Privacy Policy

Last updated May 11, 2026

This Privacy Policy describes how HotClays LLC (“HotClays”, “we”, “us”, or “our”) collects, uses, shares, and safeguards personal information when you use the HotClays websites and web application, our iOS and Android mobile applications, and the related APIs and services we operate (together, the “Services”). HotClays is a scorekeeping, competition-management, and statistics platform for clay-target shooting sports.

We care about your privacy. If you disagree with any part of this policy, please stop using the Services.

Questions or requests about this policy may be sent to support@hotclays.com.

Table of contents

1. Who we are
2. Scope of this policy
3. Information we collect
4. How we use information
5. How we share information
6. Our service providers (sub-processors)
7. AI-assisted scorecard scanning
8. International data transfers
9. How long we keep your information
10. How we protect your information
11. Cookies and similar technologies
12. Your choices and rights
13. U.S. state privacy rights
14. European Economic Area, United Kingdom, and Switzerland
15. Children’s privacy
16. Do Not Track and Global Privacy Control
17. Third-party websites and services
18. Changes to this policy
19. How to contact us

Who we are

HotClays is a product of HotClays LLC, a Minnesota limited liability company with its principal place of business in California. For the purposes of applicable data-protection laws, HotClays LLC is the “controller” (or “business”) that determines how your personal information is processed in connection with the Services.

• Contact email: support@hotclays.com

Scope of this policy

This policy applies to personal information we collect through:

• The HotClays websites and web application.
• The HotClays iOS app distributed through the Apple App Store.
• The HotClays Android app distributed through Google Play.
• The HotClays APIs and supporting backend services.

It does not apply to third-party websites, apps, or services that you may reach through links from our Services. When we hand you off to a third-party service like Stripe or the Apple App Store, that third party’s privacy policy governs the information you provide there. See “Our service providers (sub-processors)” for the main third parties we rely on.

Information we collect

We collect information in three ways: (1) information you give us directly, (2) information generated automatically when you interact with the Services, and (3) a small amount of information we receive from service providers acting on your behalf.

Information you provide to us

When you create and use a HotClays account, we collect:

• Your email address and a password. Passwords are created, validated, and stored by our authentication provider; we do not see or retain your password.
• Your first name and (optionally) last name.

When you use the Services, we collect:

• The names and details of people you add to the Services. People you add do not themselves need HotClays accounts — one registered user can track data for a whole group.
• Organizational and competition data you create, such as names, dates, team assignments, registration details, and administrative flags you set. HotClays stores only these flags; it does not store or manage any underlying documents they refer to.
• Scores, results, and related data, including per-shot results, configurations, and free-text details you enter.
• Classifications you choose to record. You can define free-form classification categories and values. HotClays does not interpret or act on their content and does not use them to make decisions about you.
• Images and PDFs you upload, including scorecard photos taken with your device camera and scorecard documents uploaded for automated processing. Because physical scorecards are filled in by hand, these images typically contain handwritten shooter names and score marks. See “AI-assisted scorecard scanning” for details on how uploaded scorecards are processed and how we use them to improve our recognition model.
• Invitation emails. If you invite someone to join a group by email, the invitation email address is stored so we can recognize the recipient when they sign in.
• File imports. If you import data via file upload (such as CSV or spreadsheet), we read the fields you supply. Email addresses in imports are stored to match imported records with HotClays accounts.
• Addresses and location coordinates you enter for discoverable content.
• Free-text content you provide in other fields.

When you connect a third-party electronic waiver provider (such as Smartwaiver, WaiverForever, or WaiverFile), we exchange registration and waiver-status information with that provider so that waiver completion can be tracked alongside registrations. The provider’s handling of your data is governed by its own terms and privacy policy.

When payments are collected or processed through the Services, they are handled by Stripe. Stripe collects payment-card data directly from the payer; HotClays does not receive or store it. We receive transaction confirmation details (such as amount, date, and status) so that payments can be reconciled within the Services.

When you pay for a HotClays subscription, we or our payment processors collect:

• Payments are handled by Stripe (web), Apple (iOS), and Google (Android). Your payment-card details are entered directly with these providers, not with HotClays. We may receive and store information provided to us by these payment processors in connection with your subscription.

