TOXO

Privacy Policy.

Effective: October 25, 2026

The short version. Toxo holds what an archery club needs to run: who is in the club, when it trains, who said they are coming, who turned up, what each member owes the club, and each archer’s scores and bows. If the club uses them, it also holds members’ contact details, a photo, and health information that keeps an athlete safe in training. Health information, and a child’s photo, are stored only after the person, or a parent for a child, agrees. Your club decides what it records about you and for how long; we store it for them. Everything lives in the European Union. We do not sell data, do not show ads, and do not use anything about a club’s members to train models. A child’s name is not shown to other families unless a guardian turns that on.

1. Who is responsible for what

Two different answers, and the difference matters.

Your club is the controller of its membership data. It decides who to enrol, what to record, and how long to keep it. Questions about your own record — correcting it, deleting it, asking what the club holds — go to the club first.

CodeEnsis Ltd (Cyprus) provides the app and stores that data on the club’s instructions, as its processor. The agreement that says so is the Data Processing Agreement, which every club accepts before it can hold anything about a child.

For a few things we are the controller in our own right: keeping the service running and secure, the crash reports described in section 5, and our correspondence with you. This policy covers both roles and says which is which.

2. What Toxo collects

What	Why
Your name	So the club and other members know who you are on a list.
Your email address	It is how you sign in, and where the club’s notices are sent.
Date of birth, if your club records it	To tell a minor from an adult, which decides what the app allows.
Who your guardian is, or whose guardian you are	So a parent can answer for a child and see what concerns them.
Your club, groups and role	To show you your own schedule and to decide what you may do.
RSVPs and attendance	The point of the app: the coach knows who is coming, and the club has a record of who trained.
Consents a guardian gives	So the club can show what was agreed, when, and to which version of the text.
Your phone number and home address, if you or your club add them	So the club can reach you, or a parent, quickly. Only coaches, managers and the owner see them.
A photo of you, if you or your club add one	So coaches recognise members on a list. A child’s photo is added only after a parent agrees.
Your federation or club code, if your club records it	To enter you in competitions.
Your status in the club (active, trial or inactive) and the end of a trial	So the club knows who is on a trial and who has paused.
Health information, if you agree (see below)	So the people who train you know what to watch for, and so you are warned before your health card expires.
A coach’s licence, first aid and police certificate dates	So the club can show its coaches are qualified.
Fees, charges and payments the club records	So the club and you know what is due and what was paid. No card or bank details are entered in Toxo.
Scores, target photos and notes you add to a round	Your own training record, private to you and your parents unless you show a round to a coach, or your club lets its coaches see all results.
Your bows and how they are set up	Your equipment record, which your coaches can see and adjust.
Notes club staff write about you	The club’s working notes, for example on technique. Only coaches, managers and the owner see them.
Messages the club sends	Club news and notices, kept so members can read them again.
A push notification token	So a cancelled training reaches your phone. It identifies an app installation, not you.

Health information, in full

Health information is special-category data under Article 9 GDPR, so it is worth being exact.

What is held. Only what the person, a parent or the club enters: the health card’s expiry date and number, a photo of the front and back of the card, a short medical history (for example, asthma and where the inhaler is kept), and injuries with a date and whether they are current or recovered. No diagnosis is asked for, and nothing is read from your phone’s health apps.
Only with agreement. The medical history, the injuries and the photos of the card are stored only after the athlete agrees, or a parent agrees for a child. The agreement is recorded with its date and the version of the text that was shown. It can be withdrawn in the app at any time, and the medical history, injuries and card photos are then deleted. The lawful basis for them is your explicit consent (Article 9(2)(a) GDPR).
The card’s expiry date and number describe a document, not a body, and are held on your club’s legitimate interest in its members being eligible to train and compete. They are used to warn the archer, or whoever answers for them, ninety, thirty and seven days before the card expires and on the day, and to give club staff a list of whose card has expired or is missing.
Who can see it. The person, whoever answers for them, and the coaches, managers and owner of a club they belong to. Nobody else: not other members, not other parents, and not a club’s treasurer. It is stored apart from your profile, and the photos of the card are only ever served through our server, which checks who is asking each time.
It goes when you go. Delete your account and all of it is deleted with it, photos included.

