Privacy Policy

TrapCloud is provided to organizations such as schools, teams, leagues, and clubs. When an organization uses the Service, that organization decides what information to submit and is responsible for it; we process that information on the organization’s behalf as a service provider. For information you provide directly to us — such as when you create an account or contact us — we act as the controller. This Policy describes our practices in both roles. Where an organization’s own privacy policy applies to the data it submits, that policy governs the organization’s relationship with the individuals whose data it provides.

• Account information. When you register, we collect your name, email address, and password (which we store only in a securely hashed form, never in plaintext), and optionally a phone number. We also store your role(s) and the organization or school you belong to.
• Athlete and roster information.Organizations and coaches add athletes to the Service. This may include an athlete’s name, date of birth, gender, graduation year, governing-body membership number (such as an ATA number), classification, handicap yardage, and competition scores and history. Many athletes are students and minors; this information is provided to us by the organization, and an athlete does not need an account to be included on a roster. See Section 5 (Students and minors).
• Competition data. Scores, standings, awards, squad assignments, and related records generated through use of the Service.
• Communications and consent data. If you choose to receive text-message alerts, we collect your phone number and your opt-in consent, along with records of that consent and any later opt-out. If you use the mobile application and enable notifications, we collect a device push token. If you follow an athlete to receive updates, we record that relationship.
• Payment information. Subscriptions are processed by Stripe, Inc. Stripe collects and processes your payment card details directly; we do not receive or store full card numbers or security codes. We store limited billing references (such as a customer or subscription identifier) needed to manage your subscription.
• Information collected automatically. When you use the Service, we and our providers automatically collect certain technical information, such as IP address, device and browser type, pages viewed, and usage activity, through cookies and similar technologies and through our analytics and error-monitoring providers.
• Mobile application information. The mobile application may access your device camera to scan scorer QR codes (image data is used only to read the code and is not stored by us for that purpose), register a push notification token, and store data locally on your device to support offline scoring, which is then synchronized with the Service.

We use information to: provide, operate, and secure the Service; create and manage accounts and roles; run meets, scoring, leaderboards, awards, and team pages; process payments and manage subscriptions; send transactional messages (such as verification, password reset, and notifications) and, where you have opted in, text-message alerts; provide customer support; monitor, debug, and improve the Service; detect and prevent fraud, abuse, and security incidents; and comply with legal obligations. We do not use student data to serve targeted advertising, and we do not sell personal information.

By design, certain information is displayed publicly as part of the Service, including on live results, leaderboards, standings, awards, and public team pages. This may include athlete names, schools/teams, squad and division, and scores. Recruiting profiles are shown publicly only when explicitly opted in. Organizations control whether and when results are made public for their meets. Do not submit information to the Service that you are not permitted to display publicly in this way.

TrapCloud is designed for scholastic and youth trap shooting, and much of the athlete information in the Service concerns students who may be minors. This information is provided to us by organizations, schools, and coaches. Those organizations are responsible for obtaining any consent required under applicable laws — including the Family Educational Rights and Privacy Act (FERPA), the Children’s Online Privacy Protection Act (COPPA), and applicable state student-data-privacy laws — before submitting student or minor information to the Service. We act as a service provider to those organizations with respect to student data: we use it only to provide the Service to the organization and as instructed by the organization, we do not use it to serve targeted advertising, and we do not sell it. A parent, guardian, or eligible student who wishes to review, correct, or delete a student’s information should contact the responsible organization; we will support the organization in responding to such requests, and you may also contact us at [email protected]. We do not knowingly permit children under 13 to create their own accounts; child information in the Service is submitted by organizations, not collected directly from children.

We share information as follows: (a) with service providers and subprocessors that help us operate the Service, under contractual confidentiality and security obligations — see our Subprocessors page for the current list; (b) publicly, as described in Section 4; (c) within your organization, with the administrators, coaches, and staff of the organization to which the data belongs; (d) for legal reasons, when we believe disclosure is necessary to comply with law, respond to lawful requests, or protect the rights, safety, or property of TrapCloud, our users, or the public; and (e) in connection with a business transaction such as a merger, acquisition, or sale of assets, subject to this Policy. We do not sell personal information.

