Privacy Policy

Sections 1–11 cover the Elo-X mobile app. For elox.no, see the separate Website Analytics notice.

This Privacy Policy explains how Bhan AS (“we”, “us”, or “our”) collects, uses, stores, and shares personal data when you use the Elo-X mobile application (“the App”). We are committed to protecting your privacy and complying with the EU General Data Protection Regulation (GDPR) and other applicable privacy laws.

The data controller for the purposes of GDPR is Bhan AS, Norway. Contact: support@bhan.no.

1. What Data We Collect

Account and Profile Data

• Email address (used for authentication)
• Username (chosen by you and public within Elo-X)
• Avatar image generated from your username
• Optional profile city and country, selected manually by you; optional device location for Nearby is described separately below
• The version and time of your acceptance of the Terms and acknowledgement of this Privacy Policy
• Your confirmation during signup or an updated legal review that you meet the minimum age; we do not ask for or store your date of birth
• Your separate crash-reporting choice, consent version and decision time; missing consent means crash-report sharing is off
• Your Google Analytics choice, including whether you allowed, declined, or withdrew it, the applicable consent version and time, and the next reminder time after choosing “Not now”

Match and Rating Data

• Official and group match results you submit or confirm, including activity, variant, participants, teams or placements, outcome, status, scores, and timestamps
• Participant user IDs and profile snapshots used to display and preserve match history
• Glicko-2 rating, rating deviation (RD), volatility, and match statistics per activity or variant
• Leaderboard position and rating history needed to calculate rating changes
• QR and link tokens used to invite participants or let them review and confirm a pending match
• Time zone and local date key used when confirming a match
• Match and round lifecycle records, including who changed scores, previous and updated values, approvals, corrections and cancellations; access follows the creator, participant and tournament roles described below
• Optional participant notes, stored separately and available only to the match creator and participants

Group Data

• Groups you create or join, including group name, custom or official activity, rules, competition format, match settings, owner, members, and invite token
• Group-specific matches, ratings, rankings, and member statistics
• Username, avatar, and optional country information shown to other members of the group

Tournaments, Rounds, Courses and Bowling Centers

• Tournament names, activities, rules, schedules, organizer/referee roles, invitations, enrollment and check-in state, player/team entries, rounds, fixtures, standings, scores, interventions, and activity records needed to run the event
• Solo and shared round results, participants, course or center references, saved setup/version, holes and optional par, per-hole or total scores, result history, corrections and aggregate play counts
• Course and bowling-center names, addresses/place labels, country and map coordinates you select, optional icons, setup versions, contributor attribution, review/moderation records, and access memberships for private places
• Public course submissions and their version history are reviewed before publication; private setups and access lists are handled as described under Visibility and Internal Access

Suggestions and Feedback

• Feature and game suggestions you submit
• Votes on suggestions, including your user ID for vote tracking
• Suggestion moderation status and whether a suggestion has been approved for visibility to other users
• Private feedback you send, its selected type, your user ID, optional inbox article, tournament or course/version context, and an optional screenshot you choose to include. The screenshot may contain information visible on the screen you were viewing. Shake-feedback preferences are stored with your private account settings
• Private inbox state for your account, including your last inbox visit and publication cutoff, which articles are unread, when unread attention was cleared, when an article was opened, and notification delivery status when applicable

