Privacy Policy
Last updated: 28 September 2026
This Privacy Policy explains how OZLab (“OZLab”, “we”, “us” or “our”) collects, uses, shares and protects personal data when you use the Smashphone application for iPhone and Apple Watch (the “App”), the website at smashphone.app (the “Website”) and the online features we operate for them, including the court code service, the online match relay and the leaderboard (together, the “Services”). It also explains the choices and rights you have. This Privacy Policy forms part of our Terms of Use.
In brief. Your motion data is processed on your own devices and local network and is never uploaded. Your Apple Health data never leaves your device through us. We do not sell your personal data, show advertising or track you across other companies’ apps and websites. We do process a limited amount of personal data to run the leaderboard and online play, to understand how the App is used, and to answer support requests — as described below.
1. Who We Are
OZLab is the controller responsible for the personal data described in this Privacy Policy. You can contact us about privacy matters at support@ozlab.xyz.
2. Information We Collect
(a) Information processed only on your devices. The following is processed on your iPhone, Apple Watch and local network and is not collected by us:
- Motion data. The App reads the accelerometer and gyroscope of your iPhone or Apple Watch to detect swings. When you play on a screen on your local network, the motion stream is sent directly from your iPhone to that browser over your own Wi-Fi network or Personal Hotspot, processed in real time for gameplay and not stored. It is not uploaded to us.
- Apple Health data — see Section 10.
- Match history shown in the App’s Activity tab is stored on your device.
(b) Leaderboard and account data. Unless you turn on “Don’t take part in the leaderboard”, the App registers with our leaderboard server when it is opened, and sends the following:
- a random player identifier and a secret access token generated on your iPhone (we store only a cryptographic hash of the token). These are kept in your iPhone’s keychain, so they persist if you delete and reinstall the App;
- the App’s version number and the country or region of your App Store account (your “region”), which is shown next to your name unless you turn it off;
- the player name you choose, if any (until then you appear under a default name such as “Player 1234”);
- for each finished match in a ball sport: the sport, mode, difficulty, opponent type, score, result, duration, the time it was played, swing statistics (such as the number of swings and hits and their quality and power) and the points awarded; and
- any medals awarded to you on the leaderboard.
If you choose Sign in with Apple, we receive from Apple and store a unique, opaque user identifier that Apple issues for our App. We do not request your email address. If Apple provides your name, it is used only on your device to suggest a player name and is not sent to us.
(c) Online play and court codes. While the App’s Play screen is open, the App keeps a short-lived session on our relay so that a screen or a friend can find your iPhone by a 6-digit code. The session contains the code, the sport, the App version, whether your plan allows play through the relay, and the private local-network address and port of the court your iPhone hosts (for example, 192.168.1.20:8787). When you play with someone on another network or through quick match, the relay forwards the match between the two devices in real time: derived swing events (such as timing, power and direction — not raw motion data) and the state of the match. During quick match, the approximate city and country associated with your IP address by our network providers are shown to your opponent (for example, “Player 2 · Tokyo”).
(d) App analytics. The App uses PostHog, a third-party analytics service, to collect information about how the App is used, so that we can improve the Services. For more information, see PostHog’s privacy policy.
(e) Purchases. All payments are processed by Apple. We do not receive your name, contact details or payment card details from Apple. The App reads your purchase status from Apple’s StoreKit on your device, and records purchase events in our analytics as described in (d). We do not receive transaction receipts on our servers.
(f) Support requests. If you contact us by email or through the support form, we receive the information you provide, such as your message and, if you choose to give it, your email address. When you open the support form or an email from within the App, it pre-fills diagnostic information: the App version and build, device model, operating-system version and language. The support form also sends us your IP address and browser user-agent to help prevent abuse.
(g) The Website. When you visit the Website, our hosting provider processes technical data such as your IP address, browser user-agent and the pages requested. We use two analytics services on the Website: Vercel Web Analytics, which counts visits without cookies using a daily-rotating anonymous hash, and PostHog, which records page views and page exits with a random identifier held only in your browser’s memory for that page load. On the pages where you enter a court code (including the home page), PostHog also records a session replay — the content of the page and your interactions with it — with the contents of input fields masked, so that we can understand why a connection fails. The Website sets one cookie, which remembers your language choice for up to one year, and stores the code you entered in your browser’s session storage for the current tab only.
