Privacy Policy

Jürgen Weiß

Ligusterstr. 7

90530 Wendelstein

Germany

Email: [email protected]

Controller for the website, app accounts, infrastructure, security, and direct customer communication. Operator-managed participant data in hosted workflows is generally processed on behalf of the relevant club or course operator.

3D Score Buddy includes a public website, an operator backend for clubs and courses, a mobile app for iPhone and Android, and a shared API for Cloud-Connect, backup/restore, and public result pages.

Pure offline scoring can run locally on the device. The privacy-relevant parts are mainly Cloud-Connect, public live links, account login, backup/restore, map features, and technical protection or monitoring services.

3D Score Buddy is the controller for its own website, operator account registration, infrastructure protection, and technical error handling.

When clubs or course operators upload participant lists, assign groups, or publish public result links, those operators usually decide the purpose and content of that data. 3D Score Buddy provides the hosted technical platform for this workflow.

• Questions about club-managed participant data may be directed to the relevant operator and to us.
• Operator-facing processor, subprocessor, and retention documentation must stay aligned with this policy.
• A DPA version for express agreement with operators is available at /admin/dpa. Displaying the text alone does not conclude a contract.

Access to the internal operator area is available only through OAuth with Google or Apple. There is no local password login on our site.

We process account data such as name, email address, identity-provider subject ID, permissions for the relevant operator account, and required session and security data.

• Necessary cookies are used for login, callbacks, CSRF, PKCE, and session state.
• Profile images may be cached for technical purposes.
• Without this data the protected operator area cannot be provided.

When Cloud-Connect is used, scoring data from the writing device of a group is transferred to the server. Depending on the event configuration this can include full participant names, bow classes, group assignments, device ID, app version, score data, and timestamps.

For technical incident analysis, the app also sends, where available, the operating-system and firmware version, Android API level, and device manufacturer and model when Cloud-Connect is used. This information is associated with the relevant event session and device ID.

Optionally, when a score is entered, the app stores an event-related technical snapshot: input gesture and correction status, app lifecycle, proximity-sensor status including measured distance, device angle, ambient light (lux), and, on Android, display-interactive, keyguard, and device-lock status. No sensor history is created; the information is used to analyze unintended input and improve protection mechanisms.

During technical score synchronization the IP address of the writing device is also processed via the sync logs and stored in the database.

Inside the operator backend, clubs and course operators can see the full participant and result data that belongs to their own provider account.

• In practice one physically present group member often records scores for the whole group.
• Offline-only events stay on the device until a cloud function or backup/restore is used.
• Technical synchronization data is processed separately from manual administrative changes.

Device Share temporarily transfers a selected event with selected archers, names, bow classes and results to another device. Depending on the selection, this may also include target and user images, image references and impact markers. Access expires after a few minutes; expired transfers are cleaned up regularly.

Local GPS tracks, personal app settings and the complete archer directory unrelated to the selected event are not transferred through Device Share.

Tournament results may be accessible through public live or results links. On the event day, participant names are shown in full in public views.

After the event day, additional parts of names are abbreviated in public tournament views, for example from "Jürgen Weiß" to "Jürgen W.". Names are generally shortened in course and training views as well. Single-part names may remain unchanged; authorized operators and the device that submitted the scores may see full names.

First names, initials and associated results may still be personal data. A shortened display is not full anonymization.

Organizers, as controllers, determine the legal basis and scope of their result publication and inform participants accordingly. They assess deletion and anonymization requests in accordance with the statutory conditions, including applicable exceptions.

The public course and tournament search uses a local GeoIP database to determine an approximate starting point. If browser location access is allowed, coordinates are sent to our server for nearby searches; they are not stored as a permanent profile attribute. On mobile views, location access may be requested when the view opens. If access is denied or unavailable, searching by place or address and an approximate starting point remain available.

In the mobile app, camera, location, notifications and Live Activity or foreground service features may be used for optional functions such as QR scanning, local GPS recording, target coordinates, map views or sync status. Local GPS tracks remain on the device unless you initiate a separate transfer.

Maps load OpenStreetMap tiles. Search text and, where applicable, coordinates are sent to Nominatim/OpenStreetMap for geocoding or reverse geocoding. Map markers may be loaded through the unpkg.com CDN. When your browser requests these resources directly, these services receive your IP address and the requested resources in particular.

The GeoIP lookup itself takes place on our server without a runtime request to MaxMind. Device location is not used to create advertising profiles. Operating system permissions can be changed in device or browser settings; they do not replace any separate consent required under data protection law.

The legal basis depends on the processing activity. For data that we process on behalf of an organizer, the organizer determines the legal basis; our processing follows its documented instructions and the DPA.

External services may also process data outside the EU/EEA. For transfers for which we are responsible, the requirements of Articles 44 et seq. GDPR apply, particularly applicable adequacy decisions or appropriate safeguards under Article 46 GDPR. You can request information about the safeguards applicable to a specific service and a copy of the relevant contractual clauses at [email protected].