Do not put health information into fields other than the ones made for it, and clubs should not ask for it elsewhere.

Photos

A member’s photo is shown to the members of their club next to their name. For anyone under 18, a photo is stored only after a parent agrees; the club cannot add one before that. Photos are only ever served through our server, which checks that the person asking shares a club with you.

3. What Toxo does not collect

No advertising identifiers, and no advertising. There are no ads in Toxo.
No continuous or background location. The only location Toxo reads is when a coach or manager taps “use my location” while putting a pin on a venue — once, in the foreground, to place a range on a map. Members never share their location.
No contacts and no microphone. Toxo opens your photo library or camera only when you choose to add a picture (a target, a member photo, a health card or a club badge), and reads only the picture you pick.
No card or bank details. Toxo records what the club charges and what was paid; the money itself moves outside the app.

4. Where it is stored

The database and the server-side logic run in Frankfurt, Germany (Google Cloud europe-west3). Email is delivered by Mailjet in the EU. Where a supplier’s wider group leads to a transfer outside the EEA, it is covered by the European Commission’s Standard Contractual Clauses.

5. Crash reports, and the analytics we do not collect

Toxo collects no usage analytics. There is no analytics SDK in the app. Nothing records which screens you open, how long you stay, or how often you come back, and no profile of your behaviour is built anywhere. We took the measurement out rather than ask you to agree to it: an app that holds children’s records is not the place for tracking that the club does not need to run.

Release builds do include Firebase Crashlytics, and we are the controller for it. When the app crashes it sends us a stack trace, the device model and the OS version, against a random installation identifier. It is given no club membership data, no name and no email address, it is never used for advertising, and it tells us nothing about what you did in the app when it did not crash. Our lawful basis is our legitimate interest in an app that works; you may object to it under section 9.

6. Who else sees it

Your club. Coaches, managers and the owner see the members of their own club, their attendance, contact details and health information. A treasurer sees fees and payments, not health information or contact details. Nobody in one club can see another club’s data.
Other members of your club see your name, your photo if you have one, and on a session who has said they are coming. Athletes and parents see the phone number of their own group’s coaches. Other members do not see your contact details, your health information or the club’s notes about you. A child’s name is hidden from other families unless a guardian has turned that on.
Your guardian, if you are a minor, sees what concerns you and can answer on your behalf.
Our suppliers, listed in the DPA: Google (Firebase), Mailjet, Geoapify. Each is contractually bound and none may use the data for its own purposes.
Nobody else. We do not sell data, do not share it with advertisers, and do not use it to train models. We disclose data to an authority only where the law obliges us, and we tell the club unless forbidden.

7. How long it is kept

Your club chooses. The default is three years, which suits a club that needs to show who trained when. Delete your account and your profile, memberships, RSVPs, contact details, photo, health information, bows, the club’s notes about you and the consents about you go with it. What remains is impersonal counts on sessions that already happened, and the club’s record of fees it charged and payments it received, which a club may have to keep for its accounts.

8. Children

A club cannot enrol anyone under 18 until we have verified that it is a real club and its owner has accepted the DPA. A child’s record is reached through a guardian, who is asked separately about photographs, about health information, and about showing the child’s name to other families; all three stay off until the guardian agrees. Obtaining whatever consent the law of the club’s country requires is the club’s responsibility; Toxo records it with a date and a version so the club can show it.

9. Your rights

Under the GDPR you may ask for a copy of your data, have it corrected, have it deleted, restrict or object to processing, and receive it in a portable form. Because your club is the controller of its membership data, start with the club. If that does not resolve it, or if your question is about the crash reports in section 5, write to [email protected] and we will answer within 30 days.

You can delete your own account at any time from inside the app, without asking anyone. You also have the right to complain to your national data protection authority.

10. Security

Data is encrypted in transit and at rest. Every read and write is authorised on the server, so what you are allowed to see is decided by the server and not by the app on your phone. Access to production is limited to named CodeEnsis personnel with multi-factor authentication, and real club data is never copied into development.

11. Changes

We will update this page as Toxo changes, with a new date above. Where a change materially affects what we do with your data, we will say so in the app rather than hope you re-read the page.

12. Contact

CodeEnsis Ltd, Cyprus — [email protected].