Privacy Policy

Last updated: September 7, 2026

This policy describes which personal data is processed when you use bowlinq. It is organised by processing activity rather than by legal provision: each one says what data is involved, what for, on what legal basis, and how long it stays.

Controller

Jens Heise, Germany
Email: info@bowlinq.de
Contact form: bowlinq.de/contact

No data protection officer has been appointed; the statutory conditions for appointing one are not met.

What bowlinq is, in data protection terms

bowlinq is an application for running the season of a bowling league. There is no advertising, no tracking, no audience measurement, no analysis of usage behaviour, no profiling and no automated decision-making within the meaning of Art. 22 GDPR. Data is not sold and not used for third-party advertising.

Two roles have to be distinguished. The controller named above is responsible for the account, the application and its operation. Whoever runs a league in bowlinq, by contrast, decides about their members' data themselves — which people are admitted, under which name they are kept, and which results are entered. The league management is responsible for those decisions as far as they go beyond purely private use; bowlinq provides the tool for it.

Legal bases

Art. 6(1)(b) GDPR — contract. Everything needed to run the account and provide the application: registration, sign-in, league operation, results, transactional emails.
Art. 6(1)(f) GDPR — legitimate interest. Security and abuse prevention: session data, server logs, rate limiting on the contact form.
Art. 6(1)(a) GDPR — consent. Only where something is optional: an uploaded profile picture, a stated DBV membership number. Consent can be withdrawn at any time with effect for the future, by deleting the entry.
Art. 6(1)(c) GDPR — legal obligation. Where the law requires retention or disclosure.

Account and profile

When you register you provide a first name, a last name and an email address, and set a password. The password is never stored in clear text, only as a hash. Optionally, a profile picture and the five-digit membership number of the German Bowling Federation (DBV) can be added.

The account also holds the time it was created and last changed, whether the email address has been confirmed, and the chosen language. The language is taken from the request when the account is created and set through the account settings afterwards; it decides which language emails arrive in.

Purpose: running the account and providing the application.
Legal basis: Art. 6(1)(b) GDPR; for the profile picture and the membership number, Art. 6(1)(a) GDPR.
Retention: until the account is deleted.

Signing in creates a session. Stored with it are a random session token, its expiry, the IP address and the browser identification (user agent). The token sits in the browser as a cookie.

The IP address and browser identification are what make the list of signed-in devices in the account settings readable at all: without them a foreign session could neither be recognised nor ended deliberately. Individual sessions or all other ones can be signed out there at any time; setting a new password ends every other session automatically.

Purpose: sign-in, session management, recognising unauthorised access.
Legal basis: Art. 6(1)(b) and (f) GDPR.
Retention: until the session expires or is signed out.

Signing in with Google

If you choose to sign in with Google, you are redirected to Google and sign in there. bowlinq then receives from Google the Google account identifier, first and last name, the email address and the address of the profile picture. No password is created in the process; one can be set later in the account settings.

In addition, the tokens issued by Google are stored, which keep the link between the bowlinq account and the Google account alive.

Opening Google's sign-in page already transmits data to Google. What Google bases that processing on and what happens there is set out in Google's privacy policy. Signing in with Google is optional; registering with an email address and a password stands alongside it as an equal option.

Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.
Purpose: signing in without a password of your own.
Legal basis: Art. 6(1)(b) GDPR (performing the user relationship at your express request).
Retention: until the link is severed or the account is deleted.

Leagues, teams and results

This is what the application is actually for. Within a league, the following are processed:

Members: first and last name, the DBV membership number where given, team membership, the role in the league (member, league management, captain) and, where present, the link to an account.
Results: for each game the score, the handicap it counts with, and whether it is a ghost score. Averages, handicaps and standings are calculated from these.
Season operation: line-ups, match days, dates, lanes, postponed fixtures, and the confirmation of a result by the teams involved, each with the time and the confirming person.
Event log: every change to a league is recorded as an event, so that pages other members have open update immediately and it stays traceable what changed.

