WORLD X10 — Privacy Policy

WORLD X10 ("we", "us", "our") is an archery performance platform operated from the United Arab Emirates. This Privacy Policy explains what information we collect from users of the uaex10.com website and related mobile / desktop applications (together, the "Service"), how we use it, and your rights over it.

Contact: support@uaex10.com

1. Information we collect

Account information

• Name, email address, and password (stored as a salted hash).
• Role (athlete, coach, club admin, federation admin).
• Optional profile data: date of birth, gender, club, bow type, category.

Performance data

• Training sessions, scores, end-by-end arrow data.
• Competition results and rankings.
• Mental logs (mood, focus, stress) you submit voluntarily.
• Form-analysis videos and pose data, only when you explicitly record a session.

WHOOP integration optional

• If you choose to connect a WHOOP membership, we store OAuth access and refresh tokens securely so we can fetch your Recovery, HRV, Resting Heart Rate, Sleep, and Strain metrics on your behalf.
• We request the scopes read:recovery, read:cycles, read:sleep, read:workout, read:profile, read:body_measurement, and offline.
• You can disconnect WHOOP at any time from your profile. On disconnect, the OAuth tokens are deleted; historical readings remain in your training history unless you delete them.

Technical data

• IP address, browser / device type, pages visited, and timestamps — used for security and fraud prevention.
• Cookies and local storage used to keep you signed in and remember preferences.

2. How we use your information

• To provide the core Service — scoring, training history, analytics, rankings.
• To personalise the AI coaching and performance recommendations shown to you.
• To send you reminders, notifications, and service announcements you've opted in to.
• To process subscription payments via Stripe (payment card data never touches our servers).
• To prevent abuse, investigate security incidents, and comply with UAE law.

3. Sharing

We do not sell your personal data. We share data only with:

• Stripe — for payment processing.
• WHOOP — only if you connect WHOOP; tokens and requests go to their developer API.
• Amazon Web Services (Frankfurt) — our hosting provider. Data is stored in EU infrastructure.
• Your coach / club admin — if you are an athlete attached to a club, the club staff can see your training sessions and performance (not your WHOOP tokens or payment details).
• UAE Archery Federation — aggregate/anonymised rankings and results for sanctioned competitions.

4. Retention

We keep account and performance data as long as your account is active. You can delete your account at any time from Settings › Privacy and data. On deletion we erase your identity and credentials, and every health, injury, nutrition, mental, form-analysis, tournament-plan, notification and community record — clips, photos and your coaches’ written notes about you included — immediately.

Two categories are kept, under an anonymous identity: competition results, rankings and records, which belong to the sporting archive; and financial records, for the period the law requires. Where those records copied your name into a column of their own — a transfer, a nomination, a national-team roster, a club contract, a licence link, a ranking row, a judge or coach certification — we replace it with “Deleted user”. We also remove the IP addresses and device details from your security history, and your name and the record of your changed details from our administrator audit log. Our encrypted backups hold the previous state for up to 30 further days, after which it is gone from those too.

What can still name you after deletion

We would rather tell you this than claim an erasure is more complete than it is. After deletion, your name may remain in:

• Records typed by a club or federation without linking your account — a payroll line, a club contract, a licence link or a trip roster where staff entered a name and nothing else. We have no way to tell which “Ahmed Al Mansoori” is you, so we do not guess. Ask the club or federation directly and they can remove it.
• Governance records of actions you took as a staff member — if you administered a club or served as a federation officer, the audit trail of what you did to other people’s records keeps your name as the person who did it. That is the point of an audit trail, and it is a legal obligation we cannot satisfy anonymously.
• Anything already published — results, start lists and rankings that were public while your account was active may have been copied, printed or indexed elsewhere. We can erase our copy; we cannot erase the internet’s.
• Our encrypted backups, for up to 30 days, as above.

We may refuse a deletion request that would break other people’s records — if you still administer a club (whether or not it has other members), hold an active federation or club staff role, are the named coach on a coaching contract that is still running, or have money outstanding in either direction. In that case we tell you exactly what blocks it and who can clear it.

5. Your rights

• Access the data we hold about you.
• Correct your details, or delete your account and personal data.
• Export everything we hold about you from Settings › Privacy and data — a ZIP containing CSV spreadsheets you can open in Excel, Numbers or Google Sheets, plus a complete JSON file, and a README explaining each one and naming anything deliberately left out. Because the archive contains your health, biometric and payment records, we ask for your password (and your second factor, if you use one) before building it, and we e-mail you afterwards so you find out if it was not you.
• Disconnect third-party integrations (WHOOP, Stripe) at any time.
• Opt out of non-essential emails and notifications.

The export and the deletion are self-service: sign in and open Settings › Privacy and data. For anything else — a correction, a question, or help with a request — email support@uaex10.com from your registered address.

6. Children

Cadet-age athletes (under 18) may use the Service only with the consent and supervision of a parent, guardian, or authorised coach. We do not knowingly collect data from children under 13.

7. Changes to this policy

We may update this policy from time to time. Significant changes will be announced in-app and by email. Continued use of the Service after a change constitutes acceptance of the updated policy.