When you contact us for support, we collect the contents of your message and any information you voluntarily include.

Information collected automatically

When you interact with the Services, we automatically collect certain technical and usage information, including:

• Your IP address and device and client details (such as operating system, app version, and platform).
• Request metadata (such as timestamps, URLs, and response timing). Our logs include a pseudonymous identifier tied to your account so we can investigate issues.
• Authentication and push-notification tokens stored on your device to keep you signed in and to deliver notifications. Push-notification tokens are shared with Apple or Google to enable delivery.
• A small amount of error and diagnostic information that helps us find and fix bugs.
• Precise geolocation, if you grant the Services permission to access your device’s location. We use your location to show you nearby discoverable content. We do not collect location data unless you opt in, and you can revoke permission at any time in your device or browser settings.

We may use analytics to understand how the Services are used and to improve them. We do not use behavioral-advertising or session-replay SDKs in the Services.

Information from third parties

Stripe, Apple, and Google send us notifications about subscription and payment events related to the Services.

How we use information

We use the information we collect to:

• Provide, operate, and maintain the Services, including authenticating you, syncing your data across your devices, computing scores and statistics, generating exports, and showing you nearby discoverable content based on your location.
• Scan and interpret images you upload, using AI-assisted optical character recognition. See “AI-assisted scorecard scanning”.
• Manage groups and permissions you create or are invited to, including surfacing in-app notifications for pending invitations.
• Process subscriptions and payments through Stripe, Apple, or Google, and to maintain a record of your subscription state.
• Send email and in-app notifications related to your account and activity, such as email verification, password resets, invitations, and activity updates. We do not currently send marketing email; if that changes, we will describe it here and give you a way to opt out.
• Investigate, prevent, and respond to fraud, abuse, security incidents, and violations of our Terms of Service.
• Debug and improve the Services. We use internal logs to diagnose failures and improve performance. Logs include pseudonymous user identifiers but not the content of your requests.
• Comply with legal obligations such as responding to valid subpoenas, court orders, tax-accounting requirements, and regulatory requests.

We process personal information on one or more of the following legal bases (for users to whom the GDPR or UK GDPR applies):

• Performance of a contract (to deliver the Services you have signed up for, including paid subscriptions).
• Legitimate interests (to keep the Services secure, to improve them, and to detect fraud and abuse), balanced against your rights and freedoms.
• Compliance with a legal obligation (for example, tax and accounting).
• Consent, where we specifically ask for it and where consent is the applicable basis.

How we share information

We do not sell your personal information, and we do not “share” it for cross-context behavioral advertising as those terms are defined in U.S. state privacy laws. We do not embed advertising, retargeting pixels, or behavioral-analytics SDKs in the Services.

We share information in the following limited circumstances:

• With our service providers (sub-processors). We rely on a small number of vendors to host, run, and protect the Services. They process personal information on our behalf under contracts that restrict them to acting on our instructions. See “Our service providers (sub-processors)” for the list.
• With other users and the public. HotClays is a multi-user product. Information you place in a group — such as names, scores, registrations, and uploaded images — is visible to other members of that group according to the level of access they have been granted. Users with sufficient access can see the members of their group and can grant or revoke access. A person record you create may be linked to a specific HotClays account once the account-holder accepts the link request. Some content you or your group choose to make discoverable or public — such as profiles, events, and results — may be visible to anyone, including people who are not signed in to HotClays.
• With payment platforms (Stripe, Apple, Google) to process and reconcile transactions that you initiate.
• For legal and safety reasons. We may disclose information when we reasonably believe disclosure is required to comply with a subpoena, court order, or other legal process; to enforce our Terms of Service; to protect the rights, property, or safety of HotClays, our users, or others; or to investigate fraud or other wrongdoing.
• In a corporate transaction. If HotClays or substantially all of its assets are acquired, merged, reorganized, or sold, personal information may be transferred to the successor entity as part of the transaction. We will give notice (for example, by an in-app banner or email) and the successor entity will be bound by this policy or by a substantially similar one unless you are notified otherwise and given a chance to object.
• With your consent or at your direction.

