Privacy Policy

Last updated August 28, 2026

This Privacy Policy describes how HotClays LLC (“HotClays”, “we”, “us”, or “our”) collects, uses, shares, and safeguards personal information when you use the HotClays websites and web application, our iOS and Android mobile applications, and the related APIs and services we operate (together, the “Services”). HotClays is a scorekeeping, competition-management, and statistics platform for clay-target shooting sports.

We care about your privacy. If you disagree with any part of this policy, please stop using the Services.

Questions or requests about this policy may be sent to support@hotclays.com.

Table of contents

1. Who we are
2. Scope of this policy
3. Information we collect
4. How we use information
5. How we share information
6. Our service providers (sub-processors)
7. AI-assisted scorecard scanning
8. International data transfers
9. How long we keep your information
10. How we protect your information
11. Cookies and similar technologies
12. Your choices and rights
13. U.S. state privacy rights
14. European Economic Area, United Kingdom, and Switzerland
15. Children’s privacy
16. Do Not Track and Global Privacy Control
17. Third-party websites and services
18. Changes to this policy
19. How to contact us

Who we are

HotClays is a product of HotClays LLC, a Minnesota limited liability company with its principal place of business in California. For the purposes of applicable data-protection laws, HotClays LLC is the “controller” (or “business”) that determines how your personal information is processed in connection with the Services.

• Contact email: support@hotclays.com

Scope of this policy

This policy applies to personal information we collect through:

• The HotClays websites and web application.
• The HotClays iOS app distributed through the Apple App Store.
• The HotClays Android app distributed through Google Play.
• The HotClays APIs and supporting backend services.

It does not apply to third-party websites, apps, or services that you may reach through links from our Services. When we hand you off to a third-party service like Stripe or the Apple App Store, that third party’s privacy policy governs the information you provide there. See “Our service providers (sub-processors)” for the main third parties we rely on.

Information we collect

We collect information in four ways: (1) information you give us directly, (2) information other users provide about you, (3) information generated automatically when you interact with the Services, and (4) a small amount of information we receive from our payment providers.

Information you provide to us

When you create and use a HotClays account, we collect:

• Your email address and a password. Passwords are created, validated, and stored by our authentication provider; we do not see or retain your password.
• Your first name and (optionally) last name.
• Optionally, display images such as a profile photo or a group logo. Metadata embedded in an uploaded image (such as location) is removed when we process the image and is not kept afterward; an upload that is never completed is deleted automatically.
• Optionally, profile details you choose to add, such as a short bio or the equipment you use.
• A HotClays number we assign to your account. It identifies you within the Services and lets anyone who has it find you and connect with you.

When you use the Services, we collect:

• The names and details of people you add to the Services. People you add do not themselves need HotClays accounts — one registered user can track data for a whole group.
• Organizational and competition data you create, such as names, dates, team assignments, registration details, and administrative flags you set. HotClays stores only these flags; it does not store or manage any underlying documents they refer to. This includes public details a group administrator chooses to show, such as the group’s name, description, location, schedule, and display image, and the roles assigned to people in the group.
• Scores, results, and related data, including per-shot results, configurations, and free-text details you enter.
• Classifications you choose to record. You can define free-form classification categories and values. HotClays does not interpret or act on their content and does not use them to make decisions about you.
• Images and PDFs you upload, including scorecard photos taken with your device camera and scorecard documents uploaded for automated processing. Because physical scorecards are filled in by hand, these images typically contain handwritten shooter names and score marks. A photo may also include metadata your device embeds in it, such as the location where it was taken; we do not use that metadata. See “AI-assisted scorecard scanning” for details on how uploaded scorecards are processed and how we use them to improve our recognition model.
• Invitation emails and numbers. If you invite someone by email or HotClays number, we store it to deliver the invitation and to recognize the recipient when they sign in. We use an invitation email address only for that invitation.
• Connections you make, such as the users you follow, the users who follow you, and pending follow, link, membership, or registration requests you send or receive.
• Blocks you place on other users.
• Reports you submit about a user, group, or content, including the reason and any details you give.
• File imports. If you import data via file upload (such as CSV or spreadsheet), we read the fields you supply. Email addresses in imports are stored to match imported records with HotClays accounts.
• Addresses and location coordinates you enter for discoverable content.
• Free-text content you provide in other fields.

