Privacy Policy
Range Tracker — rangetracker.arroway.cz. arroway.cz has its own shorter notice. This is a translation of the Czech text.
Effective from 2 November 2026 · Version 2.0 (replaces the privacy policy of 14 May 2026 and the cookie policy of 28 April 2026)
1. Controller
Filip Šeřík, self-employed sole trader, Company ID (IČO) 07763506, Ovenecká 871/13, 170 00 Praha 7 – Holešovice, Czech Republic. Privacy contact: yo@filip.wtf.
We have not appointed a data protection officer. One is not required for processing of this scale.
We process personal data under the GDPR (Regulation (EU) 2016/679) and Czech Act No. 110/2019 Coll. This policy covers the Range Tracker app. Cookies are covered in section 5. The separate cookie policy has been retired; its address now brings you here.
2. Data we process
| Category | Data | Source |
|---|---|---|
| Account | email, password as a hash held by Supabase only, account ID, signup date, role | you |
| Profile | first and last name, nickname, phone (optional), club, avatar, social links, signup reason, onboarding status | you |
| Training data | bows, arrow sets, sessions and training (date, place or range, targets, rounds, shots, notes), session photos | you |
| Community content | ranges, courses and targets, range and event gallery photos, events and registrations, group sessions and invites, club and association memberships | you and other users |
| Membership and payments | membership level, subscription status, Stripe customer and subscription IDs, history of free-access grants, redeemed promo codes and invites, any purchase of other paid content | you and Stripe |
| Communications | the app-update email setting, marketing consent, unsubscribe date, a log of emails sent (type, time, status) | you and the system |
| App usage | account-linked events (for example registration, finishing onboarding, an invite), in-app notifications and whether you read them | the system |
| Technical | IP address, browser and device type, login session, server logs | the system and hosting providers |
| Analytics, consent only | Google Analytics pseudonymous ID, pages viewed, approximate location, device | GA4 cookies |
| Third parties | a range contact entered by a user | users |
We do not receive card details. Stripe handles them. For a one-off donation by bank transfer, our statement shows the payer’s name, account number and payment note.
We do not process special categories of data, such as health data. Please do not put them in notes.
3. Purposes, legal bases and retention
| Purpose | Legal basis | Retention |
|---|---|---|
| Running your account and the Service (log, ranges, events, clubs) | contract, Art. 6(1)(b) | while the account exists, then deleted within 30 days |
| Paid membership, promo codes, invite rewards and any other paid content | contract, Art. 6(1)(b) | while the account exists; payment records as below |
| Accounting and tax (payment records and donations received) | legal obligation, Art. 6(1)(c) | for as long as accounting and tax law requires |
| Transactional email (welcome, login links, password reset, confirmations, important account and security notices) | contract, Art. 6(1)(b) | the send log is kept while the account exists, deleted with the account, and not kept longer than 24 months after sending unless the law requires longer |
| Emails about feature changes and product news for existing users | legitimate interest, Art. 6(1)(f). The profile switch “Important app updates by email” turns them off. It is on by default. | until you turn it off or the account is deleted |
| Range Tracker and Arroway marketing | consent, Art. 6(1)(a). The box is off when you register. | until you withdraw consent, and at the latest when the account is deleted |
| Security, abuse prevention including invite abuse, debugging | legitimate interest, Art. 6(1)(f) | provider logs for the provider’s own operations period; we do not extend it |
| Internal, account-linked feature statistics | legitimate interest, Art. 6(1)(f) | while the account exists, for at most 24 months, and always deleted with the account |
| Internal new-signup notice in Slack (email, name, nickname, account ID) | legitimate interest, Art. 6(1)(f) | in our internal channel until we delete the message |
| Google Analytics 4 | consent (cookies), Art. 6(1)(a) and the Czech ePrivacy rules | cookies for at most 2 years; we do not keep GA reports longer than the shortest sensible setting the product allows, and we do not use them to identify you |
| Questions, complaints, withdrawals and rights requests | contract, legal obligation or legitimate interest | 3 years after we resolve them |
| Legal claims | legitimate interest, Art. 6(1)(f) | the limitation period |
Withdraw marketing consent in your profile or with the link in an email. Turn off product-news emails with the same profile switch. Change cookies with “Cookie settings” in the footer. Withdrawal does not affect processing that already happened.
