Privacy policy

Last updated: 20 October 2026

Scorun is a system for shooting sport matches made up of three apps that share one database:

• Scorun Shooter - for competitors: account, licence, match registration, results.
• Scorun Range - for match officials: scoring at the stage, including with no signal.
• Scorun Desk (desk.scorun.com) - for organisers: matches, registrations, stages, officials, results.

This policy covers all three apps and the websites scorun.com, app.scorun.com and desk.scorun.com.

Data controller

The controller of personal data is:

BEARSTONE sp. z o.o.
ul. Czarnuszki 6, 05-071 Grabina, Poland
NIP 8222419152 · REGON 542825092 · KRS 0001196088
District Court Lublin-Wschód in Lublin, seated in Świdnik, 6th Commercial Division of the National Court Register
Share capital PLN 5,000
contact: support@scorun.com

What data we process

Every Scorun account

• Email address, first name and surname. You sign in with a code sent by email or with an Apple or Google account - in that case Apple or Google only give us your email address and, if you allow it, your name.
• Technical data: a notification token (if you turn notifications on) and server logs.

Scorun Shooter (competitor)

• Profile: sex, club and voivodeship (region).
• Phone number, if you provide one. We collect it so the organiser of a match you enter can contact you about that match. Only that match's organiser can see it (the club's owner, administrator or match staff). We do not show it in results, the calendar or public lists.
• PZSS licence: number, class, expiry date and verification result. The contents of the licence QR code are stored only in encrypted form and used only to check the licence's validity in the PZSS system - when you add the licence and before matches you register for.
• The sports club you belong to (name, PZSS club number, date of joining) - included in registrations and results bulletins.
• Match registrations: chosen events and classes, payment status, squad and competitor number.
• MojaStrzelnica range card number - only if you tick “Include MojaStrzelnica card number…” when registering. Only the card number is sent to the server (no QR parameters). The match organiser can see it to speed up check-in at the range. The app never opens the card link.
• Training sign-ups: the course you chose, sign-up status (awaiting payment, confirmed, waiting list, withdrawn), payment deadline and status, and a short sign-up code for the transfer reference. Courses do not count towards licence starts and do not appear in competitor statistics.
• Results: times, hits, penalties and placings from matches you shoot.
• Basis for taking part (e.g. PZSS licence, firearms permit, service) and your declaration, if the organiser requires it - without document numbers.
• A hash of the firearm's serial number - only in events whose rules forbid entering the same firearm twice (e.g. long range, PRS). The serial number stays on your phone; only a one-way cryptographic hash, computed with a key assigned to that match, reaches the server. It is used only to detect automatically a repeat entry with the same firearm and is not visible to anyone, including the organiser.
• Firearm data for the match committee - only when you enter a class whose rules require the firearm to be verified (e.g. historic rifle in long range) and the organiser has turned this verification on: manufacturer, model, serial number and year of manufacture. Before you enter, Scorun Shooter shows which data will be shared and with which organiser; we send it only after you confirm. Without it you cannot enter that class - other classes work without it.
• All other firearm and document data (Garage, firearm and part serial numbers, photos of firearms and documents, the firearms permit in the in-app document wallet) stays on your phone and never reaches the server.
• Anonymous calendar statistics (optional, on by default in Settings → Privacy): we count tile impressions, detail opens, sign-up clicks and filter choices. We do not store your IP or account id - only a random session id kept in app memory until you close the app. Raw events are deleted after 90 days; we keep aggregated counts longer.

Scorun Range (official)

• Score sheets entered by an official: a competitor's time, hits and penalties at a stage, the competitor's confirmation or refusal, and who entered the result and when.
• Device: device name and operating system, which match it's working on, in which mode (stage, squad) and when it last connected. A device can run on an official's account or be paired with a match using a one-time code from the organiser - in that case no account is needed.
• Official's PIN (if the organiser turns it on) - we store only its cryptographic hash, never the PIN itself. The hash is sent to the devices of officials at that match so the PIN can be checked without a signal.
• The match package is stored on the official's device: stages, squads, and competitors' first name, surname, number and class. The local database is encrypted with a key kept in the system's secure storage (Keychain / Keystore).
• Without a signal, the match package and results can be passed between the devices of that match's officials via Bluetooth, a local network or a QR code - directly between devices, without our server. The camera is used only to scan QR codes; we don't save photos.

