During calibration and matches, the camera runs entirely in your browser. Marker positions are computed on the device. No video frame, image, or raw coordinate is ever sent to our servers — only the actions the operator confirms are stored.
What we keep is the confirmed event log for each match, your pilot booking details if you request a pilot, and pseudonymous analytics. Players are never asked for a name or email to appear on the display or in a replay.
We count events — landing views, pilot requests, replay opens — using rotating pseudonymous identifiers and allowlisted properties only. No names, no emails, no faces, no long-lived device identifiers, and never raw camera data. Outreach links may carry a utm_source tag; that is the only campaign data we read.
Replay links are capability URLs that expire and can be revoked instantly from the operator console. Replay pages load no third-party resources and send no referrer, so a shared link never leaks where it came from.
Questions about scope or data handling are part of the pilot conversation — nothing is hidden, and the methodology is written into the scope you approve.