Privacy policy · TargetAce

TargetAce is an archery scoring app and a club platform (the app, TargetAce Live at clubs.targetace.app, and this website, targetace.app). It is made by Last Candle Studios ("we", "us"). This page covers TargetAce only; our other products have their own policy at lastcandlestudios.com/privacy-policy.

On your phone

Kept on your phone, and nowhere else unless you use the online features below:

Your archer profile: your name, and if you add them, your email address, year of birth, gender, country and age class.
Your scoring: rounds, ends, arrow positions, notes, and photos of ends you take.
Your equipment: bows, sight marks and tuning notes.
Badges, campaign progress, practice reminders and settings.

Photos of ends stay on your phone: they aren't in backups or Pro sync, and they're deleted with their round. Camera scoring (TargetAce Pro, experimental) reads the photo on your phone; the photo isn't uploaded or kept. The scoring model downloads once from targetace.app.

Shot replay: the app can show you what the camera saw a few seconds ago, so you can watch your shot back. The video is played and deleted on your phone as it goes. It is never saved, has no sound, and never leaves your phone.

Practice reminders are scheduled on your phone; nothing is sent anywhere.

Widgets and the Lock Screen: if you add a TargetAce widget, it shows your last round, your best score and your arrows this week; on iPhone, a round in progress can show on the Lock Screen and in the Dynamic Island. This is read from the app on your phone and doesn't leave it. Anyone who can see your phone's Lock Screen can see what the widget shows.

Share cards are made on your phone and only shared when you tap Share, with whoever you choose. They show your name, the round and, if known, the venue.

Location is used only if you turn on shooting locations or weather, and stays on your phone. For weather, your coordinates (and any place name you search for) go to Open-Meteo. Choosing a spot on the map loads map tiles from OpenStreetMap.

Backups you export (Profile › Your data) are files you control.

TargetAce Live (online features)

TargetAce Live runs clubs, competitions, events, ladders, knockouts, leagues and head-to-head matches. It's off until you connect, and the app asks first. You can disconnect at any time in Profile.

Your account: when you connect in the app, it creates an account for you, with no email address or password. You can also make an account on targetace.app with Apple, Google or a code we email you, and connect the app to it later.

Signing in with Apple, Google or an emailed code: if you sign in this way, in the app or on targetace.app, we keep an id from Apple or Google (or a scrambled copy of your email address, to find your account when you ask for a code) and your email address, to sign you in, to send you emails about your account and, only if you switch it on, your club's news (see "Club news by email"). Nothing else: we don't get your Apple or Google password, contacts or anything else from those accounts. If you sign in with Apple and choose "Hide My Email", we only get Apple's relay address. You can see and remove these under "Ways to sign in", in the app's Profile and on your account page.

Your phones: each phone signed in to your account has its own login. We keep the phone's name (for example "Sam's iPhone") and when it last signed in, so you can see your phones and remove one you have lost. Removing a phone signs it out.

What we keep, and who sees it:

