Hockey Beats

HOCKEY BEATS

Privacy Policy

Effective Date: 24 October 2026
Version: 1.1
Website: https://hockeybeats.app

1. Introduction

At Hockey Beats, we respect your privacy and are committed to protecting your personal data.

This Privacy Policy explains how we collect, use, store, share, and protect personal information when you visit our website, create an account, play games, connect supported music services, use camera-based tracking, or interact with other features of Hockey Beats.

It also explains your rights under applicable data protection laws, including the General Data Protection Regulation (EU) 2016/679 ("GDPR").

Hockey Beats is operated by:

DRIXTON s. r. o.
Mudrochova 7480/15
831 06 Bratislava – Rača
Slovak Republic

Company Registration Number (IČO): 53874871
Tax Identification Number (DIČ): 2121518399
VAT Identification Number: SK2121518399

Privacy contact: studio@drixton.com
Website: https://hockeybeats.app

DRIXTON s. r. o. is the controller of personal data processed for the purposes described in this Policy, unless otherwise stated.

2. Scope of This Privacy Policy

This Policy applies to personal data processed through:

This Policy does not replace the privacy policies of third-party providers, such as Google, Apple, Spotify, or payment processors.

3. Categories of Personal Data We Process

Depending on how you use Hockey Beats, we may process the following categories of personal data.

3.1 Account and authentication data

When you register or sign in, we may process:

Authentication is supported by Supabase Auth.

We do not need to know your plaintext password to authenticate your account.

3.2 Google and Apple sign-in

Hockey Beats supports:

If you choose Google or Apple authentication, the provider may share information necessary to create or authenticate your account, such as an account identifier, email address, or other permitted profile information.

The information shared depends on the provider and your settings.

Apple may provide a private relay email address.

We do not receive your Google or Apple account password.

Google and Apple process information under their own applicable privacy notices.

3.3 Email verification

Users registering with an email address and password must verify their email address through a verification link before their first successful sign-in.

We process the information necessary to send and validate that verification request and to maintain the security of the authentication process.

3.4 Profile and personalization data

We may store:

3.5 Gameplay and progression data

We may process:

3.6 Music-related information

Where you use music features, we may process:

We do not claim ownership of your external music accounts or subscriptions.

3.7 Website usage and visit records

Our internal visit-tracking system records:

These records are stored in the page_views table in Supabase.

Because visit records can include a username, they are personal data and are not treated as anonymous.

3.8 Technical and security information

Our hosting, authentication, and infrastructure providers may process technical information necessary to operate and secure the Service, such as:

The precise information processed depends on the relevant provider, technical configuration, and the user's interaction with the Service.

We use this information only where there is an appropriate legal basis and in accordance with applicable law.

3.9 Customer support information

If you contact us, we may process your email address, the content of your request, and information reasonably necessary to investigate and respond.

3.10 Subscription and payment information

Hockey Beats plans to introduce paid subscriptions through a payment service provider, potentially Stripe.

Stripe payment processing is not currently implemented as part of the confirmed technical setup.

When paid checkout is introduced, we will update the relevant privacy information to explain the payment provider, categories of payment and billing data, processing purposes, recipients, and applicable retention periods before processing begins.

We do not represent that Hockey Beats currently collects or processes payment card details through Stripe.

4. Camera-Based Ball Tracking

4.1 Local processing

Hockey Beats uses camera-based tracking to detect the position of a hockey ball during gameplay.

Under the current implementation, camera frames are processed locally in the user's browser using JavaScript and browser-based Canvas technology.

Raw camera images and videos are not uploaded to Hockey Beats servers or stored by Hockey Beats as part of the ball-tracking process.

Frames are processed in real time and discarded.

4.2 Camera permissions

Camera access requires permission through your browser or device.

You may manage or revoke that permission through the relevant browser or device settings.

If you do not grant camera permission, camera-dependent gameplay features may be unavailable.

4.3 Remote Phone Camera

Remote Phone Camera is available to both Free and Premium users.

Under the current implementation, the remote device transmits numerical ball-tracking coordinates, such as X and Y positions, to support gameplay.