Scorun Desk (organiser)

• Club members in Desk and their roles (owner, administrator, staff). Signing in to Desk requires a second factor (a code from an authenticator app); the key for that factor is held by the sign-in service, not by Desk.
• Club profile: name, logo, address, club contact email and phone, PZSS club number, bank transfer details, ranges.
• Course provider profile (self-employed person, company or association): the name shown to participants, tax ID (NIP, if provided), contact email, bank transfer details and online payment (PayU) settings.
• The club’s PayU account: the company and account identifiers in PayU and the account status. The company and representative details entered in the account-opening form (including the PESEL national ID number) go straight to PayU - Scorun does not store them. The PayU access keys are encrypted and cannot be read back from Desk.
• Course data: type, date, venue, price, number of places, description, prerequisites and the list of participants.
• Match data: settings, events, stages, squads, officials, payment confirmations, Range Master decisions and uploaded documents (e.g. match rules).
• Change log: who changed what in a match, and when - so that disputes about payments, results and decisions can be resolved.
• Match printouts and Excel files are generated by the organiser in their own browser. They contain no firearm data and no competitors' email addresses. The organiser's registration list may include the phone number. Public results do not. A course's participant list (including the CSV file) contains each participant's first name, surname, email address and payment status - it is how the provider contacts participants.

Officials visible to organisers

• If you add an official's licence in Scorun Shooter (number, class, disciplines, expiry) and turn on "I want to officiate - visible to organisers", organisers will see you on their list of officials and can invite you to officiate. Without this consent we don't show you to anyone. You can turn it off at any time.
• An organiser can mark an official as "favourite" or "don't invite". Only that club can see the mark; it has no comments.

Who can see your data

• The organiser of a match you register for: your registration, the profile data needed for the match, licence status, payments, results and - if you provided it - your phone number, so they can contact you about that match. If you enter a class that requires firearm verification - also the firearm data for the committee, only for that registration.
• The provider of a course you sign up for: your first name, surname, email address, sign-up status and payment status. The provider can send participants a message through Scorun.
• That match's officials on their devices: first name, surname, competitor number, class and results.
• Everyone: once results are published (or during the match, if the organiser turns on live results) - first name and surname, club, class and results, including in the results bulletin. Courses have no public participant list - the calendar only shows the number of places left.
• PZSS (Polish Shooting Sport Federation): when licence validity is checked in the PZSS system.
• PayU: when you pay online to a club or provider that uses PayU - see “Online payments”. When a club opens a PayU account through Scorun, the company and representative details entered by the club go to PayU.

Purposes and legal bases

• running your account and sign-in, handling registrations, matches, scoring and results - performance of a contract, i.e. the Scorun terms (Art. 6(1)(b) GDPR),
• PZSS licence verification and admission to matches - performance of a contract and the organiser's legitimate interest in admitting only eligible competitors (Art. 6(1)(b) and (f) GDPR),
• course sign-ups, the participant list for the provider and handling course payments - performance of a contract (Art. 6(1)(b) GDPR),
• online payments via PayU - performance of a contract (Art. 6(1)(b) GDPR),
• opening a PayU account for a club at its request - passing the details entered by the club to PayU - performance of the contract with the club (Art. 6(1)(b) GDPR),
• publishing results and bulletins - legitimate interest in the openness of sports results (Art. 6(1)(f) GDPR),
• change log, logs and system security - legitimate interest (Art. 6(1)(f) GDPR),
• anonymous calendar statistics - improving the calendar and the range of events - legitimate interest (Art. 6(1)(f) GDPR); you can turn them off in Settings,
• officials' visibility to organisers and push notifications - your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time,
• voivodeships from your profile - also match alerts for your region (Art. 6(1)(a) GDPR when notifications are on),
• club membership, licence declarations and proof photos of starts - visible only to you and your club board - performance of the club contract (Art. 6(1)(b) GDPR),
• emails about registrations, course sign-ups, payments and results - performance of a contract (Art. 6(1)(b) GDPR),
• the phone number in your profile - so the organiser can contact you about a match you enter - performance of a contract (Art. 6(1)(b) GDPR),
• basis for taking part and your declaration - admission to the match in line with the event's rules - performance of a contract (Art. 6(1)(b) GDPR),
• the firearm serial-number hash and firearm data for the committee - checking that your entry complies with the rules of the event you entered (repeat entry with the same firearm, class verification) - performance of a contract (Art. 6(1)(b) GDPR); firearm data is shared with the organiser only after you confirm in the app,
• replying to messages sent to support@scorun.com - legitimate interest (Art. 6(1)(f) GDPR).

