Privacy Policy

This privacy policy explains how personal data is processed in the OnAim app (iOS and Android) and on this website onaim.app under the EU General Data Protection Regulation (GDPR). The German version is legally binding; this is a courtesy translation.

Last updated: 17 September 2026

1. Controller

The controller within the meaning of the GDPR is:

MAK C.E.T GmbH
Heidenfelder Str. 1
97525 Schwebheim
Germany

Represented by: Mr Michael Ali Kilic
Phone: +49 9723 93805-0
Fax: +49 9723 93805-129
E-mail: [email protected]

Registry: Amtsgericht Schweinfurt, HRB 6561
VAT ID (§ 27a UStG): DE287231582

2. Data protection officer

We are not legally required to appoint a data protection officer. For any privacy enquiries or to exercise your rights, please contact the controller named above.

3. Principles and storage location

OnAim is a companion app for sport shooting (IPSC and BDS): a personal shooting log, match calendar, training analysis and equipment management. We process personal data exclusively on servers located within the European Union.

• Hosting: Hetzner Online GmbH, Frankfurt am Main data centre (Germany), under a data processing agreement (Art. 28 GDPR).
• Database: PostgreSQL, operated in the same EU infrastructure.
• File storage (your documents): Hetzner Object Storage in Germany — the same processor (Hetzner Online GmbH), a different service. See section 8.2. Target photos are not held there; they stay on your device (section 8.1).
• Transport: encrypted exclusively via TLS 1.3.

4. Account and sign-in (passwordless)

Sign-in is passwordless and uses e-mail: you receive a one-time six-digit code (or a magic link). We process:

• your e-mail address
• a cryptographic hash (SHA-256) of the code/token — the code itself is never stored in plain text
• your IP address and user-agent at sign-in time, solely for abuse and brute-force prevention (rate limiting)

Legal basis: Art. 6(1)(b) GDPR (performance of the contract) and Art. 6(1)(f) GDPR (legitimate interest in service security).
Retention: codes/tokens are valid for 15 minutes and single-use; expired records including IP and user-agent are deleted automatically within 7 days.

5. Profile data

We process the following in your profile:

• e-mail address
• first and last name
• federation membership (e.g. BDS, DSB) and disciplines
• club name and an optional location hint (e.g. region)
• optionally your firearms ownership cards (WBK type, number, NWR permit ID, your own label)
• optionally a "valid until" date for each WBK and for each federation and club membership
• language preference and privacy settings (flags)

We store the validity dates with your profile so that they survive a reinstall and reach your other devices. They serve only the expiry reminder that your device computes (section 14).

We do not collect a date of birth or age.
Legal basis: Art. 6(1)(b) GDPR.
Retention: until you delete your account.

6. Equipment / firearm data (optional)

You may — voluntarily — store details about your sport firearm and equipment. This feature is disabled by default (opt-in). We process, among others:

• make, model, calibre
• serial number, firearms ownership card (WBK) number and WBK position
• purchase date, round counter, notes, discipline tags
• optional reminder intervals: maintenance of a firearm (by days and/or by rounds) and battery change of an optic (by days). We store them with the entry; the reminder itself is computed by your device (section 14).

These entries form a private record. They are visible only to you, are never displayed publicly, are not transmitted to authorities and are not fed into the National Firearms Register (NWR). Access is strictly user-scoped at the technical level (authorisation by your user ID on every query).
Legal basis: Art. 6(1)(a) GDPR (your consent) and Art. 6(1)(b) GDPR to provide the feature. You may withdraw consent at any time with effect for the future.
Retention: until you delete the entry or your account.

7. Shooting log and training data

To maintain your shooting log and training analysis we process the entries you record, in particular:

• date/time, range name, discipline and scoring
• firearm used, results/hit pattern, notes and weather data
• training metrics (e.g. distance, duration, group size)
• for match/proof entries, where applicable the name, licence number and signature of the range officer (RO)

Where you enter third-party data (e.g. the range officer's), you are co-responsible for the lawfulness of that input. This data is not published.
Legal basis: Art. 6(1)(b) GDPR.
Retention: until you delete the entry or your account.