It does not transmit raw camera video to Hockey Beats servers as part of this functionality.

A session identifier may be stored locally to establish or maintain the connection.

4.4 Privacy considerations

Although raw camera frames are not uploaded, the use of camera permissions and tracking functionality may still involve technical information processed by your browser, device, or associated infrastructure.

You should use the camera in a suitable environment and respect the privacy of other people.

5. Gameplay, Scores, and Leaderboards

Hockey Beats processes gameplay information to:

Scores may be associated with usernames and displayed to other users through leaderboard functionality.

Users should avoid choosing usernames that reveal sensitive personal information.

6. Analytics and Website Visit Tracking

6.1 Vercel Analytics

Hockey Beats uses Vercel Analytics to understand website usage and performance.

The integration is intended to provide privacy-oriented, aggregated website analytics without Hockey Beats setting advertising or analytics tracking cookies through this integration.

Technical data may nevertheless be processed by the analytics provider in accordance with its service configuration and applicable privacy requirements.

6.2 Internal visit tracking

Hockey Beats also operates an internal visit tracker.

This system stores the visited page path, username where available, and timestamp in Supabase.

Unlike aggregated analytics, these records can be associated with an identifiable account and therefore constitute personal data.

6.3 Retention

Internal page_views records are automatically deleted after 90 days under the configured daily deletion process.

Technical infrastructure logs may have different retention periods determined by their purposes and provider configurations.

7. Cookies and Browser Storage

Hockey Beats uses cookies and browser storage to support authentication-related functionality, settings, game progress, and other features.

7.1 Username cookie

Hockey Beats uses a cookie named:

hb_username

Its purpose is to retain the user's username for relevant account and interface functionality.

The cookie is configured with a maximum lifetime of approximately one year.

It is not used by Hockey Beats as an advertising cookie.

7.2 Local storage

The current application uses the following browser local-storage keys:

sportqo_engagement

Stores gameplay engagement information, such as XP, streaks, games played, and achievements.

sportqo_user_settings

Stores user preferences, including username, platform, and selected music service.

sportqo_music_history

Stores information about previously played music tracks.

hb_friends

Stores friends-related information.

ballTracker_calibration

Stores camera and ball-tracking calibration settings.

hb_remote_session

Stores a session identifier used for Remote Phone Camera functionality.

7.3 Essential and optional storage

Storage used to provide a service expressly requested by the user may be necessary for that service to function.

Where non-essential cookies or similar technologies require consent under applicable law, we will obtain that consent before using them.

Hockey Beats does not currently use its own advertising or behavioral advertising cookies under the confirmed implementation.

Third-party services may use their own storage mechanisms when you interact with them.

7.4 Managing storage

Users can manage or delete cookies and local-storage data through their browser settings.

Removing certain stored information may reset preferences, affect locally saved progress, or require users to sign in or configure features again.

8. Supabase Database and Authentication

Hockey Beats uses Supabase for database and authentication functionality.

The confirmed database configuration uses EU-hosted infrastructure.

The principal application tables include:

8.1 user_data

May contain:

8.2 scores

May contain:

8.3 page_views

Contains:

8.4 beat_maps

Contains game-related music metadata, such as:

Beat-map information is not inherently personal data, although associated account or usage information may be personal data depending on the context.

8.5 Supabase Auth

Authentication may involve:

Supabase processes relevant data according to its role, contractual arrangements, and applicable data protection requirements.

9. Purposes and Legal Bases of Processing

We process personal data only where an appropriate legal basis applies.

9.1 Performance of a contract — Article 6(1)(b) GDPR

Where necessary to provide the Service requested by a user, we process information for:

9.2 Legitimate interests — Article 6(1)(f) GDPR

Where our interests are not overridden by users' rights and freedoms, we may process information for:

Where children are involved, their interests and rights receive particular consideration.

Users have the right to object to processing based on legitimate interests in accordance with applicable law.

9.3 Consent — Article 6(1)(a) GDPR

Where consent is the appropriate legal basis, we may rely on it for optional processing activities.

Consent must be freely given, specific, informed, and unambiguous.

Users may withdraw consent at any time, without affecting the lawfulness of processing performed before withdrawal.