Our service providers (sub-processors)

We use a small number of service providers to operate the Services. They process personal information on our behalf under contracts that restrict them to acting on our instructions. A current list of our service providers and their purposes is available at hotclays.com/legal/service-providers/.

We do not currently use advertising networks, behavioral-analytics providers, session-replay vendors, or third-party crash-reporting services. If that changes, we will update the service providers list.

AI-assisted scorecard scanning

When you upload an image for scanning, it may be sent to a third-party AI service for processing. The image may contain handwritten names and scores. If you do not wish to have images processed by a third-party service, do not upload them — you can still enter data manually.

We use uploaded scorecards to improve our own recognition models

Uploaded scorecards — including the images, the AI’s initial reading, and any corrections you make — are used to train and improve our own internal recognition models. We do not share uploaded scorecards with advertisers or data brokers, use them to train any third-party model, or sell the data.

Scorecard scanning is an assistive feature. OCR and AI can make mistakes. You are responsible for reviewing and correcting the results before relying on them for competition outcomes or statistics.

International data transfers

HotClays is based in the United States. Our primary data storage and processing occur in U.S.-based AWS regions. Our content-delivery network terminates TLS at edge locations worldwide, but the origin data always resides in the United States.

Stripe, Apple, and Google operate globally; each may process your information in countries other than the one in which you reside. Those providers maintain their own international-transfer mechanisms such as the EU Standard Contractual Clauses and UK International Data Transfer Addenda where applicable.

If you access the Services from outside the United States, you understand that your information will be transferred to, stored, and processed in the United States and other countries where our service providers operate. By using the Services, you consent to that transfer. For EU, UK, and Swiss transfers, we rely on applicable adequacy decisions and the European Commission’s Standard Contractual Clauses (or equivalent mechanisms) where needed.

How long we keep your information

We keep personal information for as long as is necessary to provide the Services and for the additional periods listed below. The specific periods depend on the type of information and the operational, legal, tax, or accounting purposes it serves.

• Account and profile data (your name, email, and account record) are kept while your account is active. If you ask us to delete your account, we will delete or de-identify your account and associated records, except for information that we are required to retain by law.
• Competition and activity data is kept until a user with sufficient access deletes it, or until your account is deleted. Some of this data may remain in database backups (see below) for a period after deletion.
• Uploaded images and OCR output are kept for as long as the associated data exists so that authorized members of your group can continue to view them through the app. They are also retained for use in improving our recognition models, as described in “AI-assisted scorecard scanning”. When the underlying record is deleted, or when you ask us to remove specific uploads, the corresponding images are removed from the active training set; existing database backups (see below) may continue to contain copies until those backups expire. Temporary exports are deleted automatically after a short period.
• Subscription events from Stripe, Apple, and Google are retained so we can reconstruct and audit your billing history. They are not deleted when you cancel a subscription.
• Application and access logs are retained for a limited period to support debugging and security investigations.
• Database backups are retained in accordance with our disaster-recovery practices.

When retention periods expire, we delete or anonymize the data.

How we protect your information

We use industry-standard technical and organizational safeguards, including encryption in transit (TLS) and at rest, network isolation of internal services, role-based access controls, and web-application firewall protection.

No method of transmission or storage is perfectly secure. We cannot guarantee absolute security, and you use the Services at your own risk. Please use a strong, unique password and keep your devices and recovery codes safe.

Cookies and similar technologies

HotClays uses a minimal set of cookies and browser storage, limited to what is needed to keep you signed in and to operate the CDN:

• Authentication-session storage. When you sign in through the web app, your session tokens are stored in the browser so you do not have to sign in on every request. These tokens are accessible only to the HotClays web app origin.
• CDN cookies. Our content-delivery network may set technical cookies that are required for its operation.

We do not set advertising, retargeting, or cross-site tracking cookies on our web domains, and we do not share information with ad networks or data brokers.

Your choices and rights

You can make the following choices at any time from inside the Services:

• Update your profile. Change your first and last name from the account screen.
• Change your password. Use the password-reset flow on the sign-in screen.
• Manage your web subscription. Update your payment method, change plan, or cancel from inside the web app. Mobile-app subscriptions are managed through your Apple ID or Google Play account.
• Remove data that you own or administer using the deletion flows in the app.

