Privacy Policy

3.1 User Account

When creating an account, we collect: email address, password (stored encrypted as BCrypt hash), and a freely chosen display name. Your email address is used for identification, password reset, and notifications.

We also store whether you registered in the Android or iOS app (Google Play Store or App Store) or in the browser (flag "APP" or "WEB"). We use it to tell app users in the welcome email where subscriptions are available and to analyse which sign-up channels people use. The legal basis is our legitimate interest (Art. 6(1)(f) GDPR). The flag is removed when you delete your account.

3.2 Player Name

When joining a tournament, you enter a freely chosen player name (pseudonym). We do not require real names. For logged-in users, tournament participation is linked to the user account to provide statistics.

3.3 Session ID

Upon joining a tournament, a random Session ID (UUID) is generated and stored in your browser's local storage. It is used solely to associate you with your tournament and is deleted when you log out or the tournament ends.

3.4 Game Results & Statistics

During the tournament, game results (throws, legs, scores) are recorded and stored. For registered users, this data is aggregated across tournaments (statistics) and is accessible only to the respective user and, according to that user's switches, their confirmed friends (see 3.10).

3.5 Payment Data

When subscribing to a paid plan (Pro, Premium), payment data is processed exclusively by our payment provider Stripe. SmartDart does not store credit card numbers or bank details. We only store the Stripe customer ID, subscription ID, and current subscription status.

Subscriptions you take out in the Android app through Google Play are handled by Google (see section 8b). What we store there: purchase token, product, term and subscription status.

Subscriptions you take out in the iOS app through Apple are handled by Apple (see section 8c). What we store there: transaction IDs, product, term and subscription status.

3.6 Server Log Data

When accessing SmartDart, our server automatically collects technical data: IP address, timestamp, requested URL, referrer (the previously visited page), and browser type. This data is required for the operation and security of the service. The web server's access log, which contains the IP address, is deleted after 15 days at the latest; all other server logs of the application (without IP address, email addresses only shortened) after 30 days at the latest. In these application logs, access codes and tokens in addresses are replaced by "***"; numbers of tournaments, matches, clubs, leagues, series, cups and public results codes appear there in readable form. Our own visit statistics (see 3.9, also without IP address) have a separate period of 90 days.

3.7 Feedback & Suggestions

Using the feedback forms in SmartDart, you can send us suggestions, bug reports and ratings. We store your message, the selected category or ticked reasons, an optional star rating and the time of submission. If you are logged in, the message is linked to your user account. Without an account we ask for your email address — solely so that we can reply to you; it is not used for newsletters or advertising. To process your message, we also receive it as an email notification.

The legal basis is Art. 6(1)(f) GDPR (legitimate interest in processing and answering feedback). The email address of a message sent without an account is automatically deleted from our database 12 months after submission; on request to support@smartdart.app we delete it earlier.

3.8 App Testing & Notification

On smartdart.app/app you can sign up as a tester for the Android app or ask to be notified as soon as the app is available for Android or iPhone. We store your email address, the chosen type (test or notification), the platform, the language, the time of sign-up and of confirmation and — if you are logged in when signing up — the link to your user account (for the thank-you to testers).

The sign-up only takes effect once you open the link in our confirmation email and confirm there (double opt-in). We only write to you for this purpose: the confirmation, at most one reminder three days later if the confirmation is still missing, for testers the link to the test in the Google Play Store, and a message as soon as the app is released. Only confirmed sign-ups receive the test link and the release message. For the closed test we enter the addresses of confirmed testers in the Google Play Console; this is the only way Google can unlock the test for you. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

The legal basis is your consent (Art. 6(1)(a) GDPR). You can withdraw it at any time — via the link in the confirmation email or by email to support@smartdart.app; the entry is then deleted. We keep unconfirmed sign-ups until the app is released, but no longer than 6 months from sign-up, and then delete them automatically; the confirmation link stays valid for that period. Confirmed sign-ups are deleted no later than 12 months after confirmation.

