Privacy notice

The individual operator of RangeUnion is the controller for personal data processed through RangeUnion. For privacy questions or requests, email info@rangeunion.com or use the contact form.

RangeUnion processes your account identifier, email in the authentication service, optional username, settings, firearms, ammunition, targets, private target reference images, range visits, results, scores, notes and saved target-coordinate shot placements. This is necessary to create and operate your account and provide the logging service you request.

Local target scoring runs on your device. Session photographs are not sent to an external analysis provider.

When registration is available, every required account field must be completed and you must acknowledge the current Privacy Notice before an account can be created. RangeUnion records the notice version and server time of that acknowledgement in your private profile so it can demonstrate which information was presented during registration.

This acknowledgement records that the notice was presented. It is not used as consent for unrelated optional processing. New registrations remain closed during the private beta unless RangeUnion explicitly enables them.

Publishing to the Community Load DB is optional. It makes the fields shown in the publishing preview, performance summary, date and chosen username available to signed-in users. Publication happens at your request as part of the service, and you can remove your own published entries.

RangeUnion processes limited pseudonymous usage events linked to your account identifier: pages used, broad feature categories, device category, save duration, result quantity and failures. It does not place firearm details, ammunition details, target names, scores, notes, images or shot coordinates in analytics events.

The legal basis is the controller's legitimate interest in understanding feature use, improving reliability and securing the service. Raw events are automatically deleted after 90 days. You may object for reasons relating to your situation through the contact form. An accepted objection stops future analytics and removes existing raw events linked to your account.

When you contact RangeUnion, your name, email, subject and message are processed to answer your request. The legal basis is taking steps you request and the legitimate interest in providing support. FormSubmit relays the message and states that it retains submissions for 30 days. Answered messages are removed from the controller's mailbox within 12 months unless they must be retained longer for an unresolved request or legal claim.

To prevent contact-form abuse, the server temporarily stores a one-way keyed token derived from the request address. It cannot be used by the application to recover the address and is automatically removed within 24 hours.

Required fields, field lengths, email format, request size and origin are checked by the server. Requests are rate limited and a hidden anti-bot field is used. Form values are not inserted into dynamically constructed SQL statements.

Supabase provides authentication, the EU-hosted database, private file storage and server functions. Vercel delivers the web application. FormSubmit relays contact messages. These providers may process technical information such as IP address, device or browser information, request logs and security events. Provider support, security logging and subprocessors may involve processing outside the EU/EEA under the providers' applicable transfer safeguards. Contact info@rangeunion.com to request more information about those safeguards.

Account data, private range records and target images are kept while your account exists and are removed when you delete the related item or your account. Product analytics events are kept for no more than 90 days. Contact rate-limit tokens are kept for no more than 24 hours. Contact submissions are retained by FormSubmit for 30 days and answered mailbox messages for up to 12 months. Authentication, infrastructure and backup records follow the documented security and backup retention periods of the relevant provider and are removed or overwritten according to those schedules.

Depending on the circumstances, you may request access, correction, deletion, restriction or portability of your personal data, or object to processing based on legitimate interests. You can update your username, download an account-data copy and delete your account from Settings. Email info@rangeunion.com or use the contact form if the self-service tools do not cover your request. Requests are normally answered within one month.

You may complain to the Swedish Authority for Privacy Protection (IMY) if you believe your personal data is handled incorrectly. RangeUnion does not use your data to make decisions that produce legal or similarly significant effects.

An email, password and multi-factor authenticator are required to provide a private account. If you generate MFA recovery codes, RangeUnion stores only non-reversible code hashes and never the readable codes. Each code can be used once, and the records are deleted with your account. Other profile and range-log fields are optional unless the selected feature needs them. Access controls restrict private records to their owner. Do not enter unnecessary information about other people in notes or photographs.