This Privacy Policy explains how Patrick Huston Ltd, trading as Level Up Archery ("we", "us", "our") collects, uses, and protects your personal data when you use the Level Up Archery app ("the App"). We are committed to protecting your privacy and complying with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and the Data (Use and Access) Act 2025.
Changes from v3: Clarified optional heart-rate reads from Apple Health and Health Connect; named Sentry as crash reporting on the native iPhone and Android apps; named Apple App Store and Google Play alongside Stripe as payment processors.
1. Data Controller
The data controller for information processed through the App is:
Patrick Huston Ltd, trading as Level Up Archery
Registered office: 13 Cabin Hill Gardens, Ballycloghan, Belfast, BT5 7AP, United Kingdom
Company No. NI634389 (registered in Northern Ireland)
Privacy enquiries: privacy@levelup-archery.com
General support: support@levelup-archery.com
You can contact us at any time regarding your data or to exercise your rights under data protection law. We aim to respond to all privacy requests within 30 days.
2. Data We Collect
Account Data
- Email address (for authentication and account recovery)
- Display name (optional)
- Subscription tier and payment status
Athlete Profile Data
- Name, club name, county, and region
- Bow type, handedness, and draw length
- Years of shooting experience
- Gender and date of birth (used for classification calculations)
- Competition levels
Archery Performance Data
- Session scores and end totals
- Arrow plot positions on target faces
- Grouping analysis results
- Sight mark records
- Training session logs, notes, and duration
- Volume tracking (arrows shot over time)
- Breath and bow training logs
Equipment Data
- Bow configurations and specifications
- Quiver, arrow shaft, stabiliser, string, and finger tab details
- Equipment photos
- Tuning records and equipment history
Arrow Images (Auto-Plot Feature)
- Photographs of target faces taken via the in-app camera
- These images are sent to Google Gemini AI to detect arrow positions
- Images are stored locally and, if cloud backup is enabled, in your private cloud storage
Health and Injury Data — Special Category (Training Intake)
- Body part injury locations and pain severity (Article 9 UK GDPR)
- Injury duration and treatments tried
- Physical activity types and intensity
- This is special category data and is ONLY collected with your explicit, separate consent before the injury screening step. You can skip this section entirely, and you can withdraw consent at any time in Settings → Your Data → Withdraw Health Data Consent.
Heart Rate (Optional Pulse Scanner)
- Pulse Scanner can measure heart rate with your phone camera. On iPhone, you may separately allow read access to Apple Health; on Android, you may separately allow read access to Health Connect. A wearable is not required.
- When you open Pulse Scanner or Wellness Check, a previously authorized health store may be checked automatically; Wellness Check refreshes while it remains open. Otherwise you can request access there. The App reads a heart-rate sample recorded within the past five minutes, its time, and its source app. This may include a wearable reading shared by a companion app; it does not show a live device connection.
- The source app is shown while its sample is recent. The beats-per-minute value, time, health-store type, and sample identifier are stored in your on-device heart-rate history for your wellness view and daily measurement XP. Level Up does not write to Apple Health or Health Connect, send these heart-rate readings to our servers, or share them with advertisers. Your device's own backups or a database export may include this local history.
- You can decline or revoke health-store read access in your device's Apple Health or Health Connect settings and continue to use the camera or manual entry. Deleting your Level Up account also removes the on-device heart-rate history.
Location Data
- GPS coordinates (latitude and longitude) when you grant location permission
- Venue names you provide
- GPS coordinates are shared with OpenWeatherMap for weather auto-fill and used for session location tagging
Technical and Analytics Data
- Device type and operating system version
- App version and screen usage patterns (which screens you visit, how long you spend on them)
- Feature usage events (which features you use, not what you type)
- Error reports and logs (sensitive data is redacted before reporting; see section 8)
- Analytics can be disabled in Settings → Your Data
Scorecard Export Data and Signatures
- When you export scorecards as PDF or share session results, the exported document includes your name, scores, and session metadata
- Archer and witness signatures are stored only within the specific scoresheet where you entered them — signatures are never stored as a global auto-fill and are not shared between scorecards
- A record of signatures is maintained per scoring session as a local-only repository for your own records and audit purposes
- Exports are created locally and shared by you; we do not receive or process exported files
AI Improvement Data (Eval Corpus)
- If you use the Eval / Bulk Upload feature to review auto-detected arrow positions, your corrections may be used to improve detection accuracy for your arrow type
- This is processed locally; corrected data is not automatically shared externally
Coaching Data (if you link with a coach)
- Coach-athlete relationship records
- Assigned training plans and session feedback
- Plan chat messages (processed by Google Gemini AI for coaching pattern learning; see Section 6)
3. How We Use Your Data
We use your data for the following purposes:
- Providing the App services (scoring, plotting, analysis, coaching)
- Authenticating your account and managing subscriptions
- Syncing your data across devices via cloud backup
- Processing arrow images via AI for automatic plot detection
- Fetching weather data based on your location
- Coaching relationship management and training plan delivery
- Improving the App through anonymised usage analytics
- Error tracking and crash reporting to maintain app stability
- Communicating with you about your account, updates, and support
Legal basis for processing (UK GDPR):
- Contract performance: providing the App services you have subscribed to, including scoring, syncing, and AI arrow detection
- Legitimate interest: improving the App, preventing abuse, crash reporting, and analytics
- Consent: location data collection, health and injury data in the training intake wizard
- Legal obligation: responding to lawful data access requests
4. Local Storage
The App follows an offline-first architecture. Your data is stored primarily on your device using a local SQLite database. This means:
- Your data is available without an internet connection
- Your device holds the authoritative copy of your data
- Cloud storage serves as a backup, not the primary store
- You can use the App fully in airplane mode
Local data is stored in the App sandbox on your device and is not accessible to other apps. We also store small preferences locally (such as your display settings and screen usage patterns for performance optimisation) which never leave your device.
