1. Who we are (Data Controller)
TrophyLog A/S ("TrophyLog", "we", "us") is the data controller for the personal data processed through the TrophyLog mobile app and related services.
- Company: TrophyLog A/S
- CVR (business reg. no.): 31282241
- Address: Sortebjergvej 6, 3200 Helsinge, Denmark
- Contact / privacy enquiries: contact@trophylog.com
- Data Protection Officer: Martin Hobert — contact@trophylog.com
2. Scope
This policy explains what personal data we collect through the TrophyLog app, why we process it, the legal bases under the EU General Data Protection Regulation (GDPR), who we share it with, how long we keep it, and your rights.
3. What data we collect and why
| Data | Examples | Purpose | Legal basis (GDPR Art. 6) |
|---|---|---|---|
| Account data | Email address, name, user ID, authentication identifiers (incl. Sign in with Google/Apple) | Create and secure your account, sign you in | Contract (6(1)(b)) |
| Hunting content | Hunts, trophies, species, notes, photos and media you add | Provide the core logging features and sync them across your devices | Contract (6(1)(b)) |
| Location data | Precise GPS location, map regions, areas and markers you create | Center the map, place markers, and store the locations you record | Contract (6(1)(b)); device location access only with your consent (6(1)(a)) |
| Photos & media | Images/videos you attach to records | Let you document hunts and trophies | Contract (6(1)(b)); photo library access with your consent |
| Contacts | Contacts you choose to import | Let you add hunting companions and contacts | Consent (6(1)(a)) — only contacts you actively import |
| Subscription & payment data | Subscription status, plan, Stripe customer/subscription identifiers, billing history | Manage your subscription and usage limits | Contract (6(1)(b)); legal obligation for accounting (6(1)(c)) |
| Diagnostics | Crash logs and technical error data (via Firebase Crashlytics) | Keep the app stable and fix bugs | Legitimate interests (6(1)(f)) — maintaining a reliable service |
| Push notifications | Device push token (via Firebase Cloud Messaging) | Send notifications you've enabled | Consent (6(1)(a)) |
We do not use your data for advertising, and we do not track you across other companies' apps or websites.
4. Payment processing (Stripe)
Subscriptions are processed by Stripe, not through Apple or Google. When you subscribe, your card and billing details are collected and processed directly by Stripe as an independent controller/processor under Stripe's privacy policy. We do not receive or store your full card number. We store your subscription status and Stripe identifiers to manage your access and usage limits.
5. Who we share data with
We share personal data only with service providers ("processors") that help us run TrophyLog, under data processing agreements:
- Railway — application hosting and database
- Google Firebase (Crashlytics, Cloud Messaging) — crash diagnostics and push notifications
- Mapbox — map rendering (receives location/map requests)
- Stripe — payment processing
- Google / Apple — only if you use Sign in with Google/Apple, for authentication
We do not sell your personal data.
6. International transfers
Some of our processors (e.g. Google, Stripe, Mapbox) may process data outside the EU/EEA, including in the United States. Where this happens, transfers are protected by appropriate safeguards such as the EU Standard Contractual Clauses and/or the EU–US Data Privacy Framework. Contact us for details or a copy of the safeguards.
7. How long we keep data
- Account and hunting content: for as long as your account is active, and deleted within 30 days after you delete your account.
- Subscription/billing records: kept for 5 years where required by Danish accounting law (Bogføringsloven).
- Crash diagnostics: retained per Firebase defaults (up to 90 days).
8. Your rights under GDPR
You have the right to access, rectify, erase, restrict, or object to processing, to data portability, and to withdraw consent at any time (without affecting prior processing). To exercise any right, contact contact@trophylog.com. You can delete your account and associated data directly in the app under Settings → Delete account, or by emailing us.
You also have the right to lodge a complaint with the Danish Data Protection Agency (Datatilsynet, datatilsynet.dk).
9. Children
TrophyLog is not directed at children under 16. We do not knowingly collect data from children under that age.
10. Changes
We may update this policy. Material changes will be notified in the app or by email. The "Last updated" date reflects the latest version.
11. Contact
TrophyLog A/S, Sortebjergvej 6, 3200 Helsinge, Denmark — contact@trophylog.com