Privacy & data
Plain-language summary of how ReplayDelay handles video and personal data. This explains our design; a full legal policy and Data Processing Agreement (DPA) are provided to clubs. It is not legal advice.
Who is responsible
Your club decides why and how athletes are filmed, so under GDPR the club is the data controller. ReplayDelay only processes data on the club's instructions, so we are the data processor. We sign a DPA with each club setting this out.
The live feed is never recorded
The delayed replay on the coach screen is ephemeral. Video streams peer-to-peer from the phone to the screen (encrypted with WebRTC DTLS-SRTP) and is discarded as it plays. It is not written to disk anywhere unless a coach explicitly saves a clip.
Clips live only for the session
When a coach saves a clip, it exists during the session and for a 2-hour pickup window afterwards — so gymnasts and parents can download it via the session QR. Then both the file and its database record are deleted automatically. As a backstop, everything is deleted after 12 hours no matter what. There is no long-term video storage.
What we store — and what we don't
| We store | We do not store |
|---|---|
| Coach accounts: name, email, hashed password | Any account/login for gymnasts |
| Club name and stations | The live delayed video stream |
| Clips for up to 2 hours after the session | Passwords in plain text (bcrypt-hashed) |
| Basic technical logs for security/operation | Contact details or IDs of minors |
Minors & consent
Many gymnasts are children. ReplayDelay keeps their data footprint minimal by design — no accounts, no contact details, ephemeral feed, automatic deletion. The camera screen shows the consent terms before filming and reminds that under-18s require guardian consent, which the club is responsible for obtaining.
Security
HTTPS/TLS everywhere with HSTS; passwords bcrypt-hashed; club-scoped access to clips (login or kiosk/QR key); rate limiting and standard security headers; encrypted media transport; nightly database backups (video excluded — there is none to back up).
Where data lives
Everything is hosted on EU servers. Video streams directly between phone and screen where possible; on difficult networks traffic can relay encrypted through our EU server (TURN) without being stored. We never sell data or use athlete video for advertising or model training.
Your rights
The club can export its data at any time (Settings → Export) or delete the entire club including all data. Access/erasure requests go to the club as controller — we assist as processor.
Contact
Questions or requests: your club owner, or the support address shown in your dashboard.