Technical and Usage Data

• Firebase Authentication UID (internal identifier)
• Optional app usage events through Google Analytics for Firebase (GA4), including events for screen views, sign-in, profiles, leaderboards, matches, groups, suggestions, feedback, location selection, and permission flows; these events may include button and filter selections, menu and dialog interactions, onboarding interactions after consent, tournament/course/round screen and control use, drag outcomes, form-field focus and completion, text length (not text contents), validation status, operation duration and success or error categories, as well as activity, variant, result type, group format, number of sides, tournament role/status/format, competition or round positions, participant counts, view scope, or permission status
• We do not send your Firebase account ID, email address, username, selected city or country, group or custom activity names, match IDs, participant identities, scores, typed text, or participant notes to Google Analytics
• Analytics uses a persistent, resettable app-instance identifier to recognize the same installation across sessions and measure returning use, feature usage, and completion of multi-step flows. Session identifiers and temporary player or group numbers connect interactions within a session without sending the underlying account or group IDs. This data is pseudonymous, not anonymous. Analytics also processes technical information such as device model, operating system, app version, language, and approximate country, region, and city derived from network information
• Firebase Cloud Messaging registration token, platform (iOS or Android), and token update time when you allow notifications
• Notification delivery data, including the relevant match ID, notification text, badge count, delivery event ID, and short-lived duplicate-prevention records
• Device, app, and operating-system information processed by Firebase Cloud Messaging and Apple Push Notification service as needed to deliver notifications
• Optional Firebase Crashlytics reports: crash stack traces, technical app/device information and installation identifiers. We do not attach your Elo-X account ID, email, username or form contents as crash-report attributes. If usage analytics is also enabled, Firebase may include analytics breadcrumbs to help diagnose a crash.
• IP address and user-agent information processed temporarily by Firebase services for service delivery, security, and abuse prevention; we do not store these directly in an Elo-X profile
• Where app attestation is used, Firebase App Check and the relevant Apple App Attest/DeviceCheck or Google Play Integrity services process app/device integrity information, security credentials and attestation tokens to verify genuine app requests and prevent abuse. Provider SDKs may store security state on the device. These security tokens are not added to GA4 event parameters or public profiles
• Operational logs from our backend, which may include location search text and returned place/address suggestions when you use location search
• Account-linked signup and daily activity records: your user ID, event type, local date, time zone, and event time; daily records also include the time reported by your device. We store the latest recorded local activity date separately. We plan to use these records for future XP features and aggregate activity measures. They are created independently of optional Google Analytics and are not sent to GA4.
• App-store review requests: We keep the time of your last request and the number of requests in your private account record to avoid asking too often. Separately, we keep a request record with its time and number, whether it came from iOS or Android, whether the finished match was Official or in a group, whether the participant logged or reviewed it, confirmed-match counts, and account age in whole days. This separate record has no user ID, match ID or device ID, though combinations of its details may still identify someone indirectly. We cannot tell whether the store displayed the request or whether you rated the App. These records are separate from optional Google Analytics and are not sent to GA4.

Optional Nearby Location and Place Search

If you enable location access, the App reads your device location while you use foreground course/center browsing to find nearby places and calculate distances. The operating system may provide approximate or precise coordinates depending on your permission. Search coordinates are sent to our backend to answer the Nearby request; we do not maintain background location tracking or a location history, add the coordinates to your public profile, or send them to Google Analytics. You can browse and search manually without granting device-location access, and change permission in device settings.

If you search for a country, city, venue or address, the search text and selected country filter are sent through our backend to Geoapify. The provider receives our server request rather than your Elo-X account identity. Device coordinates used for Nearby are not forwarded to Geoapify by this feature. A location you deliberately save as part of a course or center becomes place-registry data, with visibility determined by its private/public status; it is separate from your transient device location.

Data We Do NOT Collect

• Contacts or address book
• Payment information
• Microphone audio or audio recordings

The App requests camera access only to scan match, group and tournament QR codes. QR decoding happens on your device and does not submit camera frames to our backend. Optional feedback screenshots are a separate submission described below.

Optional Feedback Screenshots

Shaking the phone may prepare a screenshot locally for feedback. You can review it and turn its inclusion off before sending; nothing is submitted until you choose Send feedback. The image is stored privately with the report for support and product review. Please remove sensitive or confidential information, including information about other people, before submitting a message or screenshot. You may disable shake feedback and still use the ordinary feedback form.

Information You Put in Free-Text Fields

Group, tournament, team and place names, house rules, course/version comments, suggestions, feedback, screenshots and participant notes are supplied by users. Do not include personal data about another person or sensitive or confidential information unless you are authorized to share it and it is necessary for the intended feature.

2. How We Use Your Data

We plan to use these records to calculate daily, weekly, and monthly active-user counts. Reports will show aggregate counts rather than individual activity histories.

