Privacy Notice — HockeyCut
Not legal advice. Version EN-PRV-1.1-draft · 15 November 2026. Square brackets
[...]are placeholders. Turkish users: see the Turkish notice (KVKK Aydınlatma Metni).
1. In short
- Your match videos stay on your computer. The analysis runs there. We cannot see them.
- What reaches us: the Yes/No answers you give, short clips of those moments, and numeric event data (the Training Contribution). Also: your account, licence, payment and support data.
- Why: we use the Training Contribution only to train, test and improve our models. It is the way we pay for offering the app for free or at a low price. We do not sell it or publish it.
- People in the clips: clips can show players, referees and others, including minors. We have no way to contact them. This notice is also for them (Section 6).
- No facial recognition. We do not create face templates or voiceprints and do not identify people.
- No ads, no sale of data, no tracking of your site visits.
- Your rights: see Section 10. Contact: [coming soon].
2. Who is responsible (controller) and how to contact us
2.1. Controller: [COMPANY LEGAL NAME], [address], registered in Türkiye (registry no. [ ]). Email: [coming soon]. Data-protection contact / officer: [name or "none appointed"].
2.2. EU representative (GDPR Article 27): [name, address — to be appointed before we offer the Service in the EU].
2.3. UK representative (UK GDPR Article 27): [name, address — to be appointed before we offer the Service in the UK].
2.4. Who is responsible for what:
| Data | Who decides how it is used | Our role |
|---|---|---|
| Account, licence, payment, support, record of your acceptance | We do | Controller |
| Training Contribution (answers, clips, numeric data) | We do | Controller |
| Your match videos and projects on your own computer | You (the club, coach or other user) | We are only the software provider; we do not receive them |
3. What data we process
| Category | Examples | Where from |
|---|---|---|
| Account and licence | Name or email (if you give it), licence key (stored as a summary), a device summary (a one-way hash, not the raw device ID), operating system type, app version | You, the app |
| Payment | Order number, plan, amount, date, status. We do not store your card number; the payment provider does | You, the payment provider |
| Support and legal | Messages you send us, your complaints and requests, the record of your acceptance (version, time, anonymous user number, device summary) | You, the app |
| Training Contribution | Yes/No answers; short clips (a few seconds, reduced quality, no sound) that can show players, referees, shirt names and numbers; event type, time, team code (home/away), position on the ice, confidence score, month, a random user number | You, the app |
| Download request | Your email address, if you ask for a download link (the link works for [72] hours) | You |
| Website | Only strictly necessary cookies and similar storage (login session, language). No advertising or analytics cookies | Your browser |
| Security logs | A shortened or hashed IP address, time, action | Our systems |
What we do not ask for: sensitive data (health or injury details, religion, ethnic origin, political views) and biometric data. Clips are not meant to be used for these. We do not identify any person by face, voice or other biometric means. The software can follow a player from frame to frame inside one video; it does not tell us who the person is.
4. Why we use data and on what legal basis
(for people in the EEA and the UK; "Art." = article of the GDPR / UK GDPR)
| Purpose | Data | Legal basis |
|---|---|---|
| Open your account, give you the app, check your licence, apply package limits | Account and licence | Contract (Art. 6(1)(b)) |
| Take payment, issue invoices, tax and accounting | Payment | Contract (Art. 6(1)(b)); legal duty (Art. 6(1)(c)) |
| Support, answers to your requests | Support | Contract; legitimate interests (Art. 6(1)(f)) |
| Security, fraud prevention, misuse of licences | Security logs, licence | Legitimate interests (Art. 6(1)(f)) |
| Proof of your acceptance of our terms, and defending legal claims | Record of acceptance | Legitimate interests (Art. 6(1)(f)); legal claims |
| Train, test and improve our AI models and the Service | Training Contribution | For your own data (answers, user number): contract — the Training Contribution is the agreed price of the Free package and part of the Premium package (Art. 6(1)(b)), and our legitimate interests (Art. 6(1)(f)). For other people shown in clips: our legitimate interests (Art. 6(1)(f)) in building and improving the models. We have assessed these interests against the rights of the people shown, including children. [Balancing assessment on file — to be completed.] |
| Download link and emails you ask for | Your consent (Art. 6(1)(a)) — you can withdraw it | |
| Service emails (security, changes to terms) | Contract; legitimate interests |
We do not rely on consent for the Training Contribution, because it is a condition of the Service. We do not use the Training Contribution for advertising or profiling people. We do not make decisions about people based only on automated processing.
