← Back to Trap Stats
Privacy Policy
Effective date: [not yet set]
This is a working draft, not a finished legal document. It was written to accurately describe what the app actually does today, but it has not been reviewed by a licensed attorney. Trap Stats is used by minors — treat this as a starting point, not a binding policy, until an attorney has reviewed it.
Who this policy covers
Trap Stats ("the App," "we," "us") is operated by Trap Stats, LLC, an Iowa limited liability company. This policy applies to anyone with an account on Trap Stats, regardless of which club or organization they shoot with.
Information we collect
Account information you provide:
- Name, email address, and (optionally) phone number
- Password (never stored in plain text — hashed with bcrypt)
- A profile picture, if you choose to upload one
- Your team, and (if applicable) which organization(s) you belong to
Content you or your team submits:
- Photos of handwritten scoresheets, submitted so the app can read them automatically (see "AI-assisted scoresheet reading" below)
- Round scores, dates, yardage, and optional notes entered manually or extracted from a photo
- Team and league logos, if your team's admin uploads one
Information collected automatically:
- Session cookies, used only to keep you signed in — not for tracking or advertising
- IP address and basic request metadata, used for rate-limiting (to stop abuse of login/registration/scoresheet-reading) and security logging
- If you're an Organization or Platform Admin: an audit log of admin actions you take (what changed, when — not the values of anything sensitive like passwords or API keys)
If you sign in with Google: we receive your name, email address, and Google account ID from Google — nothing else from your Google account.
If the app's operator has enabled analytics: anonymous, cookieless traffic data (pages viewed, browser/device type) and a small set of named actions — completing signup, logging a round, copying a team invite link — via Umami. This never includes your name, email, or any other account identifier, and is off entirely unless the operator has configured it.
AI-assisted scoresheet reading
When you photograph a scoresheet to log a round, that photo is sent to a third-party AI provider (currently Google Gemini, with Anthropic Claude as a manual fallback the app's operator can switch to) to read the handwriting and extract scores. The photo itself is not stored by Trap Stats after extraction — only the resulting text (names, scores, dates) is saved.
AI extraction can make mistakes, especially on hard-to-read handwriting or a scoresheet combining two rounds into one photo. Always review the extracted values before saving a round.
How we use your information
- To operate the app: authenticate you, show your team's leaderboard, compute stats, log rounds
- To send you email when necessary: password resets, email verification, and notifying a Squad Leader/admin when someone requests to join their team
- To keep the app secure: rate limiting, breach-password checks at registration, audit logging of admin actions
- We do not sell your information, and we do not use it for advertising
Breached-password checking
When you set or change a password, the app checks whether it appears in a known data-breach database using a privacy-preserving method (only the first few characters of a hash of your password are sent — never your actual password) via the "Have I Been Pwned" Pwned Passwords API. This check fails silently (lets you proceed) if that service is unreachable.
Third parties we share data with
We share the minimum data each of these needs to do its job:
| Provider | What it receives | Purpose |
|---|
| Google Gemini API | Scoresheet photos | Reading handwritten scores (default) |
| Anthropic Claude API | Scoresheet photos (only as a manual fallback) | Reading handwritten scores |
| Google (Sign-In) | Name, email, if you use "Sign in with Google" | Authentication |
| Resend | Your email address, when we send you an email | Delivering password-reset/verification/notification emails |
| Have I Been Pwned | A partial hash of a password you're setting | Breach-password checking |
| Umami | Page URLs, browser/device type, and the named actions listed above — no name, email, or account identifier | Traffic and engagement analytics (only if the operator has enabled this) |
Each of these providers has its own privacy policy governing what they do with data once received. We do not share your information with any other third party beyond those listed above, and we never sell it.
How long we keep your information
- Round and score data is kept indefinitely — this is core to what the app is for (team and league history), and it isn't erased just because a member later leaves the team.
- Account information (name, email, phone, password, avatar) persists until you or an admin removes it.
- Inactive accounts: an account with no sign-in for 2+ years is flagged in the Admin panel for manual review — a visibility aid, not an automatic deletion.
- Admin audit log entries are automatically deleted after 1 year.
- Backups are retained for 14 days and then pruned — a deleted account's data could still exist in a backup for up to 14 days after removal from the live database.
- Password reset and email verification tokens expire in 1 hour and 24 hours respectively, and are single-use.
- Sessions expire automatically after 30 days of inactivity.
- Scoresheet photos are never stored at all — held only in memory long enough to extract the scores, then discarded.
Your rights and choices
- Access and correction: You can view and edit most of your own information from the Profile tab at any time.
- Deletion: Delete your own account any time by signing in at ui.trapstats.app (in a browser or the Android app — no app install required) and going to Profile > Delete account (confirm with your password). This removes your personal account information and any personal (non-team) rounds you logged immediately. It does not remove team-scoped round/score history you contributed while on a team — that stays part of your team's leaderboard and history, the same way it would if you'd simply left the club. The one exception: deleting the very last Platform Admin account isn't allowed, since every other admin role is scoped to one team/organization.
- Opting out of email: Password-reset and verification emails are necessary for account security and can't be turned off; team-join notification emails go only to Squad Leaders/admins about their own team.
Children's privacy
Trap Stats is intended for use by people 13 and older. Because trap shooting leagues commonly include high-school-age participants, a minor's account is typically created by a coach, parent, or team Squad Leader adding them to a roster, not by a young child self-registering. Trap Stats does not knowingly collect information from anyone under 13. If you believe a child under 13 has an account, contact us and it will be removed.
Security
Account passwords are hashed (never stored in plain text); optional two-factor authentication (TOTP) is available from your Profile; sensitive configuration values are encrypted at rest; the app runs over HTTPS; and the database connection uses a least-privilege role. No system is perfectly secure, but these are real, currently-implemented measures, not aspirational ones.
Changes to this policy
[How material changes will be communicated is not yet decided.]
Contact
Questions about this policy: [email protected]