Your profile: your name, bow style and main club, the clubs and teams you're in. Archers in your clubs can see these.
Club activity: matches, ladder, knockout and league results, competition scores, and the practice rounds you choose to share with a club. Archers in the club can see them.
Witnessing a score: if you confirm a clubmate's score on a leaderboard, we keep that you did and when, and members of that club see your name beside the score. You can take it back from the leaderboard, and it is removed if you delete your account.
TargetAce Rankings: scores you send to a club leaderboard or shoot in an event on TargetAce count towards the TargetAce Rankings. Signed-in archers see your name, club and ranking handicap there; a junior's name is shortened to first name and initial. On our website the rankings name you only if you have switched on a public page. You can leave the rankings in the app at any time; your scores stay where they were.
Your avatar (optional): if you make an avatar in the app and are signed in to TargetAce Live, we keep the choices that make it up (body shape, skin tone, hair, face, top, which hand holds the bow, and the kit it is wearing) so that other signed-in archers can see it beside your name where they already see your name: a club's member list, ladders and leaderboards. An avatar is made from fixed options. There is no photo and nothing you type. On the website your avatar is shown on your own archer page, to whoever can see that page. It is shown beside your name on public lists (a club's ladders, the rankings and the hall of champions) only if you have made your archer page public. A junior's avatar is never shown on a public list. Switch off "Show avatars" in Profile and it is removed from our servers and other archers' avatars are hidden on your phone.
Avatar battles: if you battle another archer's avatar, we keep the battle: the two of you, the shots you each pick and the result. The other archer sees your name as your club sees it (a junior's is shortened to first name and initial), your avatar, your shots and the result; nobody else does. You can only be challenged by an archer in a club you belong to, or by someone you gave a friend code to (friend codes are not offered on junior accounts), and you can say no. Switching "Show avatars" off means nobody can challenge you. Battles are deleted with your account.
Open battles (optional, adults only): in the app you can switch on "Open to battles from any archer". While it is on, other archers who have switched it on too can see your name and your avatar in their list of open archers and invite you to a battle, and you can see theirs. Nobody can see you there, or invite you, while it is off, and it is off until you switch it on. Archers you have blocked never see you there. We keep one yes-or-no setting with your avatar to remember your choice; switching avatars off removes it.
Club battles: if you take a board in a battle between your club and another club, the members of the other club can see the name you are playing under and your avatar on that club battle's page. Juniors can't take part.
Club records: if your club keeps records, a record holds your name, the round, score, bow style, gender, age class and date. Club members see them. If the club chooses, confirmed records also appear on the club's public page and its website (juniors by first name and initial).
Events: when you enter an event, we keep your name, club, bow style, gender, age class, round and, if you give them, your Archery GB number and a note for the organiser. The organising club sees your entry. If the event is public, its page on targetace.app shows each entrant's name (juniors by first name and initial), club, bow style, gender, age class and results. Members-only events have no public page.
Photos of targets at events: an event's organiser can ask for a photo of the target to be taken in the app each time an end is scored, as a record in case a score is questioned. The photo is taken by whoever is scoring that target. It is stored on our server with the event, the target, the end and the account that took it. Only the event's organisers and the archers shooting on that target can see it. We do not analyse the photo or use it for anything else. Photos are deleted 30 days after the event. A photo of a target may show people nearby: please frame the target only. If you are in a photo and want it removed sooner, ask the event's organiser, who can delete it, or contact us.
Club websites and pages: if your club shows TargetAce results on its website or on its targetace.app page, your name and results in its competitions, ladders, knockouts and leagues appear there. Casual head-to-head matches only appear if the club turns that on, and you can keep yours off in the app (Clubs › Your matches on club websites).
Club search: clubs that choose to be listed show their name, area, description and badge. Members aren't shown.
Reports and blocks: if you report something, we keep the report (what, a copy of its text, your reason and your account) to review it. If you block an archer, the block is kept so it can be applied; they aren't told.
Signing in on the web: targetace.app/account and the organiser console use a one-time code from the app, not a password. Codes are deleted after a day; a sign-in lasts 12 hours in that browser tab.
Your page on targetace.app (optional): you can turn on a page at targetace.app/a/<your address>. It's off until you turn it on, and you choose who sees it: members of your clubs (signed in to TargetAce), or everyone, including search engines. You choose the address and which parts show: your handicap and classification (worked out from your scores, as recorded in TargetAce, not an official classification), personal bests, recent results, your clubs, and your head-to-head record (off unless you turn it on). It only uses what's already on TargetAce Live: event and club competition results, club records, ladder, knockout and league places, and practice rounds you shared with a club. Rounds kept only on your phone and your Pro backups are never used. Casual matches that you or your opponent keep private never show, and an opponent who keeps their matches private is never named. A public page only lists clubs that have their own public page. You can change it or turn it off at any time, in Profile or at targetace.app/account; turning it off takes it down straight away. Anyone who can see a page can report it to us.

Push notifications: if you allow notifications, your phone's push token (with its platform and language) is kept against your account so we can tell you when someone challenges you, or when a place comes up in an event you're waiting for. Notifications are sent through Expo's push service, which passes them to Apple (iPhone) or Google's Firebase Cloud Messaging (Android). A challenge notification includes the challenger's name. Turn them off in your phone's settings; the token is deleted when you disconnect.

Security logs: our server and Cloudflare see your IP address when you use online features. The server keeps request logs, including IP addresses, for 5 days; server backups are kept for 14 days.

Club news: the News screen shows your club's news feed, which our server fetches from the club's website. With the Glasgow Archers theme, the app loads news straight from glasgowarchers1948.co.uk, which sees your IP address.

Club news by email (optional): if your account has an email address and you switch on "Email me this club's news" for a club, we email you the news that club's organisers choose to send by email. It's off until you switch it on, for each club separately. The club's organisers write the news; they never see your email address, only how many people an email went to. Every email names the club and has a link that switches these emails off straight away. You can also switch them off in the app or on your account page, and they stop when you leave the club or delete your account. We don't use your address for anything else here, and TargetAce sends no marketing of its own. It isn't offered to junior archers. Emails are sent through Amazon SES (Amazon Web Services, in its EU-West-2 London region).