A league keeps its own copy of the name and membership number. Whoever joins through an invitation brings those details from their account; if the profile changes later, the league follows only where its copy is still unchanged. Conversely the league management can correct a name inside their league without the account changing.

Whoever is in a league is visible to the other members of that league: name, picture, team, results, average and handicap. Email addresses are not shown to other members.

Purpose: running the season of a league.
Legal basis: Art. 6(1)(b) GDPR towards the account holder; the league management relies on its own basis for admitting a member.
Retention: as long as the league exists. Results are part of the season and stay with the league even when an account is deleted — see "Deletion".

Invitations

The league management creates invitation links. Stored with an invitation are: who created it, which league and, where applicable, which team and which already-recorded member it belongs to, how often it can still be redeemed, and when it expires.

A link that names a particular member is an identity: whoever redeems it becomes exactly that person in the league. Such links can therefore be redeemed only once. Anyone receiving an invitation link sees which league it is for before joining.

Purpose: admitting new members to a league.
Legal basis: Art. 6(1)(b) and (f) GDPR.
Retention: until the invitation expires, is used up or is revoked, at the latest until the league is deleted.

Pictures

Profile, team and league pictures are not kept on the application server but in an object store. They are retrievable under their address without signing in — the address is random and cannot be guessed, but whoever knows it can see the picture. For an account that signed in with Google, the profile picture is not copied; what is displayed is Google's picture address, which the browser retrieves directly from there.

Purpose: displaying pictures in the application.
Legal basis: Art. 6(1)(a) GDPR.
Retention: until the picture is replaced or deleted.

A team's schedule can be subscribed to as a calendar. The file created for that contains the dates, lanes and the names of the teams involved — no player names and no results. It sits in the same object store as the pictures and is retrievable without signing in, so that a calendar application can load it without credentials.

The address contains the identifiers of the league and the team and cannot be guessed, but neither is it protected: whoever passes it on passes the schedule on.

Purpose: subscribing to the schedule in a calendar application.
Legal basis: Art. 6(1)(b) GDPR.
Retention: as long as the schedule exists; the file is deleted with the league.

Emails

bowlinq only sends messages that belong to operating the service: confirming the email address, resetting the password, confirming a changed email address, confirming an account deletion, and notifying that a league has been handed over. There is no newsletter and no marketing email.

The emails contain no tracking pixels; whether an email was opened is not recorded. The sending provider does, however, log technically whether a message could be delivered.

Purpose: performing the user relationship and account security.
Legal basis: Art. 6(1)(b) GDPR.
Retention: the confirmation links expire after a short time and are deleted afterwards.

Contact form

The contact form transmits a first name, last name, email address, subject and message, and delivers them to the provider as an email. The address given serves as the reply address.

So that the form does not become a sending tool, a limit of three messages per ten minutes and sender applies. For this, the IP address of the request is counted briefly in the server's memory — it is not stored in the database and falls away when the time window ends. A field invisible to humans catches automated submissions.

Purpose: answering the enquiry; abuse prevention.
Legal basis: Art. 6(1)(b) GDPR for an enquiry about the user relationship, otherwise Art. 6(1)(f) GDPR; the rate limit relies on Art. 6(1)(f) GDPR.
Retention: until the enquiry has been dealt with conclusively, at the latest within statutory retention periods.

Cookies and local storage

bowlinq sets strictly necessary cookies only. There are no cookies for advertising, analysis or audience measurement — and therefore no consent banner either, because there is nothing to consent to.

In detail:

Session cookie. Keeps you signed in. Without it the application does not work.
NEXT_LOCALE. Remembers the chosen language.
Theme. Remembers whether the interface is shown light or dark. This value sits in the browser's local storage and never leaves the device.
Legal basis: § 25(2) no. 2 TDDDG (strictly necessary), and for the subsequent processing Art. 6(1)(b) and (f) GDPR.

Fonts and external content

The fonts used are served from our own server. No fonts, scripts or styles are loaded from third-party servers, and no maps, videos or social media elements are embedded. The one exception is the profile picture of an account that signed in with Google: it stays with Google and is retrieved from there.