5. Who receives the data
5.1. Service providers working for us (under written contracts): hosting and server providers ([Turhost, Türkiye — to be confirmed]); computing and storage providers used to train models ([names and countries to be inserted — e.g. cloud GPU or notebook providers]); payment provider / merchant of record ([name]); email provider ([name]).
5.2. Authorities and courts, when the law requires; professional advisers under confidentiality.
5.3. Business transfer: if we merge or sell the business, the data may go to the new owner, who must respect this notice.
5.4. We do not sell personal data and do not share it for advertising.
5.5. We do not send Training Contribution clips to third parties who want to build their own products.
5a. Connections the app makes
The app may connect to the addresses below on its own, even when you are not doing anything. This is so that the app works; your full match is never sent to any of them.
| Connection | When | What is sent |
|---|---|---|
Match catalogue and official match sheet: buznet-api.sporpano.com, stats.iihf.com (public sites of the federation/league and of the IIHF) When you paste the link of an official match page, the app connects only to that page's site: stats.swehockey.se (Sweden), mestis.fi and tulospalvelu.leijonat.fi (Finland), sihf.ch (Switzerland), eishockey.at (Austria), lhf.lv (Latvia), hokej.si (Slovenia), eliteleague.co.uk (England), fhr.ru, vhlru.ru and whl.ru (Russia), pro.ligasy.kz, jas.ligasy.kz and qyz.ligasy.kz (Kazakhstan), rbihf.be (Belgium), del-2.org and penny-del.org (Germany), hockey.lt (Lithuania) and the websites of US college teams (NCAA game pages). | After you accept the first-run screen, when My Matches opens and then once an hour. Official sheet lookup: only when you ask for it | Only public tournament and match IDs. No video, player names or account details. These sites can see the IP address of the computer that connects. |
| Licence: revocation-list check | When the app starts and every 6 hours | No personal data. |
| Licence: activation | When you enter a licence key | Licence key, a summary (hash) of the device ID, device name, platform and version. |
| Training Contribution (our collection server) | In the background, after you accept | Your answers and short clips. Details and safeguards: section 5 and the Training Contribution terms (not repeated here). |
| Only if you start or switch them on: downloading video from Google Drive; cloud verification; portal sync (currently off) | When you start or enable them | Drive download: file ID and Google authorisation only. Cloud verification: see section 5 and the Turkish notice. Portal sync is currently off. |
Apart from these, the app does not connect to any other address on its own, and it does not check for updates.
6. If you appear in a clip (players, referees, parents, others)
6.1. A person who uses our app sent a short clip that shows you. We did not collect it from you. We do not know who you are: we do not receive names or shirt-number lists, and we do not use facial recognition. We cannot contact you.
6.2. We use the clip only to train, test and improve our models. We keep it encrypted, for at most [24 months].
6.3. The app user has declared to us that they have the right to use the video and that they asked for permission from the people shown (and from the parents or legal guardians of minors). We rely on this, but it does not replace your rights.
6.4. You can ask us to delete a clip that shows you, or object to its use, by writing to [coming soon]. Please tell us enough to find the clip (for example, the match, the date, the team, the time). We may ask for information to help us find it. If we cannot find a clip that shows you, we will tell you.
6.5. A parent or legal guardian can ask on behalf of a minor.
6.6. Because we cannot identify you, some rights (such as access or portability) can only be met if you give us information that lets us find your data (GDPR Art. 11).
7. Children
7.1. The app is for adults (18+). We do not offer it to children, and we do not knowingly collect personal information from a child directly.
7.2. Clips may show minors (for example, youth players). The adult who loads the video declares that they have the permission of a parent or legal guardian. We treat clips with minors with extra care: short clips, reduced quality, no names, no sound, encryption, limited access, and quick deletion on request.
7.3. If you think a child is using the app, write to [coming soon]. We will close the account and delete the data.
8. Transfers outside your country
8.1. Our servers are in [Türkiye]. We process the data there and use providers in other countries as listed in Section 5.
8.2. EEA and UK: Türkiye has no European Commission "adequacy" decision. When personal data goes from the EEA or UK to us or to our providers outside those areas, we use safeguards such as standard contractual clauses and extra measures (encryption, access limits) [exact safeguards to be confirmed]. You can ask us for a copy of the safeguards ([coming soon]).