Parents and guardians of junior members: so that a club's news can reach the family of a junior member, a club organiser can add a parent or guardian's name and email address. The club decides to add them, and TargetAce sends for the club. That address gets one email asking the parent or guardian to confirm; nothing more is sent unless they say yes. The club's organisers can see the name and address they entered; other members can't, and the junior isn't named in the emails. Every email has a link that stops them, which only the parent or guardian can undo. The name and address are deleted when an organiser removes them, when the junior leaves the club, or when the junior's account or the club is deleted.

Sharing your rounds with a coach (optional): a club's organisers can mark members as coaches. If you choose to share your rounds with one of your club's coaches, we keep a copy of each round you finish from then on, and that coach can see it: the round, the date, your bow, the score of each end, and the handicap and classification the app worked out. Not your notes, where you shot, or any round from before you started sharing. It's off until you switch it on, coach by coach, in the app. You can stop at any time, in the app or on your account page; once you share with no coach, the copies are deleted. Leaving the club ends the sharing, and so does the club removing someone as a coach. Junior archers can share only with coaches their club has marked. Coaches can only look: there is no messaging.

TargetAce Pro and purchases

Buying: Pro, and add-ons such as Night of the Hollow, are bought through the App Store or Google Play; we never see your payment details. We use RevenueCat to check what you've bought. The app talks to RevenueCat when it starts, under a random id; once you connect to TargetAce Live, that id is your TargetAce Live account id (no name or email). Night of the Hollow doesn't need an account: it belongs to your App Store or Google Play account, and Restore brings it back.

Pro sync and backup: with Pro, the app keeps a copy of your data on TargetAce Live so it can move between your phones and be restored: rounds and ends (including notes and any shooting locations), bows and sight marks, badges, campaign progress and your profile, without your email address and year of birth, which stay on your phone. Photos aren't included. The copy also records the phone's name (for example "Sam's iPhone") so you can tell your phones apart. We keep the newest three copies per phone and twelve in all, and delete them all when you disconnect. When you sign in on targetace.app with a code from the app, your account page shows you your rounds, personal bests, handicap, classification and badges from your newest copy; only you can see them there, and they're never used for your public archer page.

Round summaries (Pro, experimental): the written summary of a round is worked out from findings on your phone. To word it, the round's name, score and those findings (no name or account) are sent through our server to Cloudflare Workers AI, and the text comes back. Nothing is kept.

Pro on the web: if you subscribe on targetace.app instead of in the app, Stripe handles the payment and receives your email address and payment details; we keep only Stripe's reference to your subscription.

For clubs

Club Plus is bought on targetace.app. Stripe processes the payment and receives the payer's email address and payment details. We keep only Stripe's customer reference against the club.

Entry fees: if a club takes event entry fees online, the archer pays through Stripe, on the club's own Stripe account. The club receives the payment; we keep the amounts, the payment's status and dates, and Stripe's references, never card details. Refunds follow the event's refund rules.

Club payments: clubs can ask their members to pay for one-off things on targetace.app, such as kit, socials, coaching or range fees. Only the club's members, signed in to TargetAce, can pay. You pay through Stripe on the club's own Stripe account, as for entry fees: the club receives the payment and TargetAce takes a booking fee. We keep your account, your name, what you paid for (the item, the option you chose and how many), the amounts, when you paid, the payment's status (paid, refunded, disputed with your bank) and Stripe's references, never card details. Stripe asks for your email address when you pay; we use it to send your confirmation (and an email if the club refunds you) and don't keep it. If an organiser records a payment you made to the club directly (cash or bank transfer), we keep that too, with how you paid and their note. You and the club's organisers can see your payments (organisers also in exports they download, with Club Plus); other members can't. Refunds are made by the club.

Club memberships: clubs can run their annual membership on TargetAce. The club's organisers set its membership types and prices, can put members of one family into a household, and see who has paid, who is due and whose membership has lapsed. You pay on targetace.app, signed in to TargetAce, through Stripe on the club's own Stripe account, as for entry fees: the club receives the payment and TargetAce takes a booking fee. Anyone in your household can see and pay for the household's memberships. We keep your account, your name, your membership (its type, the year it covers, when it's due and its status: due, paid, overdue, lapsed, waived or cancelled), the household you're in, the amounts, when and how it was paid, who paid it, any refund or dispute with your bank and Stripe's references, never card details. Stripe asks for an email address when you pay; we use it to send your receipt (and an email if the club refunds you) and don't keep it. We remind you before your membership is due, on the day and if it's overdue, with a notification on your phone and, if we have an address, by email: your account's own email address if it has one (accounts made in the app don't), otherwise the address you gave Stripe when you last paid a membership to the club, which we read from Stripe when we send the reminder and don't keep. If an organiser records a payment you made to the club directly (cash or bank transfer), or waives your membership, we keep that too, with their note. If your club chooses, a lapsed membership stops you entering its competitions and events until it's paid. You, the others in your household and the club's organisers can see your membership (organisers also in exports they download, with Club Plus); other members can't. Refunds are made by the club.