We use cookies and similar technologies that are strictly necessary for the Service to function (for example, to keep you signed in and to remember your privacy choices). We also use analytics cookies — currently Google Analytics — to measure and improve website performance and usage. Analytics cookies are only set after you consent through our cookie banner, and we do not load our analytics provider until you have agreed. You can review or change your choice at any time on our Your Privacy Choices page, or through your browser settings. We also honor the Global Privacy Control (GPC) browser signal: if your browser sends a GPC signal, we treat it as a request to opt out of non-essential analytics/tracking and do not load analytics cookies. Disabling strictly-necessary cookies may affect functionality.

We retain information for as long as needed to provide the Service, maintain competition and audit records, comply with legal obligations, resolve disputes, and enforce our agreements. Retention periods vary by category of information: account information is kept for the life of the account and a limited period afterward; competition, scoring, and audit records are retained to preserve the integrity of results and awards; billing references are retained as required for tax and accounting purposes; and communication-consent records are kept to evidence opt-in and opt-out. When an account or record is deleted, we may retain limited information as required for these purposes or in backups for a limited period, after which it is deleted or de-identified. Organizations may request deletion of their data as described in Section 9.

Depending on your role and applicable law, you may: access and update your account information; request access to, correction of, or deletion of personal information; opt out of text-message alerts by replying STOP or as instructed in the message; disable push notifications in your device settings; manage analytics cookies on our Your Privacy Choices page; and unsubscribe from non-essential emails using the link in those messages. Because we act as a service provider for organization and student data, requests concerning that data should be directed to the responsible organization; we will assist the organization in fulfilling them.

Sale and sharing. We do not sell your personal information, and we do not share it for cross-context behavioral advertising. We honor the Global Privacy Control (GPC) signal as a valid opt-out of non-essential analytics/tracking.

To exercise a right or ask a question, contact us at [email protected]. We may need to verify your identity before acting on a request, and you may use an authorized agent where the law permits. We will not discriminate against you for exercising your rights. If we decline a request, you may appeal by replying to our decision; if you remain unsatisfied, you may contact your state attorney general or, in the EEA/UK, your data protection authority (see Section 12).

We use technical and organizational measures designed to protect information, including encryption of data in transit, hashing of passwords, database-level tenant isolation so each organization’s data is segregated, role-based access controls, and audit logging of scoring activity. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

The Service is operated in the United States, and information is processed and stored on infrastructure located in the United States. If you access the Service from outside the United States, you understand that your information will be processed in the United States, where privacy laws may differ from those of your location. Where we transfer personal data from the European Economic Area (EEA), the United Kingdom, or Switzerland to the United States, we rely on an appropriate transfer mechanism, such as the European Commission’s Standard Contractual Clauses (and the UK International Data Transfer Addendum), together with supplementary safeguards as needed. You may request more information about these safeguards using the contact details below.

Where the EU or UK General Data Protection Regulation applies, TrapCloud acts as a controller for the account and contact information you provide directly to us, and as a processor for the organization and athlete data an organization submits. Our lawful bases for processing personal data as a controller are: performance of a contract (to provide the Service you request); our legitimate interests (to secure, operate, debug, and improve the Service and prevent fraud and abuse), balanced against your rights; your consent (for analytics cookies and, where applicable, text-message alerts), which you may withdraw at any time; and compliance with legal obligations.

Subject to applicable law, you have the right to access, rectify, erase, restrict, or object to the processing of your personal data; to data portability; and to withdraw consent at any time without affecting prior processing. To exercise these rights, contact us at [email protected]. You also have the right to lodge a complaint with your local supervisory authority. If we are required to appoint an EU or UK representative under Article 27 GDPR, their details will be provided here.

We may update this Privacy Policy from time to time. If we make material changes, we will provide notice by reasonable means, such as posting the updated Policy with a new “Last updated” date or notifying you through the Service. Your continued use of the Service after changes take effect constitutes acceptance of the updated Policy.

If you have questions about this Privacy Policy or our privacy practices, contact TrapCloud at [email protected]