Privacy Policy

Last updated: 22 September 2026

Who is responsible

Name and address: Tengizi Bardavelidze (contact by email, see below)
Email: downsetteam@gmail.com
EU representative (GDPR Art. 27): none appointed. Send any data protection request to the email above.

The short version

• Downset has no account and no sign-in. We never ask for your name or phone number. The only place that asks for an email address is the contact form, and there it is optional.
• Your reps, answers, progress, plans, games and settings stay on this iPhone.
• To check whether you have Downset Pro, the app asks our subscription service RevenueCat. It uses a random ID created for this install, never your name, your email or your Apple Account. RevenueCat's software also sends the identifier iOS gives Downset on this iPhone (the identifier for vendor, not the advertising identifier), your preferred languages and the app's App Tracking Transparency status, which can never say that tracking is allowed, because Downset never asks for it.
• If you are 16 or older, Downset can send anonymous usage data: which screens you open and which buttons you tap, including whether a purchase or a creator code went through, under a random install ID. It never includes your nickname, your jersey number, your answers or your plans. It is off until you say yes: Downset asks you once, right after the age check, and you can change your answer at any time in Profile. Under 16 it is always off and you are not asked.
• If a creator sent you and you type their creator code, we record that this install came from that code, so we can pay the creator fairly. A creator code never changes your price.
• If you write to us with the contact form in Profile, we receive your message, the topic you picked and your email address if you give one, so we can answer you. Your app version, iOS version, device model, language and Support ID (your random RevenueCat ID, so we can find your purchase) come with it only if the switch "Attach app and device details" is on when you send. Players under 16 get our email address instead of the form.
• So that we can change texts, colors and a few settings in the app without an update, the app downloads a small settings file from our website when it opens or comes back to the screen, at most once every 6 hours. It sends nothing about you with it: no ID, no cookie, only what every connection carries, such as the IP address.
• Downset has no advertising and no tracking. We do not sell your data and we do not share it with data brokers.
• You can export your profile, training data, plans and settings as a file, together with the random install ID and the creator code, and delete all of it at any time in Profile › Your data.

What Downset stores on your iPhone

• Player profile: jersey number and nickname (both optional), tracks, level, reminder times, quiet hours and app settings.
• Training data: the looks you answered, your answers, reaction times, and review schedules for spaced repetition.
• Plans: tasks, checklists, reminders, practice days, games and game-day timelines that you create.
• Age range: only an age band (13 to 15, 16 to 17 or 18+) and how it was determined. Downset never stores your birthday.
• Subscription status: whether Pro is active and until when, so the app opens unlocked even without a connection.
• Random install ID: a random number created by Downset on this iPhone. It is not a device identifier and not an advertising identifier. It is deleted when you delete the app, and "Delete all data" replaces it with a new one.
• Usage data waiting to be sent: if usage data is on, a short queue of events waits on the iPhone until it is sent.
• Creator code: if you entered one and it was accepted.
• Messages waiting to be sent: if a message from the contact form cannot reach us, for example without a connection, it waits on the iPhone and Downset sends it again on its own when the app opens or comes back to the screen. It keeps its random message ID, so a message sent twice reaches us once. At most 3 messages wait, and one that is still waiting after 7 days is deleted unsent.
• Settings file: the newest copy of the settings file from our website (see "This website"). It holds only texts, colors, switches and numbers for the app, nothing about you.

This data is saved in the app's private storage on your device. It is included in your device backups (iCloud or computer) according to your own Apple settings, except the usage data waiting to be sent. Everything except what the sections "Anonymous usage data", "Creator codes", "Subscriptions and RevenueCat" and "Contact form and email" describe stays on your iPhone.

Anonymous usage data

What it is for. To see which screens are used and where players give up, for example how many players finish setup or reach the Pro screen, so we can fix what does not work. We look at totals, never at one player.

What is sent, and nothing else:

• the random install ID described above,
• whether the event is a screen or an action,
• the name of the screen or action, from a fixed list built into the app (for example "today" or "paywall"). Actions include, for example: the first start of a new install; setup started, skipped, started over or finished; a set started, finished or quit; where the Pro screen was opened from and a switch between its plans; a purchase started, cancelled, or completed as a free trial or a paid subscription; a tap on Restore; a creator code tried or skipped and whether it was accepted,
• the position of the event within the current app session,
• the time of the event.