3.9 Own visit statistics

On every page view we store on our server in Germany: the page visited (without access codes, tokens, email addresses or most URL parameters; numbers of tournaments, matches, clubs, leagues, series, cups and public results codes do appear in the address), a random visitor ID from your browser's localStorage, your account ID if you are signed in, browser and device type, the language of the interface (German or English), the session identifier if a tournament session is running, only the domain of the referring page for external websites and – if the link you opened contains them – the campaign tags utm_source, utm_medium and utm_campaign (e.g. "chatgpt.com"). Your IP address is not stored for this. Links in our automated emails carry campaign tags that only name the type of email (e.g. "trial-ende-bald"). Links with a personal code (e.g. sign-in, confirmation, password reset, invitation, unsubscribe) carry none. Links in emails we write to you personally carry a short code for that single email instead (e.g. "m-k7q2"). This lets us see whether our reply arrived and is being read; the legal basis is our legitimate interest in working customer communication (Art. 6(1)(f) GDPR). We keep the record of which code belongs to which email for no more than 90 days. You can object at any time by emailing support@smartdart.app; we will then no longer link your clicks to you. Names or email addresses are never part of a link. The purpose is to understand how visitors find SmartDart and to produce a summarised analysis of which areas of the app are used; the legal basis is Art. 6(1)(f) GDPR. The data is not shared with third parties and is deleted automatically after 90 days.

3.10 Friends

The friends feature is voluntary, free for signed-in accounts, and only used if you use it yourself. For it we store: your friend code (randomly generated; you can generate a new one in your profile at any time, which invalidates the old one), your friendships and requests (who, when, status), and your privacy switches per area. For an invitation by link (personal link, valid for 30 days, revocable in your profile) we store only a hash of the link, not the link itself; expired or revoked invitations are deleted 30 days after expiry or revocation. Whoever registers through your link is friends with you immediately; in that case, too, the sharing switches apply by default (on) and right from the friendship, and you can change them at any time.

There is no search by name: people can find you only through your friend code, your invitation link, or suggestions. For suggestions, we propose accounts to each other, by display name, that have played in the same tournaments (legal basis: our legitimate interest in offering the feature, Art. 6(1)(f) GDPR). You can object at any time: with the “Appear in suggestions” switch in the friends settings (default: on) or by email (see 13); you also decide yourself whether to send or accept a request or not. Suggestions create no obligation to become friends.

Confirmed friends see your display name and, depending on your switches (default: on), key figures separately for Quick Match, Bot, Tournament, League and Training, as well as the head-to-head record from your shared tournament matches. They never see your email address. Someone who sends you a request sees only your display name. Anyone who is not your confirmed friend sees none of this. To prevent abuse, we limit the number of new requests per account (per hour, per day, and open requests); these counters exist only in working memory and are not stored.

We notify you about requests and acceptances in the app (bell) and, unless you turn it off, by email (see 7). For the notices in the bell we store the type of notice, the triggering account, the time and whether you have read it; we delete them 90 days after they arise. The legal basis for the friends feature is performance of a contract (Art. 6(1)(b) GDPR) for the feature you chose. The data export (“Download my data”, see 11.1) contains your friend code, your own friendships and requests, your switches, your notices and your setting for friend emails. For deletion see 11.3.

3.11 League Player Pass (Date of Birth, Place of Residence)

To manage leagues and associations, for players registered in a league we store, at the request of the league board, the date of birth and the place of residence in addition to the name, as they appear on the player pass. For a late registration, address, phone number and email address can also be given (optional). The data comes from four routes: the league board's late registration form, the report by a team captain, a club's bulk report, or entry by hand or list import by the league board. Many of these players do not have a SmartDart account.

Purpose: issuing and checking the player pass, that is, assigning a player to the league and to their team. Who can see the data: only the league board (league administrators). Captains, teammates, spectators and public results and standings pages never see date of birth or place of residence. We do not pass them on to third parties.

Legal basis: your consent (Art. 6(1)(a) GDPR). In the late registration form, in the report by a captain and in a club's bulk report, the person reporting confirms with a tick box that the player agrees to the data being stored. You can withdraw it at any time with effect for the future. If the league board adds the data by hand or by import, this is done at its instigation for the administration of its league; for access, rectification and deletion you can contact your league board or us.

Retention and deletion: There is currently no automatic deletion period. The data stays stored until the league board deletes the date of birth or the player's entry, or you request deletion (support@smartdart.app, deadline: one month). If the league board deletes a player, only the player pass entry is removed; we delete the details in the original late registration request only on your request. We then delete date of birth, place of residence and the other details in the late registration request; the name may remain so that results already played stay traceable. If a player has a SmartDart account and deletes it (see 11), the pass data is not removed automatically; please write to us in that case as well.

