Privacy

Updated 29 October 2026

Who is responsible

DEM8 is run by Denys Feshchenko, a private individual in the Netherlands, who is the controller of your data. Questions and requests: privacy@dem8.eu.

What is stored, and why

• Your account: email address and a salted, slow hash of your password (never the password itself). To sign you in. If you add them: your passkeys’ public keys, which password manager holds them and when they were added and last used (the private key never leaves your device), and a slow hash of your recovery code (never the code itself).
• Your training: sessions, target sheets, the holes you mark, scores, distances, pistol, caliber, notes, coach settings (your shooting hand and goals), the drills you mark as done, dry-fire sessions you log, your weekly plan, and the conditions you note for a session (indoors or outdoors, the light, how you felt). This is the service itself.
• Your shooter card, if you fill it in: name, club, shooting hand, dominant eye, the year you started, a profile photo, and your pistols (name, caliber, photo).
• Your club, if you join one: its members see the name you choose for the board, the class you give a pistol, and the scores of your Service Pistol series by day — never photos or holes. The club’s screen link shows the same to anyone who has it, until the club’s owner replaces it. Leaving the club takes your results off its board.
• A session you share with a coach: anyone with its link sees that session’s report — date, pistol, scores, the plotted holes and your notes, with your shooter card’s name — until you stop the link or delete the session. No photos.
• A shop order: your name, email address, phone number if you give it, the delivery address (unless you pick the order up), what you ordered, the price and your message. To make, deliver and invoice the order, and for the accounts. Kept for 7 years, as Dutch tax law requires of business records.
• The shop’s waiting list, if you join it: your email address, the format and colours you want, your country and message if you give them, whether you ticked the box for an email, and the page’s language. With the tick, for one email when the product goes on sale; the legal basis is your consent (art. 6(1)(a)), which you can withdraw by writing to shop@dem8.eu. Without it, your entry only counts towards which formats and countries are wanted. Nothing removes entries automatically yet: an entry stays until you ask for it to be removed.
• Your photos: target sheets and, if you add them, pistol and ammunition photos. Location and camera details are removed from photos on your device before upload. Photos are private: only your account can open them.
• Detector learning: measurements of the spots on your sheets and whether you kept them as holes. Used only to improve hole detection for your own account.
• Feedback and errors: what you write with the feedback button (with a picture of the screen you were on, or a screenshot you add, unless you untick it), and technical error reports (the error message, the screen, your browser and app version), linked to your account when you are signed in. To fix problems. Kept for up to 180 days.
• How you use the app: when you open it and which sections (Analysis, History, Coach, Account), when you start, save or leave a scan, when you sign in, and how many minutes a day the app is open and in use. Linked to your account, measured by DEM8 itself — no outside analytics service. To see whether the app helps and what to improve. Kept for 180 days; daily totals of minutes and visits are kept with your account.
• Security: to slow down password guessing, failed sign-ins and sign-ups are counted per hashed IP address and hashed email address, and removed automatically after a short time.

The legal basis is providing the service you signed up for (GDPR art. 6(1)(b)); for security measures, error reports and usage measurement it is the legitimate interest in a safe, working service that gets better (art. 6(1)(f)); for a shop order it is the purchase itself (art. 6(1)(b)) and the legal duty to keep records (art. 6(1)(c)). You can object to usage measurement by writing to privacy@dem8.eu.

The owner can see account details and this usage in an admin console, to run the service and help you. When you ask for help, or something needs checking, the owner can also open your sessions, sheets and their photos, read-only, and export your data for you; every look is recorded in a log.

What is not done

No advertising, no outside tracking or analytics services, no selling or sharing of your data.

The Instagram and TikTok icons are plain links: the site loads none of their scripts, pixels or embeds. What happens once you are on their sites is up to their own privacy policies.

Cookies and storage on your device

DEM8 keeps only what it needs to work, or what you chose, in your browser. None of it tracks you, and nothing is shared with anyone else, so no consent is asked for it (the Dutch Telecommunications Act, art. 11.7a, and the EU ePrivacy rules exempt storage that is strictly necessary for a service you asked for). You can clear it in your browser’s settings at any time; you are then signed out.

• dem8_session (cookie, 30 days): keeps you signed in.
• dem8_lang and dem8_theme (cookies, one year): the language and the look (day, night or your system’s) you chose.
• dem8_welcome and dem8_secure (cookies, one year): that you closed the welcome card, or the card about keeping a way back in.
• Local storage: a club code from an invitation link, until you are signed in to use it; and, in this tab only, that the opening animation was shown.
• Offline storage: sheets saved with no signal, until they are uploaded; and the app’s own files with your last-seen data, so it opens on the range without a connection.

The app’s own usage counts (see above) are sent to DEM8 with your sign-in, not kept in cookies.

Who else processes it

• Cloudflare hosts the app, its database and photo storage.
• Telegram delivers notifications to the owner: a new account’s email address, a first saved sheet, feedback with the sender’s email, error messages, password reset requests when the email could not be sent (the email address and the one-time link, which the owner then emails to you), and who wrote to privacy@dem8.eu (sender and subject), a paid shop order (what was ordered, the total, and the buyer’s name, email address and town), and a new entry on the shop’s waiting list (the email address, format, colours, country, language, whether the box for an email was ticked, and the message). An account deletion is reported without the email address.
• Resend sends the account email: the link that confirms your address when you sign up, password reset links, and, once your address is confirmed, a summary of your training week on Sunday evenings (turn it off in Account or from any of them), and the receipt for a shop order. It receives your email address and the message.
• Your phone’s push service (Apple, Google or Mozilla, depending on the browser) delivers reminders if you turn them on in Account. It receives only an address for your phone and a signal to wake it; the words are fetched from DEM8 by the phone itself.
• Mollie (Amsterdam) takes the payment for a shop order: it receives the order number and the amount, and what you enter on its payment page (your bank or card details), under its own privacy statement.
• Printables and Cults3D sell the print files. Their privacy notices apply to that purchase; we receive only what they share for sales reports and VAT (order date, amount, country).
• PostNL delivers a shop order you have sent to you: it receives your name and delivery address.
• GitHub keeps encrypted nightly backups of the database for 30 days.
• Google (Gmail) holds the owner’s mailbox, where mail to privacy@dem8.eu is forwarded.

These providers may process data outside the European Economic Area under the safeguards the GDPR requires (such as the EU–US Data Privacy Framework or standard contractual clauses). The optional AI coach is switched off; if it is ever switched on, this notice will say so first.

How long

Your data is kept until you delete it or your account. Deleting a session or photo removes it at once. Deleting your account removes everything listed above at once. Backups of the database and copies of photos may keep it for up to 30 days before they are removed. Shop orders aren’t part of an account: they are kept for 7 years after the order, then deleted.

Your rights

You can see, correct and delete your data in the app. In Account you can download all of it (Download my data) and delete your account (Delete account). You may also ask for access, correction, deletion, restriction or portability, or object to processing, by writing to privacy@dem8.eu. You can complain to the Dutch data protection authority, the Autoriteit Persoonsgegevens.

Children

DEM8 is not meant for people under 16 (see the terms of use).