What is never sent: your nickname, jersey number, team, answers, reaction times, streaks, plans, games, task titles, age band, language, device model or app version, and no advertising or device identifier. The app cannot send free text as an event name: the list is fixed in the app, and our database accepts only short keys made of lowercase letters, digits and underscores.

Where it goes. To our own database at Supabase (see "Our database at Supabase" below), hosted in Frankfurt, Germany.

When it is on:

• Players under 16: always off. The switch in Profile is shown locked. Nothing is sent before Downset knows whether you are 16 or older.
• Everyone 16 or older, in every country: off until you agree. Downset asks once, right after the age check ("Help us make Downset better?"), and "Not now" is as easy as yes. You can change your answer at any time with "Share usage data" in Profile.
• Before you answer, the events of the first screens (opening the app, the welcome and the age check) are kept only in the iPhone's working memory. Nothing is stored on the iPhone and nothing is sent. If you say yes, they are sent with the rest; if you say no or close the app, they are gone.

Switching it off stops all new events at once and deletes the events on your iPhone that were not sent yet. Events already received stay in our database until they are deleted automatically (see "How long data is kept").

Why we call it anonymous. It contains nothing that says who you are, and we never try to find out. Under the GDPR, data with a random ID still counts as pseudonymous personal data, so we treat it with the same care as personal data.

Creator codes

Downset works with creators, for example athletes on Instagram or TikTok. A creator gets a link (such as https://downset-two.vercel.app/go/CODE) and a code. You can type a code during setup or later in Profile › Creator code. Entering a code is optional.

What a code does: it tells us which creator sent you, so we can count the players and subscriptions each creator brought and pay the creator their share. It never changes your price, never gives a discount and never unlocks anything.

What is sent when you tap "Use code":

• to our database at Supabase: the code and the random install ID. Our database adds the time. It answers whether the code exists, and it keeps only the first code for an install.
• to RevenueCat: the same code, stored with your random RevenueCat ID as a "referral code" and as the "campaign" field, so that purchases can be credited to the creator.

The code names the creator, not you. Many players share the same code and the code cannot tell them apart.

Players under 16 do not see the code field, and no code is ever sent from their iPhone.

Changing your mind. "Delete all data" removes the code from this iPhone and from RevenueCat. The record in our database stays until it is deleted automatically, because the creator's count and payment rely on it. It holds only the code, the random install ID and the time.

Subscriptions and RevenueCat

Downset Pro is sold through Apple. To show the current prices, to unlock Pro after a purchase or a restore, and to check on each launch whether your subscription is still active, Downset uses RevenueCat, Inc., 1032 E Brandon Blvd #3003, Brandon, FL 33511, USA. RevenueCat works for us as a processor, bound by our instructions and its data processing agreement.

RevenueCat receives:

• a random app user ID created on your iPhone (no name, no email, no Apple Account),
• the identifier for vendor (IDFV) that iOS gives Downset on this iPhone. It is not the advertising identifier, and iOS keeps it the same until every app from our developer account is removed from the iPhone. RevenueCat's software sends it with every request,
• your preferred languages from iOS Settings (the first three, for example "en_US"),
• the purchase and subscription records Apple reports for that ID (product, dates, trial, renewal, cancellation, refund),
• the app version, iOS version, device model and App Store country, and technical details of the app build, such as whether it is a test build,
• the app's App Tracking Transparency status, which RevenueCat's software reads from iOS on its own. Downset never shows the tracking prompt, so this status can never say that tracking is allowed: it is sent as "notDetermined", "denied" or "restricted",
• the IP address of the connection,
• your creator code, only if you entered one (see "Creator codes").

Purpose: to validate purchases, unlock Pro and prevent fraud, and, where you entered a creator code, to credit the purchase to that creator. Legal basis: Art. 6(1)(b) GDPR for the subscription check, because we cannot sell you a subscription or give you what you paid for without checking it, and Art. 6(1)(f) GDPR for the creator code (see "Legal bases"). This check runs for every player, also on the free version and from the first launch, before the age check, because the app has to know whether Pro is active.

