This page explains what personal data we collect when you use Tennis Mind (the website at tennis-mind.com and the iOS and Android apps), why we collect it, and what your rights are. It complies with the EU General Data Protection Regulation (GDPR) and Slovenia's Personal Data Protection Act (ZVOP-2).
1. Who we are (data controller)
The data controller is MADRAS - LINE d.o.o., Levičnikova ulica 4A, 1000 Ljubljana, Slovenia. Registration number: 5620198000. Tax number: 59594519.
For privacy questions, write to info@tennis-mind.com.
2. What data we collect, why, and the legal basis
Tennis Mind currently offers free access. We collect the minimum needed to run the service:
- Guest profile (device identifier) — when you first open the app we generate a random identifier (a UUID) on your device so your progress and preferences (level, accuracy, court theme, 2D/3D mode) can be saved and restored. The identifier is stored locally and is not linked to your real identity. We do not create an anonymous Firebase user. Legal basis: legitimate interest (Art. 6(1)(f)) in providing a usable, stateful service.
- Email/password, Google, or Apple sign-in (optional) — if you choose to save your progress across devices and sign in, we receive your email address and a unique Firebase user ID. For Google or Apple sign-in, we may also receive your display name and profile photo URL from the chosen provider. For email/password accounts, Firebase Authentication handles password storage; we do not receive or store your plain-text password. Your guest progress is then migrated to that account. Legal basis: consent (Art. 6(1)(a)) — you trigger the sign-in.
- Profile data — display name and any preferences you set. Legal basis: performance of contract (Art. 6(1)(b)).
- Service email to your account address — we use the email address on your account to send messages about the account itself: sign-in codes, and notice of changes to the terms or to what your free plan includes (for example, if scenarios that are free today later move to a paid subscription — see Terms, Section 3, which commits us to at least 30 days' notice). These are transactional service messages, not marketing: they are sent whether or not you opted in to marketing email, and you cannot unsubscribe from them while you hold an account — deleting your account ends them. Legal basis: performance of contract (Art. 6(1)(b)), and our legitimate interest (Art. 6(1)(f)) in informing you of material changes to a service you use.
- Local-only data — court theme, court mode, and intro-shown flag are stored in your browser's local storage on the device. We do not transmit this. Legal basis: not personal data once stored locally.
- Technical data — IP address and basic device info reach Firebase Hosting and Authentication during normal HTTPS requests. Legal basis: legitimate interest in operating and securing the service.
- Product analytics and marketing measurement — on the web app and Android app we use Firebase Analytics (Google Analytics 4) only after you accept analytics. On the landing page we may load the Meta Pixel only after the same opt-in choice. See Section 3 for the event categories and how we keep this minimal. Legal basis: consent (Art. 6(1)(a)).
3. Product analytics
We use Firebase Analytics (Google Analytics 4) to understand how the drill is used and where people drop off. On the web app and Android app this starts only after you choose "Allow analytics". IP anonymisation is on by default. We collect the following categories of usage data:
- Gameplay — which scenarios you start and answer, the zone you chose, whether it was correct, your level and accuracy.
- Conversion — when you reach the end of the guest pool and how you respond to the sign-in prompt.
- Sign-in — provider used and, on failure, a non-personal error code.
- Errors — a short hash of the error fingerprint so we can spot crashes. We never receive the raw stack trace or anything you typed.
We deliberately do not send your email, display name, profile photo, or any directly identifying data to Firebase Analytics. On the marketing landing page, the Meta Pixel is used only for basic campaign and conversion measurement after consent. If you choose "Only essentials", Firebase Analytics and Meta Pixel do not load.
4. Cookies and similar technologies
Tennis Mind uses strictly necessary storage plus optional analytics and marketing storage described in Section 3:
- A session token managed by Firebase Authentication when you sign in.
- Browser
localStorageentries for your court theme, 2D/3D mode, intro-shown flag, guest device identifier, scenario chunk progress, and privacy choice. - Firebase Analytics cookies (
_ga,_ga_*) on the web app, and Firebase Analytics app instance storage on Android, used only after analytics consent. - Meta Pixel cookies or similar browser storage on the landing page, used only after analytics/marketing consent.
The strictly necessary entries do not require consent under the ePrivacy framework because they are needed to provide the game, authentication, preferences, and consent controls. Rejecting analytics does not disable local progress or gameplay. You can change your cookie choice from the landing page footer, or clear browser storage to reset the choice.
5. Who we share data with
We do not sell your data. We use the following processors, each strictly to run the service:
- Google LLC / Google Ireland Ltd. — Firebase Authentication (email/password and Google sign-in), Firebase Hosting (web), Firestore, and Firebase Analytics / Google Analytics 4. The iOS and Android apps are distributed via the Apple App Store and Google Play Store, which receive only the data those stores require to install the app.
- Meta Platforms Ireland Ltd. — Meta Pixel on the landing page, only after analytics/marketing consent, for basic campaign and conversion measurement.
- Apple Inc. — only if you choose Sign in with Apple. Apple sends us a unique identifier and, if you allow it, your email and display name.
EU data centres are used where available; some processing may occur in the United States under the EU-U.S. Data Privacy Framework or the European Commission's 2021 Standard Contractual Clauses.
6. International transfers
Where Google or Apple processes data outside the European Economic Area, we rely on adequacy decisions or the European Commission's 2021 Standard Contractual Clauses to provide the equivalent level of protection required by the GDPR.
7. How long we keep your data
- Guest profile state: until you clear your browser or app data.
- Account data (email/password, Google, or Apple sign-in): until you delete your account. You can do that yourself, immediately, on the account deletion page or from the Delete account link in the app's Settings. If you ask us to do it instead, we complete it within 30 days.
- Invoices and their fiscal records, where we have issued them: retained for as long as Slovenian tax law requires, even after account deletion.
- Analytics events: retained by Firebase Analytics for 14 months, then deleted automatically. Aggregated, non-identifying reports may be kept longer.
- Server logs: 30 days, then deleted.
8. Your rights
Under the GDPR you can, at any time:
- request a copy of the data we hold about you (Art. 15);
- have inaccurate data corrected (Art. 16);
- have your data erased, where the law allows (Art. 17);
- restrict or object to processing (Art. 18 and 21);
- receive your data in a portable format (Art. 20);
- withdraw consent at any time, without affecting the lawfulness of past processing (Art. 7(3)).
To delete your account and its data, use the account deletion page or the Delete account link in the app's Settings — you sign in, confirm, and it is done immediately; no app install needed. To exercise any of the other rights, write to info@tennis-mind.com. You also have the right to lodge a complaint with the Slovenian Data Protection Authority — Informacijski pooblaščenec, ip-rs.si.
9. Security
We rely on Google Cloud's infrastructure controls (encryption in transit and at rest, identity-based access).
10. Automated decision-making
We do not make automated decisions that produce legal or similarly significant effects on you (no automated profiling, no automated account closure).
11. Changes to this policy
We update this policy when our practices or sub-processors change. Material changes are signposted on this page and dated above; small edits (typos, clarifications) are made silently. Always check the "Last updated" date.