3. How We Use Information and Our Legal Bases
We use personal data for the purposes below. Where the EU or UK General Data Protection Regulation (“GDPR”) or a similar law applies, we rely on the legal bases indicated.
| Purpose | Data | Legal basis |
|---|---|---|
| Operating the leaderboard, player names, regions, medals and cross-device identity | Leaderboard and account data | Performance of our contract with you (the Terms) |
| Connecting courts by code and providing online and two-player play | Relay session data; relayed match data; approximate city and country for quick match | Performance of our contract with you |
| Understanding and improving the App and Website, measuring features and fixing problems | App analytics; Website analytics and session replay | Our legitimate interests in operating and improving the Services |
| Responding to support requests | Support data | Our legitimate interests in helping you; performance of our contract with you |
| Keeping the Services secure, preventing abuse, cheating and fraud, and enforcing the Terms | IP addresses (for rate limiting); leaderboard data; support data | Our legitimate interests in protecting the Services and their users |
| Complying with legal obligations and responding to lawful requests | Any of the above, as required | Compliance with legal obligations |
| Saving workouts to Apple Health | Apple Health data (processed on your device) | Your consent, given through the iOS permission prompt |
Where we rely on legitimate interests, we have balanced those interests against your rights and freedoms; you may object as described in Section 8. We do not use personal data for advertising, we do not sell it, and we do not make decisions based solely on automated processing that produce legal or similarly significant effects concerning you.
4. How Information Is Shared
With other users and the public. Your player name, region, points, match count and, for top-ranked players, the sport you played most, are displayed on the public leaderboard together with your random player identifier, and can be seen by anyone who views the leaderboard. In an online match, your opponent sees your player name or default name, the match and, in quick match, your approximate city and country.
With service providers. We use the following service providers to operate the Services. They process personal data on our behalf, under contractual obligations of confidentiality and data protection that provide at least the same level of protection as this Privacy Policy, and may not use it for their own purposes:
| Provider | Purpose | Location |
|---|---|---|
| PostHog, Inc. | App and Website analytics, session replay on court-code pages | United States |
| Vercel, Inc. | Website hosting; secure proxy for the App’s connections to our analytics, relay and leaderboard services; Website analytics; support form processing | United States and other locations of its global network |
| Cloudflare, Inc. | Relay and quick match; leaderboard database; content delivery; security and rate limiting | Global network, including the United States |
| Alibaba Cloud | Relay for users in mainland China (in-memory only) | Mainland China |
| Discord Inc. | Delivery of support requests to our team | United States |
With Apple. Purchases, Sign in with Apple, Apple Health and App Store update checks are provided by Apple under Apple’s own terms and privacy policy.
For legal reasons. We may disclose personal data if we believe in good faith that it is required by law, regulation, legal process or a governmental request, or necessary to protect the rights, property or safety of OZLab, our users or others.
Business transfers. If OZLab is involved in a merger, acquisition, reorganisation or sale of assets, personal data may be transferred as part of that transaction, subject to this Privacy Policy.
We do not sell personal data, and we do not share it for cross-context behavioural advertising.
5. International Data Transfers
We and our service providers process personal data in the United States and in other countries where they operate, which may be outside the country in which you live and may not provide the same level of data protection. Where the GDPR or a similar law requires it, such transfers are made on the basis of appropriate safeguards, such as the European Commission’s Standard Contractual Clauses or an adequacy decision, incorporated into our providers’ data processing terms.
6. Data Retention
We keep personal data only for as long as necessary for the purposes described in this Privacy Policy, unless a longer period is required or permitted by law:
| Data | Retention |
|---|---|
| Leaderboard and account data | Until you delete your leaderboard account or ask us to delete it. Access tokens are deleted when you sign out on a device. |
| Relay sessions, including local-network addresses | Deleted when you leave the Play screen, and in any case no later than two hours after the session was last used. A local-network address is handed to a joining screen only while your iPhone has refreshed it within the last 25 seconds. |
| Quick-match tickets, including approximate city and country | While you are waiting for a match and for no more than about one minute after the match is made. |
| IP addresses used for rate limiting | Held in memory for a few minutes; not written to our databases. |
| App and Website analytics and session replays | For as long as they are useful for the purposes in Section 3, within the retention periods of our analytics provider, after which they are deleted or aggregated so that they no longer relate to an identifiable installation. |
| Support requests | For as long as needed to handle your request and any follow-up, and then deleted. |
| Server and security logs kept by our providers | For the limited periods set by those providers. |
7. Security
We use technical and organisational measures designed to protect personal data, including encrypted connections (HTTPS) between the App and our services, storing only a hash of leaderboard access tokens, and limiting access to personal data to those who need it. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.