8. Target photos and your own documents

8.1 Target photos — they stay on your device

You may voluntarily attach a photo of your target to a training entry. That photo is stored exclusively on your own device: it is not transmitted to our servers, not included in the shooting-log extract (PDF), and not used to improve any detection model.

Automatic hit detection from the photo is not active at present. Earlier versions of this notice described a server-side evaluation and a separate consent to model improvement; neither has been in operation since 4 August 2026. Should the feature return, we will inform you beforehand and obtain the required consent again.

Legal basis: Art. 6(1)(b) GDPR (performance of a contract). Retention: until you delete the photo or the entry it belongs to, or uninstall the app.

8.2 Your own documents

In the Documents area you may voluntarily store your own paperwork so that you have it to hand — typically a club certificate, a copy of your firearms ownership card (WBK), a proof of expertise (Sachkunde) or proof of insurance. The feature is entirely optional: no document exists unless you upload one, and the app is fully usable without it.

• Data processed: the file itself (PDF, JPEG or PNG, max. 10 MB) plus a label you choose, optionally an expiry date ("valid until"), the detected file type, the file size and the time of upload.
• We do not read the contents. There is no text recognition (OCR), no evaluation and no automatic classification. The file is stored unchanged and served back only to you.
• Storage location: the file is held at Hetzner Object Storage in Germany; the accompanying details (label, type, size, time) in our database, likewise in Germany. No transfer to third parties takes place.
• Transmission and access: transmission is TLS-encrypted. Access is bound to your account — every request is restricted server-side to your user ID, and files are delivered solely through our authenticated interface, never via publicly retrievable links.
• End-to-end encryption: your documents are encrypted on your device before they are uploaded. The key is derived from a passphrase that only you know and that never reaches us. On our servers the files — and their labels — exist only as ciphertext.
• Expiry date: an optional expiry date is stored by the app together with the label in the encrypted details of the document. Our servers cannot read it and therefore cannot remind you of it. The reminder is computed by your device (section 14), and only after you have opened your documents on that device with your passphrase.
• What this means and what it does not: we cannot read your documents without guessing your passphrase. So that a new device can open them, we store the key encrypted with your passphrase; the security of your documents therefore depends directly on the strength of that passphrase. We explicitly do not claim that access is "impossible": the app is built and signed by us, and this commitment is a statement about how we operate, not a mathematical proof.
• A forgotten passphrase: we cannot reset it and we hold no copy of your key. If it is lost, the uploaded documents are permanently unreadable — by us as well. This also affects your rights as a data subject: for a request under Art. 15 GDPR or a data export under Art. 20 GDPR we could then only hand over the encrypted data and the metadata (size, timestamp), not the content. Your original documents remain in your possession; please keep the passphrase in your password manager.
• On your device: downloaded documents are placed in the app's own cache so that they are available offline. That area is shielded by your operating system's protection mechanisms; it is cleared when you delete the document and when you uninstall the app.

Legal basis: Art. 6(1)(b) GDPR (performance of a contract — you actively request the storage).
Retention: until you delete the document. Deleting it also removes the file itself. Deleting your account deletes all documents and files in full (see § 19).
Scope: up to 2 documents on the free tier, up to 100 with OnAim Pro. That limit exists to prevent abuse.

9. Microphone (par-timer time measurement)

For time measurement during training you may enable the microphone so that the start of your run is detected automatically. This feature is off by default; the microphone permission is only requested once you switch it on.

Processing happens entirely on your device and in real time: only the point in time of a signal is determined. No audio recording is created, stored or transmitted. The audio data never leaves the device's native processing layer and reaches neither our servers nor any third party. Accordingly, no personal data is transmitted to us in this respect.
Legal basis: Art. 6(1)(b) GDPR, to the extent that any processing by us takes place at all.

10. Publication of results

Results are published (e.g. in rankings) only if you actively allow it; by default this is disabled / can be switched off (opt-out).
Legal basis: Art. 6(1)(a) GDPR.