We do not make automated decisions that produce legal effects, and we do not sell data.
4. Who sees your data
Other users and the public. A public profile can show your name or nickname, photo, club, links, association names, saved bows and arrow sets, and public sessions. Public ranges and galleries can be visible without an account. Email, phone number and payment data are not on the public profile. Event organisers and club managers see what they need to run the event or club.
Processors, acting for us:
| Provider | Role | Location and transfers outside the EEA |
|---|---|---|
| Supabase, Inc. | database, sign-in, photo storage | processing can include access from the USA (the parent company). Transfers are covered by standard contractual clauses or the EU–US Data Privacy Framework, whichever the provider uses. This page does not state a project region. |
| Vercel Inc. | hosting, serverless functions, logs | a global network and the USA. EU–US Data Privacy Framework or standard contractual clauses. |
| Resend (Plus Five Five, Inc.) | email delivery | USA. Standard contractual clauses or the Data Privacy Framework. |
| Google Ireland Ltd. / Google LLC | Google Analytics 4, consent only | EU and USA, Data Privacy Framework |
| Slack Technologies (Salesforce) | an internal new-signup notice: email, name, nickname and account ID | USA, Data Privacy Framework |
| GitHub, Inc. | source code; no user data is stored there | — |
Independent controllers:
- Stripe Payments Europe, Ltd. (Ireland) processes payments under its own policy and may transfer data to the USA under the Data Privacy Framework or standard contractual clauses.
- Your bank or Revolut processes transfer data.
- Public authorities receive data where the law requires it.
5. Cookies and similar technologies
We do not use marketing cookies and the banner does not offer that category. Analytics loads only after you consent.
| Name | Purpose | Type | Duration |
|---|---|---|---|
| `sb-…-auth-token` | keeps you signed in. The session is in localStorage, and the server side may set a cookie of the same name. | necessary | until you sign out or the session expires |
| `rt_cookie_consent_v1` | stores your cookie choice in localStorage | necessary | until you change it or clear site data |
| `rt_locale` | the interface language, in localStorage | necessary | until you change it |
| `rt_invite_code` | remembers an invite code before you register | necessary | at most 30 days |
| the app’s IndexedDB | an unfinished session or training on the device, until it is sent or discarded | necessary | until sent or discarded |
_ga, _ga_ plus the measurement ID | Google Analytics 4. The production measurement ID is PN9QTPLKND. | analytics, consent only | up to 2 years |
Change your choice with “Cookie settings” in the footer, or delete cookies in your browser. We do not load the Google Analytics script until you consent.
6. Security
We use encrypted connections (HTTPS/TLS), database row-level security, password hashing and limited admin access. We review and fix security on an ongoing basis. If a breach is likely to risk your rights, we will notify the Office for Personal Data Protection within 72 hours, and you as well if the risk is high.
7. Your rights
You have the right to access your data and get a copy, to rectification, erasure, restriction, portability (on request, in a machine-readable format such as JSON or CSV), to object to processing based on legitimate interest, and to withdraw consent.
Email yo@filip.wtf from your account address. We reply within one month, which can be extended by two further months for a complex request.
You can also complain to the Office for Personal Data Protection (ÚOOÚ), Pplk. Sochora 27, 170 00 Praha 7, www.uoou.gov.cz.
8. Account deletion
Ask us to delete your account by emailing yo@filip.wtf from the account address. There is no button for this in the Service. We delete the account, private training records and photos stored only for the account within 30 days, including records held by processors where we can. We cancel a subscription with the account if it is not already cancelled.
Exceptions:
- records we must keep by law;
- content shared with the community, such as a range you created or a photo in a range or event gallery. After the account is deleted we anonymise it so it does not disappear for other people.
9. Children
The Service is for people aged 16 and over. We do not offer consent-based services to children under 15 (the age in section 7 of Czech Act No. 110/2019 Coll.). If we learn that a child under 16 created an account without a guardian’s consent, we will delete it.
10. Changes
We may update this policy. We will tell you about a material change by email or in the Service. An earlier version is available on request.