Separate Introductory-Flow Measurement

Where enabled, a separate first-party measurement records daily totals for introductory screens and successful sign-ins or account creation. We use these totals to understand and improve the introductory, sign-in and signup flow. This is separate from Google Analytics and does not grant, withdraw or reset your Google Analytics choice.

We limit the counter records to a day, the introductory-flow version and totals for a small set of steps. The records contain no Elo-X account ID, device ID, name, email address, entered text, advertising identifier or persistent measurement identifier. Temporary duplicate-prevention state stays in app memory for the current app process. These approximate totals are not individual activity histories or a count of unique people.

Ordinary network and service-security processing still occurs. Firebase and platform attestation services may process connection information, app/device integrity information and security tokens to protect requests against abuse, and their SDKs may retain technical security state. Connection and security data can be personal data even though the counter records have no account or device key. We do not use these totals for advertising or to build individual profiles. This description does not replace any consent required by applicable law for access to information on your device.

Your Google Analytics Choice

Google Analytics is disabled by default. After your account is ready and any required legal update has been completed, the App asks whether you want to allow it. Choosing “Not now” does not limit the App. We may ask again after 30 days, then 90 days, and then at intervals of up to 180 days. After an app update, we may offer an earlier reminder to people who previously chose “Not now”. This reminder does not change an existing permission or re-prompt people who explicitly withdrew consent in Account. Accepting revised Terms or acknowledging an updated Privacy Policy does not grant Analytics permission or reset your existing Analytics choice. If the Analytics purposes, provider, or data materially change, we may ask everyone for a new choice before collecting further Analytics data.

You can allow or withdraw consent at any time under Account > Privacy & analytics > Usage analytics. Withdrawal stops new Analytics collection on that installation and does not affect processing that occurred before withdrawal. We disable advertising storage, advertising user data, ad personalization, advertising identifiers, and automatic screen reporting.

Optional Crash Reports

Crash-report sharing is off by default and is separate from usage analytics. We do not prompt you to enable it. You can enable or disable it under Account > Privacy & analytics > Crash reports. We use reports only to diagnose errors and improve reliability, based on your consent. Native crash information may be held locally even while sharing is off. Pending reports are discarded when you first enable sharing, disable it or switch to another account; subsequent reports are submitted only after the App resolves the relevant account permission. Turning sharing off stops future submissions but does not recall reports already submitted.

Visibility and Internal Access

• Public within Elo-X: Any signed-in user can access usernames and public profiles. A profile may include the user’s generated avatar, optional city and country, official ratings, and confirmed official matches. Confirmed official matches may show the activity, variant, date, participants, result, scores, and rating changes.
• Groups: Group information and group matches are limited in the App to group members and relevant match participants as described by the feature. A person with a valid invitation link or QR code may receive the limited preview needed to join or respond. Participant notes are limited to the match creator and participants. Match/round activity records are available to the creator, participants in current-format matches, and authorized tournament readers, organizers or referees as applicable.
• Tournaments: Official event information, entries, fixtures, standings and results may be read by signed-in users. Group events are limited to their authorized group/event audience. Valid invitations may disclose a limited preview. Organizers and referees have the additional access required to administer entries, results and disputes; interventions and relevant reasons are recorded in event/match activity.
• Solo rounds: Standalone solo drafts and results are owner-private. A completed solo round linked to a group is visible to current members of that group; drafts and editing remain owner-controlled. Solo rounds do not affect competitive ratings.
• Courses and centers: Approved public places and their published/retained setup history, contributor usernames and aggregate play counts are available to signed-in users. Private places and playable versions are restricted to their owner, people granted access and authorized administrators. Joining a round can grant access to its private place; access holders can share access onward. Private place identity is redacted from result snapshots for unauthorized viewers. Publishing a place can make retained private setup versions publicly readable, as explained in the publication confirmation. New unapproved proposals remain restricted. Place access, result visibility and group membership are separate permissions.
• Internal product analysis: Authorized personnel at Bhan AS can use internal analysis tools to view recent users’ public usernames and optional city and country, group and activity names with member and match counts, and aggregated user, group, activity, and match statistics. We use this information to understand adoption and improve Elo-X. These tools may process participant IDs to count distinct active players but do not present group membership lists or specific private match results, scores, or notes for routine product analysis.
• Product review: Authorized personnel may review group names, custom activity names, rules, and configuration settings to understand how groups use Elo-X and identify activities that may be useful to offer officially. We do not routinely review group membership lists, specific private group match details, or participant notes for product analysis.
• Official matches: Authorized personnel may review the same confirmed official match information that is available within Elo-X, including when and what was played, participants, results, scores, and rating changes. We use this information to operate and improve official activities and leaderboards, check data quality, provide support, and investigate reports or suspected abuse.
• Consented crash reports: Authorized personnel may use Firebase Crashlytics to investigate technical failures and improve app reliability.
• Consented usage analytics: When you allow Google Analytics, authorized personnel may analyze the resulting account-unlinked usage events in GA4, BigQuery, and internal reports to understand how screens and features are used and improve Elo-X.
• Private feedback: Authorized personnel may review feedback you submit, any included screenshot and its source context to understand problems, consider ideas, and improve Elo-X. Feedback is not shown to other users.
• Support and administration: Authorized personnel may access relevant account, group, match, and technical records when reasonably necessary to provide support, troubleshoot a technical issue, respond to a report, investigate fraud, abuse, or a security incident, comply with law, or protect Elo-X and its users.