Server logs

Opening the application produces the usual log data at the hosting provider: IP address, time, requested address, amount of data transferred, status code and browser identification. The application itself additionally writes technical messages about errors and processes; these contain no passwords and no message content.

Purpose: operation, troubleshooting and security.
Legal basis: Art. 6(1)(f) GDPR.
Retention: logs are kept only briefly and overwritten regularly.

Recipients and processors

Data stays with the controller and with the following service providers, which process it solely on instruction under a data processing agreement pursuant to Art. 28 GDPR. It is not passed on for any other purpose.

Fly.io — hosting of the application. Provider: Fly.io, Inc., 2261 Market Street, San Francisco, CA 94114, USA. The application runs in the Frankfurt am Main region.
Neon — the PostgreSQL database holding all data described above. Provider: Neon Inc., USA. The database is in the eu-central-1 region (Frankfurt am Main).
Tigris — object store for pictures and calendar files, delivered via cdn.bowlinq.de. Provider: Tigris Data, Inc., USA. Storage is restricted to the European Union.
Resend — sending of emails. Provider: Resend, Inc., USA. Sending runs through the service's EU region.
Google — signing in with Google, see above. Provider: Google Ireland Limited, Ireland.

Transfers to third countries

The data is processed in the European Union: application, database, object store and email sending each sit in EU regions.

The companies behind Fly.io, Neon, Tigris and Resend are based in the United States. Access from the USA — for support or maintenance, say — can therefore not be ruled out entirely. For that case, the European Commission's standard contractual clauses under Art. 46(2)(c) GDPR have been agreed with these providers; where a provider is certified under the EU-US Data Privacy Framework, the Commission's adequacy decision of 10 July 2023 applies in addition.

Retention and deletion

The principle: data is deleted as soon as the purpose it was collected for no longer applies and no statutory retention obligation stands in the way.

Deleting the account. This is done in the account settings and confirmed by email. It deletes the account data, all sessions and a linked Google sign-in.
What the league keeps. Membership in a league stays, with the name and membership number that league keeps, and the link to the deleted account is severed. The reason is the other members' season: line-ups, confirmations and the results of entire match days hang off that membership.
Disappearing from the league. A member who has not yet bowled a game can be removed by the league management. Once results have been entered, the application no longer allows it; anyone who still wants to be deleted should contact the controller — the right to erasure under Art. 17 GDPR is unaffected by this and is carried out by hand.
Whoever owns a league has to delete or hand it over before deleting their account. Otherwise the account would take the whole league with it, including every result of every other member.
Deleting a league. This removes that league's teams, memberships, schedules, results, invitations, calendar files and event log.
Backups. Deleted data may be contained in database backups for a short time and disappears when those expire.

Your rights

You have the following rights towards the controller. An informal message to the address above is enough to exercise them.

Access (Art. 15 GDPR) to which data is processed.
Rectification (Art. 16 GDPR) of inaccurate data. Many details can be corrected in the account settings directly.
Erasure (Art. 17 GDPR), as far as no retention obligation and no right of others stands in the way.
Restriction of processing (Art. 18 GDPR).
Data portability (Art. 20 GDPR): the data you provided, in a common, machine-readable format.
Objection (Art. 21 GDPR) to processing based on a legitimate interest. A right to object exists in particular against the processing based on Art. 6(1)(f) GDPR described in this policy.
Withdrawal of consent (Art. 7(3) GDPR) with effect for the future.
Complaint to a supervisory authority (Art. 77 GDPR), in particular in the member state of your residence, place of work or the alleged infringement.

Security

The connection to the application is encrypted with TLS throughout; requests over HTTP are redirected to HTTPS. Passwords are stored as a hash only. Access to league data is checked on the server on every request, not just in the interface. The object store accepts write access only with a signed authorisation.

Changes to this policy

This policy is adjusted when the processing described here changes — because a feature is added or a service provider changes, for instance. The date at the top of the page states the version. Users with an account are additionally notified of substantial changes.