal of consent to image rights

• All videos associated with the account are deleted within 30 days at most.
• An acknowledgment of receipt is sent to you within 72 hours.
• A confirmation of deletion is sent to you once completed.

7.4 Deleting your account at your request

You can delete your account at any time from the app (Profile > My data & privacy > Delete my account) or by writing to privacy@forthereal.app. This deletion is immediate and irreversible, and it goes further than the automatic purge in section 7.2:

• your authentication account is actually deleted, including your email address;
• the deletion extends to your profile, your videos and the coach’s comments attached to them, your rounds and scores, your posts, comments and likes, your friendships and your golf bag;
• your files are deleted from storage: swing videos, media posted on For Real, profile photo;
• if your account was created with “Sign in with Apple”, the authorization granted to the app is revoked with Apple;
• the technical log of billing events concerning you is erased during the next run of the automatic purge.

What remains after deletion, and why: the comments you left on other members’ posts are not erased — they are part of a third party’s discussion thread — but are anonymized and displayed as “Deleted user”; the proof of your consents, which we must be able to produce (Art. 7(1) GDPR), is detached from your account rather than deleted — only an anonymous record remains (timestamp, accepted version numbers, choices made) that can no longer identify you; the accounting records relating to your subscriptions, kept for 10 years (Art. L. 123-22 of the French Commercial Code) by Apple and RevenueCat as payment intermediaries, with no copy on our side; and anonymized data that can no longer identify you (aggregate statistics).

7.5 Summary: the two erasure paths

8. Content moderation

8.1 Role of the moderator

Jules Artale, the sole moderator, reviews submitted videos and content to ensure they comply with the rules of use, to maintain a respectful environment and to protect users from any inappropriate or unlawful content.

8.2 Prohibited content

• Sexual content or content suggesting nudity
• Violent or dangerous content
• Content that undermines human dignity: harassment, discrimination, hate speech
• Content that infringes the image rights of third parties filmed without their consent
• Content involving minors submitted without verified parental authorization
• Content unrelated to golf or that diverts the app from its purpose
• Content that infringes the rights of third parties: copyright, trademarks, privacy

8.3 Procedure and timeframes

8.4 Appeals and reporting

Any removal is notified by email with its reason. You can contest it at privacy@forthereal.app; the final decision is issued within 7 business days. Any user can also report inappropriate content from the app (“Report” function) or by email; each report is handled as quickly as possible.

9. Security

• Encryption in transit: all communications are encrypted using TLS 1.3.
• Encryption at rest: AES-256 encryption of data and video files, with keys managed by AWS KMS.
• Videos: stored in a private space, accessible only via a temporary signed URL (1 hour maximum), no public or permanent URL.
• Access control: Row Level Security enabled on all tables — each user can only access their own data; administrator access is logged.
• Authentication: hashed passwords, sessions with a limited lifetime, detection of suspicious attempts.
• Organization: production access limited to Jules Artale, documented incident response procedure, regular review of permissions.

In the event of a data breach likely to result in a risk to your rights, we notify the CNIL within 72 hours (Art. 33 GDPR) and inform you without undue delay if the risk is high (Art. 34 GDPR).

10. Transfers outside the European Union

All application data (database, videos, files) is hosted by Supabase, on AWS eu-west-1 (Ireland): no transfer outside the EU takes place for this processing.

The RevenueCat, Resend, Anthropic and ElevenLabs services are based in the United States. These transfers are governed by the standard contractual clauses approved by the European Commission (Art. 46(2)(c) GDPR). The data transmitted is limited to what is strictly necessary; no video is transmitted to RevenueCat.

Apple processes data in connection with the distribution of the app, the management of payments and the delivery of notifications (APNs), in accordance with its own privacy policy and developer agreement.

11. Cookies and trackers

forthereal.app website: this website is a static showcase. It sets no advertising cookies, uses no audience measurement trackers and carries out no profiling. Only cookies strictly necessary for authentication may be set when you sign in to the administration area.

Mobile app: the app does not use cookies in the browser sense. It uses the device’s local storage to keep your session, your display preferences and a temporary cache. This data stays on your device. RevenueCat collects limited analytics data relating to subscriptions (conversions, billing events) — RevenueCat privacy policy.

12. Protection of minors

The app is restricted to people aged at least 15 years. In accordance with Article 8 of the GDPR and the French Data Protection Act (loi Informatique et Libertés), the consent of a minor under 15 is only valid if it is given or authorized by the holder of parental responsibility.

If a minor under 15 signs up without verifiable authorization:

1. the account is suspended immediately pending regularization;
2. an email is sent to the account’s address requesting proof of parental authorization;
3. without a response within 14 days, the account and all associated data are permanently deleted;
4. with valid proof, the account is reactivated and the parental authorization recorded.

Any report can be sent to privacy@forthereal.app; it is handled as quickly as possible.

13. Your rights

• Access (Art. 15): obtain confirmation that data concerning you is being processed and receive a copy of it.
• Rectification (Art. 16): correct inaccurate or incomplete data — most of it can be edited directly in your account settings.
• Erasure (Art. 17): request the deletion of your data. This right expressly includes your videos, which are deleted within 30 days at most.
• Restriction (Art. 18): request that processing be frozen, with the data kept but not used.
• Portability (Art. 20): receive your data in a structured, machine-readable format. The JSON export available in the app (Profile > My data & privacy > Export my data) contains your full profile (identity, username, date of birth, preferences and your entire golf profile), the timestamped history of your consents, your rounds and hole-by-hole scores, the metadata of your videos and the coach’s comments, your posts, comments and likes, and your friends list. Files are referenced in it by their storage path and can be exported on request in their original format.
• Objection (Art. 21): object to processing based on legitimate interest (security logs).
• Withdrawal of consent (Art. 7(3)): withdraw your consent at any time (videos, image rights), without affecting the lawfulness of prior processing.
• Automated decision-making (Art. 22): no fully automated decision producing legal effects is made. Every swing analysis is carried out or approved by Jules Artale.

How to exercise your rights: by email to privacy@forthereal.app, in the app via Settings > My data & privacy, or by post to Impasse Saint-Louis, 83270 Saint-Cyr-sur-Mer. We acknowledge receipt within 72 hours and respond within one month, which may be extended by two months for complex requests (you would be informed of this within the first month). Proof of identity may be requested. To delete your account, see the Delete my account page.

14. Complaint to the CNIL

If you believe that the processing of your data infringes your rights, you can lodge a complaint with the Commission Nationale de l’Informatique et des Libertés (CNIL, the French data protection authority) — 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France, phone +33 1 53 73 22 22, www.cnil.fr. We nevertheless encourage you to contact us first so that we can resolve your request amicably.

15. Changes to this policy

We may amend this policy to reflect changes in our practices, in regulations or in the app’s features. In the event of a substantial change, you will be notified by email and/or in the app at least 30 days before it takes effect, the update date at the top of this document will be changed and a summary of the changes will be provided. The version history is available on request.

16. Final provisions

This policy is governed by French law and European Union law, in particular the GDPR (EU) 2016/679 and amended French Law No. 78-17 of January 6, 1978. It is written in French, and the French version prevails in the event of a translation.

Contacts: privacy@forthereal.app · Impasse Saint-Louis, 83270 Saint-Cyr-sur-Mer · in the app, Settings > My data & privacy. See also the legal notice and the terms of use.