boxprepEffective from: 10.11.2026
Version: 1.0 (beta)
This is an English translation. If it differs from the Estonian version, the Estonian version prevails.
In short
- What we collect: your profile and measurements, your video without sound, AI findings and clips, your and your coach's ratings.
- Who sees it: of people, only you and the coach you send a link to yourself. The AI analysis is done by Google Gemini on the paid tier, which does not use your video to train its models.
- How long: the original video is deleted 30 days after the analysis, clips and findings stay until you delete them.
- How to delete: in the app, Seaded (Settings), "Kustuta video" (Delete video) or "Kustuta konto" (Delete account).
- Where to write: tugi@boxprep.app.
1. Who we are and how to contact us
The controller is the operator of the boxprep service, Henri Ots, a private individual in Estonia ("boxprep", "we"). The postal address is provided on request (tugi@boxprep.app). If a company starts providing the service, we will update this section and tell you in the app.
Contact for all personal data questions: tugi@boxprep.app. We reply within one month at the latest.
We have not appointed a data protection officer at present.
2. Whose data we process
- The user (boxer) who installs the app and uploads a video of their own training or bout.
- Other people in the video: sparring partner, opponent, coach and people in the gym who happen to be in the frame. They do not use the app themselves.
- The coach the user sends a sharing link to. The coach does not create an account.
- The opponent whose data (nickname, measurements, notes) the user enters to make a plan.
3. What data we collect
3.1 User data
You can scroll the table sideways.
| Category | Data | Source |
|---|---|---|
| Account and device | user identifier, random device identifier created by the app, sign in token, display name, creation time; if you allow notifications and the app is the store version, also the device push token and platform (iOS or Android) | the app creates it on first launch; the push token after you allow notifications |
| Profile and body measurements | height, weight, reach, stance (orthodox or southpaw), experience, number of bouts, date of the next bout, whether a measurement is measured or estimated, age confirmation (at least 18) | entered by the user |
| Videos | original file without sound (sound and file metadata, such as the location saved by the phone, are removed right after upload), a 720p copy made from it without sound, duration, dimensions, title, recording time, type (sparring, bout, shadowboxing, bag work), the "which one are you" description (such as glove colour), the partner's nickname and identifying feature, the user's question | uploaded by the user |
| Analysis results | findings (recurring behaviour, strength, next task), timestamps, evidence clips of about 6 seconds and thumbnails, the decision of two AI checks, the name of the model used | created during analysis |
| Ratings and notes | the user's rating of a finding (agree, not right and the reason, comment), the coach's rating and comment, corner card, review of plan keys, gym mode round answers | entered by the user and the coach |
| Opponents | nickname, height, reach, weight, stance, style type, notes | entered by the user |
| Consent records | partner's nickname, role, method (user confirmation, given in the app, public competition), text version, time, time of withdrawal | the user confirms before upload |
| Coach links | coach's name (if the user gives it), the link's random identifier and six digit code, whether the full video is included, validity, status, how many times and when the link was opened (without IP address or device) | created by the user; the open count and time arise when the coach view is opened |
| Analysis job status | stage, progress, error code, timestamps, whether a notification has been sent | created during analysis |
| Unfinished upload | file size and name, form fields (as for a video), the part of the file already received | the app, until the upload finishes or is cancelled |
| Technical logs | server error messages and service status (such as an analysis failure or an interrupted upload with its identifier); the app request log, which would contain IP addresses and links, is turned off both in the web server and in the application server | server |
| Website visits | for boxprep.app pages: time of the request, address (path without the query string; the coach link identifier is removed), response code and size, referrer (the page you came from, without the query string), browser type; no IP address, cookies or other headers are stored, so a visit cannot be linked to a person | web server when a page is opened |
| Feedback | type (idea, bug or other), the text you write, time of sending and the app or page language; for a bug also the app screen, app version and platform (iOS, Android or web); for feedback sent from the app while signed in, the user identifier. We do not ask for or store an email address or an IP address. Please do not write other people's names in the text | the user sends it from the app (Settings, Send feedback) or from the form on the website support page |
Only on the user's phone (does not reach our server): marks for clips already reviewed, the state of an unfinished upload (so the upload can resume), analyses being followed (to notify), the device identifier and sign in token. They are deleted when the account is deleted or the app is removed.
3.2 Data of other people in the video
The video the user uploads also shows other people: their appearance, movement and punches. We do not store their voice: sound is removed right after upload, before the file reaches the analysis. We do not ask for their name. The user gives the partner a nickname and an identifying feature (such as "red gloves") so the analysis knows which boxer is the user.
3.3 What we do not collect
We do not collect email addresses, phone numbers, location, contacts, advertising identifiers or payment data. The app and the website have no ads, no cookies and no third party analytics. For usage we only look at aggregate counts on our own server (for example how many videos, analyses and page views per day), which contain no names or identifiers. The notification that an analysis is ready is shown by the phone itself (local notification); a message from the server is sent only if that is turned on and you have allowed notifications (section 6).