3.12 Public Results Pages, Link Previews and Share Cards

Public results pages. The results page of a tournament (/results/…) can be opened by anyone who knows the link. It shows the tournament name, the names of the participants, results, tables and match values (for example average, 180s, highest finish) and, where throw data exists, the course of individual legs. The page does not show which accounts a name belongs to. This is the information the organiser wants to publish with the tournament; we process it as part of the service. The legal basis is our legitimate interest and that of the organisers and participants in making results accessible (Art. 6(1)(f) GDPR). If you do not want to be named publicly, contact the organiser or us (see 11 and 13).

Fixed projector link of a club. Club admins can create a fixed projector link (/projection?club=…) for their club. Only club admins see and create the key; anyone who knows the link can open the waiting view without signing in. “Regenerate” invalidates the previous link. Between two tournaments the waiting view shows the club name, the logo and statistics tiles: figures about the club (members, tournaments, matches, 180s), the display names of members with match values from the club's tournaments (average, highest checkout, 180s, win rate) and the winner of the most recently finished tournament. The page does not show which accounts a name belongs to; club admins choose the names of placeholder players. Deleted accounts and members who have left do not appear in the rankings; a member who has left can remain named as the winner of an earlier tournament, a deleted account cannot. Club admins can turn the statistics in the waiting view off in the “Projector link of the club” box (default: on). The legal basis is our legitimate interest and that of the club in making play on site easy to follow (Art. 6(1)(f) GDPR). If you do not want to be named, contact the club admin or support@smartdart.app (see also 11 and 13).

Preview images for shared links. Chat and network services (for example WhatsApp, Telegram, Facebook, Slack, LinkedIn, Discord) fetch a shared results link automatically to build a preview. When we recognise such a preview request, we return a small metadata page (/api/og/…) instead of the page and, for finished tournaments, a preview image. They contain only information from the public results page: tournament name, name of the winner, final score with the name of the finalist, for club tournaments the club name, number of players, date and three numbers (highest finish, best average in one game, number of 180s; if no throw data exists, the number of games, legs and players instead). For tournaments that are only found through the join code, we return no preview. We store nothing for this outside the server logs (see 3.6): the requests appear there like any other access with the address and identifier of the service; the finished preview image stays in the server's memory at most until the next restart. The chat service itself may cache the preview; we have no influence on that. The legal basis is our legitimate interest in an understandable link preview (Art. 6(1)(f) GDPR).

Share cards. With “Share as image”, your device creates an image from the values shown (tournament winner, player in the tournament, single game or the result of a Quick Match). The image is created in your browser or app; SmartDart neither stores nor receives it. You see a preview before sharing. For Quick Match you can hide the names on the image (it then says “Player 1” and “Player 2”); names are visible by default. What you do with the image and who you send it to is up to you; we cannot recall an image once it has been sent. The image contains a QR code that leads to the tournament's results page or to smartdart.app/quick-match. We count anonymously how often images and links are shared (without names and without tournament code, see 9).

5a.1 Training images – only with your consent

When you first start camera scoring, we ask whether you would like to send us images to help improve detection. Taking part is voluntary; if you decline, you can use camera scoring just the same – nothing is transmitted. The question and your answer apply equally to Quick Match, training and multiplayer matches: it appears once, in whichever mode you first open camera scoring, and then applies to all three.

If you consent, the app sends up to four still images of the dartboard per visit (up to three darts) to SmartDart – cropped to the board, one before the first dart, one after each dart and, after a correction you made, one image of the board as a cross-check (at most four images per visit). They come with the recorded result (including any correction you made), the fields the camera detected, a technical log of the detection, the version of the detection model and the app version. The technical log contains the positions of detected darts within the camera image, measurements of the image (for example the size of the board in the image), time intervals between detection steps (no times of day) and counts from the detection, for example how many possible dart tips were detected in a throw and how many of them were discarded. In addition, we send entries without an image – the log only – when you close camera scoring or a match ends. We store images and data without an account identifier and without a name, only with the day of upload and filed by date. In our database we store the images without any account identifier. To enforce the limit of 1,000 images per account, we only count, alongside your consent, how many images you have sent. Please keep people out of the picture.

