1.Who we are & what this covers
ShotGroup is a software platform for shooting ranges, gun clubs, firearms instructors, and the shooters who train and compete with them. It is provided by Scrypster LLC, a Pennsylvania limited liability company (“Scrypster LLC,” “ShotGroup,” “we,” “us,” or “our”). This Privacy Policy applies to our websites (including shotgroupplatform.com), our web and mobile applications (including shotgroup.app and the ShotKeeper scoring app), and related services (together, the “Services”).
Our two roles
Because ShotGroup is a business-to-business-to-consumer platform, we handle personal information in two different capacities, and your rights may run through a different party depending on the context:
- As a business (controller) for our own users. When you create a ShotGroup account, browse our sites, or use our consumer features, we determine how your information is used and this Policy governs.
- As a service provider (processor) for our business customers. When a range, club, or instructor uses ShotGroup to manage their members, students, bookings, or match registrations, that business is the controller of the information it collects about those people, and it processes that data under its own privacy notice. We act on that business’s instructions. If you are a member or customer of such a business, please also review that business’s privacy notice, and direct requests about your data to them; we will support them in responding.
2.Information we collect
We collect the following categories of information, depending on how you use the Services:
- Identifiers & contact data: name, display name/handle, email address, phone number, mailing/billing address, and account credentials.
- Profile & business data: business name and profile, role/title, competitive division and classification, avatar or photos you upload, and preferences.
- Membership & booking records: membership plans and status, dues, lane/bay/room reservations, check-ins, and attendance.
- Match & competition data: match registrations, squad assignments, division/class, and scores, times, penalties, and results. Some of this information is published publicly — see Section 6.
- Staff & scheduling data: shifts, availability, time-off, and role assignments (for operators who use staff scheduling).
- Waivers & e-signatures: liability waivers and other documents you sign electronically, and associated metadata (timestamp, IP address) used to evidence signature.
- Payment data: processed by our payment provider, Stripe. Card details are entered directly into Stripe and are not stored on our servers; we receive limited information such as the last four digits, card brand, billing name, and transaction status. See Section 5.
- Location data: approximate location derived from your IP address, and, only with your permission, more precise device location used to sort ranges, matches, and shooters “near you.” Precise geolocation is treated as sensitive information — see Section 10.
- Device, usage & analytics data: IP address, device and browser type, operating system, app version, pages/screens viewed, and interactions, collected through logs and analytics tools.
- Communications: messages you send through in-app chat, and support or feedback you send us.
We do not intentionally collect special categories of data (such as health, biometric, or genetic data). Please do not submit such information through the Services.
3.Where the information comes from
- From you — when you create an account, set up a profile, register for a match, make a booking, sign a waiver, or contact us.
- From ranges, clubs, and instructors — when a business adds you to its roster, registers you, or imports results from another scoring system.
- From your devices — through cookies, SDKs, logs, and (with permission) location services.
- From service providers — such as Stripe (payment and fraud-prevention signals) and analytics providers.
- From public and third-party sources — such as published match results and venue information.
4.How we use information
We use personal information to:
- provide, operate, and maintain the Services, including accounts, bookings, memberships, scheduling, matches, and scoring;
- process payments and payouts through Stripe, and prevent, detect, and investigate fraud;
- publish competition registrations and results where you or an operator have chosen to make them public (see Section 6);
- communicate with you about your account, transactions, and service changes, and — where permitted — send you product news and marketing you can opt out of;
- personalize features such as discovery of nearby ranges, matches, and shooters;
- maintain security, enforce our Terms of Service, and comply with legal obligations (including retaining waivers and records);
- analyze and improve the Services and develop new features.
Legal bases (EEA/UK users)
Where the GDPR or UK GDPR applies, we rely on the following legal bases:
| Purpose | Legal basis |
|---|---|
| Providing the Services, accounts, bookings, payments | Performance of a contract |
| Security, fraud prevention, product improvement | Legitimate interests |
| Retaining waivers, records, and meeting tax/legal duties | Legal obligation |
| Marketing, non-essential cookies, precise location, and publishing information that reveals firearms activity | Consent (which you may withdraw) |
6.Public competition results & profiles
Competitive shooting is public by nature. When you register for or compete in a match through the Services, information such as your name or display name, club/affiliation, division and classification, scores, times, penalties, and finishing position may be published publicly on leaderboards and results pages, may be visible to other participants, and may be indexed by search engines. Public business and shooter profiles may likewise be visible to anyone.
Because this creates a lasting public record that links your identity to firearms-related activity, we give you controls:
- You can choose how you appear (for example, a display name, initials, or handle) where the feature allows.
- You can request that a public listing be limited or removed, subject to a match organizer’s legitimate interest in the integrity of official results.
- We suppress contact details and precise location from public results.
- We take extra care with minors — see Section 11.
8.How long we keep information
We keep personal information only for as long as needed for the purposes described in this Policy, and then delete or de-identify it. Retention periods vary by category:
- Account & profile data — for the life of your account and a reasonable period afterward.