RevenueCat is in the USA. The transfer is covered by the EU Standard Contractual Clauses in RevenueCat's data processing agreement (https://www.revenuecat.com/dpa). RevenueCat's privacy policy: https://www.revenuecat.com/privacy.

Downset never gives RevenueCat the advertising identifier (IDFA) and never switches on RevenueCat's option to collect further device identifiers. The identifier for vendor and the tracking status listed above are sent by RevenueCat's software on its own. Downset never gives RevenueCat your nickname, jersey number, training data or plans.

From RevenueCat to our database. When something happens to a subscription (a trial starts, a purchase, a renewal, a cancellation, a refund), RevenueCat sends a message about it to our database at Supabase. We keep from it: the kind of event, whether it was a trial or a trial that turned into a paid subscription, the reason for a cancellation, the price in US dollars and in the currency you paid, the currency, the store's commission, the store, whether it was a test purchase, the time, RevenueCat's ID for the event (so no event is counted twice) and the creator code, if there is one. We do not keep the product, your RevenueCat ID, your IP address or your country from it. These records hold no name, email, Apple Account or install ID. Because they keep RevenueCat's ID for the event and its time, we can link a record to a customer at RevenueCat, where the same event is stored. We use it to see how many players try and buy Pro, and to work out what each creator earned.

Contact form and email

In Profile, under Support, "Contact us" opens a form to write to us from inside the app. The form sends, and nothing else:

• the topic you pick (a bug, an idea, a question, your subscription or something else) and your message,
• your email address, only if you type one in, so that we can answer you,
• a random message ID, made on your iPhone for this one message and used for nothing else: if a message is sent again after a lost connection, we keep it only once,
• only while the switch "Attach app and device details" is on: the app version and build number, the iOS version, the device model (for example "iPhone17,1") and the language the app runs in (English or German), so that we can understand a problem.
• only while the same switch is on: your Support ID, the random ID our subscription service RevenueCat uses for this install (see "Subscriptions and RevenueCat"), so that we can find your purchase there, for example when a purchase did not unlock Pro. It goes as the last line of your message, and the form shows it under the switch, with a Copy button. It is not sent otherwise.

The app and device details and the Support ID are your choice. The form has this switch, and while it is on, the lines under it show the details and the Support ID it will attach. They go with your message only while the switch is on; switch it off and the message goes without them. The form never sends the random install ID, and sending a message is not recorded in the usage data, so a message is never stored under that ID and we never connect a message with usage data. Without the Support ID, a message cannot be connected with a purchase or a creator code either. With it, we can look up your subscription at RevenueCat, where we also see the creator code if you entered one. Please do not write about other people in a message.

Where it goes. The message is stored in our database at Supabase in Frankfurt, Germany (see "Our database at Supabase"). From there it is sent to our mailbox as an email through Resend, with your email address as the reply address if you gave one. Resend is run by Plus Five Five, Inc., 2261 Market Street #5039, San Francisco, CA 94114, USA, which works for us as a processor under its data processing agreement (https://resend.com/legal/dpa). The transfer to the USA is covered by the EU Standard Contractual Clauses in that agreement. Resend's privacy policy: https://resend.com/legal/privacy-policy. Resend keeps each email it delivers, with its content and its delivery log, for 30 days and then deletes it. That is Resend's retention on each of its standard plans, the free plan we use included (https://resend.com/docs/knowledge-base/account-quotas-and-limits). Our mailbox, downsetteam@gmail.com, is a Gmail account at Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA, which stores the email under its own privacy policy (https://policies.google.com/privacy). Google LLC is certified under the EU-U.S. Data Privacy Framework, so the transfer to the USA rests on the European Commission's adequacy decision for that framework (Art. 45 GDPR). Where the framework does not apply, Google uses the EU Standard Contractual Clauses (https://policies.google.com/privacy/frameworks).

What it is used for. Only to read your message, answer it and fix what you reported. Your email address is used only to answer you. We never add it to a mailing list, never use it for advertising and never pass it on.

Players under 16 do not see the form. Profile gives you our email address instead, and tapping it opens your own email app with a message to us whose subject holds only the app name and version. If you send it, we receive your email address and what you wrote, like any email.

Writing to us by email. If you write to downsetteam@gmail.com, we receive your email address and what you write in the same mailbox, and use them only to answer you.