The sole purpose is to improve dart detection: we use the images to train and test our own detection models. The legal basis is your consent (Art. 6(1)(a) GDPR). The images are stored on our server in Germany (IONOS, see section 6); training takes place only on our own computers. We do not pass the images on to third parties and do not use cloud AI services for them.

As the consent itself we store only: its time and version, your browser identifier (user agent) and the number of images sent so far (for the per-account limit). This tells the server whether your device may send. Images are only sent during breaks in play, never during a throw. We accept at most 1,000 images per account and 10,000 in total.

In addition, we record your answer – share images, continue without sharing images or stop taking part – in our internal activity log: account number, type of answer, time and version of the text. This shows us how the beta is received (legitimate interest, Art. 6(1)(f) GDPR). It does not affect your choice: camera scoring works without sharing images as well. These entries are deleted after 12 months, or immediately when you delete your account.

We delete stored images and the related log automatically 24 months after upload. You can withdraw your consent at any time with effect for the future – in the camera menu or in your profile. When you stop taking part, no further images are sent; images on your device that have not been sent yet are discarded. We delete images already sent when the 24 months have passed. If you would like them deleted earlier, write to support@smartdart.app – we will then try to find your images by date and game history. After you withdraw, we delete your browser identifier; we keep the time and version of your consent as proof for up to 36 months after the withdrawal. If you delete your account, we delete the consent immediately (section 11). If this text changes, we will ask you again before anything is transmitted.

11.1 How to delete your account — in the Android or iOS app or in the browser

• Sign in to your SmartDart account and open your profile.
• In the “Account & Data” area, tap “Delete account” and confirm the prompt.
• In the next window you can tell us briefly why you are leaving (“Send & delete account”) or continue straight away with “Delete without feedback”. Choosing “Cancel” leaves your account unchanged.

Beforehand, you can save a copy of your data in the same area under “Download my data” (Art. 20 GDPR). Deletion cannot be undone.

11.2 Deletion by email — also without the app

Already uninstalled the app, or can no longer get into your account? Write to support@smartdart.app from the email address you registered with (subject: “Delete account”). We will then carry out the deletion for you within one month of receiving your email.

11.3 What happens when your account is deleted

• Email address and display name are replaced with placeholders, the password is made unusable and all sign-ins on your devices are ended.
• Your friendships, requests, friend code, privacy switches, invitation links and in-app notices (including those you triggered for others) are deleted (see 3.10); your friends no longer see you in their list afterwards.
• A running paid subscription is cancelled at the end of the paid period. Exception: SmartDart cannot cancel a subscription taken out through Google Play or Apple; you do that in Google Play or in your Apple settings beforehand (see sections 8b and 8c).
• Stored data about Google Play subscriptions (purchase token, product, term, status) and the Play identifier of your account are deleted.
• Stored data about Apple subscriptions (transaction IDs, product, term, status) and the Apple identifier of your account are deleted.
• Your consent to camera training images is deleted. Training images already sent are stored without an account identifier and are deleted after 24 months; you can request earlier deletion via support@smartdart.app (see 5a.1).
• The account is detached from visit statistics, the activity log is cleared of names and email addresses, and open confirmation and password links become invalid.

11.4 What is retained

• Anonymized game and tournament data (results, statistics) remain; they can no longer be attributed to any person.
• The flag that the free trial has already been used stays on the anonymized account so that trials cannot be repeated by creating a new account.
• The identifiers of your Stripe customer account and subscription stay on the anonymized account. Payment and invoice data that Stripe processed as payment provider (see section 8) is not deleted by SmartDart together with the account; Stripe’s privacy policy and statutory retention obligations apply to it.
• Player names in tournament and match results remain visible as they were entered.
• Your analytics person at PostHog (pseudonymous user ID, see section 9) remains until the retention period stated there, 12 months, has passed. Session recordings (see section 9) are deleted after 30 days.
• Server log data (see 3.6) remains until it is deleted automatically (access log after 15 days at the latest, all other logs after 30 days at the latest).
• Entries of the visit statistics (see 3.9) lose their link to your account upon deletion but still carry the random visitor ID of your browser and remain until they are deleted automatically after 90 days.
• Each account deletion triggers an internal notification to our support mailbox (support@smartdart.app); it states the account number, the plan, the subscription status and the former email address in shortened form only (e.g. m***n@example.com), no name.