Privacy Policy
The Boules for Gays
This policy explains how this application handles information and how to contact us about privacy.
Information we process
The Boules for Gays stores your exercise choices, distances, individual hit or miss results, active training duration, session dates and optional personal notes in a local database on your iPhone. An unfinished session and preferences, including language, distance units and reminder days and time, are stored locally. There are no accounts, names or email fields. When you enable optional backup, the app sends saved session details and notes to our backend. A random installation secret is generated on your iPhone and held in the non-synchronizing device Keychain. It is transmitted in an HTTPS request header; the server stores only its cryptographic hash to separate installations. Ordinary requests to the API or this public website also expose connection information such as IP address, request time, path and technical request metadata to the hosting infrastructure. We do not use advertising or analytics SDKs, tracking cookies, geographic location, contacts, camera or microphone access.
How we use information
Local records let you count throws offline, resume a session, review personal history and calculate accuracy charts. Preferences control presentation and local reminders. Optional backup stores and restores your own training history using the installation secret, without signing in. The secret hash authorizes access to that installation's records. Technical connection information and minimal operational error logs support delivery, reliability, security and troubleshooting. We do not use training notes for advertising, public rankings or social features.
Service providers and sharing
Cloudflare terminates public HTTPS and proxies requests for the application API and this website to Railway. Cloudflare processes connection information and request traffic to deliver and secure these endpoints and may maintain infrastructure logs under its service practices. The backend and its PostgreSQL database are hosted by Railway, which processes uploaded records and infrastructure request information to operate the service. The app server logs limited events and request identifiers for failures; it does not deliberately log installation secrets, secret hashes, request bodies or personal notes. Railway infrastructure may maintain its own operational logs under its service practices. Apple operates iOS, Keychain and local notification delivery, and device backups you independently enable may include local app data under your Apple settings. The app does not integrate an external analytics, advertising, email or messaging provider. We do not sell your data or publish your training history. Information may be disclosed where legally required.
Data retention
Saved local sessions remain until you delete them or remove the app's local data. The current draft remains until saved or discarded. Preferences remain until changed or the app's local data is removed. A Keychain secret may remain after reinstallation on the same device; its survival is controlled by iOS and is not guaranteed. Uploaded sessions remain in the live server database until you request deletion; turning backup off stops future uploads but does not erase an existing server copy. We have not configured an additional application-level archive or a fixed expiry for sessions. Cloudflare and Railway infrastructure logs and any provider-managed snapshots or backups follow the hosting provider's configuration and practices; we do not promise a specific retention period or immediate erasure from those copies.
Deleting your information
Use Settings, Delete all my data, to erase saved sessions and the unfinished draft on this iPhone and request deletion of all sessions associated with its installation secret from the live server database. Preferences are retained. If offline or the service is unavailable, the deletion request is retained locally and retried when the app can connect, before later uploads or restoration. Keep the app installed and reopen it online until deletion is confirmed. The secret remains in Keychain so a queued deletion can still be authorized; it is not a shared credential. Removing the app alone does not delete the server copy. Loss of the secret prevents the app from finding or restoring that copy, and we cannot recover it through an email address or account. Provider backup or log copies, if present, are not directly removed by the live database deletion and follow provider handling. Contact albiebawden@icloud.com for privacy questions or assistance; never send your installation secret.
Permissions and your choices
Notifications are optional and requested only when you apply enabled reminder settings. These reminders are scheduled locally on your iPhone without APNs or an application push server. You can disable reminders in the app and apply the change, or withdraw notification permission in iOS Settings at any time. No location, photo library, camera, microphone, contacts or tracking permission is requested. Optional network backup is controlled separately in app Settings; disabling it does not affect offline training. Opening the privacy link loads this public website using your browser, which sends ordinary web request information.
Your privacy rights
Depending on where you live, you may have rights to access, correct, delete, restrict or object to certain processing, request a copy of your data, or complain to a competent privacy authority. You can view your recorded history in the app, change local preferences, turn off future backup and delete your records using Settings. Send privacy requests to albiebawden@icloud.com. We will consider applicable rights and what we can verify without an account; an email address alone does not identify a secret-scoped backup. Do not include your secret or unnecessary sensitive information in correspondence.
Security
Public API connections use HTTPS. Each installation has its own cryptographically random secret, kept in device-only Keychain storage and sent in a header rather than a URL. The server validates it, stores only a SHA256 hash and scopes every history query, upload and deletion to that hash. Inputs are validated and database access uses parameterized statements. Database credentials stay on the server; the production database is reached over Railway's private network. These measures reduce risk but cannot guarantee absolute security. Anyone who obtains an installation secret can access its associated backup. Avoid adding sensitive personal information to optional notes and protect access to your device.
Children’s privacy
The app is intended for adult recreational pétanque players and is not directed to children. It does not ask for age or collect children's profiles. If you believe a child has submitted personal information, contact albiebawden@icloud.com so the concern can be assessed. The app has no social contact or account system.
Changes to this policy
We may update this policy when the app, processing or service practices change. The current policy is published on this page with its effective date. Material changes will be described in an updated policy and, where appropriate, in the app. Review this page before enabling optional backup if you want to understand the current practices. Privacy contact: albiebawden@icloud.com.