Privacy

Last updated: 13 October 2026.

Pistol Accuracy is a small private tool for measuring your shooting from photos of your targets. It is run by Pistol Accuracy, and you can reach us at contact@pistolaccuracy.com. You are using it because you were invited. This page says plainly what it stores, where, and for how long.

What we store

Your account. Your username, your email address, and your password. The password is stored only as a one-way scrambled form (Argon2), which nobody, including us, can turn back into your password. We also store when you last logged in, when you confirmed your email address, the time zone your browser reported when you logged in (so "today" means your today), and a count of recent failed login attempts (so repeated wrong guesses lock the account for a while).

If you are an admin. The few accounts that run the site also have two-step sign-in for the admin area: a secret shared with their authenticator app, stored encrypted; ten single-use recovery codes, stored only in scrambled form; and, on each of their sign-ins, when it last passed the two-step check. Ordinary accounts have none of these. Only the person who runs Pistol Accuracy makes an account an admin. When an account stops being an admin, its two-step secret and recovery codes are deleted.

What you enter. Your firearms, ammunition, range sessions (date, whether indoors or outdoors, any notes you type, and any weather you record), drills and any goals you set, timings, and every target you mark: the shot positions, scale, distance, rounds fired, training type, and notes.

Your screen choices. We also remember choices you make on screens, such as the distance a chart shows, so they are kept next time.

Your target photos. When you upload a photo, the app makes a fresh copy of the picture and throws away everything else in the file. That includes the GPS location your phone may have recorded, the camera details, and the date the photo was taken. Large photos are also shrunk in your browser before they are sent.

Signing in. While you are signed in, we keep a record of that sign-in: which account it belongs to, when it started, when it was last used, and when it ends. It holds a scrambled form of the sign-in code, never the code itself. We also keep the kind of browser and device you signed in from, such as "Safari on iPhone", so you can recognise your sign-ins on your Account page. That is worked out from what your browser reports when you sign in, and only the short description is kept; we do not keep your internet address with it. It goes when the sign-in record goes. Signing out deletes it at once, and changing your password deletes every sign-in except the one you made the change from. One that simply runs out after 14 days is deleted the next time the app tidies up (see "How long we keep it").

For security. When a login fails, we record the internet address it came from, so that many wrong guesses from one place can be slowed down. That record is deleted 30 days after the last failed attempt from that address, or at the next tidy-up after a successful login from it.

If you reset your password. Asking for a reset link stores a scrambled form of the email address you typed and the internet address the request came from, so that one person cannot send a flood of reset emails. These are deleted after 24 hours. The link itself is stored only in scrambled form, works once, and stops working after 30 minutes.

Confirming your email address. Before an account can be used, its email address has to be confirmed with a link we send to it. The link is stored only in scrambled form, works once, and stops working after 24 hours. Completing a password reset also confirms the address, because that link went to the same address.

If you were invited. To invite you, an admin gives us only your email address. Until you accept, we keep that address, which admin invited you, when, and the link we emailed you (only in scrambled form). There is no account until you accept: the link works once, stops working after 72 hours, and on it you choose your own username and password. Accepting creates your account and confirms your email address. An invitation that is cancelled or runs out is deleted, and one that is accepted is deleted as your account is created. Admins can see invitations that are still waiting.

Server logs. The servers keep ordinary request logs: which page was asked for, and when. Render, which runs the app, keeps them for 7 days.

Two cookies, both necessary. One keeps you signed in for up to 14 days; the other protects your forms against being submitted by another website. No advertising cookies, no analytics, no tracking.

What we never do

We do not sell, share or rent your information, show you advertising, or use analytics or tracking services. Nobody but you can see your shooting data in the app. Every other user's view is limited to their own data, and that limit is checked on every request.

The site's admins can see, in an admin area, each account's username, email address, whether it is an admin account, whether it is active, whether its email address is confirmed, when it was created and last signed in, and how many range sessions and targets it holds. They do not see your records, photos or notes there. An admin can also deactivate an account, which signs it out everywhere and stops it signing in until it is reactivated, without changing or deleting anything in it; and can have a password reset link or a new email confirmation link sent to the account's own email address, which the admin never sees. When the account's owner asks, an admin can delete the account and everything in it (see "Deleting your account" below). Every action an admin takes there is written to an admin log, which names accounts by number only and is kept for two years. The person who runs Pistol Accuracy can also see the database directly, as anyone running a service like this can.