Where parental consent is required for a child, we must take reasonable steps to obtain and verify it in accordance with applicable law.

Browser camera permission is a technical device permission and does not, by itself, replace any GDPR consent that may be legally required.

9.4 Legal obligations — Article 6(1)(c) GDPR

We may process information where necessary to comply with applicable legal obligations, including accounting, tax, consumer protection, and lawful regulatory requirements.

10. Children and Parental Consent

Hockey Beats is intended for users aged 13 and older.

Children under 13 must not create an account or use the Service.

Users aged 13 to 15 must have permission from a parent or legal guardian to use Hockey Beats.

In Slovakia, Article 8 GDPR consent for information society services may be given independently from age 16.

Where we rely on consent for processing subject to Article 8 GDPR, the necessary parental authorization must be obtained for younger users through an appropriate verification process.

A child selecting a checkbox stating that parental permission has been obtained does not, by itself, establish verified parental consent.

Different rules may apply in other jurisdictions.

We aim to minimize personal data processing involving minors and to provide information in language that is understandable to younger users.

Parents or guardians may contact studio@drixton.com regarding a child's account or personal data.

If we learn that personal data has been processed without a required legal basis or authorization, we will take appropriate steps under applicable law.

11. Third-Party Music Services

11.1 Apple Music

Hockey Beats supports optional Apple Music integration through MusicKit.

When a user connects Apple Music, relevant authorization and playback-related information may be processed to provide the requested integration.

Apple independently processes information under its applicable privacy policies and terms.

11.2 Spotify

Hockey Beats contains technical support for Spotify connectivity, but public use within the game remains subject to Spotify's applicable requirements and any necessary permissions.

Spotify integration will be made available only where legally and contractually permitted.

Where implemented, relevant authentication and music-related information may be processed to support the connection.

11.3 Disconnecting music services

Users can disconnect supported music services through Settings.

Under the current implementation, disconnecting a music service clears the associated music history stored by Hockey Beats.

Disconnecting a service does not necessarily delete information independently retained by the external music provider.

Users may need to manage third-party authorizations separately through the relevant provider's account settings.

12. Data Sharing and Service Providers

We may disclose personal data to service providers where reasonably necessary to operate Hockey Beats and where an appropriate legal basis exists.

Relevant providers include:

Vercel: Website hosting, infrastructure, and analytics.

Supabase: Database hosting, authentication, and related backend services.

Google: Optional Google account authentication.

Apple: Optional Apple account authentication and Apple Music integration.

Spotify: Optional music connectivity if and when lawfully available.

Payment providers: Payment processing when paid checkout functionality is introduced.

Service providers may act as processors or independent controllers depending on the specific processing activity.

Where required, we use appropriate contractual and organizational safeguards.

We do not sell users' personal data to advertisers.

We may disclose information where required by applicable law, a valid legal request, or to protect legal rights, subject to applicable safeguards.

13. International Data Transfers

Hockey Beats uses EU-hosted Supabase database infrastructure under the confirmed configuration.

However, some providers, support operations, authentication services, or other technical processing may involve access to or transfers of personal data outside the European Economic Area.

Where GDPR transfer restrictions apply, we will use an appropriate legal transfer mechanism, such as:

Additional safeguards will be applied where required.

Users may contact studio@drixton.com for information about relevant transfer safeguards.

14. Data Retention

We retain personal data only for as long as necessary for the purposes for which it was collected, subject to applicable legal obligations.

14.1 Account and profile data

Account-related and profile information is generally retained while the account remains active and until it is deleted, unless a different lawful retention period applies.

14.2 Scores and achievements

Scores, XP, streaks, levels, and achievements are retained while the relevant account exists, subject to account deletion and any lawful retention requirements.

14.3 Internal page views

Records in the page_views table are automatically deleted after 90 days through the configured daily deletion process.

14.4 Local browser storage

Local-storage information remains on the user's device until removed by the application, cleared by the user or browser, or otherwise affected by the relevant browser's storage behavior.

The hb_username cookie has a configured maximum lifetime of approximately one year.

14.5 Camera frames

Raw camera frames are processed locally and discarded in real time.