11. E-mail delivery and international transfer (AWS SES)

To send transactional e-mails (sign-in codes) we use Amazon Simple Email Service (Amazon Web Services EMEA SARL, Luxembourg), region eu-central-1 (Frankfurt). Only your e-mail address and the one-time sign-in code are passed to the e-mail service — no names, federation, firearm, shooting-log or location data.

Because the parent company (Amazon.com, Inc.) is based in the USA, theoretical access under US law (in particular the CLOUD Act) cannot be fully excluded. We base the transfer on the EU Commission's Standard Contractual Clauses (Art. 46 GDPR) together with a Transfer Impact Assessment and supplementary measures (EU region pinning, TLS 1.3 encryption, minimal payload, short-lived single-use tokens). We do not rely primarily on the EU-US Data Privacy Framework.
Legal basis: Art. 6(1)(b) GDPR; transfer under Art. 46 GDPR.

11a. Subscription management and international transfer (RevenueCat)

To manage the paid OnAim Pro subscription we use RevenueCat, Inc., Brandon, Florida (USA), as a processor. RevenueCat maps the purchase, renewal and cancellation notifications from the App Store and Google Play to your OnAim account, and it delivers the content of the subscription screen.

• Data transferred: a pseudonymous user identifier (random UUID), the product purchased and its term, purchase, renewal, cancellation and refund events, the expiry date, the store (Apple/Google), country, IP address, plus device type, app version and language setting.
• Not transferred: your name, your e-mail address, federation and club details, firearm and equipment data, shooting-log and training data, your documents and location data. Without our database, your identifier at RevenueCat cannot be linked to a person.
• Neither we nor RevenueCat receive payment data. The purchase contract is concluded with the respective store operator and payment is handled exclusively there (see Terms of Use).

This also affects you without a subscription: the content of the subscription screen (prices, texts, layout) is loaded at runtime from RevenueCat's content delivery network. As a result, merely opening that screen transmits your IP address to RevenueCat — even if you never subscribe and use OnAim free of charge indefinitely. The screen is loaded only when you open it yourself; no connection to RevenueCat is made when the app starts.

International transfer: RevenueCat is based in the USA and operates its systems on Amazon Web Services in the USA. The provider does not offer storage exclusively within the EU — unlike the e-mail delivery described in section 11, region pinning is technically not available here. RevenueCat in turn engages sub-processors, all of which are established in the USA. Access under US law (in particular the CLOUD Act and FISA 702) therefore cannot be excluded.

We base the transfer on the EU Commission's Standard Contractual Clauses (Art. 46 GDPR) together with a Transfer Impact Assessment and supplementary measures: pseudonymisation (no real names, no e-mail addresses), strict data minimisation, no advertising, attribution or marketing integrations, no collection of device advertising identifiers, and deletion of the record when you delete your account. We do not rely on the EU-US Data Privacy Framework.

The decision whether your account receives Pro features is made exclusively by our servers in the EU. For us RevenueCat is only a source of events, not the deciding party.
Legal basis: Art. 6(1)(b) GDPR (managing the subscription you entered into); transfer under Art. 46 GDPR.
Retention: for the duration of the subscription and for as long as required for tax and commercial accountability; when you delete your account, deletion at RevenueCat is additionally requested.

12. Server and security logs

For security, accountability (Art. 30 GDPR) and attack prevention we log security-relevant events (e.g. profile changes, failed sign-ins) together with your user ID, the timestamp and the IP address.
Legal basis: Art. 6(1)(f) GDPR (legitimate interest in security and integrity).
Retention: generally 90 days, then automatic deletion or anonymisation.

12a. Usage statistics and crash reports (first-party)

To keep the app stable and its features useful, the app collects technical usage and error data — exclusively on our own servers in the EU (Hetzner, Germany), with no third parties, no advertising identifiers and no cross-device tracking. There are two tiers:

• Anonymous counting (always on): event counters such as "area X was opened" or "feature Y was used" — with app version, platform and OS version, but without any identifier: no user reference, no device or installation ID, and nothing is stored on your device for it. The permitted event names are technically restricted to a fixed set; free text is impossible. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in stability and development).
• Linked statistics (only with your consent): if you enable "Share usage statistics" in the settings, the app generates a random installation ID that links events from the same device (e.g. for usage journeys). Switching it off deletes the ID. Legal basis: Art. 6(1)(a) GDPR; withdrawal at any time in the settings with effect for the future.
• Crash reports (can be switched off): if the app crashes, it sends a technical report (error message, code path, app/OS version, device model) to our servers on the next launch. The report contains no identifier whatsoever — the database table structurally has no user and no device column. Can be disabled in the settings ("Send crash reports"). Legal basis: Art. 6(1)(f) GDPR.