When you connect a third-party electronic waiver provider (such as Smartwaiver, WaiverForever, or WaiverFile), we exchange registration and waiver-status information with that provider so that waiver completion can be tracked alongside registrations. The provider’s handling of your data is governed by its own terms and privacy policy.

When payments are collected or processed through the Services, they are handled by Stripe. Stripe collects payment-card data directly from the payer; HotClays does not receive or store it. We receive transaction confirmation details (such as amount, date, and status) so that payments can be reconciled within the Services.

When you pay for a HotClays subscription, we or our payment processors collect:

• Payments are handled by Stripe (web), Apple (iOS), and Google (Android). Your payment-card details are entered directly with these providers, not with HotClays. We may receive and store information provided to us by these payment processors in connection with your subscription.

When you contact us for support, we collect the contents of your message and any information you voluntarily include.

Information other users provide about you

Other users may add your name and details to a group, round, or scorecard, invite you, link a person record to your account, or submit a report about you. We hold that information as part of their content and, once a record is linked to you, as part of your account.

Information collected automatically

When you interact with the Services, we automatically collect certain technical and usage information, including:

• Your IP address and device and client details (such as operating system, app version, and platform).
• Request metadata (such as timestamps, URLs, and response timing). Our logs include a pseudonymous identifier tied to your account so we can investigate issues.
• Authentication and device notification tokens, so you stay signed in and we can deliver notifications to your devices. Notification tokens are issued by Apple or Google and used with them to deliver notifications.
• A HotClays link you open before signing in, kept so we can take you there after you sign in or create an account.
• A small amount of error and diagnostic information that helps us find and fix bugs.
• Precise geolocation, if you grant the Services permission to access your device’s location. We use your location to show you nearby discoverable content. Other than metadata embedded in images you upload (see above), we do not collect your device location unless you opt in, and you can revoke permission at any time in your device or browser settings.

We may use analytics to understand how the Services are used and to improve them. We do not use behavioral-advertising or session-replay SDKs in the Services.

Information from third parties

Stripe, Apple, and Google send us notifications about subscription and payment events related to the Services.

How we use information

We use the information we collect to:

• Provide, operate, and maintain the Services, including authenticating you, syncing your data across your devices, computing scores and statistics, generating exports, and showing you nearby discoverable content based on your location.
• Scan and interpret images you upload, using AI-assisted optical character recognition. See “AI-assisted scorecard scanning”.
• Manage groups and permissions you create or are invited to, including surfacing in-app notifications for pending invitations.
• Process subscriptions and payments through Stripe, Apple, or Google, and to maintain a record of your subscription state.
• Send email, in-app, and push notifications about your account and activity — for example email verification, password resets, invitations, requests that need your answer, confirmations, and, according to your notification settings, activity from people you follow and groups you belong to. You can control which notifications you receive in your device settings and, where available, in the Services. We do not currently send marketing email; if that changes, we will describe it here and give you a way to opt out.
• Suggest people, groups, and squads to you based on your connections, your groups, and who you have shot with.
• Moderate the Services, including reviewing reports, enforcing blocks, and acting on violations of our Terms of Service.
• Investigate, prevent, and respond to fraud, abuse, security incidents, and violations of our Terms of Service.
• Debug and improve the Services. We use internal logs to diagnose failures and improve performance. Logs include pseudonymous user identifiers but not the content of your requests.
• Comply with legal obligations such as responding to valid subpoenas, court orders, tax-accounting requirements, and regulatory requests.

We process personal information on one or more of the following legal bases (for users to whom the GDPR or UK GDPR applies):

• Performance of a contract (to deliver the Services you have signed up for, including paid subscriptions).
• Legitimate interests (to keep the Services secure, to improve them, and to detect fraud and abuse), balanced against your rights and freedoms.
• Compliance with a legal obligation (for example, tax and accounting).
• Consent, where we specifically ask for it and where consent is the applicable basis.

