Privacy

How your data is actually handled

This section describes what the software really does, not generic legal boilerplate.

• Your video is written to a temporary folder on the server Caddium runs on. That working copy is deleted automatically 30 minutes after your last action, or immediately if you click "Delete my video now" on the results page. If the analysis was saved to your account, a copy is kept in that analysis's own folder so you can watch it back — see below.
• Body tracking runs locally — the pose-estimation step never sends your video anywhere.
• When a cloud AI provider is used (Anthropic, OpenAI or Google Gemini), a small number of still frames from your swing are sent to that provider to generate the written report. With Gemini, the clip itself can optionally be sent instead — this is off by default (GEMINI_SEND_VIDEO=false). Nothing else about you is sent.
• On free AI tiers (e.g. Google's default free tier), the provider may use submitted content to improve their products. This app shows plainly when you're on a free tier so you can decide whether that trade-off is acceptable for the footage you're submitting.
• If you have an account, a finished analysis stores your name and email address, the full report, highlighted still frames and your uploaded video. Only your account can access them, except when you report an analysis yourself: then Caddium can view that analysis and its video to check it. Videos remain available for 30 days on Free and Starter, and 90 days on Pro. Reports and frames remain until you delete them. You can delete an analysis earlier at any time.
• Only the text is reused in future analyses for the same profile, so the AI can notice patterns over time. Stored images and video are never re-sent to a provider.
• Passwords (if you create an account) are salted and hashed before being stored — the plain password is never written to disk.
• Payments run entirely through our payment provider Stripe; your card or bank details never reach our servers. We only store a Stripe customer id and the link to your purchased packages or an existing subscription, so we can link your payment to your account. Stripe processes your data as an independent controller for payment handling.
• Deleting an analysis, profile or account removes the saved history immediately and permanently — including the stored report, frames and video files on disk, not just the database rows.
• An account is needed to analyse a swing — this ties the analysis to you and saves it.

We count visitors without cookies. From your IP address and browser we make an anonymous code with a secret key that is thrown away every day. Your IP address is not stored, and the next day you can no longer be recognised. We only see totals: how many visitors, how many pages and which website you came from.

For each account we keep track of the steps you take: an upload, an analysis that started or finished and, when a recording could not be measured, the reason why. That shows us where filming gets stuck. It contains no videos or images, we do not share it with any other company, and it disappears with your account and after 6 months at the latest.

For each account we keep your practice week: which practice moments you ticked off and what you answered to “How did it feel?”, and, if you switch the reminder on, the day of the week you want that email. We use this for your practice week and for that reminder. It disappears with the analysis or with your account, and we do not share it with any other company.

For each analysis we also keep the measured skeleton: the series of points of your body, frame by frame, without any picture or video. The Lab (Season pass) uses it. If your video is deleted or its retention period ends, the skeleton stays with that analysis and the Lab keeps working, on a neutral background. If you delete the analysis or your account, the skeleton goes with it. We share it with no other company.

Formal privacy policy Concept — not yet legally reviewed

This is a draft privacy policy, written based on how the software actually works and the GDPR. It has not yet been reviewed by a lawyer. Until then it is provisional — the technical operation described above takes precedence.

Data we process

Video files (both the temporary working copy and, for saved analyses, a retained copy), still frames extracted from video, optional profile/account information (name, email, handicap, handedness), and swing report text as described above. For payments we store a Stripe customer id and the link to purchased packages or an existing subscription. Messages you send through the contact form (your name, your e-mail address and the content of your message) are also kept in our database so we can follow up on your question; if you delete your account, the messages linked to that account are deleted with it.

Legal basis

Personal data is processed on the basis of consent (GDPR Article 6(1)(a)). By uploading a video and creating an account you explicitly consent to the processing described here. You may withdraw your consent at any time by deleting your account and associated data — this can be done directly from the Account page. For users outside the EU: processing follows the same standard, but the specific legal basis may vary by jurisdiction.

Third parties

Still frames (or, optionally, the full video) are sent solely to the configured AI provider to generate your coaching report. Depending on configuration this is Anthropic (privacy policy: anthropic.com/legal/privacy), OpenAI (openai.com/policies/privacy-policy), or Google (policies.google.com/privacy). On free tiers these providers may use submitted content for product improvement; on paid tiers they do not. In addition, Stripe is our payment provider for subscriptions (privacy policy: stripe.com/privacy); see the payments paragraph above. Caddium runs on a server we rent from hosting provider Contabo (Contabo GmbH); the stored videos, still frames and data files live on that server. Emails the app sends (account verification, password reset, notifications and contact form messages) go through our email provider Resend, which for that purpose receives the recipient's email address and the contents of that email — never videos or analysis frames. Beyond that, Caddium shares no data with any other third party.

Your rights

Under the GDPR you have the right to access, correct, delete, port, and restrict processing of your personal data. In practice today: you can delete your video at any time from the results page, and delete your profile/account at any time from the Account page — both take effect immediately. For a data portability request or other GDPR requests: contact us via the contact form or the email address below. We respond within 30 days.

Contact

For privacy questions or GDPR requests: use the contact form or email support@caddium.nl. Caddium is a product of Lars Groeneveld, based in the Netherlands.