Results from public sources

Controller: BEARSTONE sp. z o.o. The data comes from bulletins and results that match organisers and federations publish on public websites (e.g. NTS bulletins, PractiScore results). We take first name, surname, club, result and place. The licence number is used only to match a person and we never display it. Purpose: a competitor's start history, the licence summary, statistics, and the match result tables in the app and on scorun.com. People who are not on Scorun are shown by initials only (e.g. “Ko... Ja...”). Scorun competitors are shown by first name and surname, unless they switch this off in Settings → Privacy. People under 18 and youth categories are shown neither by surname nor by initials. Switching your name off takes effect at once in the app and on scorun.com within 6 hours at the latest. Legal basis: Art. 6(1)(f) GDPR (legitimate interest). Retention: we set no limit in years, because the results archive is the source of start history; we keep the data until you object. Objection and erasure requests: form at scorun.com/usun-wyniki, also without a licence number. After an objection, the name and club disappear from all views (we show “Data hidden”), and the database keeps them only encrypted with a key the service does not have, so they cannot be read in normal operation. This also applies to future downloads.

Processors

• Supabase - hosting, database, files and sign-in, in the European Union,
• dhosting - mail and email delivery,
• Cloudflare - the websites scorun.com, app.scorun.com and desk.scorun.com,
• Apple and Google - sign-in with an Apple or Google account and push notifications, if you use them,
• Google Firebase Cloud Messaging - only to deliver push notifications; club push wording is generic (e.g. “new announcement”), details stay in the app.
• Sentry (Functional Software, Inc.) - crash reports from the Shooter and Range apps, data stored in the European Union (Germany).

App crash reports

When Scorun Shooter or Scorun Range crashes, the app sends a technical report to Sentry (Functional Software, Inc.; data stored in the European Union, in Germany): device model, system and app version, the error trace and the latest technical events in the app. The report does not contain your name, e-mail address, licence numbers or firearm data. Purpose: finding and fixing bugs. Legal basis: Art. 6(1)(f) GDPR (legitimate interest - a working app).

Online payments

You can pay for a match or a course online through PayU (when the organiser or provider uses it) or by ordinary bank transfer. The money goes directly to the match organiser's or course provider's account, not to Scorun. Refunds are settled with the organiser or provider. A match fee paid through PayU can be refunded by the organiser in Desk: on their instruction our server asks PayU to return the full amount the same way you paid.

When the organiser or provider uses PayU, we pass PayU the amount, the payment reference (registration code and event name) and your email address. The details needed for the payment itself (e.g. bank, card, BLIK) you give directly to PayU - Scorun never sees them. PayU is PayU S.A., Poznań, Poland (ul. Grunwaldzka 186, 60-166 Poznań, KRS 0000274399, NIP 7792308495), which processes this data as a separate controller under its own privacy policy. When a club opens a PayU account through Scorun, the company and representative details (including the PESEL national ID number) entered by the club pass through our server straight to PayU in order to open the account; Scorun does not store them.

How long we keep data

• Account and profile data, including the encrypted licence QR code: until the account is deleted.
• Registrations, score sheets and match results: indefinitely. After the account is deleted, without the name, surname or other account data.
• Firearm data for the committee: deleted automatically 30 days after the match results are approved (it disappears from backups 7 days later).
• Firearm serial-number hash: for as long as the registration it relates to.
• Desk change log: for as long as the data of the match it relates to.
• Match data on an official's device (Scorun Range): deleted automatically 7 days after the match closes, once the server has confirmed receipt of every result from that device.
• One-time device pairing codes: valid for 30 minutes.
• Course sign-ups and payment confirmations: like match registrations - indefinitely; after the account is deleted, without the name, surname or other account data.
• Anonymous calendar statistics: raw events for 90 days; aggregated counts indefinitely - they cannot be used to identify you.
• Database backups: 7 days.
• Server logs: 7 days.

Your rights

You have the right to access your data, rectify it, erase it, restrict its processing, port it and object to its processing, and - where processing is based on consent - to withdraw that consent at any time. You can also lodge a complaint with the President of the Personal Data Protection Office (PUODO) in Poland. You can delete your account in the app or by following the instructions on the Delete account page.

Cookies and browser storage

The websites scorun.com and app.scorun.com don't set cookies and don't use analytics tools. Scorun Desk stores only your sign-in session in the browser's storage - without it you can't sign in. Scorun apps contain no ads and no third-party analytics tools. The only statistics are the anonymous calendar statistics in Scorun Shooter described above: Scorun counts them itself, without any identifier stored on your phone, and you can turn them off in Settings → Privacy.

Contact

For anything about personal data, write to support@scorun.com.