Our database at Supabase

The anonymous usage data, the creator code records, the subscription events from RevenueCat and the messages from the contact form are stored in our own database, run for us by Supabase Pte. Ltd., 65 Chulia Street #38-02/03, OCBC Centre, Singapore 049513. Supabase works for us as a processor under its data processing agreement (https://supabase.com/legal/dpa). Our database is hosted in the AWS region eu-central-1 in Frankfurt, Germany. Where Supabase staff or its sub-processors in other countries (such as Singapore or the USA) can access it, the transfer is covered by the EU Standard Contractual Clauses in that agreement. Supabase's privacy policy: https://supabase.com/privacy.

Like any server, Supabase sees the IP address of each request in order to answer it, and keeps it in its own technical logs for a short time. Our tables never store an IP address.

Only we can read the database. We look at it through a password-protected page on our website that shows usage data and creator codes only as totals per screen and per creator code, never per player, and lists the messages from the contact form so that we can answer them.

Age check

Downset is for players aged 13 and older. During setup it checks your age in one of two ways, depending on the iOS version of your iPhone:

• On iOS 26 and later, Downset asks your Apple Account for an age range through Apple's Declared Age Range feature. Apple shares only a range, never your date of birth. If no range is shared, or if you would rather type it, you can pick your birth month and year instead.
• On iOS 18, Apple's Declared Age Range feature does not exist, so Downset asks for your birth month and year straight away. This is your own statement; nobody checks it.

Whenever you pick a month and year, Downset calculates the age band on the device and discards the month and year immediately. Either way Downset keeps only the age band (13 to 15, 16 to 17 or 18+) and how it was determined (shared by Apple or picked by you), on this iPhone. The age band is never part of the usage data and is never sent to us, to RevenueCat or to anyone else.

If you pick a month and year under 13, Downset asks you once to confirm the date. If the check shows that you are under 13, Downset keeps a note on this iPhone that the app cannot be used yet, together with the month in which the note expires (the month after your 13th birthday month, or 12 months later if Apple only reported "under 13"). The note contains no other information. It is kept in the iPhone's keychain, so it stays even if you delete the app or use "Delete all data", and it is removed automatically when it expires or, on iOS 26 and later, when Apple later shares an age range of 13 or older.

Players under 16 use Downset in device-only mode: anonymous usage data, creator codes and the contact form are switched off (Profile gives you our email address instead), and so will be any future feature that would need a parent's consent (such as sync or sharing). The subscription check described above is not one of them: it is needed to run the app, so it also runs for players under 16 and sends RevenueCat only what "Subscriptions and RevenueCat" lists, including the identifier for vendor and your preferred languages, but never a creator code, your profile, training data or plans. The download of the settings file (see "This website") also runs for players under 16, because it sends nothing about you.

When Apple shares an age range, Downset also stores how Apple determined it (for example self-declared or confirmed by a parent). This stays on your iPhone.

Legal bases

• Running the app (profile, training data, plans, reminders): Art. 6(1)(b) GDPR, providing the service you asked for.
• Subscriptions (the check through RevenueCat, and the subscription events RevenueCat sends to our database): Art. 6(1)(b) GDPR, performing the subscription contract, and Art. 6(1)(f) GDPR, our legitimate interest in knowing how the app sells.
• Usage data: your consent, Art. 6(1)(a) GDPR, and for storing and reading the events and the install ID on your iPhone § 25(1) TDDDG (in Germany) or the equivalent national rule (in the UK, PECR). You give it by saying yes when Downset asks during setup or by switching on "Share usage data" in Profile, and you withdraw it by switching it off. Withdrawing does not affect what was sent before.
• Creator codes: our legitimate interest in knowing which creator sent a player and paying creators fairly, Art. 6(1)(f) GDPR. The code is only sent when you type it and tap "Use code".
• Contact form and emails: Art. 6(1)(b) GDPR where your message is about using the app or your subscription, otherwise Art. 6(1)(f) GDPR, our legitimate interest in answering questions and fixing what does not work.
• App and device details and the Support ID in a contact message: your consent. Reading them on your iPhone to send them rests on § 25(1) TDDDG (in Germany) or the equivalent national rule, and using them to understand your message and to find your purchase rests on Art. 6(1)(a) GDPR. You give it for a message by sending it with the switch "Attach app and device details" on, and you refuse it by switching it off: the message then goes without them. Switching it off later does not affect a message already sent; to have that one deleted, see "Your rights".
• Age check and the under-13 note: Art. 6(1)(c) GDPR (legal obligations to protect children) and Art. 6(1)(f) GDPR (our legitimate interest in keeping the app to its age rating).
• This website and the settings file (delivering the pages and the settings file, and Vercel's server logs): Art. 6(1)(f) GDPR, our legitimate interest in delivering the site and the file, keeping them secure and changing texts and colors in the app without an update.
• Storing and reading other data on your device: this is strictly necessary to provide the app and the features you requested (§ 25(2) No. 2 TDDDG). Downset stores nothing on your device for any other purpose.

