Privacy Policy

This Privacy Policy explains how AS Labs Oy (Business ID 3637687-8, Vattuniemenkuja 3, 00210 Helsinki, Finland — “we”, “us”) processes personal data when you use the Toisto iOS application and this website. We are the data controller for this processing.

If you have any questions, contact us at support@toistogolf.com.

The short version

• Swing videos and photos you upload, coaching conversations, Coach Memory, and training plans are stored privately under your account, in Google Cloud data centers in the European Union.
• When you request AI analysis, your media and messages are processed by AI models to generate feedback. That processing may run in any Google Cloud region, including outside the EEA. Your content is not used to train AI models.
• We show no ads and never sell your data. This website sets no cookies.
• We use Firebase Analytics (Google) for aggregated product analytics (for example, subscription funnel and feature usage). We do not use that data for advertising.
• You can edit or delete coaching memories in the app, delete individual conversations, or delete your entire account instantly. Account deletion removes your chats, media, Coach Memory, plans, and sign-in. A limited subscription usage record (not your name, email, videos, or chats) may remain after that, and is dropped 90 days after the subscription’s last-known expiration.

What we collect

Account information

Toisto uses Sign in with Apple as its only sign-in method. When you sign in, we receive an Apple-provided user identifier and, if you choose to share it, your name and email address (which may be an Apple private relay address — this works normally with Toisto). Authentication is managed through Firebase Authentication. We use this information solely to operate your account and keep your content private to you.

Your content

When you use AI analysis, we store the content you provide:

• Swing videos and photos you upload
• Your chat messages and the AI’s responses, including timestamped swing segments
• Conversation metadata: sport, conversation title, timestamps, the AI model used, and token usage counts
• Conversation digests (short summaries of a coaching chat), when Coach Memory is on

Videos and photos are stored in Google Cloud Storage and conversation data in Google Cloud Firestore, both scoped to your account.

Recording, slow-motion replay, and clips saved to your Photos library happen on your device. That content never reaches our servers unless you explicitly upload it for AI analysis.

Coaching memory and training plans

When Remember me between sessions is on, we also store a coaching picture under your account so the coach can continue across chats:

• Coach profile — facts you provide or confirm, such as handedness, handicap, physical notes, equipment, goals, and coaching preferences
• Memory items — discrete personal facts or preferences (for example, from onboarding or from chats)
• Swing observations — technique findings from analyses (faults and strengths tagged by club or shot area)
• Coach-state notebook — internal working notes the coach uses between sessions. This notebook is not shown as an editor in the app
• Training plans — the program for a club or shot area you create (goals, drills, feels, and similar items), plus revision snapshots when a plan changes

You can view, edit, and delete profile fields and memory items in Settings → Coach Memory. Deleting a memory in the app removes that record. Turning the toggle off stops the coach from using or saving this long-term coaching data for later chats. Incognito Analysis chats are excluded from long-term memory (no profile, memory, observation, digest, or plan writes from that conversation); the messages and videos in that conversation still exist until you delete them.

Training plans are created and managed in Your Training. Deleting a plan removes that plan and its revisions; related conversations are kept and are no longer tied to the plan.

Two-device mode

When you connect two devices, video streams directly between them over your local network (using Apple’s peer-to-peer networking). This video does not pass through our servers and is not collected by us.

Subscriptions and App Store purchases

Subscriptions are purchased through Apple. Apple processes payment; we do not receive your card details. When you subscribe, restore, or the app refreshes your status, it sends Apple’s signed StoreKit transaction to our servers. We verify that signature ourselves against Apple’s root certificate and store the verified subscription fields we need to provide access and apply the AI coaching allowance: the original and current transaction identifiers, product identifier, App Store environment, whether the period is a free trial, and the purchase, original-purchase, expiration, revocation, renewal, and grace dates, plus when we last verified them. We derive this from the signed transaction — not from values the app declares — and we do not store App Store receipts.

We also keep a separate subscription usage record, keyed by the original transaction identifier (not by your name or email). It holds the current-period usage totals and dates, the paid billing-anniversary date, which Toisto account identifiers have been linked to that subscription, and the last-known expiration. One subscription can be linked to one Toisto account at a time; if you delete that account, the same subscription can later be linked to a new one. Family Sharing is not supported. The app shows only a percent of the allowance in Settings — never tokens or dollar amounts.

Product analytics

The iOS app uses Firebase Analytics to record events such as app opens, onboarding completion, paywall views, purchase outcomes, and high-level feature usage (for example, completing a recording session or an AI analysis). These events are used to understand product performance and are not used for advertising or cross-app tracking.

Bug reports and diagnostics

If you choose to submit a bug report, it includes your description plus technical context that helps us fix the problem: app version and build number, iOS version, device model, language/locale, timezone, and which screen you were on. If you report a problem with an AI conversation, a snapshot of that conversation is attached so we can reproduce the issue. Bug reports may also include a snapshot of the current AI-allowance period (including token and cost totals used for support).

Crash and performance diagnostics collected by Apple’s MetricKit remain on your device and are not automatically sent to us.

We do not track you across other companies’ apps or websites.