5. Cloud Backup (Firebase)
Your data is synced to Google Firebase (Firestore and Firebase Storage) for cloud backup and cross-device access.
- Data is encrypted in transit (TLS) and at rest
- Each user has a private data partition; no other user can access your records
- Firebase security rules enforce strict per-user access controls
Firebase is operated by Google LLC. Google acts as a data processor under our instructions. Our Firebase databases and storage are hosted in Google's United States data centres; transfers of your data to the US are protected by the UK–US Data Bridge and the UK Addendum to the EU Standard Contractual Clauses. For details, see the Google Cloud Privacy Notice.
6. AI Image Processing (Google Gemini)
The Auto-Plot feature uses Google Gemini AI to detect arrow positions in photographs of target faces. When you use Auto-Plot:
- Your target face photograph is sent to Google Gemini API servers for processing
- The AI returns arrow position coordinates; images are not retained by Google after processing
- Arrow appearance learning also uses Gemini AI to improve detection accuracy for your arrows
Coaching plan chat messages may also be processed by Google Gemini AI to learn coaching patterns and provide better training plan recommendations.
Google processes this data under its Gemini API terms of service. Under the paid-tier terms we use, Google states that prompts and images are not used to train its models.
7. Payment Processing (Stripe, Apple, Google)
How your payment is processed depends on where you subscribe or buy:
- On the web: payments are processed by Stripe, Inc. Your card details are collected and processed directly by Stripe; we never see or store your full card number. Stripe provides us with a customer ID, subscription status, and payment confirmation, which we store to manage your subscription. Stripe acts as an independent data controller for payment data (stripe.com/privacy).
- On iOS: purchases are made through Apple's App Store in-app purchase system. Apple processes the payment and is an independent data controller for it; we never see your payment details. Apple provides us with a transaction identifier and subscription status, which we store to manage your access (apple.com/legal/privacy).
- On Android: purchases are made through Google Play's billing system. Google processes the payment and is an independent data controller for it; we never see your payment details. Google provides us with a purchase token and subscription status, which we store to manage your access (policies.google.com/privacy).
Whichever route you use, we store only what we need to know which features you have paid for: an entitlement record (tier, status, renewal date, and the store it came from).
8. Error Reporting
To keep the App stable, errors that occur in the App are reported in two ways:
- On every platform: our own error-reporting system, which runs on Firebase (Google) and our development issue tracker (GitHub, operated by GitHub, Inc., US-based). The error type, an error code, device type, OS version, and app version are recorded. Sensitive data is redacted before reporting: only a truncated portion of your user ID is included, and never your password or payment details.
- On the native iPhone and Android apps: crash reports are also sent to Sentry (Functional Software Inc., US-based) so we can keep those apps stable. Exception details, device type, OS version, and app version are included. Sensitive data is redacted before sending. The native store binary initialises Sentry for this purpose.
Reports are used solely to find and fix defects. Data transfers to US-based processors are protected by Standard Contractual Clauses.
