Privacy

Last updated 9 August 2026

Who holds your data

Your club does. A club decides who is on its roster, what goes in each archer's record, and who can see it. ArcheryScores runs the software on the club's behalf and handles that data only to make the scoring work — we don't use it for anything of our own.

Each club gets its own address, like yourclub.archeryscores.app. Every request is tied to the club in that address, so one club's admins cannot see another club's archers, scores or leagues.

What's in an archer's record

Usually a club administrator types this in from the club's own membership records, rather than you entering it yourself:

• First and last name. Required — it's how you're identified on the board and in standings.
• Email address (optional) — for signing in, league results emails, and PIN recovery.
• Phone number (optional) — for PIN recovery by text.
• Date of birth (optional) — used only to work out your competition age class. The class is what appears anywhere; the date itself doesn't.
• Gender, equipment class and age class — for divisions and league classes.
• A 4-digit PIN. It confirms it's you when you pick your name at a shared bale tablet.
• Your scores. Every arrow value, every end total, X counts, which bale you shot on, event results, league standings, and any private practice rounds you log.

If you sign in with Google instead of a PIN, we receive your verified email address and the account identifier Google issues for you, and we store both so we can recognise you next time. We ask Google only for your basic profile and email address, we don't store your Google profile picture, and we can't post anything to your account or read anything else in it.

What the scoreboard makes public

This is the part most worth knowing, so here it is plainly.

What the scoreboard does not show: your email address, your phone number, your date of birth, or your PIN.

Private practice rounds are separate. They stay in your own score history and are not put on the board.

Club administrators

For someone who runs a club, we store a username, an email address, a phone number, and either a hashed password (a PBKDF2 hash — we never keep the password itself) or the identifier from their Google account, depending on how they sign in. Which email addresses are allowed to administer a club is a list the club itself controls.

A tablet that's been paired for admin use on the range stores a label, when it was last seen, and a hash of its pairing secret — not the secret itself.

Who else sees any of it

Three companies, each for one specific job. That's the whole list. There are no advertising networks, no data brokers and no analytics companies involved, and we don't sell anyone's data.

• Google — only if you choose "sign in with Google". Google tells us your verified email address and your account identifier; that's the extent of it.
• Mailgun — delivers email: league results and recap emails, PIN recovery emails, and the notification we get when someone fills in the form on this site. Recipients of a league email are BCC'd, so members don't see each other's addresses. Mailgun necessarily handles the message and the addresses in order to deliver them.
• Twilio — can text an archer their PIN, and only to a number that already matches the record. This depends on a club's installation having Twilio credentials configured; the current archeryscores.app deployment does not have them, so PIN recovery there happens by email. Where it is switched on, the phone number and the message go to Twilio to be delivered.

Copies of league emails

When an administrator emails a league, the system keeps a record of what went out so the club can check it later: the subject, the reply-to address, any custom message, the list of addresses it was sent to, and the full contents of the email. That record stays with the club and its administrators can read it back.

This website

These marketing pages set no cookies. There is no analytics, no tracking pixel, no advertising tag, and no third-party font, script or image — everything on them is served from archeryscores.app, so simply reading this page doesn't hand your IP address to anyone else. As with any website, the hosting layer keeps ordinary server request logs.

If you fill in the beta form, we store the name, club name, email address and optional phone number you typed, and when you sent it. We use it to contact you about setting your club up, and for nothing else.

Cookies and staying signed in

Once you sign in on a club site, there is one cookie: a session cookie. It carries a signed reference to your session, not your personal details. It's marked HttpOnly so page scripts can't read it, it's sent only over HTTPS in production, it expires after 12 hours, and it's tied to your club's own hostname — a session on one club's site is not valid on another's. There are no advertising or tracking cookies anywhere on ArcheryScores.

The bale tablet app

The Android app for scoring a whole bale from one tablet asks for two things: internet access, and the camera.

• The camera is only used to read a QR code. Frames are decoded on the device itself. No photo is taken, nothing is saved, and no image is ever uploaded.
• What it keeps on the tablet: which club it's pointed at, the access tokens it got from scanning the bale or admin QR code, and any ends that haven't uploaded yet — so a dropped signal doesn't lose the round. Tokens are held in the device's encrypted app storage where the device supports it. All of it is private to the app and goes when the app is removed.
• No advertising identifier, no analytics SDK, and no Google Play Services in the app at all.

Young archers

Clubs run JOAD and other youth programmes here, so some records belong to children. Those records are created by the club — normally from the club's own membership paperwork, completed by a parent or guardian — not collected from a child on this site. Nothing on a club site is designed to get a child to give us information, and we don't advertise to anyone.

The only extra thing held for a young archer is date of birth, and it is used solely to calculate the age class they shoot in. Worth knowing before a junior league night: a young archer's name and scores appear on the public scoreboard exactly as an adult's do, and a class grouping indicates their age bracket.

A parent or guardian can ask the club administrator to show, correct or delete a young archer's record — administrators can do all three directly. If you'd rather not go through the club, or you don't know who to ask, write to us and we'll handle it.

How long it's kept

Scores are meant to last. League standings, handicaps and an archer's progress over the years all depend on old rounds, so nothing is deleted on a timer — there is no automatic purge, and a record stays until the club deletes it or someone asks us to remove it.

Two things do expire on their own: a sign-in ticket is valid for 60 seconds and can be used once, and a session cookie lasts 12 hours.

Seeing, correcting or deleting your data

Start with your club administrator. They have the tools already: they can show you everything held about you, edit any field of your record, correct a mis-entered score, and delete an archer outright.

If you don't know who that is, or you'd rather not ask them, email sales@archeryscores.app with your name and your club's name and we'll take it from there. Tell us what you want removed — the whole record, or particular rounds — and we'll confirm what was done.

If you think information is visible that shouldn't be, or you spot a security problem, please tell us at that same address rather than posting it publicly, and we'll look at it straight away.

Changes to this page

If this changes, we update this page and the date at the top. If a change affects what's collected or who it's shared with, we'll tell club administrators so they can pass it on to their members — the club is the route to archers, not a mailing list of our own.