Privacy
The text below is the text of the app. The applicable version is the number shown in BallTrap OS when you accept it.
Controller
The controller is the author of BallTrap OS. Contact: BallTrap.os.infos@gmail.com. This version does not name a data-protection officer. No company and no postal address are invented in this text.
Data processed
Account: Firebase Auth technical id, email address, display name, email verification state, Google or email-and-password sign-in. The password is kept by Firebase Authentication, never in clear text by BallTrap OS, and is not part of the export. Profile: name, nickname, club, licence number as typed, profile photo stored on the device. Assigned roles and badges, in Firestore roles/{uid}. Logbook: series, scores, disciplines, grounds, shooting conditions, training, duels, friend requests (ids and names of both shooters), contest entries (public name and club). Gun safe: brand, model, type, settings, notes, gun photo on the device. Sheet photos: the image in Firebase Storage (users/{uid}/scans/) and the cells read into Firestore. Directory: public name and club only, visible to signed-in accounts; not the email, not the licence. Preferences: language, theme, accepted terms version. JSON export: every account can download it from settings. A wider device copy stays limited to the Super Admin and the Founder badge, and does not contain the password. Weather: if it is opened, the approximate position is sent to Open-Meteo and is not stored on the account. Android: a Firebase Cloud Messaging token may be used for a notification on the device. The provider’s technical logs. No payment data.
Purposes and bases
Providing the logbook and, when the account is online, sync: performance of the service requested (GDPR article 6.1.b). Storing the accepted terms version: legitimate interest in knowing which version was accepted, and performance of the service that requires that agreement. Photos: the user adds them to illustrate their profile or gun as part of the service. Account security and abuse prevention: legitimate interest. Statistics are calculations on the scores entered. No automated decision with legal effect is made.
Where the data sits
On the device: local database (Hive on Android, IndexedDB in the browser), photos in the app folder, sync queue. That is what lets the stand work offline after sign-in. Online: Firebase Authentication, Cloud Firestore, and Firebase Storage (Google), on the publisher’s behalf. The private logbook is under users/{uid}. The public directory holds only the name and the club. Sheet photos are under users/{uid}/scans/. Each shooter can read and write only their private documents, under the project’s security rules. Firebase secrets are not copied into the JSON export.
Recipients and transfers
Recipients: the publisher, the user, Google (Firebase Authentication, Cloud Firestore, Firebase Storage, and on Android Firebase Cloud Messaging and App Check in monitoring only) as processor, and Open-Meteo when the weather is requested. Other signed-in shooters see the public name and club from the directory, and the name on a contest, a ranking, or a friend request, not the email, not the licence, not the gun safe. A club president sees that club’s data and its events, not other shooters’ private profiles. The technical Super Admin can access the whole set in order to run the service. No sale of data. Google may process data outside the European Economic Area under its clauses. Open-Meteo receives the coordinates for the weather request.
Retention
Local data stays until the account is deleted on this device, the app is uninstalled, or a restore replaces it. Cloud data for the account stays while the account exists. Deletion in settings or at https://balltrap-os.com/delete-account then removes the Authentication account, the personal Firestore documents and the personal Storage photos, then the local copy on this device. The provider’s technical logs follow the provider’s own periods. A legal duty to keep data, if one exists, is respected.
Rights
You can access your data and download a JSON copy from settings (portability), rectify it in the profile, erase it from settings or https://balltrap-os.com/delete-account, ask for restriction or object to processing based on legitimate interest, and withdraw consent where a processing relies on it. Requests can also be sent to BallTrap.os.infos@gmail.com. A complaint can be lodged with the CNIL, 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France, https://www.cnil.fr, with the Belgian Data Protection Authority, rue de la Presse 35, 1000 Brussels, https://www.autoriteprotectiondonnees.be, or with the authority of the country of residence in the European Union. The policy is also published at https://balltrap-os.com/privacy.
Photos
The avatar and gun photos are the user’s content. They must be the user’s own photos, not manufacturer catalogue images. A gun photo is shown on that gun’s card and replaces the generic illustration for the type (over-and-under, semi-automatic, side-by-side). It is not published in a brand gallery.
Club and public profile
The club picked from the Belgian ground list, or a name typed when the ground is not listed, may appear on the shooter card. That card is the public profile space inside the app. The user chooses what it shows.
Children and safety
The service is not directed at children. The user must be legally allowed to use a service related to sport shooting where they live. The app does not check a shooting licence and does not replace any safety rule or firearm authorisation.
Security
Cloud access goes through Firebase Authentication: a Google account, or email and password. The publisher does not keep the password in clear text and never emails it. Reset uses a link. A device with an open session can read the local logbook: the user keeps control of their phone.
Changes
This policy is versioned together with the terms. If the version increases, it is shown again before the app can be used further.
Contact
To use your rights or ask a question: BallTrap.os.infos@gmail.com.