How we share information

We do not sell your personal information, and we do not “share” it for cross-context behavioral advertising as those terms are defined in U.S. state privacy laws. We do not embed advertising, retargeting pixels, or behavioral-analytics SDKs in the Services.

We share information in the following limited circumstances:

• With our service providers (sub-processors). We rely on a small number of vendors to host, run, and protect the Services. They process personal information on our behalf under contracts that restrict them to acting on our instructions. See “Our service providers (sub-processors)” for the list.
• With other users and the public. HotClays is a multi-user product. Information you place in a group — such as names, scores, registrations, and uploaded images — is visible to other members of that group according to the level of access they have been granted. Users with sufficient access can see the members of their group and can grant or revoke access. A person record in a group may be linked to a HotClays account when the user accepts the group’s invitation, registers with or joins the group, or asks to claim the record and the group approves. While linked, the group’s scores for that person count toward their account; if the link is later removed, those scores stay with the group’s records but no longer appear on the account. Declining an invitation is not shown to the group. Some content you or your group choose to make discoverable or public — such as profiles, events, and results — may be visible to anyone, including people who are not signed in to HotClays and where a group displays or embeds its public pages outside the Services. We may review a group before listing it as discoverable.
• Profiles and social features. Where the Services offer profiles and social features, what other users can see about you — such as your rounds, statistics, and activity — is governed by the visibility settings you choose. Scores and results recorded in a group or competition remain visible to whoever can see that group or competition, regardless of your profile settings. Your name, HotClays number, and display image may be visible to other users in the groups and competitions you take part in, and to anyone who has your number. If you or your group choose to be discoverable, your name (or your group’s name and public details) may appear in search results and listings within the Services. We do not make content you have already added more visible without an action on your part. If you block a user, we stop showing each of you to the other in social features, search, and invitations; we do not notify a user that they have been blocked, and a block does not remove either of you from competitions you both take part in.
• Links and codes. Users and group administrators can create links or codes (including QR codes) that give anyone who has them access to specific content — for example to view a round, register for an event, or join a group. Content shared this way is visible to whoever the link or code reaches, until the link or code is turned off or expires; a code printed on a physical item, such as a scorecard, may keep working for as long as that item circulates. If you ask to join a group, claim a person record, or access content you cannot see — or a group invites you — your name, HotClays number, and display image are shown to the people who decide while the request or invitation is pending.
• Display images. A display image you upload (such as a profile photo or a group logo) is shown to other users who can see you or your group in the Services, and can be viewed by anyone who has the image’s web address.
• With payment platforms (Stripe, Apple, Google) to process and reconcile transactions that you initiate.
• For legal and safety reasons. We may disclose information when we reasonably believe disclosure is required to comply with a subpoena, court order, or other legal process; to enforce our Terms of Service; to protect the rights, property, or safety of HotClays, our users, or others; or to investigate fraud or other wrongdoing.
• In a corporate transaction. If HotClays or substantially all of its assets are acquired, merged, reorganized, or sold, personal information may be transferred to the successor entity as part of the transaction. We will give notice (for example, by an in-app banner or email) and the successor entity will be bound by this policy or by a substantially similar one unless you are notified otherwise and given a chance to object.
• With your consent or at your direction.

Our service providers (sub-processors)

We use a small number of service providers to operate the Services. They process personal information on our behalf under contracts that restrict them to acting on our instructions. A current list of our service providers and their purposes is available at hotclays.com/legal/service-providers/.

We do not currently use advertising networks, behavioral-analytics providers, session-replay vendors, or third-party crash-reporting services. If that changes, we will update the service providers list.

AI-assisted scorecard scanning

When you upload an image for scanning, it may be sent to a third-party AI service for processing. The image may contain handwritten names and scores. If you do not wish to have images processed by a third-party service, do not upload them — you can still enter data manually.

We use uploaded scorecards to improve our own recognition models

Uploaded scorecards — including the images, the AI’s initial reading, and any corrections you make — are used to train and improve our own internal recognition models. We do not share uploaded scorecards with advertisers or data brokers, use them to train any third-party model, or sell the data.

