Privacy policy

1. Controller

The controller responsible for processing personal data in the ThrowKit app and on this website is:

For questions about privacy and to exercise your rights, write to me at support@throwkit.app.

2. The ThrowKit app

What is stored on your devices

During a session, ThrowKit records the motion sensor data of your Apple Watch (acceleration, rotation and orientation of your wrist) and uses it to work out your throws and analyses such as the consistency score. Each recording also includes the start and end of the session, the wrist you wear the Watch on, the device name “Apple Watch” with its watchOS version and, for drills, the chosen drill and the hits you entered.

For a match, the recording also contains the marks you set on the Watch: when a leg ended and, if you tap “Set over”, when a set ended; whether you won or lost the leg or skipped the answer; and the format you chose (a game such as 501, legs only or sets). If you later correct the legs on the iPhone – you place, move or remove a leg end, change a result, type in a leg’s darts or average, or mark a session as a match or not a match – ThrowKit stores these corrections on the iPhone only; the recording itself stays unchanged. The corrections are deleted with the session.

This data is stored only on your Apple Watch and your iPhone; the Watch transfers it to your paired iPhone over the system’s connection. You can delete sessions in the app. If you delete the app, the system removes its data from the device. If you use iCloud Backup or back up to a computer, the data can be part of those device backups; Apple’s terms apply to them.

ThrowKit has no account and no server of its own. The app contains no analytics, advertising or tracking services and no third-party code libraries. I receive your recordings and analyses only if you send them to me yourself. What data Apple provides to me is described below under “App Store and TestFlight”.

Apple Health

So that recording keeps running when you lower your arm, ThrowKit starts a workout on Apple Watch for the length of a session. For this, the Watch app and the iPhone app ask for the Health permission to write workouts; the iPhone needs it to start a session on the Watch.

If you turn on “Save sessions to Apple Health” (ThrowKit Pro), each session is saved to Apple Health as an “Other” workout with its start, end and duration; Apple Watch itself measures and saves the energy and the heart rate during that workout. The workout also carries the session’s identifier and, for a drill, which drill it was – no throws, no hits, no analysis. With the setting off, no workout is saved. You can turn it off at any time in ThrowKit’s settings on the iPhone or on the Watch, or withdraw ThrowKit’s permission in the Health app under “Sharing” › “Apps” › ThrowKit. Deleting a session in ThrowKit keeps its workout in Apple Health; you delete workouts in the Health app. ThrowKit deletes nothing from Apple Health.

If you turn on “Record heart rate” (ThrowKit Pro), ThrowKit reads your heart rate from Apple Watch – only while a ThrowKit session is recording and only for as long as the setting is on. The readings stay with the session: on the Watch until it is transferred to your iPhone, on the iPhone afterwards. They are deleted with the session and never sent to me by the app. Your heart rate is in an exported file or in an email sent with “Send to ThrowKit” only if you turn on “Include heart rate” for it or choose “Export JSON with heart rate”. You turn this setting off in ThrowKit’s settings on either device as well, or withdraw ThrowKit’s read access in the Health app. Apart from heart rate, ThrowKit reads no health data.

Nothing from Apple Health reaches me unless you send it to me yourself, as described below. ThrowKit has no server of its own and never uses health data for advertising.

AI coach on your iPhone

ThrowKit Pro includes a coach that answers questions about your sessions. It works only on your iPhone: the answers are computed from the sessions stored there, and a question you type is read by Apple Intelligence with Apple’s language model on the device itself. Your questions, the answers and your sessions are not sent by the app to me or to Apple, and nothing of it is stored: a question and its answer are gone when you close the coach. If Apple Intelligence isn’t available on your iPhone, there is no text field, and the ready-made questions are answered from ThrowKit’s own rules.

When you export sessions or send them to me

Your recordings and analyses leave your devices only when you do it yourself:

• Export: with “Export JSON”, “Export JSON with heart rate” or “Export CSV” you pass a session on through the iOS share sheet, for example via AirDrop, to the Files app or to another app. You decide where the file goes; I receive nothing. Your heart rate is only in the file “with heart rate”. A match exported as JSON also contains the marks from the Watch; your corrections from the iPhone are in no exported file.
• “Send to ThrowKit”: you choose sessions and send them with your own Mail app to support@throwkit.app (ThrowKit 1.0 still sends to support@tobibechtold.dev), or through the share sheet if Mail isn’t set up on the iPhone. Nothing is sent automatically.