9. Other Third-Party Services
Video Streaming (Bunny.net and YouTube)
- Coaching video content is delivered via Bunny.net CDN and YouTube embeds
- These services may collect your IP address and basic request metadata for content delivery
- No personal archery data is shared with these services
Weather Data (OpenWeatherMap)
- If you grant location permission, your GPS coordinates are sent to OpenWeatherMap to fetch current weather conditions
- Weather data is cached locally for 15 minutes
Email (Resend)
- Transactional emails (feedback confirmations, purchase receipts) are sent via Resend
- Your email address is shared with Resend solely for email delivery
10. Coaching and Data Sharing
If you choose to link with a coach using your athlete share code:
- Your coach can view training plans assigned to you and your feedback on those plans
- Your coach cannot access your scoring sessions, equipment data, or other personal records unless you share them
- You can unlink from a coach at any time
We do not sell, rent, or trade your personal data to third parties. We share data only with service providers listed in this policy who process data on our behalf, and with law enforcement when required by law.
We do not use your archery performance data for advertising or profiling.
11. Automated Decision-Making
The App uses automated processing in the following ways:
- Auto-Plot AI: Automatically detects arrow positions in target photos. You can always manually adjust detected positions.
- Classification calculations: Automatically determines your age category and handicap band based on your date of birth and gender.
- Training plan recommendations: AI-assisted suggestions based on your coaching data.
None of these automated processes make decisions with legal or similarly significant effects. All AI-generated results can be reviewed and overridden by you.
12. Data Retention
Local data: Stored on your device for as long as the App is installed. Deleting the App removes all local data.
Cloud data: Retained while your account is active. After account deletion, cloud data is permanently removed within 30 days.
Arrow images: Stored locally and in your private cloud storage. AI-processed images are not retained by Google after processing.
Error reports: retained for up to 12 months, then deleted.
Analytics data: Retained by Firebase Analytics for up to 14 months, after which it is aggregated and anonymised.
Payment records: your payment processor (Stripe, Apple, or Google) retains payment records in accordance with financial regulations.
Feedback: Retained until resolved, then deleted within 12 months.
13. Your Rights (UK GDPR)
Under UK data protection law, you have the right to:
- Access: Request a copy of the personal data we hold about you
- Rectification: Ask us to correct inaccurate data
- Erasure: Request deletion of your data ("right to be forgotten")
- Restriction: Ask us to limit how we process your data
- Portability: Receive your data in a structured, machine-readable format (use Settings → Your Data → Export My Data)
- Objection: Object to processing based on legitimate interest
- Withdraw consent: Where processing is based on consent (location, health data, analytics), withdraw it at any time in Settings → Your Data without affecting the lawfulness of prior processing
- Complaint: Lodge a complaint directly with us or with the ICO
To exercise any of these rights:
- Use Settings → Your Data for export, deletion, and consent withdrawal
- Email: privacy@levelup-archery.com
- We will acknowledge your request within 30 days
You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk if you believe we have not handled your data correctly.
14. Data Security
We implement appropriate technical and organisational measures to protect your data:
- Local database stored in the App sandbox, protected by device OS security
- TLS encryption for all data in transit
- Firebase security rules restricting data access to authenticated users only
- Stripe PCI-DSS compliance for payment data
- Error reports are redacted to remove sensitive data before transmission
- Account recovery uses SHA-256 hashed emails and answers, never stored in plaintext
- Regular security reviews of our cloud infrastructure
No system is 100% secure. We encourage you to use a strong device passcode and keep your operating system up to date.
15. Children
The App is not directed at children under 13. We do not knowingly collect personal data from children under 13. If you believe a child under 13 has provided us with personal data, contact us and we will delete it promptly. Users aged 13–17 should use the App with the knowledge and consent of a parent or guardian.
Archers aged 13–15 can share their training data with a linked coach, but written communication features (coach notes, community posts and comments) are disabled for them until they turn 16 — see Section 1 of the Terms of Service.
16. International Transfers
Your data may be processed in countries outside the UK where our service providers operate:
- Google Firebase: US data centres (UK–US Data Bridge / UK Addendum safeguards)
- Google Gemini AI: Google Cloud servers
- Stripe: US-based (with EU infrastructure)
- Apple and Google: payment data for store purchases (see section 7)
- Sentry (native crash reports): US-based
- GitHub (error reports): US-based
- Resend: US-based
Where data is transferred outside the UK, we ensure appropriate safeguards are in place, including the UK International Data Transfer Agreement (IDTA), the UK Addendum to the EU Standard Contractual Clauses, or the UK–US Data Bridge where the recipient is certified.
17. Changes to This Policy
We may update this Privacy Policy from time to time. When we make material changes, we will notify you through the App with a notification requiring your acknowledgement. The "Last updated" date at the top reflects the most recent revision.
We will not reduce your rights under this policy without obtaining your explicit consent.
18. Contact
For privacy-related questions or to exercise your data rights:
Patrick Huston Ltd, trading as Level Up Archery
Privacy: privacy@levelup-archery.com
Support: support@levelup-archery.com
We aim to respond to all privacy requests within 30 days.