Privacy policy

1. Controller

You can also use our protected contact form.

2. Website hosting

The website is provided through Cloudflare Pages by Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA. When you visit, Cloudflare processes connection data needed to deliver the site. This may include your IP address, the time and destination of the request, the amount of data transferred, browser and system information, and traffic management information.

We process this data to provide a secure and reliable website and prevent abuse. The legal basis is Article 6(1)(f) GDPR. Our legitimate interest is the secure operation of the website. Cloudflare processes some data on our behalf and, according to its own information, acts as an independent controller in some cases.

Processing may take place outside the European Economic Area, especially in the United States. Cloudflare provides safeguards including EU standard contractual clauses. See Cloudflare's privacy policy.

Data is deleted when it is no longer needed for these purposes, unless legal retention duties or legitimate security interests require otherwise. We do not fully control retention periods set by Cloudflare in its own capacity.

We use Cloudflare Turnstile on contact and deletion forms and before displaying the controller's name and email address. Turnstile evaluates technical connection, browser and interaction signals to distinguish people from automated requests. We receive only the verification result; the legal basis is Article 6(1)(f) GDPR and our legitimate interest in preventing scraping, spam and abuse. A failed or unavailable verification can prevent the protected form or contact details from being displayed.

3. Confirmation links and Supabase

The /auth/ page helps confirm registration, sign-in, invitations, email changes and password recovery. The one-time token in the link is first read locally from the URL fragment in your browser and removed from the visible address. The website does not verify it automatically.

Only when you choose “Continue in DanceRep” are the token hash, confirmation type and intended redirect destination sent to Supabase, Inc., 970 Toa Payoh North #07-04, Singapore 318992. Supabase also processes connection data needed to complete the requested authentication step.

The legal basis is Article 6(1)(b) GDPR where processing is needed to provide the account or take pre-contractual steps. Otherwise it is Article 6(1)(f) GDPR: our legitimate interest is secure confirmation that resists automated email-link scanners. Supabase processes data on our behalf and provides safeguards for transfers to third countries, including EU standard contractual clauses.

Authentication data is kept for the life of the account and otherwise only as long as needed for the stated purposes or legal duties. One-time confirmation links expire.

4. DanceRep app and user account

Account data also includes your chosen username, an available profile photo, role and permissions, Free/Plus plan, any trial period, additional move slots, and creation and update timestamps. Provider sign-in can retain the provider identifier, name and photo URL in authentication records even though the app does not ask for a separate display name. Your plan and permissions determine available features and capacity.

We process the data necessary for sign-in, account management and the features you request to perform our contract (Article 6(1)(b) GDPR). Without that information, the relevant features, such as account access or cloud synchronization, cannot be provided. Acceptance of the content rules is not blanket consent to personal data processing. Product analytics and improvement are described separately in section 5.

Synced content also includes ordering and practice stage, recording dates, creation and update timestamps, and technical media information: file size, duration, format, dimensions, frame rate, checksum, storage reference and backup status. Clips can include audio, and preview images may be stored with them. Local working copies and downloaded caches are also held on your device.

Blocking, reviewing reports and preventing abuse protect users and the sharing service. Where no specific legal obligation applies, we rely on our legitimate interest in the security of the service for this necessary processing (Article 6(1)(f) GDPR).

You can create an account with an email address and password, or through Google or Apple. We process your email address, internal user ID, sign-in and confirmation data, and the session data needed for access. With Google or Apple sign-in, we receive the account information you choose to share; authentication itself takes place with that provider. The legal basis is Article 6(1)(b) GDPR.

When you first sign in with Google, we use the profile photo supplied by Google as your initial DanceRep photo, if available. We retrieve it from Google and store a copy in our private Supabase storage. You can replace or remove it in Settings; a removed or chosen photo is not automatically overwritten on later sign-ins. Recipients of your shared moves can see your username and profile photo. This provides the account and sharing features under Article 6(1)(b) GDPR.

The app first stores your boards, moves, practice stages, tags, notes and settings on your device. With an account, board data and finished, compressed clips are privately synchronized through Supabase so they can be available on other devices. A video selected from your photo library is processed locally; the original is not uploaded to our servers. The app accesses your library only after your selection or permission. This processing and synchronization provide the app features you request under Article 6(1)(b) GDPR.

If you explicitly share a public Instagram Reel to DanceRep for import, the Reel URL is sent temporarily to our server so it can resolve the public video source. DanceRep does not store a server-side copy of the imported Reel during this step. The app downloads the video directly from Instagram's media delivery infrastructure to your device, then processes it like another selected video. The public source URL and limited source metadata, such as the creator handle, may be stored with your move and synchronized with your board. This processing is initiated by you and provides the requested import feature under Article 6(1)(b) GDPR.

When you share a move, its name, notes, selected tags, recording date and clip become available to signed-in people with the link. Share links expire after seven days and can be revoked earlier. If someone imports the move, an independent copy is created in their account. Deleting your link or account later does not delete that copy.

For safe sharing, we store your chosen username, the accepted version of the terms and time of acceptance, import relationships and blocks. For a report, we store the reason, any description you provide and a snapshot of the shared content. Authorized administrators can inspect that snapshot and its clip. Moderation decisions and media access are logged. Email notifications to moderators contain only a case ID and a link to the protected dashboard.

Open reports are kept until they are handled. Closed reports and associated moderation notes are removed after 30 days at the next administrative review. Account deletion removes linked reports as described below. See the terms of use for the content rules.