Who else handles it

• Render runs the app and its database, in its Oregon, USA region. Its network runs through Cloudflare, so Cloudflare also carries every request between your browser and the app.
• Cloudflare also stores your target photos, in its Western North America storage location, and provides the site's domain name.
• Backblaze keeps the backups (below), in its US West region, whose data centers are in Sacramento, California and Phoenix, Arizona.
• Postmark sends the app's emails: today, links to confirm your email address or reset your password, invitations to join, and a notice whenever your password changes. To send one it receives your email address, your username and the message itself. Open and click tracking are switched off, so it does not record whether you read the email. Postmark keeps a copy of each email for 45 days. If an email to you ever bounces or is marked as spam, Postmark keeps your address on a do-not-send list with no time limit. Its servers are in a data center near Chicago and in Amazon Web Services; it has none in the European Union, and it does not say which Amazon locations it uses.
• Google Workspace holds the contact@pistolaccuracy.com mailbox. If you write to us, including with the Send feedback link in the app, or reply to one of the app's emails, your message and your email address are kept there. Google does not promise a country for it: its terms allow it to keep and process this mail in any country where it or its suppliers have facilities.

Two other services watch the app and receive nothing about you: UptimeRobot checks every few minutes that the site answers, and Healthchecks.io is told whether each night's backup worked, and the admin area reads those results back. Neither sees any account or any of your data. The admin area also reads Postmark's counts of emails sent, bounced and marked as spam over the last seven days, which contain no addresses.

Backups. Every night the database is copied to Backblaze. That copy is encrypted with a key we keep offline, so Backblaze cannot read it. Every day your photos are also copied to Backblaze, where they are encrypted at rest by Backblaze. The backups can only be added to: nothing that runs day to day can delete them early.

No copy of your data is kept on anyone's personal computer.

How long we keep it

While your account exists, we keep your data so the app can work.

If you delete a target, it is removed from the app immediately, with its photo, its shots and any timings, and removed from the backups within 70 days. Backups are kept for 70 days so that a mistake can be undone. After that, it is gone. The same is true of anything the clean-up above deletes: it is gone from the app at once and from the backups within 70 days.

The app also tidies up after itself. Expired sign-ins, old failed-login records, password-reset requests, and used reset and confirmation links are deleted on the periods above, when the app starts and then at most once an hour while someone is using it. If nobody uses the app for a while, nothing new is stored either, but an old record can wait until the next visit to be deleted.

Restoring from a backup. If we ever have to restore the app from a backup, anything deleted after that backup was taken would come back with it. Re-applying those deletions automatically is coming soon; until then, if a restore ever happens, we will tell you, so you can delete anything that came back. A deleted account is the exception: we keep a record of each account deletion (below), so if a restore brings a deleted account back, we delete it again.

Deleting your account. There is no delete-account button yet. Write to contact@pistolaccuracy.com and an admin will delete your account and everything in it, photos included, and confirm when it is done. Before deleting it, the admin makes sure a fresh backup has been taken, so a mistake can be put right. Your account leaves the backups within the same 70 days.

The deletion record. When an account is deleted, we keep a short record: the date, the account's number, and how many records and photos were removed. It holds no username or email address, and on its own it doesn't identify you, though the account number in it can be matched to your account in backups made before the deletion, until they expire. It is kept indefinitely, with Cloudflare where the photos are stored and in our own records, so that a deleted account can be deleted again if we ever restore from a backup.

Your choices

• See your data: it is all in the app. Downloading all of it: coming soon. Today the only download is the PDF report of a single range session.
• Correct it: you can edit the details of what you entered, in the app. Marked shot positions cannot be moved once saved: delete the target and mark it again.
• Delete it: you can delete targets yourself, and then any session, firearm or ammunition no target uses any more. Some things, such as drills, can be archived but not yet deleted. For your whole account, see "Deleting your account" above.
• Change your password: on your Account page, reached from "Account" at the top of every page. Changing it signs out every other device. If you have forgotten it, use "Forgot password?" on the sign-in page.

Questions

Use Send feedback in the app, or write to contact@pistolaccuracy.com.