We limit administrative access to people who need it for these purposes. Information that is public within Elo-X remains personal data and is handled under this Privacy Policy.

3. Data Storage and Infrastructure

The App is built on Google Firebase (Cloud Firestore, Firebase Authentication, Cloud Functions, Analytics, Crashlytics, Cloud Messaging and App Check). Primary Firestore data and Cloud Functions are configured in the European Union (region: europe-west1). Firebase Authentication, Analytics, Crashlytics, Cloud Messaging, and related support systems may process data through Google’s global infrastructure. Google acts as a data processor on our behalf under Google’s standard Data Processing Addendum.

If you consent, Analytics data is processed by Google Analytics for Firebase (GA4), which may process data across Google’s global infrastructure. Where data is transferred outside the EEA, Google relies on Standard Contractual Clauses (SCCs) as a transfer mechanism. We use Analytics to understand product usage and reliability, not to sell personal data or serve advertising in Elo-X.

GA4 events are also exported daily to a Google BigQuery dataset located in europe-west1 for product analysis. Access is limited through the Google Cloud project’s permissions.

For more information on Google’s data practices, see Google’s Privacy Policy and Firebase’s Privacy and Security.

4. Data Retention

• Account and profile data: Retained while your account is active and deleted when your account is deleted, normally within 30 days of a valid deletion request.
• Match, round, tournament, group, place/version, rating, and suggestion data: Retained while needed to provide the relevant service. On account deletion, account-linked records are deleted or identifying references are removed or replaced with a non-identifying deleted-user marker where a record must remain to preserve other users’ match/tournament history, ratings, group integrity, retained place versions, or suggestion totals.
• Private feedback and included images: Retained while needed for support/product review and deleted together when the submitting account is deleted.
• Private inbox state: Retained while your account is active and deleted when your account is deleted. Expired unread attention is retained as read state so it is not recreated.
• Introductory-flow totals: Aggregate daily totals are retained while needed for product-improvement trend analysis. They have no account key or individual contribution record, so a particular person’s contribution cannot normally be retrieved or removed from these totals when their account is deleted. Technical security records are handled separately under the infrastructure/retention practices described in this Policy.
• Signup and daily activity records: Retained while your account is active to support future XP features and aggregate active-user counts, and deleted when your account is deleted.
• App-store review requests: Your private last-request time and count are deleted with your account. Separate request records have no user ID and are kept for 365 days, then automatically deleted, normally within another 24 hours. Because they are not linked to your account, account deletion does not identify and remove those records individually.
• Crash reports: Google retains crash stacks and associated installation identifiers for 90 days before beginning removal from live and backup systems.
• Analytics data: Consented event-level data in GA4 and its BigQuery export is retained for up to 14 months. Standard aggregated Analytics reports may remain available for longer.
• Push tokens: Retained while associated with an active signed-in installation. We remove or disassociate them on sign-out or account deletion, subject to limited retry delays if the device is offline, and remove invalid tokens when detected.
• Push delivery records: Duplicate-prevention records are configured to expire after seven days.
• Auth and QR tokens: Used to authenticate sessions or access match and group flows. Match-token access is restricted when the relevant flow ends; group invitation tokens remain active until replaced or the group is deleted.