The app uses Sentry for operation and error analysis. Technical device, app and crash data may be processed. Touch logs are discarded and network details are reduced to the method, status and broad service endpoint. Email addresses, move names, request bodies, tokens and private storage paths are intended to be excluded from error reports. The legal basis is Article 6(1)(f) GDPR; our legitimate interest is a secure and reliable app. Supabase processes synchronization and authentication data on our behalf. The providers offer safeguards for possible transfers outside the EEA, including EU standard contractual clauses.

To delete your entire account: You can delete your account in the app under Settings → Privacy and deletion, or request deletion without the app on our account deletion page. This removes account access, private boards and moves, stored clips, shares and attributable product analytics data. Original videos in your device's photo library remain untouched. Independent copies already imported into other accounts remain. Records required by law or technical security logs may be retained only for as long as necessary for those purposes.

4a. Deletion requests and recovery backups

Account data is retained for the life of the account. Content is retained while you use it in DanceRep unless you arrange for its earlier deletion. You can remove individual moves and your profile photo in the app. You can also request deletion of selected data without deleting your account. Information needed to operate the remaining account is retained.

To recover from technical failures, we also create encrypted database and private-file backups on a separate server. They can contain the same account data and content as the active system.

Encrypted recovery backups may still contain older copies after deletion from active systems. They leave those backups through the daily, weekly and monthly retention rotation. Backup deletion is therefore not immediate. We explain the applicable backup retention and remaining deletion date when handling your request; any restoration must take completed deletion requests into account.

We handle requests manually and respond without undue delay, normally within one month of receipt. If a complex request requires an extension, we explain why within that first month; the legal extension can be up to two additional months. We tell you when deletion is complete and which data, if any, must still be retained.

To handle a request, we process your contact address, the data you identify, necessary identity verification information and the processing history. The legal basis is compliance with our data protection obligations (Article 6(1)(c) GDPR). After completion, we retain only evidence necessary to demonstrate fulfilment of these obligations or establish, exercise or defend legal claims. Its scope and retention depend on that purpose and the applicable periods. You can ask us for the period applicable to your case.

Copies already imported by other people are not automatically removed when the source account deletes content. This does not exclude statutory erasure or other data protection rights concerning those copies; please identify affected content in your request.

5. Product analytics and improvement

The app records selected usage and product events. After sign-in these events are linked to the account through an internal user ID and are therefore not anonymous. Events include app starts and later active use, onboarding steps, creating, deleting and moving moves, the extent of tag use, opening practice mode, filter use, outcomes of local video processing and backup, shares and imports, and the Plus funnel including paywall views, plan selection, purchase starts, completions or cancellations and reaching the Free limit.

Event properties are technically restricted and do not include email addresses, move names, notes, specific tag labels, share tokens, local file paths or video or audio content. App version, build number, platform, a coarse action source, counts and technical failure codes may be included. To preserve events during temporary connectivity problems, the app keeps a bounded local queue of at most 500 such events and sends them to Supabase after sign-in.

The account-linked analysis is used to measure return and retention, understand key flows and drop-off points, identify technical problems and improve features or product variants using actual usage. We rely on Article 6(1)(f) GDPR for the processing of personal analytics data. Our legitimate interest is the data-informed, economically sustainable and user-oriented improvement of DanceRep using a limited set of predefined first-party events. This product analysis does not use advertising tracking, cross-app tracking or fingerprinting. You may object to processing based on this ground through our protected contact form; we assess and implement objections as required by law.

For quality and safety checks during testing, the authorized administrator may also inspect synchronized move names, notes, tag labels and the compressed clip produced by DanceRep. The original video from the device library is not uploaded. Clip previews use short-lived private links; moderation access is logged separately.

Attributable product events are deleted together with the account at the latest, unless a higher-ranking legal duty applies. They may be deleted earlier or aggregated into statistics that can no longer be linked to an individual. Valid deletion and objection requests are also taken into account.

Technical crashes and errors are processed through Sentry. In the beta and production apps, approximately 10% of performance traces measure app startup times (cold and warm starts), screen navigation, video processing, upload waiting and transfer times, and synchronization attempts. These measurements use fixed technical categories without board content, video URLs, purchase data or route parameters. Performance tracing is disabled in development. The app does not deliberately attach the DanceRep user ID to Sentry events and automatic Sentry session tracking is disabled. Touch logs are discarded and network details are limited to the method, status and broad service endpoint. Visible email addresses, move names, request bodies, tokens and private storage paths are intended to be excluded from error reports.

6. Optional Google questionnaires

After access is granted, the beta page may link to optional Google Forms questionnaires. A connection to Google is made only when you open one of those links. The forms ask for the neutral tester code and are prepared not to collect email addresses. Please do not submit videos, passwords or confidential move content. Google's privacy information shown there also applies.

7. Cookies, analytics and external content

This website does not use analytics or marketing cookies. We do not run general website audience measurement or load external fonts. After sign-in, the administrator dashboard uses only a short-lived, technically necessary session cookie protected by HttpOnly. Private clips are loaded directly from private Supabase storage only after a deliberate administrator action. The language selector stores your chosen language in a preference cookie.

8. Your rights

Subject to the legal requirements, you may request access, rectification, erasure, restriction of processing and data portability. You may also object to processing under Article 6(1)(f) GDPR for reasons relating to your particular situation.

You may lodge a complaint with a data protection supervisory authority, in particular in the place where you normally live, work or believe an infringement occurred.

9. Updates

We update this policy when the website, services or legal requirements change.