An email sent with “Send to ThrowKit” contains:

• your email address and sender name, as set in your mail account,
• the motion recordings of the selected sessions as JSON files in a ZIP archive, with the details listed above for each recording,
• your heart rate for those sessions, but only if you turn on “Include heart rate” when sending; otherwise it is in none of the files,
• the app version and build, your iPhone’s model identifier (for example “iPhone18,1”) with its iOS version, and the device name “Apple Watch” with its watchOS version,
• for each session the date and time, the drill and the detected throwing style,
• for a match, or a session you marked as a match or not a match: whether it counts as a match, the game (for example 501), the number of legs, legs won and legs with a result, and your corrections to the legs, including darts and averages you typed in,
• for drills aimed at a single target, your answer to what counted as a hit, if you give one,
• your note, if you write one.

The motion recordings, and your heart rate if you include it, are only in the ZIP archive. The other details (app and device details, session data, throwing style, hit answer and note) are in the text of the email and also in the attached metadata.json file, which also records whether you included your heart rate. The match details are in metadata.json; the text of the email names only the game and the legs. Your name and email address are in none of the files. The email travels through your email provider and is stored in the support@throwkit.app mailbox, which Fastmail runs for me on servers in the EU; emails from ThrowKit 1.0 arrive in the support@tobibechtold.dev mailbox, which STRATO AG in Berlin runs for me. I use its contents only to evaluate, check and improve ThrowKit, for example throw detection and the analyses.

Analysis with AI

For this evaluation, the recordings and their metadata may be analysed with Anthropic’s AI tool Claude; if you sent your heart rate along, it is part of that. They are then transferred to Anthropic and may be processed in the USA. Your name and email address are not needed for this and are not contained in the files. Your note, however, is also in metadata.json and may be processed along with it.

Test data only with your consent

Only if you agree explicitly and separately do I keep individual recordings permanently as test data in ThrowKit’s private source code repository on GitHub. There they are also processed by Apple Xcode Cloud when the app is built. Test data is stored without your name or email address but is not anonymous: it can contain details such as your wrist, your throwing style and your playing level, and your heart rate if you sent it along. Without this consent, I use your recordings only for evaluation.

Legal basis, retention and deletion

The legal basis is your consent: for evaluation, the consent you give by sending; for test data, your separate consent (both Art. 6(1)(a) GDPR). I keep the emails and recordings for as long as I need them to develop ThrowKit. You can withdraw any consent at any time by writing to support@throwkit.app and ask for deletion. I will then delete your emails and recordings, including test data created with your consent, which I remove from the repository including its version history.

ThrowKit Pro

ThrowKit Pro – monthly, yearly with a free trial, or once for lifetime – is bought in the App Store with your Apple Account. Apple handles the purchase and the payment under its own responsibility and privacy policy. I receive no payment or card data. The app on your iPhone learns from Apple (through StoreKit) whether Pro is active and until when; the iPhone app passes on to your Apple Watch only whether Pro is active. ThrowKit stores nothing about it on a server, because it has none.

During a trial you can choose “Turn on reminder”. ThrowKit then asks for permission to send notifications and schedules a local notification on your iPhone two days before the trial ends. If you cancel, buy another plan or the trial ends, ThrowKit removes it again. Nothing leaves your device.

App Store and TestFlight

ThrowKit is distributed through Apple’s App Store and TestFlight. Apple processes data in doing so, for example for downloads and updates, under its own responsibility and privacy policy: https://www.apple.com/legal/privacy/. If you test ThrowKit through TestFlight, Apple provides me with the details you take part with (for an email invitation, for example, your name and email address), as well as installs, sessions and crashes with device model and operating system version, and feedback and crash reports you send through TestFlight. If you have agreed on your device to share analytics with app developers, Apple provides me with aggregated usage statistics and crash reports.