We may retain certain data for longer where required by law or for legitimate business purposes (e.g., fraud prevention), but only to the extent necessary.

Operational logs are retained only as long as necessary for debugging and operational purposes.

5. Third Parties

We share your data only with the following categories of third parties:

• Google / Firebase: Infrastructure, authentication, database, Analytics, Crashlytics, Cloud Messaging, App Check, notification delivery, and backend logs (see Section 3).
• Apple: Apple Push Notification service (APNs) processes device tokens and notification payloads to deliver notifications to iOS devices. Notification previews may appear on a locked device depending on your device settings. App Attest/DeviceCheck may also process app/device integrity information for supported security checks. See Apple’s Privacy Policy.
• Geoapify: If you use place/location search, your query (such as a country, city, venue or address) and relevant country filter are sent to Geoapify through our backend. We do not send your account ID or Nearby device coordinates to Geoapify. Geoapify and its infrastructure providers may process request/network information under their own security and retention practices. See Geoapify’s Privacy Policy.
• Robohash.org: Avatar images are generated by Robohash.org based on your username/seed. This is a public API; see robohash.org.

We do not sell your personal data. We do not share your data with advertisers or data brokers.

6. Your Rights (GDPR)

If you are located in the EU/EEA (including Norway and Sweden), you have the following rights regarding your personal data:

• Right of access: Request information about and a copy of the personal data we hold about you.
• Right to rectification: Request correction of inaccurate or incomplete data.
• Right to erasure (“right to be forgotten”): Request deletion of your personal data where applicable. You can delete your account directly in the App (via Settings > Account > Delete Account), which will trigger deletion or de-identification as described below. You may also contact us at support@bhan.no to request erasure.
• Right to data portability: Where applicable, request data you provided to us in a structured, commonly used, machine-readable format.
• Right to restriction of processing: Request that we limit how we process your data in certain circumstances.
• Right to object: Object to processing based on legitimate interests.
• Right to withdraw consent: Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing. Google Analytics consent can be changed under Account > Privacy & analytics > Usage analytics.

Push notifications are optional. You can disable or change notification and lock-screen preview permissions at any time in your device settings without losing access to the App.

To exercise any of these rights, contact us at support@bhan.no. We will respond without undue delay and normally within one month, subject to any extension permitted by law. You also have the right to lodge a complaint with your national data protection authority (e.g., Datatilsynet in Norway, IMY in Sweden).

7. Account Deletion

You can delete your account at any time. To delete your account:

• Open the App and go to your Profile.
• Tap the settings icon → Account → Delete account.

Alternatively, contact us at support@bhan.no with the subject line “Account Deletion Request”. We will delete your account and associated personal data within 30 days.

Note: Match and group records involving other users may be retained with your identity replaced by a deleted-user marker where necessary to preserve their match history, ratings, or group records. Suggestions may remain without a link to your deleted account so existing votes and moderation history remain consistent. Analytics data already collected is not linked to your Elo-X account and normally cannot be isolated by account; it remains subject to the separate retention period above.

Certain records may be retained where required by applicable law or to prevent fraud and abuse.

8. Children’s Privacy

You must be at least 13 years old to use the App, or older if applicable law where you live requires a higher minimum age. We do not knowingly collect personal data from children under 13, even with parental authorization. If you believe a child under 13 has provided us with personal data, contact us and we will take steps to delete it. Users above 13 who are below the applicable age of digital consent may need authorization from a parent or legal guardian, depending on the law where they live.

