Privacy Policy

Stance is a cricket biomechanics product operated by CitroSpace. This policy explains what we collect, why, where it is processed, and how you can have it deleted. If anything here is unclear, contact us at rishigupta.rg007@gmail.com.

Waitlist details. If you join the waitlist: your name, email address, whether you are a player or a coach, and the campaign tag in the link you arrived from, if there was one. We use them to email you when Stance opens up and to see which links bring people in. When you join, we email you a confirmation with your place in the queue and a link to leave the waitlist, and your details are emailed to our team so we can see sign-ups as they arrive. We keep them until you are invited or you leave; you can also email us to be taken off the list.

Account details. Your email address and name, provided when you sign up or through Google or Apple sign-in. Authentication is handled by Clerk; we never see or store your password.

Player profile. Height and weight, handedness, batting guard and trigger type, and optionally your age, sex, jersey number, playing role and format. Height and weight are required because every biomechanical measurement is scaled by them — without them the analysis cannot be computed.

Videos you upload. The clips you submit for analysis, plus the frame ranges you mark within them.

Analysis outputs. Measurements derived from your videos (speed, length, line, movement, pose-derived angles), annotated video, charts and written summaries.

Technical data. Standard request logs and aggregate usage analytics needed to operate and secure the service. On our public pages this includes Vercel Web Analytics, which sets no cookies and counts page views and the same waitlist steps described under “Advertising and analytics measurement” below (button taps, the form opening, sends and error types), without your name, email or anything you type.

Advertising measurement. Which of our public pages you viewed, with your IP address and browser details, collected by Meta through the Meta Pixel, as described under “Advertising and analytics measurement” below.

Site analytics. Which of our public pages you viewed and for how long, how you reached them, your device and browser, an approximate location worked out from your IP address, and some interactions on those pages, collected through Google Analytics, as described under “Advertising and analytics measurement” below.

To produce the analysis you asked for, to show your history and progress across sessions, to keep your account secure, and to operate and improve the service. We do not sell your data, and we do not use your videos to advertise to you. Your videos, profile and analysis results are never sent to Meta or Google Analytics.

We use a small number of infrastructure providers, each for a specific purpose:

• Clerk — authentication and account identity
• Supabase — database for the waitlist and for your profile, sessions and results
• Cloudflare — API layer and object storage for videos and outputs
• Modal — GPU compute that runs the analysis on your clips
• Upstash — job queue coordinating analysis runs
• Vercel — website hosting and analytics
• Resend — sends our emails, including your waitlist confirmation and our team’s notice of your sign-up
• Meta Platforms — advertising measurement on our public pages (see below)
• Google Analytics — site analytics on our public pages (see below)
• Google Gemini — generates the written coaching summary from your numeric results

These providers process data on our behalf and may store it outside your country. Meta is the exception: it also uses the advertising data for its own purposes, under its own privacy policy (see Advertising and analytics measurement). Where a written summary is generated, only derived measurements are sent — not your video.

On our home page, about page, guides, tools and plans page we use the Meta Pixel, a script from Meta Platforms, the company behind Facebook and Instagram. It tells Meta which of those pages you viewed, when you open the waitlist form and from which button or box, and, if you join the waitlist, that a sign-up happened and whether you chose player or coach. Because your browser loads the pixel from Meta’s servers, Meta also receives your IP address and basic browser and device information. We do not pass your name or email address to the pixel, and Meta’s automatic advanced matching, which would otherwise read them from forms, is turned off.

Meta sets its own cookies (_fbp, and _fbc when you arrive from a link on Facebook or Instagram, such as one of our ads) and may connect this activity to a Facebook or Instagram account you are logged in to, under Meta’s privacy policy. We use it to see whether our ads lead to sign-ups and to show our ads to people who have visited the site.

The pixel is not started on the signed-in dashboard, onboarding, reports or settings. If you are signed in and open one of the public pages above, that visit is counted like anyone else’s. Once it has loaded on a public page it stays loaded in that tab until the page is reloaded, so a page view can occasionally be recorded with a signed-in page’s address.

On the same pages we also use Google Analytics, a Google service, to see how the site is used. It records which of those pages you viewed, how long each was open and in view, and the page or link that brought you there, your device type, operating system, browser, screen size and language, and an approximate location (country, region and city) that Google works out from your IP address. Because your browser loads it from Google’s servers, Google receives your IP address; Google states that Google Analytics does not log or store it. On those pages it also records when you scroll most of the way down a page, click a link to another website or download a file, and when you tap a “Join the Waitlist” button or email box, open the waitlist form, send it, or are stopped by a short error type (such as a missing field). If you join the waitlist, it records that a sign-up happened and whether you chose player or coach; your name and email address, and anything else you type, are never sent to it.

It sets two cookies on this site: _ga, which holds a random ID so repeat visits from the same browser can be recognised, and _ga_R1919VZ9GZ, which keeps track of the current visit. Each lasts two years from your most recent visit. Google signals and ad personalisation are turned off, so this data is not linked to Google accounts for cross-device reports and is not used to personalise ads.

Google processes this data only to run Google Analytics for us, under the Google Analytics terms and the Google Ads Data Processing Terms. Our Analytics account does not share it with Google for any other purpose. It keeps the individual events for our property’s retention period, currently 2 months; totals in reports that identify no one are kept after that.

Google Analytics is not started on the signed-in dashboard, onboarding, reports or settings, and a signed-in visit to one of the public pages above is counted like anyone else’s. Once it has loaded on a public page it stays loaded in that tab until the page is reloaded, but it is told to send nothing while the tab is on a signed-in page.

Neither the pixel nor Google Analytics loads if your browser sends a Global Privacy Control or Do Not Track signal, if your device is set to a time zone in Europe (including the UK and Switzerland) or in EU territory outside Europe, or if you turn them off here: the one switch covers both. You can also change how Meta uses this information in your Facebook or Instagram ad settings.

Uploaded source videos are retained only as long as needed to produce and deliver your analysis, then removed automatically. Your profile, session results and analysis outputs are kept while your account is open so you can see progress over time. Google Analytics keeps the individual events from our public pages for our retention period, currently 2 months, as described above.

You can view and correct your profile at any time in Settings. You can delete your account, which removes or anonymises your personal data, your sessions and your uploaded media. You may also request a copy of your data, or object to a particular use, by emailing us.

Depending on where you live, you may have additional rights under laws such as India’s Digital Personal Data Protection Act or the GDPR. We honour those requests regardless of location.

Stance is intended for players aged 13 and over. If a younger player uses Stance, it must be with a parent, guardian or coach who consents on their behalf and supervises the account.

Access to your data is restricted to your own account at the database level, videos and outputs are served over short-lived signed links rather than public URLs, and all traffic is encrypted in transit. No system is perfect; if we ever become aware of a breach affecting you, we will tell you.

If we change this policy materially we will update the date above and, where the change is significant, notify you in the app.