3. The throwkit.app website

Hosting

The website is hosted by Vercel Inc. (USA). On every visit, Vercel processes technically necessary data such as your IP address, the address requested, the date and time and details about your browser, to deliver the page and protect it against abuse. The legal basis is my legitimate interest in a secure, working website (Art. 6(1)(f) GDPR). Vercel states that it is certified under the EU-U.S. Data Privacy Framework. More: https://vercel.com/legal/privacy-policy.

No analytics, no tracking cookies

The website uses no analytics or tracking services, no advertising and no tracking cookies. It uses your device’s system fonts; images and scripts come from throwkit.app itself. No content is loaded from other servers such as Google Fonts or CDNs.

If you pick a language in the language menu, the website stores that choice in the “tk-lang” cookie (valid for one year) and in your browser’s local storage. The cookie is sent along when you open throwkit.app, so the home page takes you straight to your language. Your choice between the light and dark design is kept only in your browser’s local storage (“tk-theme”) and never leaves it. Both are technically necessary settings that you trigger yourself (Section 25(2) no. 2 of the German TDDDG); they contain only the language code or “light” or “dark” and are not used for tracking. You can delete them in your browser at any time.

Waitlist (closed)

Until ThrowKit launched on the App Store, you could join a waitlist on this website. Your browser then sent your email address, together with the page’s language and the labels “iOS waitlist” and “Landing page”, directly to the email service Loops (Astrodon, Inc., USA); Loops also received technical connection data such as your IP address. The waitlist is closed and the website no longer collects email addresses. I use the stored addresses only to tell you by email that ThrowKit has launched, and delete them afterwards.

The legal basis is your consent (Art. 6(1)(a) GDPR). You can unsubscribe at any time with the link in every email or by writing to support@throwkit.app; on request I will delete your address right away. Loops states that it is certified under the EU-U.S. Data Privacy Framework. More: https://loops.so/privacy.

4. Recipients and transfers outside the EU

Personal data is received only by these recipients, each for the stated purpose:

• Fastmail Pty Ltd (Melbourne, Australia; data stored on servers in the EU): the @throwkit.app mailboxes, including support@throwkit.app,
• STRATO AG (Berlin, Germany): the support@tobibechtold.dev mailbox, which still receives “Send to ThrowKit” emails from ThrowKit 1.0,
• Anthropic (USA): analysis of sent recordings and their metadata with Claude,
• GitHub, Inc. (USA): private source code repository, only for test data with your separate consent,
• Apple: App Store and TestFlight, and Xcode Cloud for test data with your consent,
• Vercel Inc. (USA): hosting of the website,
• Loops (Astrodon, Inc., USA): the closed waitlist, until the addresses are deleted.

I have concluded data processing agreements under Art. 28 GDPR with Vercel, Loops, STRATO and Fastmail. Several recipients process data in the USA. Vercel and Loops state that they are certified under the EU-U.S. Data Privacy Framework; other transfers to the USA rely on the safeguards of the respective provider, such as the EU-U.S. Data Privacy Framework or EU standard contractual clauses. Fastmail stores my emails on servers in the EU; because Fastmail Pty Ltd is based in Australia, access from there, for example for support, cannot be ruled out, and it relies on the EU standard contractual clauses in its data processing agreement.

5. Your rights

Under the General Data Protection Regulation (GDPR) you have the right

• to get access to the data I process about you (Art. 15),
• to have incorrect data corrected (Art. 16),
• to have your data deleted (Art. 17),
• to have processing restricted (Art. 18),
• to receive data you gave me in a common, machine-readable format (Art. 20),
• to object to processing based on my legitimate interest (Art. 21),
• to withdraw consent at any time for the future (Art. 7(3)).

To do so, write to support@throwkit.app. I don’t have data that is only on your devices; you can view, export and delete it in the app yourself.

You can also complain to a data protection supervisory authority (Art. 77 GDPR), for example the one responsible for me: the Baden-Württemberg State Commissioner for Data Protection and Freedom of Information (LfDI), https://www.baden-wuerttemberg.datenschutz.de/.

6. Changes

When ThrowKit or the website changes, I will update this privacy policy. The version published here applies.