Organisers can see the members of their club, who has asked to join, entries to their events, and an audit log of changes made in the club.

Booking a club's course or have-a-go session

Clubs can let people book their beginners' courses and have-a-go sessions on targetace.app, without a TargetAce account. For these bookings the club is the data controller: it decides what its booking form asks and what it does with the answers. TargetAce processes the booking on the club's behalf, under the data processing agreement each club accepts (targetace.app/dpa), and doesn't use booking details for anything else. The booking form names the club.

What's collected. The name and email address of the person booking (the payer); each participant's name and age in years (never a date of birth); for anyone under 18, the name of a parent or guardian (who may be the payer); the answers to the club's own questions, which may include health or access information if the club asks for it; which of the club's statements (for example its terms or photography consent) were agreed to; and, once the course runs, the club's register (who came to each session) and whether each participant completed the course. If you're signed in to TargetAce when you book, the booking is linked to your account. Your IP address is used to limit repeated bookings; it isn't stored with the booking (the server's request logs keep it for a few days, as for any visit). Courses are paid for when booking, through Stripe on the club's own Stripe account, as described under Entry fees; the booking keeps what was paid, when, any refund and Stripe's references as the club's payment records, which aren't deleted with the contact details.

Who sees it. The club's organisers, in the TargetAce organiser console, and in exports they download (Club Plus). Nobody else at the club, and no other TargetAce user, sees it. Participants' names are never shown on any public page: a course's page shows only how many places are left. TargetAce staff can access it only to run and support the service.

Emails. TargetAce sends, for the club: a confirmation (with a private link to see, change or cancel the booking), an email if a waiting-list place comes up, an email when the booking is cancelled (by you, or by the club, with its note), and, after the course, an invitation to join the club if the club sends one. No marketing. Emails are sent through Amazon SES (Amazon Web Services, in its EU-West-2 London region).

How long it's kept. 90 days after the course's last session we delete the email address, the parent or guardian's name, the answers to the club's questions (including any health or access information) and the booking link. We keep the club's register for 3 years after the last session: each participant's name and age at booking, the name of the person who booked, which sessions they came to, whether they completed the course, and the exact wording of the club's terms, insurance, consent or photography statements each booking agreed to, with when. Clubs may need this record for insurance or a claim. For participants under 18 at booking we keep it until 3 years after the course or until they turn 21, whichever is later. After that the register is anonymised: no names, only counts of places, attendance and courses completed.

Your rights. For access, correction or deletion of a booking, contact the club that runs the course; you can also change names and ages or cancel with the link in your confirmation email. If you contact TargetAce instead, we'll pass your request to the club.

Children. Bookings for under-18s are made by an adult, who gives a parent or guardian's name. We store an age, not a date of birth, and never show participants' names publicly.

Crash reports and feedback

Crash reports: if the app crashes, a report goes to Sentry (EU data region) with the error, the app version and your phone's model and operating system. It never includes names, scores, email addresses or account ids. Turn it off in Profile › Send crash reports.

Report a problem: if you send us a report from the app or the website, we keep your message, where it happened, the app version and platform, your account (if connected) and, only if you give it, your email address, and it's emailed to us. We keep it until we've dealt with it. If you disconnect, your reports are unlinked from you and your email address is removed.

This website

targetace.app sets no cookies, except one while you sign in with Apple or Google: it ties the sign-in to your browser, lasts at most 10 minutes and is deleted when you come back. There are no analytics. Your browser remembers your language, your calculator settings and, while you're signed in, your sign-in (in that tab only). Pages load fonts from Google Fonts, which sees your IP address. Cloudflare protects and delivers the site.