9. Security

We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, loss, or disclosure. These include encryption in transit (TLS), Firebase security rules restricting data access, and server-side-only rating computations. However, no system is completely secure, and we cannot guarantee absolute security.

10. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will provide notice through the App, by email, or by another appropriate method, and provide advance notice where required by law. We may require you to acknowledge the updated policy before continuing to use the App. A material change to the optional Google Analytics processing may also require a new Analytics choice. The “Effective date” at the top of this page reflects the latest revision.

11. Contact

For privacy-related questions, requests, or complaints, contact us at:
Bhan AS, Norway
Email: support@bhan.no

12. Website Analytics

This section applies to elox.no and is separate from the App policy above. Website analytics notice added: 2026-10-10; last updated: 2026-10-19.

We use PostHog EU Cloud to understand and improve the website. We measure page visits, page exits, traffic sources, campaign tags (utm_source, utm_medium, utm_campaign and utm_content), browser/device information, and clicks on App Store and Google Play links. Other URL query parameters, fragments and individual advertising click identifiers are removed from analytics events. Campaign tags must not contain personal information. We do not connect website events to your Elo-X account, create person profiles, or enable session recordings.

Cookieless analytics

Before you make a choice, and if you choose “Decline cookies”, PostHog uses cookieless analytics without storing analytics identifiers in cookies or browser storage. PostHog processes your IP address and browser User-Agent to generate a server-side hash for our project and website using a daily changing salt. This can associate visits and actions within the same day; it does not reliably recognise returning visitors across days. The daily salt is deleted after that day’s events have been processed. Cookieless events do not receive IP-based location information. We rely on our legitimate interest in measuring and improving the public website for this limited processing (GDPR Art. 6(1)(f)). You can stop all website analytics using “Stop all analytics” in Analytics settings, or object by contacting support@bhan.no.

Group and match invitation links

We also count visits to group and match invitation pages. Invitation tokens are replaced with a keyed hash on our server before an event is sent to PostHog. This reference lets us count repeat visits to the same link without including the original token, usable invitation link or group name. These events do not recognise individual visitors, use analytics cookies or include visitor IP addresses or browser details. A new invitation token creates a new reference. We rely on our legitimate interest in measuring and improving the website for this aggregate measurement (GDPR Art. 6(1)(f)). The same website analytics opt-out applies.

Optional analytics cookies

If you choose “Accept cookies”, PostHog also uses cookies and browser storage to recognise the same browser across visits, improving visitor and campaign reporting. With your consent, events can also include approximate location derived from your IP address, such as country or city. Our project is configured to discard the IP address after this processing. The legal basis for this additional processing is your consent (GDPR Art. 6(1)(a)). You can use the website without allowing these cookies.

Your choice

You can change your choice at any time using “Analytics settings” in the footer. Choosing “Decline cookies” removes this project’s analytics identifiers from your browser and returns future measurement to cookieless mode. This cookie choice does not stop cookieless analytics. To stop future website analytics events in this browser, choose “Stop all analytics”. The PostHog SDK may already have loaded on the current page; it will not load on subsequent pages while this preference is remembered. Changing a preference does not automatically erase past events; requests already submitted, including retries, may finish processing.

We remember cookie preferences, their timestamp and notice version in browser storage for up to 180 days, after which we ask again. A “Stop all analytics” preference remains until you change it or clear browser storage. If your browser blocks storage, preferences may not be remembered between pages. PostHog also stores a functional value to honour the cookie choice. These preferences are separate from analytics identifiers. Public-page events indicate the measurement mode and notice version; cookie-based events include the consent timestamp. Analytics cookies have a maximum configured lifetime of 180 days; analytics browser storage remains until cleared or removed when cookie permission is withdrawn. PostHog’s current free plan provides one year of analytics event retention; older data may be deleted under its retention policy. Deleting the daily hash salt does not delete historical event records. These website preferences do not change the App’s separate analytics or crash-reporting settings. See PostHog’s Privacy Policy.