Hockey Beats does not retain raw camera photographs or videos as part of its ball-tracking functionality.

14.6 Support requests

Support correspondence is retained for as long as reasonably necessary to resolve the request, maintain appropriate records, and comply with applicable obligations.

14.7 Authentication records and technical logs

Authentication records, technical logs, and backups may be subject to separate retention schedules determined by operational needs, provider configurations, security requirements, and applicable law.

Such records will not be retained indefinitely without an appropriate justification.

14.8 Legal retention

Where personal data must be retained to satisfy a legal obligation or establish, exercise, or defend legal claims, relevant information may be retained for the legally justified period.

15. Account Deletion

Users can initiate account deletion through:

Settings → Delete my account and all data

The process includes a double-confirmation step.

The current account deletion endpoint is:

DELETE /api/account

Under the confirmed implementation, the deletion process removes associated records from:

Deletion of authentication records, other linked records, provider-held information, and backup copies must be handled according to their actual technical configuration and applicable law.

Some information may need to be retained temporarily or for a legally required period.

Where immediate deletion is not technically possible, we will apply appropriate restrictions and deletion schedules consistent with applicable law.

Users may also request deletion by contacting:

studio@drixton.com

We will assess and respond to requests in accordance with applicable data protection law.

16. Your GDPR Rights

Where GDPR applies, you may have the following rights:

16.1 Right of access

You may request confirmation of whether we process your personal data and obtain access to relevant information.

16.2 Right to rectification

You may request correction of inaccurate personal data and completion of incomplete information.

16.3 Right to erasure

You may request deletion of your personal data where the conditions established by applicable law are satisfied.

16.4 Right to restriction

You may request restriction of processing in circumstances provided by law.

16.5 Right to data portability

Where applicable, you may request personal data in a structured, commonly used, machine-readable format and have it transmitted to another controller where technically feasible.

16.6 Right to object

You may object to processing based on legitimate interests, including profiling based on that legal basis, in accordance with applicable law.

16.7 Right to withdraw consent

Where processing is based on consent, you may withdraw that consent at any time.

Withdrawal does not affect the lawfulness of earlier processing.

16.8 Automated decisions

You have rights concerning certain decisions based solely on automated processing, including profiling, where Article 22 GDPR applies.

16.9 Right to complain

You may lodge a complaint with a competent data protection supervisory authority.

In Slovakia, the competent supervisory authority is:

Úrad na ochranu osobných údajov Slovenskej republiky
(Personal Data Protection Office of the Slovak Republic)

You may also contact the competent supervisory authority in another EU Member State where applicable.

16.10 Exercising your rights

To exercise your rights, contact:

studio@drixton.com

We may request information reasonably necessary to verify your identity before fulfilling a request.

We will respond within the deadlines required by applicable law, generally within one month under the GDPR, subject to permitted extensions.

17. Data Security

We use technical and organizational measures intended to protect personal data against unauthorized access, accidental loss, alteration, disclosure, or destruction.

These may include:

No online service can guarantee absolute security.

We review and adapt safeguards as appropriate to the risks associated with the processing.

Where a personal data breach triggers legal notification obligations, we will comply with the applicable requirements.

18. Automated Gameplay Processing

Hockey Beats uses automated technical processes to:

These processes are intended to provide interactive game functionality.

Under the current design, they do not ordinarily produce legal effects or similarly significant effects on users within the meaning of Article 22 GDPR.

If future functionality introduces automated decision-making subject to additional legal requirements, we will provide the necessary information and safeguards.

19. Changes to This Privacy Policy

We may update this Privacy Policy to reflect changes in:

The updated version and effective date will be published on our website.

Where a change requires additional notice or consent under applicable law, we will provide it before the relevant processing begins.

20. Contact

For questions about this Privacy Policy, personal data, account deletion, parental requests, or your data protection rights, contact:

DRIXTON s. r. o.
Mudrochova 7480/15
831 06 Bratislava – Rača
Slovak Republic

Company Registration Number: 53874871
VAT ID: SK2121518399

Email: studio@drixton.com
Website: https://hockeybeats.app

End of Privacy Policy — Version 1.1