Scorecard scanning is an assistive feature. OCR and AI can make mistakes. You are responsible for reviewing and correcting the results before relying on them for competition outcomes or statistics.

International data transfers

HotClays is based in the United States. Our primary data storage and processing occur in U.S.-based AWS regions. Our content-delivery network terminates TLS at edge locations worldwide, but the origin data always resides in the United States.

Stripe, Apple, and Google operate globally; each may process your information in countries other than the one in which you reside. Those providers maintain their own international-transfer mechanisms such as the EU Standard Contractual Clauses and UK International Data Transfer Addenda where applicable.

If you access the Services from outside the United States, you understand that your information will be transferred to, stored, and processed in the United States and other countries where our service providers operate. By using the Services, you consent to that transfer. For EU, UK, and Swiss transfers, we rely on applicable adequacy decisions and the European Commission’s Standard Contractual Clauses (or equivalent mechanisms) where needed.

How long we keep your information

We keep personal information for as long as is necessary to provide the Services and for the additional periods listed below. The specific periods depend on the type of information and the operational, legal, tax, or accounting purposes it serves.

• Account and profile data (your name, email, and account record) are kept while your account is active. If you ask us to delete your account, we will delete or de-identify your account and associated records, except for information that we are required to retain by law.
• Competition and activity data is kept until a user with sufficient access deletes it. When your account is deleted, records a group holds about you stay with that group but are no longer linked to an account. Some of this data may remain in database backups (see below) for a period after deletion.
• Uploaded images and OCR output are kept for as long as the associated data exists so that authorized members of your group can continue to view them through the app. They are also retained for use in improving our recognition models, as described in “AI-assisted scorecard scanning”. When the underlying record is deleted, or when you ask us to remove specific uploads, the corresponding images are removed from the active training set; existing database backups (see below) may continue to contain copies until those backups expire. Temporary exports are deleted automatically after a short period.
• Display images are kept until you replace or remove them, or until the associated account or group is deleted. After removal, copies may persist for a short time in caches and in backups (see below).
• Block and report records are kept for as long as needed to enforce them and to keep the Services safe.
• Subscription events from Stripe, Apple, and Google are retained so we can reconstruct and audit your billing history. They are not deleted when you cancel a subscription.
• Application and access logs and device notification tokens are retained for a limited period to support debugging, security investigations, and notification delivery.
• Database backups are retained in accordance with our disaster-recovery practices.

When retention periods expire, we delete or anonymize the data.

How we protect your information

We use industry-standard technical and organizational safeguards, including encryption in transit (TLS) and at rest, network isolation of internal services, role-based access controls, and web-application firewall protection.

No method of transmission or storage is perfectly secure. We cannot guarantee absolute security, and you use the Services at your own risk. Please use a strong, unique password and keep your devices and recovery codes safe.

Cookies and similar technologies

HotClays uses a minimal set of cookies and browser storage, limited to what is needed to keep you signed in and to operate the CDN:

• Authentication-session storage. When you sign in through the web app, your session tokens are stored in the browser so you do not have to sign in on every request. These tokens are accessible only to the HotClays web app origin.
• CDN cookies. Our content-delivery network may set technical cookies that are required for its operation.

We do not set advertising, retargeting, or cross-site tracking cookies on our web domains, and we do not share information with ad networks or data brokers.

Your choices and rights

You can make the following choices at any time from inside the Services:

• Update your profile. Change your name and profile details from your profile or account settings.
• Add, change, or remove display images such as your profile photo.
• Manage your profile and social settings — visibility, discoverability, who can follow you, blocks, and notification preferences — where these are available in the Services.
• Change your password. Use the password-reset flow on the sign-in screen.
• Manage your web subscription. Update your payment method, change plan, or cancel from inside the web app. Mobile-app subscriptions are managed through your Apple ID or Google Play account.
• Remove data that you own or administer using the deletion flows in the app.