How we use your data

Purpose	Data used	Legal basis (GDPR)
Operating your account and keeping your content private	Account information	Performance of a contract (Art. 6(1)(b))
Generating AI coaching feedback you request	Your uploaded media and messages	Performance of a contract (Art. 6(1)(b)); you are asked to acknowledge AI processing before first use
Storing your conversations and media so you can return to them	Your content	Performance of a contract (Art. 6(1)(b))
Remembering you across coaching sessions and maintaining training plans you create	Coach profile, memory items, observations, digests, coach-state notebook, and training plans	Performance of a contract (Art. 6(1)(b))
Investigating and fixing problems you report	Bug reports and diagnostics	Legitimate interest in maintaining a working service (Art. 6(1)(f))
Understanding product usage and subscription funnel	Firebase Analytics events	Legitimate interest in improving the Service (Art. 6(1)(f))
Providing subscribed access and applying the AI coaching allowance	Verified StoreKit subscription fields and current-period usage totals	Performance of a contract (Art. 6(1)(b))
Securing the service and preventing abuse	Account and technical data	Legitimate interest (Art. 6(1)(f))

AI processing

When you submit media or messages for analysis, they are processed by Google AI services to generate coaching feedback. Content is stored in the EU at rest; that analysis is not pinned to an EU region. When Coach Memory is on, the same processing may update your coaching picture (profile, memories, observations, digests, notebook, and related training plans). Your content is used only to operate the Service for you and is not used to train AI models.

AI feedback is generated automatically. See our Terms & Conditions for important limitations on relying on it.

Who we share data with

We use the following processors to run the service. We do not sell personal data, and we do not share it with advertisers or data brokers.

• Google Cloud / Firebase (Google Ireland Ltd. / Google LLC) — cloud hosting, storage, database, authentication, AI processing, and Firebase Analytics.
  • Stored in the EU: Cloud Run in europe-north1 (Finland), Google Cloud Storage, and Firestore multi-region eur3.
  • Not pinned to the EU: Google AI services (analysis may run in any Google region); Firebase Authentication (Google operates this service in the United States); Firebase Analytics (may be processed by Google under its terms).
• Apple Inc. — Sign in with Apple, App Store distribution, and in-app subscription billing, under Apple’s own privacy terms.

We may disclose data if required by law or to protect the rights, safety, or property of our users or ourselves.

International transfers

Your content is stored in the European Union. When you request AI analysis, your media and messages are sent to Google AI services, which may process them outside the EU/EEA. Firebase Authentication and Firebase Analytics may also involve processing outside the EU/EEA. Where a processor (such as Google or Apple) transfers personal data outside the EU/EEA in the course of providing its service, such transfers are safeguarded by the European Commission’s Standard Contractual Clauses or an applicable adequacy decision, including the EU–US Data Privacy Framework.

Retention and deletion

• Conversations and media are kept until you delete them. Deleting a conversation removes its messages and associated media.
• Coach Memory (profile and memory items) is kept until you edit or delete it in Settings → Coach Memory, or until you delete your account. Deleting a memory in the app removes that record.
• Training plans (including revision snapshots) are kept until you delete the plan in Your Training, or until you delete your account.
• Swing observations, conversation digests, and the coach-state notebook are kept while Coach Memory is in use and are removed with your account (and are not written from Incognito Analysis chats).
• Verified subscription fields on your account (transaction identifiers, product, environment, trial or paid status, and the dates listed above) are kept while the account exists so we can apply subscribed access and the AI coaching allowance. They are removed when you delete your account.
• Subscription usage record (current-period totals and dates, paid billing-anniversary, linked Toisto account identifiers, last-known expiration) is stored separately, keyed by the subscription’s original transaction identifier — not your name, email, videos, or chats. This record may remain after you delete your account. Automated deletion drops it 90 days after the subscription’s last-known expiration.
• Your entire account can be deleted in the app (Settings → Delete Account). This permanently removes all conversations, uploaded videos and photos, Coach Memory, observations, training plans, bug reports, the verified subscription fields on your account, and your authentication record, and revokes your Sign in with Apple authorization. Deletion takes effect immediately and cannot be undone. It does not remove the subscription usage record described above, and it does not cancel your App Store subscription.
• Bug reports are kept for as long as needed to investigate and improve the service; they are deleted along with your account.
• If you cannot access the app, email support@toistogolf.com from the address associated with your account and we will process your deletion request within 30 days.

Residual copies may persist in routine system backups for a short period after deletion before being overwritten.

Your rights

Under the GDPR you have the right to:

• Access the personal data we hold about you
• Rectify inaccurate data
• Erase your data (largely self-service, as described above)
• Restrict or object to certain processing
• Data portability for data you have provided
• Lodge a complaint with a supervisory authority — in Finland, the Office of the Data Protection Ombudsman (tietosuoja.fi)

To exercise any of these rights, contact support@toistogolf.com. We respond within one month.

Security

All data is encrypted in transit (TLS) and at rest in Google Cloud. Access to your content is restricted to your authenticated account; uploads and downloads use short-lived signed URLs. Server access is limited and logged, and production systems do not log the content of your coaching conversations.

Children

Toisto is not directed at children under 13, and we do not knowingly collect personal data from children under 13. If you believe a child has provided us personal data, contact us and we will delete it.

Changes to this policy

We will update this policy as the service evolves — for example, if we add new integrations. Material changes will be announced in the app or on this website, and the “Last updated” date above always reflects the current version.

Contact

AS Labs Oy Business ID: 3637687-8 Vattuniemenkuja 3, 00210 Helsinki, Finland support@toistogolf.com