Please note that, by design, the court server that the App runs on your iPhone communicates with browsers on your local network over unencrypted HTTP and WebSocket connections that are not protected by a password, so other devices on the same network may be able to connect to it while the App is open. For the same reason, the in-game connection between a court page and our relay in mainland China is not encrypted. Play on networks you trust.
8. Your Choices and Rights
Controls in the App. You can:
- turn on “Don’t take part in the leaderboard” in account settings, after which the App sends nothing to the leaderboard server;
- turn off “Show my region on the leaderboard”, which removes your region from our server;
- change your player name at any time;
- if you are signed in with Apple, delete your leaderboard account in account settings, which permanently deletes your name, region, points, matches, medals and Apple identifier from our server;
- turn off “Save matches to Apple Health” and manage Health permissions in the Health app or iOS Settings; and
- delete the App, which removes the analytics identifier and all data stored in the App on your device.
Your rights. Depending on where you live, you may have the right to access, correct, delete or receive a copy of your personal data, to restrict or object to certain processing (including processing based on legitimate interests), and to withdraw consent at any time without affecting the lawfulness of processing before the withdrawal. To exercise these rights — including to have your leaderboard data deleted if you have not signed in with Apple — contact us at support@ozlab.xyz. We will respond within the time required by applicable law, and we may need to ask for information to verify that the request comes from you, such as your player name or a screenshot of your account settings.
Our analytics are associated only with a random identifier created for each installation of the App, which we cannot link to your name, email address or Apple Account. We may therefore be unable to identify analytics data relating to you from the information you give us. Deleting the App discards that identifier.
We will not discriminate against you for exercising your privacy rights.
9. Additional Information for Certain Regions
European Economic Area, United Kingdom and Switzerland. The legal bases for our processing are set out in Section 3. You have the right to lodge a complaint with the data protection supervisory authority in the country where you live or work, or where an alleged infringement took place.
United States (including California). In the last 12 months we have collected the following categories of personal information: identifiers (such as the random player and installation identifiers, the Apple user identifier and IP address); internet or other electronic network activity information (App and Website usage and analytics); commercial information (purchase events); general geolocation (country and approximate city derived from IP address, and App Store country); and the content of support messages. We collect it from you and your devices for the business purposes described in Section 3, and disclose it to the service providers described in Section 4. We do not sell or share personal information (as those terms are defined under California law), and we do not use or disclose sensitive personal information for purposes that require a right to limit. Residents of California and other states with comprehensive privacy laws may exercise the rights in Section 8, including through an authorised agent, and may appeal our decision on a request by replying to our response.
Mainland China. We process personal information in accordance with the Personal Information Protection Law of the People’s Republic of China. As described in Sections 4 and 5, some personal information of users in mainland China, such as analytics data and leaderboard data, is transferred to and processed by service providers outside mainland China, for the purposes and in the manner described in this Privacy Policy. You may exercise your rights under that law, including to access, copy, correct, delete and withdraw consent, as described in Section 8.
10. Apple Health
If you allow it, the App uses Apple’s HealthKit framework to save finished matches to Apple Health as workouts (and, on Apple Watch, active energy) and to read workouts, heart rate and active energy recorded during a match, so that the App can show them to you. “Save matches to Apple Health” is turned on by default and can be turned off at any time in the App; the App accesses Apple Health only after you grant permission in the iOS prompt.
Health data read or written by the App stays on your device and in Apple Health. We do not transmit Health data to our servers or to any third party, do not use it for advertising or marketing, do not sell it, and do not use it for any purpose other than providing the features described above. If you choose to share a match poster from the App, it may show heart rate and energy figures from that match; sharing it is entirely under your control.
11. Children
The Services are intended for a general audience and are not directed at children under the age of 13, or the minimum age required in your country to consent to the processing of personal data. We do not knowingly collect personal data from children below that age beyond what is necessary to operate the App. If you are a parent or guardian and believe that your child has provided us with personal data, such as a player name, contact us at support@ozlab.xyz and we will delete it. Parents can also turn on “Don’t take part in the leaderboard” on their child’s device.
12. Changes to This Privacy Policy
We may update this Privacy Policy from time to time. We will post the updated version on this page with a new “Last updated” date and, where the changes are material, we will provide reasonable notice, for example in the App or on the Website, before they take effect.
This Privacy Policy is available in several languages. If there is any inconsistency between a translation and the English version, the English version prevails, to the extent permitted by applicable law.
13. Contact Us
If you have any questions, requests or complaints about this Privacy Policy or our handling of personal data, please contact OZLab at support@ozlab.xyz.