You may also ask us to exercise the following rights, subject to our ability to verify your identity and to any exceptions permitted by law:

• Right to know / access. Request a copy of the personal information we hold about you.
• Right to correct. Ask us to correct inaccurate information. You can correct most profile fields yourself from within the app.
• Right to delete. Ask us to delete your account and the associated personal information. We will honor this request except where retention is required or permitted by law (for example, tax records, fraud prevention, or legal defense). Because a self-serve account-deletion flow is not yet available inside the app, please email support@hotclays.com to request deletion.
• Right to portability / export. Ask us for an electronic export of your personal information. Because a self-serve export flow is not yet available, please email support@hotclays.com.
• Right to opt out of sales and “sharing.” HotClays does not sell or share your personal information, so there is nothing to opt out of.
• Right to limit use of sensitive personal information. We use precise geolocation only to show you nearby content, and only when you grant permission. You can revoke permission at any time in your device or browser settings.
• Right to non-discrimination. We will not deny Services, charge different prices, or degrade quality because you exercised your privacy rights.

To exercise any of these rights, email support@hotclays.com from the email address associated with your account, or reply from that address to a request we send you. We may ask for additional information to verify your identity. We will respond within the time required by applicable law (typically 30–45 days, with a possible one-time extension).

You may also designate an authorized agent to submit a request on your behalf. We may require the agent to provide written proof of their authorization and may contact you to verify that you authorized the request.

If we deny a request, you may appeal the decision by emailing support@hotclays.com with “Privacy Appeal” in the subject line. We will respond to the appeal within the time required by applicable law.

U.S. state privacy rights

This section supplements the rights described above for residents of California and other U.S. states with comprehensive consumer privacy statutes.

Categories of personal information collected in the last 12 months

Sources, purposes, and recipients are described in “Information we collect”, “How we use information”, and “How we share information” above.

Sale and sharing

HotClays does not “sell” personal information and does not “share” personal information for cross-context behavioral advertising, as those terms are defined in the California Consumer Privacy Act (as amended by the CPRA) or in equivalent state statutes. We have not sold or shared personal information in the preceding twelve (12) months, and we do not knowingly sell or share the personal information of consumers under sixteen (16) years of age. We also do not disclose personal information to third parties for their direct-marketing purposes (Cal. Civ. Code § 1798.83).

European Economic Area, United Kingdom, and Switzerland

If you are in the European Economic Area (EEA), the United Kingdom, or Switzerland, the GDPR, UK GDPR, or Swiss FADP may apply. HotClays LLC is the controller (see “Who we are”). Our legal bases are described in “How we use information”, and our transfer mechanisms are described in “International data transfers”.

In addition to the rights in “Your choices and rights”, you may:

• restrict or object to our processing of your personal information;
• withdraw consent (withdrawal does not affect prior processing); and
• lodge a complaint with your local supervisory authority.

We do not make decisions about you based solely on automated processing.

Children’s privacy

You must be at least thirteen (13) years old to use HotClays. Users between 13 and 18 must have parental or guardian consent. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has provided personal information to HotClays, please contact support@hotclays.com and we will take steps to delete it. Groups may record names and scores for participants of any age who do not have accounts; the group is responsible for any consent that requires (see our Terms of Service, Section 5). A parent or guardian may contact us about a child’s record or to request changes to a minor’s profile or data.

Do Not Track and Global Privacy Control

Our Services do not currently respond to Do Not Track (“DNT”) or Global Privacy Control (“GPC”) browser signals. HotClays does not sell or share personal information, so these signals do not change how we handle your data.

Third-party websites and services

The Services may link to or interoperate with third-party websites, services, and apps (for example, Stripe, the Apple App Store, or Google Play). This policy does not apply to those third parties. We encourage you to read their privacy policies and terms before using them. If you add your HotClays number to a digital wallet (such as Apple Wallet), the wallet provider’s policies govern that pass.

Changes to this policy

We may update this Privacy Policy from time to time to reflect changes to our practices, the Services, our service providers, or the law. When we do, we will update the “Last updated” date at the top of this document and notify you through the Services (for example, with an in-app banner). If a change materially affects how we collect, use, or share your personal information, we will give you reasonable advance notice before it takes effect. Your continued use of the Services after the effective date of the updated policy constitutes acceptance of the update.

How to contact us

For any question, comment, or request about this policy, including to exercise your rights, please contact us at support@hotclays.com.