Privacy Policy

Who we are

ShotRx is operated by 17452217 Canada Inc. (operating as Metriview), based in Outremont, Quebec, Canada. Contact: founders@metriview.info.

The person in charge of protecting personal information is Andrew Dahms, President. You can reach him at founders@metriview.info.

What we collect

• Account info: email, display name, avatar (when you sign in with Google or Apple). Password hash if you register with email.
• Golf profile: handicap, typical distances, preferred ball flight, launch monitor used, goals, physical considerations. You enter this in onboarding and can edit or delete it at any time. Physical considerations are optional.
• Launch monitor photos: the images you upload for AI analysis. We send the photo to our AI provider to read the numbers. ShotRx does not store the photo.
• Session data: when you keep a session, we store the extracted metrics (club speed, ball speed, smash factor, launch angle, spin, club path, face angle, attack angle, carry distance), diagnosis text, drill recommendations, notes, tags, ratings, conditions.
• Subscription status: whether you have Full Bag active, from RevenueCat (iOS) or Stripe (web).
• Usage events: which analyses you've run (count + timestamp only), used to enforce the free-tier limit and rate limit.
• Agreement records: the version of the Terms of Use and of the AI notice you accepted, and when you accepted them.

We do not collect your GPS location or advertising ID, and we do not track you across other apps or websites. IP addresses do appear in our hosting providers' server logs, and we record them for lounge guests (see Lounge mode below).

How we use your data

• To run the AI analysis: your launch monitor photo, your golf profile and your answers about the shot are sent to Anthropic's Claude API. It reads the numbers and writes the coaching. If you type your numbers in by hand, or ask the AI coach a question, that text is sent to Anthropic the same way.
• To show a drill video from YouTube with each recommended drill (see YouTube videos below).
• To show your session history, trends, and goals across sessions (the longitudinal tracking is the core product).
• To enforce free-tier limits and rate limits on analyze calls.
• To process subscription payments (Stripe on web, StoreKit via Apple on iOS, validated by RevenueCat).
• To authenticate you (Supabase Auth).

The diagnosis and drill suggestions are produced by automated processing, using an AI model. You can ask a person to explain any result by emailing founders@metriview.info.

You can turn off AI processing at any time via Settings → Privacy & AI. With it off, nothing new is sent to Anthropic. Your saved sessions are kept.

Who we share data with

ShotRx uses the following third-party processors. Each has their own privacy policy; we minimize what we send.

• Anthropic (Claude API): your launch-monitor photo, golf profile, session context and any coach chat messages. Anthropic deletes API inputs and outputs from its systems within 30 days by default. It may keep them longer, up to 2 years, if they are flagged for a usage policy violation, or where the law requires it. Anthropic does not use them to train its models without express permission. anthropic.com/legal/privacy · Anthropic's retention policy
• Supabase: hosts the database and authentication. Hosted in the United States and the European Union. supabase.com/privacy
• Vercel: hosts the web app. Vercel keeps server logs of requests to the site. These logs can include your IP address. vercel.com/legal/privacy-policy
• Google (YouTube): drill videos and their thumbnail images are served by YouTube. See YouTube videos below. policies.google.com/privacy
• Google / Apple Sign-In: only if you choose that sign-in option. We receive your email + name from the provider. No ongoing data exchange.
• Apple and RevenueCat: iOS subscriptions. Apple processes the payment. RevenueCat validates the receipt. Your Supabase user id links to a RevenueCat customer record. revenuecat.com/privacy
• Stripe: web subscription billing only. Handles card data directly; ShotRx never sees card numbers. stripe.com/privacy

We do not sell your data. We do not share it with advertisers. We do not load analytics, advertising pixels, session replay or error tracking tools.

Where your data is processed

Your data is processed outside Quebec and outside Canada. The vendors listed above process it in the United States and the European Union. They handle it under the data protection terms of their contracts.

YouTube videos

Drill videos are served by YouTube, a Google service. ShotRx does not host them. We embed them with the official YouTube player on its privacy-enhanced domain (youtube-nocookie.com). A video only loads when you tap play.

Video thumbnail images load from Google's servers (i.ytimg.com) as soon as a drill card is shown, before any tap. When that happens Google receives your IP address and basic browser details, as with any web request, and can see which video is shown. If a drill has no chosen video yet, we show a link that opens a YouTube search for that drill (in a new tab on the web, or in a browser sheet inside the iOS app). For videos, we do not send Google your name, email or launch monitor numbers. Google's privacy policy: policies.google.com/privacy.

Your rights

• Access + export: Settings → Data → Export All Data exports every session to CSV.
• Correct: edit your profile (ProfileDrawer) or individual sessions any time.
• Delete: Settings → Danger Zone → Delete Account removes your account, profile, all sessions, and all drill recommendations. This is irreversible and happens within seconds. Deleting your account does not cancel a subscription. Cancel it first.
• Revoke AI consent: the Settings → Privacy & AI toggle stops new analyses and coach chat messages from being sent to Anthropic. Previously-saved sessions remain until you delete them.
• Object / restrict / complain: email us at founders@metriview.info. Quebec residents have additional rights under Law 25 (Quebec private-sector privacy law); EU/UK residents have GDPR rights. We respond within 30 days.

Data retention

Sessions and profile data: kept as long as your account exists. We do not store your launch monitor photos. On account deletion, removed within minutes and purged from backups within 30 days. Billing records are kept as long as tax law requires. Server logs kept by our hosting providers are deleted on their own schedules. Anthropic's retention is described above.

Security

All traffic is HTTPS-only with HSTS. Row-level security on the database prevents users from reading each other's data. We do not store your launch monitor photos, and we do not write photo content to our server logs.

If something goes wrong

We keep a register of privacy incidents. If an incident creates a risk of serious harm, we will notify the people affected and the privacy regulators. To report a concern, email founders@metriview.info.

Children

ShotRx is not directed at children under 13, and you must be 13 or older to use it. If you are under the age of majority where you live, you need a parent or guardian's permission. We do not knowingly collect data from children under 13. If you're a parent and believe your child has created an account, email us and we'll delete it.

Changes

When we change this policy materially, we'll notify you via email and an in-app banner before the change takes effect. Past versions available on request.

Lounge mode (venue guests)

If you scanned a QR code at a golf simulator lounge or venue, you got a temporary guest session instead of creating a full account. Here's what that means:

• What we collect: your email and first name, and (if you chose to check the box) your consent to receive occasional golf tips and ShotRx news. With your consent record we also store your IP address, your browser's user agent, the version of the consent wording you saw, and the time. If you sign in with Google or Apple instead, we receive your email and name from the provider.
• Why: your email lets you claim your swing history later by creating a free account. It also lets us enforce fair-use limits and prevent abuse of the free coaching the venue is providing. The IP address and user agent are used to prevent abuse.
• How your shots are analyzed: your photo and numbers are analyzed by an AI service (Anthropic), the same way as for any user. We do not store the photo. See the sections above.
• What the venue sees: aggregate usage only (like how many sessions happened that day). The venue does not see your individual swing data, diagnosis, or contact info.
• How long your session lasts: each venue sets its own guest session duration (typically a few hours), long enough to cover a visit. When it expires, you can scan the QR code again to start a new one.
• Retention: if you never convert your guest session into a full account, we delete your guest data within 13 months of your visit.
• Your rights: same as any user: access, correction, deletion. Email founders@metriview.info to request deletion of your guest data at any time.