You may also ask us to exercise the following rights, subject to our ability to verify your identity and to any exceptions permitted by law:

• Right to know / access. Request a copy of the personal information we hold about you.
• Right to correct. Ask us to correct inaccurate information. You can correct most profile fields yourself from within the app.
• Right to delete. Ask us to delete your account and the associated personal information. We will honor this request except where retention is required or permitted by law (for example, tax records, fraud prevention, or legal defense). Because a self-serve account-deletion flow is not yet available inside the app, please email support@hotclays.com to request deletion.
• Right to portability / export. Ask us for an electronic export of your personal information. Because a self-serve export flow is not yet available, please email support@hotclays.com.
• Right to opt out of sales and “sharing.” HotClays does not sell or share your personal information, so there is nothing to opt out of.
• Right to limit use of sensitive personal information. We use precise geolocation only to show you nearby content, and only when you grant permission. You can revoke permission at any time in your device or browser settings.
• Right to non-discrimination. We will not deny Services, charge different prices, or degrade quality because you exercised your privacy rights.

To exercise any of these rights, email support@hotclays.com from the email address associated with your account, or reply from that address to a request we send you. We may ask for additional information to verify your identity. We will respond within the time required by applicable law (typically 30–45 days, with a possible one-time extension).

You may also designate an authorized agent to submit a request on your behalf. We may require the agent to provide written proof of their authorization and may contact you to verify that you authorized the request.

If we deny a request, you may appeal the decision by emailing support@hotclays.com with “Privacy Appeal” in the subject line. We will respond to the appeal within the time required by applicable law.

U.S. state privacy rights

This section supplements the rights described above for residents of California and other U.S. states with comprehensive consumer privacy statutes.

Categories of personal information collected in the last 12 months

Sources, purposes, and recipients are described in “Information we collect”, “How we use information”, and “How we share information” above.

Sale and sharing

HotClays does not “sell” personal information and does not “share” personal information for cross-context behavioral advertising, as those terms are defined in the California Consumer Privacy Act (as amended by the CPRA) or in equivalent state statutes. We have not sold or shared personal information in the preceding twelve (12) months, and we do not knowingly sell or share the personal information of consumers under sixteen (16) years of age. We also do not disclose personal information to third parties for their direct-marketing purposes (Cal. Civ. Code § 1798.83).

European Economic Area, United Kingdom, and Switzerland

If you are in the European Economic Area (EEA), the United Kingdom, or Switzerland, the GDPR, UK GDPR, or Swiss FADP may apply. HotClays LLC is the controller (see “Who we are”). Our legal bases are described in “How we use information”, and our transfer mechanisms are described in “International data transfers”.

In addition to the rights in “Your choices and rights”, you may:

• restrict or object to our processing of your personal information;
• withdraw consent (withdrawal does not affect prior processing); and
• lodge a complaint with your local supervisory authority.

We do not make decisions about you based solely on automated processing.

Children’s privacy

You must be at least thirteen (13) years old to use HotClays. Users between 13 and 18 must have parental or guardian consent. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has provided personal information to HotClays, please contact support@hotclays.com and we will take steps to delete it.

Do Not Track and Global Privacy Control

Our Services do not currently respond to Do Not Track (“DNT”) or Global Privacy Control (“GPC”) browser signals. HotClays does not sell or share personal information, so these signals do not change how we handle your data.

Third-party websites and services

The Services may link to or interoperate with third-party websites, services, and apps (for example, Stripe, the Apple App Store, or Google Play). This policy does not apply to those third parties. We encourage you to read their privacy policies and terms before using them.

Changes to this policy

We may update this Privacy Policy from time to time to reflect changes to our practices, the Services, our service providers, or the law. When we do, we will update the “Last updated” date at the top of this document and notify you through the Services (for example, with an in-app banner). If a change materially affects how we collect, use, or share your personal information, we will give you reasonable advance notice before it takes effect. Your continued use of the Services after the effective date of the updated policy constitutes acceptance of the update.

How to contact us

For any question, comment, or request about this policy, including to exercise your rights, please contact us at support@hotclays.com.