• Operator accounts, expressly requested cloud functions and handling contract-related requests: Article 6(1)(b) GDPR where the data subject is a party to the contract; for an operator's contact persons, Article 6(1)(f) GDPR, based on our interest in managing that business relationship.
• Website operation, necessary communication, map and nearby search, abuse prevention and technical error analysis: Article 6(1)(f) GDPR. Our legitimate interests are providing the requested search and map functions, secure and reliable operation, correcting errors and protection against unauthorized access.
• Where separate consent is obtained for a processing activity, Article 6(1)(a) GDPR is the legal basis. Such consent is voluntary and may be withdrawn with effect for the future. An operating system or browser permission alone is not treated as proof of such consent.
• Processing required by law, such as compliance with tax retention obligations: Article 6(1)(c) GDPR together with the applicable legal provisions.

Cloud Backup and Restore can save app settings, event and score data, archer directories, and selected images and impact markers. Archer directories may contain names, bow class, club, notes and event associations. The retention period depends on the purpose of restoring the data and applicable statutory requirements. Please send deletion requests to [email protected].

Operator-related participant and results data are processed to provide the relevant event and in accordance with the responsible operator's instructions. Retention of our own account, support, security and log data depends on the respective purpose, the need to investigate errors or abuse, and applicable legal obligations. Once the data is no longer needed, it must be deleted; for operator instructions, the agreed return or deletion instruction applies. Technical backup copies must be distinguished from active Cloud Backups.

Google and Apple are used for OAuth login and in-app purchases or restoration of purchases. We do not receive full payment card details. The app stores also process purchase and account data under their own privacy information.

Subject to the legal requirements, you have the rights of access, rectification, erasure, restriction of processing and data portability. Where we process data on the basis of legitimate interests, you may object on grounds relating to your particular situation.

You may withdraw consent at any time with effect for the future. This does not affect the lawfulness of processing before withdrawal. Shortening names alone does not constitute erasure or full anonymization.

We do not make automated decisions with legal or similarly significant effects, including profiling within the meaning of Article 22 GDPR. AI-assisted image suggestions are aids to be reviewed by the operator and are not such decisions.

You can send privacy matters to [email protected]. You have the right to lodge a complaint with a data protection supervisory authority, particularly in the place of your habitual residence, workplace or the alleged infringement. The authority responsible for us is the Bavarian State Office for Data Protection Supervision (BayLDA), PO Box 1349, 91504 Ansbach, Germany; visitor address: Promenade 18, 91522 Ansbach, Germany; complaint form: https://www.lda.bayern.de/de/beschwerde.html.

When you register for an event, we process the participant names, email addresses, bow classes, club affiliations and event selection entered. This also includes registration status, group assignments, fees and payment confirmations recorded by the organizer, as well as technical access and reservation data. The organizer is responsible for managing its participants; we provide the platform for this purpose.

Confirmations and access links are sent to the email address provided. Messages are transmitted through a Google SMTP relay; Google processes the recipient address, message content and technical transport data. Only provide data about other participants if you are authorized to do so and have informed them about the processing. Information required for event registration is necessary to process the registration; without it, registration cannot be completed.

For enquiries by email or through the contact form, we process your email address and the content of your message to handle and answer your request. The contact form forwards the enquiry via our email service to the stated contact address and does not store it in an application table. The IP address is used temporarily to limit abusive requests.

We use necessary login and security cookies and a cookie to store the selected language. Local browser storage also holds display settings you expressly choose. Storage or access required to provide functions you expressly request takes place under Section 25(2) TDDDG; non-essential access requires prior consent.

During public registration, the form draft containing participant details may be stored locally in the browser so an interrupted registration can be resumed. The draft is removed after successful registration. If registration is abandoned, it currently remains until the browser data is deleted. Reservation processes also use session storage limited to the browser session.

We do not use advertising or marketing trackers. Browser Session Replay is disabled. You can delete cookies and local data in your browser settings; this may remove sessions, saved drafts and selected settings.

The platform runs on Hetzner Cloud infrastructure with a configured server location in Germany. Cloudflare is used as a reverse proxy and protection service. IP addresses, connection and HTTP request data, and the content carried for technical delivery may be processed. Server operation also generates access and error logs.

We use the external service Sentry for technical error and performance monitoring. It processes filtered error and request information and app and build metadata. Browser Session Replay is disabled. Retention depends on the settings for the product in use.

Target images are analyzed using our own Vision model on our server infrastructure. The images provided for analysis are processed for this purpose. The resulting image proposals are reviewed by the operator. Operators should avoid identifiable people or other unnecessary personal information in target images.

The MCP interface is currently in internal testing and is not generally available to the public. It allows authorized users to query event, participant, result, training and target-image data through a connected external client and to manage it within granted write permissions.

The recipient is the client connected by the user or its provider, for example OpenAI when using ChatGPT. Depending on the enabled functions, transmitted data includes participant names, email addresses, bow classes, club affiliation, registration details, fees and recorded payments, results and training data, associated technical identifiers and target images. Further processing by the client follows the privacy information and agreements applicable to its use. Depending on the provider and configuration, data may be processed outside the EU/EEA; the requirements for international transfers described above apply.

Access permissions are set by the authorized user and can be revoked. Revocation stops further access through the connection but does not automatically delete data already sent to the client. Requests concerning storage or deletion there should be addressed to the respective provider.