8.3. Türkiye: we follow the transfer rules of KVKK Article 9 for transfers out of Türkiye.
9. How long we keep data
| Data | Time |
|---|---|
| Training Contribution | At most [24 months], or until you ask us to delete it, or until a valid deletion request from a person shown. Anonymised or aggregated results and trained models may stay (Section 12) |
| Account and licence | While the account is open; then up to [30] days to let you change your mind |
| Payment and invoices | As long as tax and accounting laws require (for example, [10] years in Türkiye) |
| Record of acceptance | Contract period + [10] years, to defend claims. After the account is closed, the licence link is deleted and the record stays under the anonymous user number |
| Support messages | [2] years after the request is closed |
| Security logs | [1] year |
| Download-link email | Link validity + [30] days, unless you agreed to emails |
10. Your rights
10.1. EEA and UK: you can ask us for access, correction, deletion, restriction, portability (where it applies), and you can object to processing based on legitimate interests. You can withdraw consent (for example for emails) at any time. We answer within one month (we may extend it by two months for complex requests and will tell you).
10.2. United States: depending on your state, you may have the right to know, access, correct and delete your data, and to opt out of sale or sharing. We do not sell or share personal data (see Section 14).
10.3. Türkiye: your rights under KVKK Article 11 are in the Turkish notice.
10.4. Canada, Australia and other countries: you may have access, correction and complaint rights under your local law. Write to us and we will respond as the law requires.
10.5. How: email [coming soon] or use the request link in the app settings ([URL]). We may ask for information to confirm who you are. We do not charge for requests unless the law allows it.
10.6. Complaints: you may complain to your data-protection authority (for the EEA: the authority in the country where you live, work, or where the problem happened; for the UK: the Information Commissioner's Office; for Türkiye: the Personal Data Protection Authority). We ask you to contact us first, but you do not have to.
11. Security and incidents
We use encryption in transit and at rest, access controls and logging, separation of the stored clips from the web, and limits on who can read them. If a data breach is likely to risk people's rights, we notify the competent authority without undue delay and where possible within 72 hours, and we tell affected people where the law requires it.
12. AI models
We use the Training Contribution to build models that find events in hockey video. A trained model is not a copy of the clips, but it may be affected by them, and it cannot always be changed to remove one piece of data. We do not claim that a model "forgets" a clip. We delete the clips themselves on valid requests and stop using them for future training.
13. Cookies and similar technology
Our website and portal use only strictly necessary cookies and local storage (a login session, a two-step sign-in step, your language choice). We do not use advertising, analytics or social-media trackers, and we do not load fonts or scripts from third parties. If we add analytics later, we will update this notice and ask for consent where the law requires.
14. Regional information
A. EEA and UK
- Legal bases: Section 4. Rights: Section 10. Representatives: Section 2. Transfers: Section 8.
- Data protection impact assessment: we have done / will complete one for the Training Contribution [status to be confirmed before launch].
- Your supervisory authority: see Section 10.6.
B. United States
- Categories we collect (past 12 months): identifiers and account data; commercial information (plan, orders); internet/app activity data (licence checks, security logs); audio-visual information (short clips in the Training Contribution); inferences (none about individuals); no sensitive personal information by design; no biometric identifiers.
- Sources: you, the app, your payment provider. Purposes: Section 4.
- We do not sell personal information and do not share it for cross-context behavioural advertising. We do not knowingly sell or share information of people under 16.
- Retention: Section 9.
- Your choices: Section 10.2. We will not treat you worse if you use these rights.
- Children (COPPA): the Service is not directed to children under 13, and the app is for adults. We do not knowingly collect personal information directly from children under 13. If you believe we have, contact [coming soon].
- Biometrics: we do not collect face-geometry scans, face templates, voiceprints or other biometric identifiers, and we do not use biometric information to identify a person. (This answers the notices required by laws such as those of Illinois, Texas and Washington.)
- Do Not Track / Global Privacy Control: we do not track you across websites.
- Contact: [coming soon]; [toll-free number if required].
C. Türkiye
For KVKK, please read the Turkish notice. In short: [COMPANY LEGAL NAME] is the data controller for the data in Section 2.4; your rights are in KVKK Article 11 and you can apply to us at [coming soon] or by registered electronic mail [KEP address].
15. Changes to this notice
We will change this notice when our practices change. For important changes we tell you by email or in the app before they apply, and, if the change affects the Training Contribution, the app shows the acceptance screen again. Earlier versions are kept.
16. Contact
[COMPANY LEGAL NAME] · [address] · [coming soon] · EU representative: [ ] · UK representative: [ ].
| Version | Date | Change |
|---|---|---|
| EN-PRV-1.0-draft | 2026-11-15 | First international English draft |
| EN-PRV-1.1-draft | 2026-11-15 | Added section 5a, connections the app makes |