Privacy Policy

The short version

• Serials and photos stay on your phone. Firearm and component serial numbers and every photo you take are stored on your device only. They are never uploaded, and never sent to the AI.
• Synced under a pseudonym. Cloud records are labelled with a random identifier, never your name or email, and your account details are held separately from your logbook.
• No ads, no trackers. No advertising SDKs, no analytics SDKs, no cross-site tracking. We do not sell your data or share your logbook for anyone else's use.
• Yours to take. Export your full database at any time, on any tier. Delete your account and synced records whenever you want.

What never leaves your device

Some data is deliberately kept off our servers entirely. The following is stored only on the device you entered it on, is not synced, is not backed up to your Shot Caddy account, and is never included in anything sent to the AI features:

• Firearm and component serial numbers
• Every photo you take, including captured target images

Because this data is held only on your device, it is removed when you uninstall the app or clear its storage, and we cannot recover it for you.

What syncs to your account

Shot Caddy is offline-first: your logbook works with no signal. If you sign in and sync, the following is stored in your account so it can appear on your other devices:

• Firearms, components, accessories and loadouts
• Ammunition, handload recipes, batches, lot numbers and on-hand counts
• Purchase details and notes
• Range sessions and maintenance records
• App preferences
• Analysis conversations, unless you switch saving off in Options → AI & Analysis

Synced records are labelled with a random identifier rather than your name or email address, and your account details are held separately from your logbook contents.

Account and subscription data

If you create an account we store your email address and authentication identifiers, and your subscription status. We use these only to sign you in, sync your data, apply your plan entitlements, and contact you about the service.

AI features and what they transmit

Shot Caddy's Analysis module and its firearm, load and product lookups are powered by a third-party AI model. When you use them, a redacted copy of your logbook is transmitted through Lovable's AI Gateway to a large language model so it can answer from your own records. Our request asks for a Google Gemini model; Lovable brokers it to a model provider and does not confirm which one serves it.

Serial numbers, photos and identity fields are stripped before anything is transmitted, and the request is made server-side using our own API key rather than from your device. The AI is not given your name, your email address, or anything that identifies your account. Everything else in your logbook is part of what is sent — including the free-text notes you write on sessions and equipment, because those observations are much of what makes the analysis worth anything.

Answers produced by these features are estimates generated from the data you entered. They are not published reference data, not load data, and not professional advice. Verify anything that matters against current manufacturer publications.

If you do not want your logbook transmitted to a model, do not use the AI features; the rest of Shot Caddy works without them.

When you use Analysis, your question and the answer are saved to your account so you can re-read the conversation later. Options → AI & Analysis has a switch that stops new conversations being saved, and a button that permanently deletes every conversation already saved. Deleting removes them from your Shot Caddy account; it does not reach our AI provider, which has already received and answered the request.

Once a request leaves our server we no longer control it. Inference takes place in the United States. Lovable publishes no retention period for the requests and responses that pass through its gateway, so we do not publish one either — a number we cannot verify would be a promise we cannot keep. We cannot warrant that a request is never retained, or never used to train machine-learning models. We have opted out of model training at the account level, both through the control Lovable offers and by written request, and Lovable states that its agreements with model providers restrict them from training on the content sent to them. That is Lovable's statement rather than a term we can enforce, and we do not describe it as more than that. Lovable's own sub-processors are listed at trust.lovable.dev/subprocessors.

Location

When you log a range session, the app can turn a location into a range label and fill in the weather for you. To do that it sends a coordinate — or a place name you type — to Google Maps Platform, and a coordinate and date to Google Weather. We do not track your location in the background, and we do not keep a location history beyond the range labels and conditions saved on your own sessions.

Payment data

We never see or store your card details. Purchases made on this website are processed by Stripe, our Merchant of Record, which collects the billing information it needs to take payment and handle tax; we receive only a subscription reference, plan and status. Stripe's privacy notice is published at stripe.com/privacy.

Purchases made inside the mobile app are processed by Apple or Google under their own privacy policies. We receive only the purchase and subscription state needed to unlock your plan.

Who else receives data

We share data only with the processors needed to run the service. This is the complete list:

We do not sell personal data, we do not share it with advertisers or data brokers, and we do not disclose your individual logbook contents to anyone for their own purposes. These providers may process data in the United States and other countries; where data leaves the EEA or UK, transfers rely on Standard Contractual Clauses or an equivalent safeguard.

Cookies, analytics and advertising

The Shot Caddy app contains no advertising SDKs and no analytics or tracking SDKs. This website uses only the cookies and local storage needed for the site and app to function, such as keeping you signed in. We do not run advertising or cross-site tracking cookies. Stripe sets its own cookies on the checkout it hosts, as described in Stripe's privacy notice.

Why we are allowed to process this data

Where the GDPR or similar laws apply, we rely on: performance of a contract, to give you the account and subscription you signed up for; legitimate interests, to keep the service working, secure and free of abuse; legal obligation, for tax and accounting records held through Stripe; and consent, where we ask for it separately. You can withdraw consent at any time by emailing us.

Aggregated data

We may create, use, and share de-identified, aggregated statistics derived from usage of the app. We do not re-identify this data, and we do not disclose individual logbook contents or anything that could be used to identify a specific shooter.

Security

Data in transit is encrypted with TLS, and synced account data is stored with our hosting provider under access controls limited to what running the service requires. No system is perfectly secure, but we will notify affected users without undue delay if a breach affects their personal data.

Children

Shot Caddy is not directed at children and is intended for adults who lawfully own the equipment they record. We do not knowingly collect personal data from anyone under 16. If you believe a child has given us data, email us and we will delete it.

Retention and deletion

Account data is kept while your account is open. You can export your full database at any time, on any tier. You can delete your account from within the app, or email contact@shotcaddy.com, and we will remove your synced data. Data held only on your device is removed when you uninstall the app or clear its storage. Billing records are retained by Stripe, Apple or Google as required for tax and accounting.

Analysis conversations are stored with your account until you delete them, either from Options → AI & Analysis or along with everything else when you delete your account. A request already sent through the AI gateway is a different matter. There is no mechanism to delete the gateway records belonging to one identified user, no retention period is published for them, and we cannot delete them on your behalf.

Cancelling a subscription does not delete anything. See our Refunds, Cancellation & Delivery policy for what changes when a plan ends.

Your rights

Depending on where you live, you may have the right to access, correct, export or delete your personal data, or to object to certain processing. Email contact@shotcaddy.com and we will respond within 2 business days. We do not charge for these requests and we will not treat you differently for making one. One limit, stated plainly: a request already sent through the AI gateway cannot be reached by a deletion request — see Retention and deletion above.

If you are in the United States

Residents of California and other states with comprehensive privacy laws have the right to know what personal information we collect and who receives it — set out above — and the right to request a copy, a correction, or deletion. We do not sell personal information, and we do not share it for cross-context behavioural advertising, as those terms are defined under California law. To exercise a right, email contact@shotcaddy.com. You may appeal a refused request by replying to our response.

Changes to this policy

We will update this page when our practices change and revise the "last updated" date at the top. Material changes will also be announced in the app or by email. Because the app links to this page rather than embedding the text, the version here is always the current one.

Who to contact

We are the data controller for the information described above. If you are in the EU or UK and cannot resolve a concern with us, you may also complain to your local data protection authority.