For all three: no combination with your shooting-log, equipment, document or profile data; no disclosure to third parties. Retention: raw data at most 90 days, then automatic deletion; only anonymous aggregate figures (e.g. "uses per day") are kept permanently, and they no longer relate to any person.

When you access this website, our hosting provider processes and briefly stores technically necessary access data (IP address, date/time, requested resource, user-agent) in server log files.

13. Storage on your device

The app also stores your data locally on the device (encrypted SQLite database) so it works offline. Your sign-in token (JWT) is stored in the operating system's secure storage (iOS Keychain / Android Keystore). Some data remains on the device only and is not transmitted to our servers: checklists and the history of local reminders (section 14). Your own appointments and starred matches, by contrast, are synchronised with your account (section 13a). Uninstalling the app deletes the local data.

Lending record (§ 38 WaffG). The app stores lending records on your device only — including the data you enter about your lending partner (name, address, WBK or hunting-licence number, issuing authority). This data never reaches our servers: there is no endpoint for it and no synchronisation. The QR transfer runs directly from one device to the other. The signed PDF leaves your device only through a channel you choose (the operating system's share sheet, or print) — both parties have to carry the record, which is the purpose of § 38. Only what the official form asks for is recorded. Deleting the record in the app, or deleting the app, removes the data from your device. The return reminder is a local notification (see section 14). Its text names neither the firearm nor the other party, so none of that becomes visible on a locked screen; nothing is transmitted in the process.

13a. Calendar: your own appointments and starred matches

We store your own appointments and the matches you starred in the calendar on our servers in the EU (Hetzner, Germany), so that they are available on your other devices and after a phone change or a reinstall. The app synchronises them with our servers at start, when you return to the app and after every change. We process:

• Your own appointments: type of appointment (e.g. training, club meeting, travel), title, start and end, location, federation and discipline, your notes, your reminder choice (24 hours and/or 1 hour before), the link to a checklist (its identifier only; the checklist itself stays on your device) and the times of creation and last change.
• Starred matches: the match identifier, title and short description, start and registration deadline as they appeared in the public match calendar when you starred the match, and the time you starred it.

These entries are visible only to you; every request is restricted server-side to your user ID. Unlike your documents (section 8.2) they are not end-to-end encrypted; like your other data they are protected in transit and at rest (section 22). Reminders for these entries are still computed by your device (section 14). No transfer to third parties takes place.

Not synchronised: lending records (they remain on your device only, unchanged, section 13), checklists and the history of local reminders.

Legal basis: Art. 6(1)(b) GDPR (providing your own data under the contract of use).
Retention: until you delete the appointment or remove the star, or delete your account. So that your other devices learn about a deletion, a deletion marker is kept for up to 90 days; the title, location, notes, description and checklist link are removed immediately. Deleting your account deletes all entries including the deletion markers.

14. Notifications

One setting, "Notifications" (Settings → Notifications), covers three kinds of notifications:

• Reminders: reminders your device computes from your own entries: your appointments and starred matches (including match day and registration deadline), the return after a lending record, maintenance and battery intervals of your equipment, validity dates (firearms ownership card, memberships, documents), the progress of your shooting record (Schießnachweis) and a missing range officer signature. They are computed and scheduled on your device only as local notifications; nothing is transmitted to us or to third parties for this.
• Service notices: notifications from our server, only when needed to use the service: a required app update, planned maintenance or the security of your account. This kind has no switch of its own; it follows "Notifications".
• News and events: notifications from our server about items from the sources of our news section and new matches for the federations and disciplines you selected in your profile.