- Booking, membership, and transaction records — as needed to provide the Services and to meet tax, accounting, and audit obligations.
- Signed waivers and competition/results records — retained on a durable basis for legal, evidentiary, and historical-record reasons, which may be longer than other data.
- Logs and analytics data — for a limited period consistent with security and product needs.
- Children’s data — only as long as needed for the specific purpose, then deleted (see Section 11).
Where we act as a service provider for a business customer, that business’s instructions and its own retention obligations also apply.
9.Security
We use administrative, technical, and organizational safeguards designed to protect personal information appropriate to its sensitivity, including encryption in transit, access controls, and handling card data through Stripe’s PCI-compliant systems rather than our own. No method of transmission or storage is perfectly secure, so we cannot guarantee absolute security. If a security incident affects your personal information, we will notify you and the relevant authorities as required by applicable law.
10.Your privacy rights & choices
Depending on where you live, you may have some or all of the following rights regarding personal information we hold as a controller:
- Know / access the personal information we have collected and how we use and share it;
- Correct inaccurate personal information;
- Delete personal information, subject to legal exceptions (such as retained waivers and records);
- Portability — receive a copy in a portable format;
- Opt out of any sale or sharing of personal information and of targeted advertising and certain profiling;
- Limit the use of sensitive personal information (such as precise geolocation);
- Withdraw consent where we rely on it (such as marketing or precise location); and
- Non-discrimination for exercising your rights.
To exercise these rights, email us at privacy@shotgroup.io or use the privacy controls in your account settings. We will verify your request and respond within the time the law requires. You may use an authorized agent where the law permits. If we decline a request, you may appeal by replying to our response; residents of states that provide an appeal right may also contact their Attorney General.
If a range or club collected your information and we act only as its service provider, we will direct your request to that business and support its response.
11.Children & minors
The Services are not directed to children under 13, and we do not knowingly collect personal information directly from children under 13. Youth and junior competitors participate through a parent, guardian, or club acting under parental authority, who is responsible for the registration and for any consent required.
- Where a junior competitor is registered, we suppress a minor’s identifying details from public results absent verifiable parental consent.
- A parent or guardian may review, correct, or request deletion of a child’s information by contacting privacy@shotgroup.io.
- We do not sell or share the personal information of consumers we know to be under 16 without opt-in consent (and, for those under 13, parental consent), as required by law.
If you believe a child has provided us personal information without appropriate consent, contact us and we will delete it.
12.International users & data transfers
We operate in the United States, and the information we process is stored and handled in the United States. If you access the Services from the European Economic Area, the United Kingdom, or elsewhere outside the United States, you understand that your information will be transferred to and processed in the United States. Where required, we rely on appropriate safeguards for such transfers, including the European Commission’s Standard Contractual Clauses and the UK’s International Data Transfer Addendum. EEA/UK users may exercise their data-protection rights and lodge a complaint with their local supervisory authority.
13.Changes to this Policy
We may update this Privacy Policy from time to time. When we do, we will revise the “Last updated” date above and, for material changes, provide additional notice (such as through the Services or by email). Your continued use of the Services after an update takes effect means you accept the revised Policy.
14.Contact us
Questions or requests about this Policy or your personal information:
- Privacy: privacy@shotgroup.io
- General/legal: legal@shotgroup.io
- Mail: Scrypster LLC, [MAILING ADDRESS], Pennsylvania
Scrypster LLC, a Pennsylvania limited liability company, is the entity responsible for personal information processed as a controller under this Policy.
15.U.S. state privacy notices
California (CCPA/CPRA) notice at collection
In the past 12 months we have collected the following categories of personal information, for the business purposes described in Section 4, from the sources in Section 3, and disclosed them to the categories of recipients in Section 5:
| Category | Collected | Sold / Shared |
|---|---|---|
| Identifiers & contact data | Yes | No |
| Commercial information (bookings, memberships, transactions) | Yes | No |
| Internet/device & usage activity | Yes | No |
| Geolocation (approximate; precise with consent) | Yes | No |
| Audiovisual (photos/avatars you upload) | Yes | No |
| Professional/employment (staff scheduling) | Yes | No |
| Sensitive PI (precise geolocation; account log-in credentials) | Yes | No |
California residents have the rights described in Section 10, including the right to know, delete, correct, and opt out of sale/sharing and to limit sensitive personal information. We do not sell or share personal information; we honor GPC signals. You may exercise these rights at privacy@shotgroup.io.
Other U.S. states
Residents of Virginia, Colorado, Connecticut, Texas, and other states with comprehensive privacy laws have similar rights to access, correct, delete, and obtain a portable copy of their personal information, to opt out of targeted advertising, sale, and certain profiling, and to appeal a decision on a request. We process sensitive data (such as precise geolocation) only with your consent. Exercise these rights at privacy@shotgroup.io.