4. For what purpose and on what basis
You can scroll the table sideways.
| Purpose | Data | Legal basis (General Data Protection Regulation, GDPR) |
|---|---|---|
| Providing the service: video analysis, findings, your own page, opponent plan, gym mode | user data from section 3.1 | Article 6(1)(b), contract with the user |
| Using the movement of other people in the video as context for the user's analysis | the partner's and opponent's image and movement, nickname, identifying feature | Article 6(1)(f), legitimate interest (the user's interest in analysing their training and our interest in providing the service) with the safeguards in section 5; if the partner gives consent in the app, Article 6(1)(a) |
| Opponent plan | opponent data entered by the user | Article 6(1)(f) |
| Sharing with the coach | coach's name, the coach's ratings and comments | Article 6(1)(b) for the user and point (f) for the coach |
| Security and preventing misuse | technical logs, sign in tokens | Article 6(1)(f) |
| Reading feedback, fixing bugs and developing the service | feedback | Article 6(1)(f), legitimate interest (fixing bugs in the service and developing it based on users' suggestions) |
| Improving the service based on aggregate counts (whether the service works and whether it is used) | analysis job status, reviews and coach link opens as counts, website visits | Article 6(1)(f), legitimate interest |
| Legal obligations (such as accounting, if payments are added) | invoice data | Article 6(1)(c) |
We do not use videos or findings to train AI models or to improve the rule set. If this changes in the future, we will ask for separate consent, off by default.
Balancing of legitimate interest for videos of other people: the processing is analysis of private training, not publication; of people, only the user and the coach they invite see the video; findings are made only about the user (the analysis prompt explicitly tells the AI model not to make findings about the partner; the opponent plan is made from the measurements and style type entered by the user, not from a video of the opponent); faces are not recognised; sound is not stored or sent to the AI service; a person can request deletion of the part concerning them.
5. Videos, body data and special categories of data
- There is no face recognition. boxprep does not identify people by face, body shape or voice, does not create biometric templates and does not link the same person across videos of different users. There is no search like "is this boxer already in the system". The user says which boxer they are by describing their clothing.
- The video itself is not biometric data within the meaning of Article 9 of the General Data Protection Regulation, unless it is processed technically to uniquely identify a person. The European Data Protection Board guidelines 3/2019 on video devices are interpreted this way: video is not biometric data in itself (EDPB guidelines 3/2019). For this reason we do not treat the analysis of movement and punches as processing of special categories of data.
- Body measurements (height, weight, reach) are needed for tactics and comparing measurements. We do not ask for health data, injuries or treatment. A video may show an injury or other health condition by chance; we do not analyse it separately.
6. Who we share data with
We do not sell data or share it for advertising.
- Google (Gemini API, paid tier) analyses the video as our processor. We send: the 720p copy without sound and its 6 second windows, the user's "which one are you" description, the partner's identifying feature or nickname, the video type and duration and the user's question. We do not send the user's name, body measurements or earlier findings. Under Google's terms, prompts and responses of the paid service are not used to improve Google's products, they are processed under the data processing addendum, Google logs them for a limited time only to detect violations, and data may be stored or cached temporarily in any country where Google or its agents have facilities (Gemini API additional terms). The uploaded file is deleted from Google's file service right after the analysis; if that fails, Google deletes it automatically after 48 hours.
- Expo (650 Industries, Inc., USA) and Apple or Google, only if server notifications are turned on and you have allowed notifications: we send the device push token, the text of the message ("Your three things are ready" or "The analysis failed") and the video identifier so the app opens the right view. The message contains no name, findings, measurements or video.
- Server and file storage provider: Hetzner Online GmbH (Germany). The server and files are located in Hetzner's data centre in Helsinki, Finland (European Union). The registrar of the domain boxprep.app is Zone Media OÜ (Estonia); no app data is passed to the registrar.
- The coach the user sends a link or code to themselves. The coach sees the user's page, the findings and evidence clips of analysed videos, opponent plans and corner cards, and can confirm or reject findings and plan keys. The coach sees the full video only if the user includes it when creating the link, and only while the original still exists (section 7). A clip on the coach's screen can technically be recorded; the app asks the coach not to do this, but cannot prevent it.
- Apple and Google as app store providers under their own terms.
- Authorities, if the law requires it.
6.1 Transfers outside the European Economic Area
Our server and file storage are in the European Union (Finland). On the paid tier of the Gemini API, Google may store or cache data temporarily also outside the European Economic Area (see section 6 point 1). In that case the transfer is based on Google's data processing addendum and the safeguards named in it.
The consent screen in the app says the same: the server is in the European Union and the AI analysis in Google's paid service may also take place outside the European Union. With a server notification (section 6 point 2), the device token and message text go to the USA through Expo.