How long data is kept

• Your profile, training data, plans and settings stay on your iPhone until you delete them in Profile › Your data or delete the app.
• The under-13 note expires as described above.
• An exported file exists only while the Export screen is open, unless you save or send it somewhere yourself.
• The copy of the settings file on your iPhone is replaced by each newer copy and removed when you delete the app. It holds nothing about you.
• Anonymous usage events in our database are deleted automatically 180 days after they arrive. Counters that limit how often one install can send (they carry the random install ID) are deleted after 3 days.
• Creator code records (the code, the random install ID and the time) are deleted automatically 400 days after they arrive. We need them that long so that the first renewal of a yearly subscription can still be credited to the creator.
• The subscription events in our database (see "From RevenueCat to our database") are kept as long as we need them to pay creators and for our accounting, at most 10 years, then deleted. If you ask us to delete your data, we delete them together with your record at RevenueCat, unless the law requires us to keep them.
• Messages from the contact form (the message, the topic, the message ID, the reply address and, if you attached them, the app and device details and the Support ID) are deleted automatically from our database 12 months after they arrive. Resend deletes its copy of the email 30 days after sending it. The email in our mailbox, and any email you send us directly, is kept only as long as we need it to answer you and to handle what you asked for, then deleted.
• Purchase and subscription records at RevenueCat are kept for as long as they are needed to manage the subscription and to meet legal record keeping duties, then deleted.

Apple services

Downset uses features of iOS and the App Store provided by Apple, which processes data under its own responsibility and privacy policy (https://www.apple.com/legal/privacy/):

• Purchases: Apple takes the payment, bills your Apple Account and handles renewals, cancellations and refunds. We never see your payment details.
• Declared Age Range (iOS 26 and later): Apple shares an age range from your Apple Account when you agree. On iOS 18 this feature does not exist and the age check uses only the month and year you pick (see "Age check").
• Ratings: Downset may show Apple's own rating prompt, and Profile › Rate Downset opens the App Store page for writing a review. Apple handles both; Downset itself sends nothing, and we only see the ratings and reviews that the App Store shows publicly.
• Notifications: reminders are scheduled locally on your iPhone.
• Crash reports and App Analytics: if you chose in iOS Settings to share analytics with app developers, Apple may pass anonymous crash reports and usage statistics to us through App Store Connect.

Notifications

Reminders are local notifications scheduled on your iPhone. They are created only after you allow notifications, and you can turn them off at any time in Profile or in iOS Settings. "Coach's fact" notifications are off until you switch them on. If you start a free trial with the day 5 reminder switched on, one local notification reminds you before the trial ends.

Asking a parent

The "No card? Ask a parent" link on the Pro screen opens the iOS share sheet with a short message and the App Store link. You choose who gets it and how. Downset sends nothing itself and does not see who you picked.

Data sources in the app

Football statistics shown in the app are bundled with the app (see Profile › Data sources & licenses). Showing them does not send any data from your device.

Your rights

Under the GDPR you have the right to access, rectify, erase and port your data, to restrict or object to processing, to withdraw a consent at any time, and to lodge a complaint with a supervisory authority. For the data on your iPhone you can exercise most of these rights directly in the app: export your data (access and portability), edit your profile (rectification), switch usage data off (withdrawal) and delete all data (erasure).