Who processes data for us

netcup GmbH: hosts TargetAce Live and targetace.app (Vienna, Austria).
Cloudflare: network security and delivery; Workers AI for Pro round summaries.
RevenueCat: in-app purchase and subscription status.
Apple and Google: app stores and payments for in-app purchases; push notifications (Apple Push Notification service, Firebase Cloud Messaging); and signing in with Apple or Google, in the app or on targetace.app, if you choose to.
Expo (650 Industries): app builds, updates and the push notification service.
Stripe: Club Plus, Pro on the web, event entry fees, club payments and club memberships.
Amazon Web Services (Amazon SES): emails, such as course booking confirmations, sign-in codes and club news you've asked for (EU-West-2, London).
Sentry: crash reports (EU data region).
Open-Meteo: weather and place search (no tracking).
OpenStreetMap: map tiles in the location picker.
Google Fonts: fonts on targetace.app.

Some of these are outside the UK and EU (for example in the United States); where they are, they use recognised safeguards for international transfers.

Keeping and deleting

On your phone: until you delete it or uninstall the app.
Disconnecting (Profile › Online play › Disconnect) deletes your TargetAce Live account:
- you leave your clubs and teams;
- your lobby entry, challenges, competition attempts, shared practice rounds and join requests are deleted;
- your Pro backups and push tokens are deleted;
- your name is replaced with "Deleted archer" in past matches, records and results, so other archers' results still add up;
- event entries you haven't paid for are removed; paid or finished entries stay with the event's results as "Deleted archer" (a refund due is made as if you withdrew).
Ways to sign in (Apple, Google, email): until you remove one under "Ways to sign in", or delete your account. Your phones: until you remove the phone or delete your account. An account made on targetace.app that isn't on a phone yet can be deleted on its account page; deleting removes the same things as disconnecting, and all its ways to sign in.
Uninstalling without disconnecting leaves your account (which holds no contact details). Email us with your name and club and we'll delete it.
Your page on targetace.app: your settings for it are deleted when you disconnect, and its address is then held for 90 days so nobody else can take it straight away (only the address is kept, not who it was). If you change or clear the address, the old one is held for you for 90 days. We may take a page down, and keep its address out of use, if it breaks our terms.
Your avatar: kept while you have one and avatars are switched on. Removed when you switch avatars off or delete your account.
Avatar battles: until you or the other archer delete your account.
Photos of targets at events: deleted 30 days after the event.
Rounds shared with a coach: kept while you share with at least one coach (the newest 600 rounds), and deleted when you stop, leave the club or delete your account.
Club news by email: your choice for each club is kept until you switch it off, leave the club or delete your account. A parent or guardian's name and email address are kept until an organiser removes them or the junior leaves the club. We keep a record of which news items were emailed and to how many people, not who opened them.
Course and have-a-go bookings: as set out in section 4 (contact details and answers 90 days after the last session; the club's register 3 years, longer for under-18s, then anonymised).
Club payments: kept as the club's payment records; if you disconnect, they stay with the club without your name.
Club memberships: kept as the club's membership and payment records; if you disconnect, they stay with the club without your name, and a membership you hadn't paid yet is cancelled.
Crash reports: kept by Sentry under its retention policy.
Billing records: kept by Stripe and by us as accounting rules require.

Junior archers

TargetAce is used by junior archers, often through their club. On public pages (event pages, club records, competition results, ladders, knockouts, leagues and head-to-head results on targetace.app and on club websites), archers in junior age classes (under 21 and younger) are shown by their first name and the initial of their surname, never their full name. Their club, and the organisers of events they enter, see their full name. We recommend parents and clubs agree how juniors use the online features, and we'll remove a child's information on request.

Archers in junior age classes can only show their page to members of their clubs, never to everyone. Their page shows their first name and initial, isn't listed by search engines, has no link preview, can't be shown on other websites, and its address can't contain their surname. We treat an archer as a junior if they have entered an event, shot a club competition or shared a practice round in a junior age class.

Making an account on targetace.app asks you to confirm you're 13 or over, or that a parent, guardian or your club has agreed. We don't ask for or keep your age.

Your rights

Under UK data protection law (UK GDPR) you can ask for a copy of the personal data we hold about you, and ask us to correct it, delete it, restrict or object to how we use it, or give it to you in a portable format. Many of these are in the app (Profile › Your data, Disconnect). Email [email protected] and we'll reply within a month.

We use personal data to provide the features you choose (contract), to keep the service secure and fix crashes (legitimate interests), and, where the app asks first, with your consent, which you can withdraw in the app at any time.

If you're unhappy with how we've handled your data, you can complain to the Information Commissioner's Office (ico.org.uk).

Changes and contact

If we change this policy in a way that matters, we'll say so in the app or on this page, and update the date at the top.

Questions: [email protected] · Last Candle Studios