Activation: you receive notifications from our server (push notifications) only after you turn "Notifications" on in the app, accept the notice shown at that point, which names all three kinds, and the operating system has granted permission. Only then does the app read the device token and send it to us. Turning "Notifications" off ends local reminders and push notifications on this device. "News and events" is on once you have accepted the notice; you can switch it off on its own in Settings at any time.

Delivery: On iOS, push notifications are delivered via the Apple Push Notification service (APNs) of Apple Inc., One Apple Park Way, Cupertino, USA (for users in the EEA, Apple's privacy policy names Apple Distribution International Limited, Ireland, as responsible for Apple's processing); on Android via Firebase Cloud Messaging (FCM) of Google Ireland Limited or Google LLC. We use Firebase for message delivery only: no Firebase Analytics and no other Firebase feature. On iOS there is no other delivery route; on Android there is none within Google Play services.

Data processed: When you enable notifications, the operating system creates a device token (on Android also a Firebase installation ID). On our servers in the EU we store the token together with its link to your account, the platform (iOS/Android), the app language, the app version and the time of last use, as well as your choice for "News and events", the time you accepted the notice and the version of that notice text. Apple or Google receive the token and the content of each notification and process technical delivery data.

Content of notifications: Push notifications contain no results or scores, no names, e-mail addresses, firearm, shooting-log, document or location data. They consist of a short text in your app language (e.g. the headline of a news item or the number of new matches) and an internal identifier the app uses to open the right screen. Please note: the text may be visible on your lock screen, and Apple or Google can see that your device received a notification with this content.

Content of local reminders: the app puts no firearm or optic, no other party of a lending record, no document title, no WBK or permit number and no result into the text of a local reminder, because a local reminder can also be visible on the lock screen. For appointments and starred matches the title appears, as you chose it or as it stands in the match calendar. All other reminders name only the kind of reminder. You see the details only when you open the app.

Scope: we send "News and events" sparingly and only between 08:00 and 21:00 (German time). We send no advertising by push: nothing about the Pro subscription, other offers or third-party content for advertising purposes.

Legal bases:

• Reminders and service notices: Art. 6(1)(b) GDPR (providing the feature you turned on).
• News and events: Art. 6(1)(f) GDPR. Our legitimate interest is to inform members about news from their federations and about matches in their disciplines. You can object at any time (Art. 21 GDPR) by switching "News and events" off in Settings; the app then no longer sends you these notifications.
• Storing and reading the token on your device: Section 25(2) No. 2 TDDDG (a service you expressly requested by turning "Notifications" on and accepting the notice).

Opens: when you tap a push notification, the app counts this as part of the anonymous counting described in section 12a: only the fact that this notification was opened is transmitted, without any user or device identifier.

"Notifications" overview: the app shows upcoming reminders and a history of the last 30 days. For local reminders it keeps a list of scheduled and fired reminders on your device; fired entries are deleted after 30 days, and the list never leaves your device. The history of push notifications sent to your account is read by the app from our servers; it covers the last 30 days and is based on the delivery logs, which we delete after 30 days (see Retention).

Retention: the token is deleted when you sign out, turn "Notifications" off, Apple or Google report it as invalid (e.g. after the app is uninstalled), at the latest 180 days after the app was last used on that device, and when your account is deleted. Delivery logs (which notification went to which device, delivery status) are deleted after 30 days.

International transfer: Apple Inc. and Google LLC are based in the USA; access under US law cannot be fully excluded. For Google we base the transfer on the EU Commission's Standard Contractual Clauses (Art. 46 GDPR) together with a Transfer Impact Assessment, not primarily on the EU-US Data Privacy Framework. Apple provides developers with neither a data processing agreement nor Standard Contractual Clauses for APNs; Apple processes the token and notification text as the operating system provider under its own responsibility and its own privacy policy. For that reason push notifications contain only the non-confidential content described above.

15. Maps and match calendar

To display match locations, map tiles may be loaded from OpenStreetMap (OpenStreetMap Foundation). Your IP address is technically transmitted to the map service in the process. Match dates are aggregated from publicly available sources; for details see onaim.app/en/about/bot.
Legal basis: Art. 6(1)(f) GDPR.