The export is one JSON file with your profile (including your age range), training data, plans and settings, and a "device" section with the random install ID, your creator code and your usage data choice. It does not contain usage events or contact form messages still waiting to be sent: each is either sent within 7 days or deleted unsent. It also leaves out the saved Pro status, which only copies what RevenueCat reports.

"Delete all data" clears this iPhone, deletes unsent usage events and messages and gives the app a new random install ID, so nothing later sent to our database can be joined to what was sent before. It also removes your creator code from RevenueCat, so a later purchase is not credited to that creator. Your RevenueCat ID stays the same, so your subscription keeps working, and the identifier for vendor, which iOS controls, stays the same too. It also switches usage data back off, and Downset asks again the next time you set the app up. It does not cancel a subscription, and it does not erase records already in our database or your purchase records at RevenueCat.

Our database stores usage events and creator code records under the random install ID. In the app, that ID appears only in the export file, so we usually cannot tell which records are yours. If you send us the install ID from your export, we delete the records stored under it; otherwise they are deleted automatically on the schedule above. Messages from the contact form are not stored under that ID: to have one deleted sooner, write to us from the email address you gave in it, or tell us when you sent it and what it was about. For records linked to a purchase, write to downsetteam@gmail.com and include the order ID from Apple's purchase receipt, and we will find your record at RevenueCat and delete it together with the matching subscription events in our database, unless the law requires us to keep them.

Supervisory authority: the data protection supervisory authority of the EU member state you live in; in Germany, the data protection authority of your federal state.

Third parties

We share data only with the services named in this policy (Apple, RevenueCat, Supabase, Resend, Google for our mailbox, and Vercel, which hosts our website and the settings file the app downloads). Each of them is bound by its own privacy policy, and each gives your data the same or equal protection as this policy: RevenueCat, Supabase and Resend work for us as processors under a data processing agreement; Vercel and Google are certified under the EU-U.S. Data Privacy Framework; and Apple processes its part under its own responsibility and privacy policy, for people in Europe through Apple Distribution International Limited in Ireland, with its transfers outside Europe covered by the EU Standard Contractual Clauses. We do not sell data, we do not share it for advertising, and we do not use any advertising or analytics SDK other than our own anonymous usage data described above.

This website

This privacy policy, the terms, the imprint and a support page are also published on the web, together with the creator links, our password-protected statistics page and the settings file the app downloads. That website is hosted by Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA. Like every web host, Vercel receives the IP address and browser details of each visit in order to deliver the page and keep the service secure, and keeps them in its server logs for a short time. The site sets no cookies, has no analytics and no tracking. Our password-protected statistics page also shows us the messages from the contact form, which Vercel's servers pass from our database to our browser. The legal basis for hosting the site and its server logs is our legitimate interest in delivering the site and keeping it secure (Art. 6(1)(f) GDPR). Vercel Inc. is certified under the EU-U.S. Data Privacy Framework, so the transfer to the USA rests on the European Commission's adequacy decision for that framework (Art. 45 GDPR). Vercel's privacy notice: https://vercel.com/legal/privacy-notice.

A creator link opens a page that shows the creator's code and a link to Downset in the App Store. It does not pass the code into the app: the code only reaches Downset if you type it in.

The settings file. Downset downloads a small settings file from this website (https://downset-two.vercel.app/config.json) when the app opens and when it comes back to the screen, at most once every 6 hours. It lets us change texts, colors, switches and numbers in the app without an app update. The file holds only such data: never program code, never prices and never legal texts. The request sends no install ID, no RevenueCat ID, no cookie and nothing from your profile, your training or your plans. It carries only a fixed app name ("Downset") and a fixed language code ("en"), the same on every iPhone, and what every connection on the internet carries, such as the IP address, which Vercel receives and keeps in its server logs for a short time, as described above. Downset keeps the newest copy of the file on your iPhone and uses it from the next time the app starts. The app does not need it: without a connection, before the first download or if the file is damaged, the app uses the texts and colors built into it. The legal basis is our legitimate interest in adjusting the app without an update and in delivering the file securely (Art. 6(1)(f) GDPR). Apart from this file, the app does not use this website, and everything in the app works without it.

Changes

If this policy changes, the updated version ships with an app update and shows a new "Last updated" date. If a change needs your consent, Downset asks for it again before it applies.