RallyCue: Tennis Scorekeeper Privacy Policy

# RallyCue: Tennis Scorekeeper Privacy Policy Last updated: August 25, 2026 ## Overview RallyCue is a standalone Wear OS tennis scorekeeper developed by Quazmoz. The current product is still in Gate 0 development and physical-watch qualification. This policy describes the current source implementation and will be re-audited against the final release AAB before production publication. RallyCue is designed to keep core match scoring and the current voice-recognition path on the watch. The current source has no RallyCue account, developer-operated backend, cloud sync, advertising SDK, third-party analytics SDK, third-party crash-reporting SDK, Play Billing integration, or INTERNET permission. ## Microphone and voice scoring RallyCue requests the Android RECORD_AUDIO permission because voice scoring is a core optional interaction. Microphone access begins only after the user explicitly starts a bounded recognition request from the active match experience. The current implementation uses Android's explicit on-device speech-recognition API only when the watch/runtime reports the required capability available. RallyCue does not silently fall back to a generic recognizer that may use cloud processing. If the required on-device recognizer is unavailable, voice scoring is disabled and touch scoring remains available. A RallyCue-owned timeout limits each current recognition request to a maximum of 15 seconds. The user can also stop listening explicitly. RallyCue does not advertise continuous, always-on, or all-day listening. Raw microphone audio is not persisted by RallyCue. The Gate 0 diagnostic logger also does not persist arbitrary recognized transcript text. Android/Wear OS system components may process audio and technical information while providing the on-device speech-recognition service under Google's platform policies. RallyCue does not send microphone audio to a Quazmoz-operated server. ## Match data stored on the watch The current implementation stores authoritative active tennis match state and bounded Undo recovery snapshots locally on the watch using Android DataStore. This supports recovery after app recreation and safe reversal of the previous accepted score state. Stored match state can include deterministic scoring context such as points, games, sets, server context, tiebreak state, and the bounded prior state needed for Undo. The current source does not transmit this match state to Quazmoz or another RallyCue backend. ## Local Gate 0 diagnostics Current development builds maintain bounded local diagnostic JSONL files to support recognition, lifecycle, scoring, battery, thermal, and false-mutation qualification. These diagnostic records may include app-controlled decision categories, random local session or event identifiers, confidence buckets, timing values, device model and OS information, and battery or thermal samples. They are designed not to include raw microphone audio or arbitrary recognized transcript text. The current diagnostic logger does not automatically upload these files. The local diagnostic files are bounded to approximately 4 MiB for the active file plus at most one previous rotated archive. These diagnostics are development and qualification tooling, not an analytics service. ## Network access and third parties The current RallyCue manifest does not request android.permission.INTERNET. The app therefore does not include a RallyCue network path for sending match state, diagnostics, or microphone data to Quazmoz. The current source also contains no advertising SDK, analytics SDK, crash-reporting SDK, Play Billing integration, backend client, cloud-sync client, or third-party speech SDK. Google Play, Android, Wear OS, and system speech components may process standard technical information required for app distribution, installation, updates, platform security, permission handling, foreground-service behavior, and on-device recognition according to their own policies. ## Permissions The current Wear OS manifest declares: - RECORD_AUDIO for explicit user-started voice scoring; - VIBRATE for haptic scoring and interaction feedback; - FOREGROUND_SERVICE and FOREGROUND_SERVICE_MICROPHONE for the bounded user-started microphone session. The current source does not declare INTERNET, location, camera, contacts, calendar, files/photos, health/body-sensor, AccessibilityService, exact-alarm, or advertising-ID permissions. The application declares itself as a standalone Wear OS app. A phone companion is not required for point-by-point scoring in the current implementation. ## Foreground microphone service RallyCue uses a non-exported microphone foreground service only for the explicit voice-scoring session. The service is tied to the current user-started recognition request and is configured to stop with the task. The recognition request is also bound to the current match-state revision and voice-session identity so stale speech cannot safely mutate a newer score state. If a voice session becomes stale or is interrupted, RallyCue is designed to end that request rather than silently apply it later. ## Backup and local security posture The current application sets android:allowBackup to false and disables cleartext network traffic. The microphone service is not exported to other apps. Match-state mutations are intended to be persisted locally before RallyCue reports an accepted score transition to the user. ## Data sharing Under the current Gate 0 source implementation, RallyCue does not sell user data and does not intentionally transmit RallyCue match data, microphone audio, or diagnostic files to the developer or advertisers. This statement must be re-reviewed before release if the final app adds networking, analytics, crash reporting, billing, a backend, cloud speech, cloud sync, account features, or another third-party SDK. ## Retention and deletion Active match state and Undo recovery data remain local while needed for the current match and recovery behavior. Ending the active match removes the persisted active-match recovery state subject to successful local storage operation. Bounded Gate 0 diagnostic files remain in app-private storage until they are rotated, app data is cleared, or RallyCue is uninstalled. Because the current implementation has no RallyCue account or developer-hosted user database, there is no RallyCue server-side account dataset to request deletion of. You can remove local RallyCue data through Android/Wear OS app-data controls or by uninstalling the app. ## Children and sensitive use RallyCue is a sport scorekeeping utility and is not directed to children as a data-collection service. The current app does not make medical, health, injury-prevention, certified officiating, or governing-body affiliation claims. ## Product limitations relevant to privacy Voice capability can vary by Wear OS device and runtime. The current public app page therefore does not claim universal voice support, universal offline support, continuous listening, Tile support, complication support, or support for sports other than tennis. ## Changes to this policy This policy will be updated before shipping functionality that materially changes data collection, sharing, networking, analytics, advertising, billing, authentication, cloud processing, speech processing, permissions, or external provider behavior. The final Google Play Data Safety declaration and privacy policy must be regenerated from the actual release AAB, merged manifest, dependency graph, and runtime behavior before production publication. ## Contact For privacy questions, contact Quazmoz@vivaldi.net.