7. How long we keep data
You can scroll the table sideways.
| Data | Retention |
|---|---|
| Sound | not kept: removed right after upload, before the analysis; the part of an unfinished upload (with sound) is deleted within 24 hours at the latest |
| Original video (without sound) and 720p copy | deleted automatically 30 days after the analysis is finished; earlier if the user deletes the video or the account. The app shows the date next to the video |
| Evidence clips, thumbnails, findings, ratings | until the user deletes the video or the account |
| Unfinished upload | up to 24 hours after the last part received, then the partial file is deleted automatically; immediately on cancel |
| Push token | until the account is deleted or until Apple or Google reports that the token is no longer valid |
| File in Google's file service | deleted right after the analysis, automatically after 48 hours at the latest |
| Google's violation log | the limited time set by Google (Gemini API additional terms) |
| Profile, opponents, corner cards | until the account is deleted |
| Consent records | until the account is deleted; a withdrawn consent stays as a record together with the time of withdrawal |
| Coach link | 30 days by default, the user chooses 1 to 365 days and can revoke it at any time; the six digit code is valid for 48 hours; the record is deleted with the account |
| Sign in tokens | until the account is deleted |
| Technical logs | limited by size: up to 50 MB per server service (five files, each up to 10 MB), older lines are deleted automatically; there is no time limit, so with little traffic a line may remain for several months; in server backups up to 7 days longer |
| Website visits | up to 30 days: the log starts a new file every day and files older than 30 days are deleted automatically; in server backups up to 7 days longer |
| Feedback | up to 12 months from sending, then deleted automatically; feedback sent from the app while signed in is also deleted when the account is deleted; in server backups up to 7 days longer |
| Backups | server backup (videos, clips, database) up to 7 days (Hetzner daily backup, 7 copies). On deletion the app says: "deleted from server backups within 7 days" |
Once the original is deleted, the evidence clips (about 6 seconds, 720p, without sound), findings and their ratings remain; after that there is no full video, not even through the coach link.
8. Your rights
You have the right to:
- know what data we process about you and get a copy of it;
- have incorrect data corrected (you can change your profile yourself in the app);
- have your data deleted;
- restrict processing;
- object to processing based on legitimate interest;
- receive your data in a machine readable form (data portability);
- withdraw consent at any time where processing is based on consent; this does not affect the lawfulness of earlier processing;
- lodge a complaint with the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, www.aki.ee, info@aki.ee) or go to court.
In the app you can yourself: delete a video, delete your account, change your profile, revoke a coach link, withdraw a partner consent record and download an export of your data. For anything else, write to tugi@boxprep.app.
If you are in a video but are not a user (sparring partner, opponent, coach, person in the gym): write to tugi@boxprep.app and describe the time and place of the video and your clothing. Since we do not identify people by face, we cannot find you ourselves; we use your description and ask the user if needed. We delete the parts concerning you or the whole video if your interest outweighs.
9. Deletion
- Deleting a video (in the app "Kustuta video", Delete video): immediately deletes the original, the 720p copy, evidence clips, thumbnails, findings, ratings and the analysis job record. It is deleted from server backups within 7 days.
- Cancelling an upload (in the app "Tühista laadimine", Cancel upload): immediately deletes the part of the file that reached the server.
- Deleting the account (in the app Settings, "Kustuta konto", Delete account): immediately deletes all videos and files, the profile, opponents, consent records, coach links (the link stops working), corner cards, sign in tokens, push tokens, unfinished uploads and the data kept on the phone. It is deleted from server backups within 7 days. This cannot be undone. Instructions are also on the support page.
- A corner card printed by the coach or saved as a screenshot stays with the coach; we have no control over it.
- Withdrawing consent (in the app next to the partner's consent): you can no longer upload a new sparring video with that consent. Videos already uploaded where the partner is visible, delete them yourself in the app or write to tugi@boxprep.app and we will delete them for you.
10. Minors
boxprep is meant for people aged 18 and over. The user confirms in the app that they are at least 18, and without this confirmation a video cannot be uploaded. Do not upload a video with a partner or opponent under 18. If we learn that a user is a minor or that a minor is in a video, we delete the related data.
In Estonia the age limit for a child's own consent for an information society service is 13 years (Personal Data Protection Act and Article 8 of the General Data Protection Regulation), but the boxprep service is based on a contract, also concerns other people and is linked to a full contact sport, so 18 years is the more careful choice.
11. Security
- Every video, clip and finding is tied to one account; other users do not see them.
- Media files open only with a signed link that is valid for 1 hour.
- The coach link is based on a long random identifier and expires; the user can revoke it at any time. The six digit code for manual entry is valid for 48 hours and the number of wrong attempts is limited.
- Data is transferred encrypted (HTTPS).
- There is no public feed, public profile or search.
- A clip on the screen can technically always be recorded; that is why you should send the coach link only to a person you trust.
12. Changes
If we change this policy, we will update the date and version. We will tell you about significant changes (such as a new processor or a new purpose) in the app before the change takes effect.
13. Contact
Service operator and controller: Henri Ots, a private individual in Estonia
The postal address is provided on request (tugi@boxprep.app).
Email: tugi@boxprep.app