16. No advertising or tracking services

OnAim uses no advertising or tracking services: no Google Analytics, no Firebase Analytics, no advertising identifiers (IDFA/AAID), no cross-app or cross-device tracking, no attribution or marketing networks and no profiling for advertising purposes. No data is processed for advertising or sold to third parties.

So that this statement stays accurate, we expressly delimit four points:

• Subscription screen: RevenueCat (section 11a) counts how often the subscription screen was shown and how often a purchase follows from it. This measurement relates to that single screen only and serves solely to assess it; it is not combined with your shooting-log, equipment or profile data. A/B testing and audience targeting are switched off and will not be enabled without first amending this policy.
• Error diagnostics: no third-party crash-reporting SDK is embedded in the app (no Crashlytics, no Sentry). Crash reports and usage statistics are collected by the app exclusively first-party as described in section 12a — on our own EU servers, in the identifier-free or consent-bound form described there. Our processors use their own diagnostic and logging tools to operate their own systems; that processing happens on their side and is part of the respective data processing agreement.
• Hit detection as described in section 8: a feature you actively trigger, not an analytics or tracking service. It involves no profiling and no advertising purpose.
• Notifications as described in section 14: Firebase Cloud Messaging is used for delivery on Android only; opens are counted only anonymously and first-party as described in section 12a.

17. Fonts on this website

This website loads fonts via Google Fonts (Google Ireland Limited). When the fonts are loaded, your IP address is transmitted to Google. The provider is Google Ireland Limited; for more information see policies.google.com/privacy.
Legal basis: Art. 6(1)(f) GDPR (consistent, accessible presentation).

18. Recipients and processors

We share your data only with the following processors required to provide the service (Art. 28 GDPR) and other recipients:

• Hetzner Online GmbH — hosting (Germany)
• Hetzner Online GmbH — Object Storage for your documents (Germany); the same processor, an additional service
• Amazon Web Services EMEA SARL — transactional e-mail (eu-central-1)
• RevenueCat, Inc. — management of the Pro subscription (USA); for details and the international transfer see section 11a
• Google Ireland Limited / Google LLC: delivery of push notifications on Android via Firebase Cloud Messaging; see section 14

Other recipients (not processors):

• Apple Inc. (USA) or Apple Distribution International Limited (Ireland): delivery of push notifications on iOS as the operating system provider under its own responsibility; see section 14

For the automatic hit detection (section 8), no external AI or image-analysis services are used; it runs on our own infrastructure within the EU. The sub-processors engaged by RevenueCat concern subscription management only and are described in section 11a.

We do not sell personal data.

19. Your rights

You have the following rights:

• access (Art. 15 GDPR)
• rectification (Art. 16 GDPR)
• erasure (Art. 17 GDPR) — you can delete your account directly in the app (Settings → Account → Delete account). The account is first marked for deletion and permanently deleted after 30 days; if you sign in again within this period, the deletion is automatically cancelled. This irreversibly removes your profile, firearm, shooting-log and calendar data. Instructions (including by email) are available at onaim.app/en/delete-account
• restriction of processing (Art. 18 GDPR)
• data portability (Art. 20 GDPR)
• objection (Art. 21 GDPR)
• withdrawal of consent (Art. 7(3) GDPR) with effect for the future

To exercise your rights, simply e-mail [email protected].

20. Right to lodge a complaint

You have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority competent for us is the Bavarian State Office for Data Protection Supervision (BayLDA), Promenade 18, 91522 Ansbach, Germany.

21. Minors

OnAim is intended exclusively for adult sport shooters (aged 18 and over) and is not directed at children or adolescents under 18. We do not knowingly collect personal data from anyone under 18; if we become aware of such data, we delete it.

22. Data security

We apply appropriate technical and organisational measures (Art. 32 GDPR): TLS 1.3 transport encryption, encryption of the database at rest, strictly user-scoped access control and storage of sign-in codes/tokens only as hashes (SHA-256).

23. Changes to this policy

We update this privacy policy when the scope of features or the legal situation changes. The current version published here always applies.