Privacy Policy

_Last updated: 2026-09-14. Version 2.6_

This Privacy Policy explains how BAGGERS ("we", "us") processes personal data in compliance with the EU General Data Protection Regulation (GDPR, Regulation 2016/679), the UK GDPR and Data Protection Act 2018, the California Consumer Privacy Act (CCPA/CPRA), and other applicable laws.

1. Data Controller

**Controller:** Baggers is a service operated by CORNHOLE, obrt za usluge i trgovinu, vl. Marin Barišić, OIB 57812107056, Vilima Korajca 22, 10000 Zagreb, Croatia. "Baggers" is a trading name of that business.

**General contact:** support@baggers.app

**Privacy contact:** privacy@baggers.app

**EU establishment:** The controller is established in Croatia, an EU member state. No representative under Art. 27 GDPR is required.

We are the controller of the personal data described below. Our processors act on our documented instructions only.

2. Personal Data We Process

2.1 Provided by you

Account: email address, password hash (managed by Supabase Auth), nickname, avatar.

Profile: country, skill level, preferences, weekly goals.

Support communications: messages, screenshots, contact details.

Payment: handled directly by Stripe; we store a customer ID and subscription status only.

2.2 Generated by your use of the App

Training data: drill sessions, game sessions, scores, achievements.

Device & technical: device type, OS version, app version, language, crash diagnostics.

Usage analytics: feature events, session duration (only with your consent, see §5).

Security: authentication events, IP address at sign-in, audit logs of sensitive actions.

We do not knowingly process special-category data (Art. 9 GDPR).

3. Purposes and Legal Bases (Art. 6 GDPR)

| # | Purpose | Legal basis |

|---|---------|-------------|

| 1 | Creating and operating your account, delivering the core training features | Performance of a contract. Art. 6(1)(b) |

| 2 | Processing subscription payments | Performance of a contract. Art. 6(1)(b) |

| 3 | Sending transactional emails (password resets, billing, security alerts) | Performance of a contract / legal obligation. Art. 6(1)(b)/(c) |

| 4 | Product analytics and performance monitoring (anonymised / pseudonymised) | Consent. Art. 6(1)(a). Withdraw any time in Settings. |

| 5 | Marketing emails and newsletters (if offered) | Consent. Art. 6(1)(a) with double opt-in and one-click unsubscribe |

| 6 | Fraud prevention, abuse detection, security audit logs | Legitimate interests. Art. 6(1)(f). Balancing test on file. |

| 7 | Complying with legal obligations (tax, accounting, lawful requests) | Legal obligation. Art. 6(1)(c) |

| 8 | Defending or pursuing legal claims | Legitimate interests. Art. 6(1)(f) |

We do not carry out solely automated decision-making producing legal or similarly significant effects on you (Art. 22 GDPR). Skill-level estimation is statistical, non-binding, and you may correct or delete it at any time.

4. Recipients and Sub-Processors (Art. 28 GDPR)

We use a small number of processors. Each is bound by a Data Processing Agreement (DPA) and processes data only on our instructions.

The current list — who they are, what each is used for, where they are located, and the transfer mechanism relied on — is maintained at /privacy/sub-processors. That page is the authoritative list, so that adding or removing a processor does not require republishing this document; material changes are notified in-app.

We do not sell or "share" personal data for cross-context behavioural advertising (CCPA/CPRA §1798.140).

5. Cookies and Local Storage

We use a small number of strictly necessary cookies / localStorage entries to operate the App (authentication, session, security). Optional analytics and preference storage is only activated with your explicit consent via the cookie banner, which you may withdraw at any time in Settings → Privacy. A full inventory is available at /privacy/cookies.

6. International Data Transfers (Chapter V GDPR)

Where personal data is transferred outside the EEA or UK, we rely on:

adequacy decisions of the European Commission / UK government, where applicable;

the EU-US and UK-US Data Privacy Frameworks for certified US recipients; and/or

the European Commission's Standard Contractual Clauses (SCCs). Decision 2021/914, supplemented by additional technical and organisational measures (encryption in transit and at rest, access controls, audit logging).

You may request a copy of these safeguards by emailing privacy@baggers.app.

7. Data Retention

| Category | Retention |

|----------|-----------|

| Account profile and training data | While your account is active. Deleted within 30 days of account deletion request, except as required by law. |

| Audit logs (security events) | 12 months, then deleted. |

| Pending parental-consent requests | Identifying details removed 30 days after the request expires; a non-identifying record of the request date is kept. |

| Analytics events (pseudonymised) | 14 months from collection. |

| Payment & invoicing records | 10 years (tax / accounting obligations). |

| Backups containing your data | Maximum 35 days rolling; deletion requests are honoured on next backup rotation. |

Anonymised, aggregated data that cannot be re-identified may be retained indefinitely for product analytics.

8. Your Rights (Arts. 15–22 GDPR / CCPA §1798.100 et seq.)

You have the right to:

**Access** the personal data we hold about you (Art. 15).

**Rectification** of inaccurate data (Art. 16), via Profile screen or by emailing us.

**Erasure / "Right to be Forgotten"** (Art. 17), via Settings → Delete Account.

**Restriction** of processing (Art. 18).

**Data Portability**, receive your data in a machine-readable format (Art. 20), via Settings → Export My Data.

**Object** to processing based on legitimate interests, including profiling (Art. 21).

**Withdraw consent** at any time without affecting prior lawful processing (Art. 7(3)).

**Not be subject to solely automated decision-making** (Art. 22).

**Lodge a complaint with a supervisory authority**, the lead authority for EU users is your local Data Protection Authority (list: https://edpb.europa.eu/about-edpb/about-edpb/members_en); for UK users the ICO (https://ico.org.uk); for California users the CPPA.

We will respond to verifiable requests within **one month** (Art. 12(3)), extendable by two further months for complex requests.

CCPA-specific rights: right to know, delete, correct, opt-out of sale/sharing (we do not sell or share), limit use of sensitive personal information, and non-discrimination for exercising rights.

9. Security (Art. 32 GDPR)

We implement appropriate technical and organisational measures including: TLS in transit, AES-256 encryption at rest (Supabase managed), row-level security on all user-owned tables, hashed passwords (bcrypt via Supabase Auth), PII redaction in logs, principle of least privilege, audit logging of sensitive actions, and regular vulnerability review.

10. Data Breach Notification (Arts. 33–34 GDPR)

In the event of a personal data breach likely to result in a risk to your rights and freedoms, we will notify the competent supervisory authority within **72 hours** of becoming aware and inform affected users without undue delay where the risk is high. Our internal Incident Response Plan governs this process.

11. Children's Privacy

Players must be at least 16 to create and use a BAGGERS account on their own. Players under 16, including players under 13, may join only after a parent or legal guardian completes our Verifiable Parental Consent (VPC) flow, in line with COPPA (16 CFR §312), GDPR Article 8, and the UK Age Appropriate Design Code.

**How we obtain consent.** During signup we ask for the player's month and year of birth. If the player is under 16 we collect a parent or guardian's email address and send a notice describing what data we collect and how it is used. The parent then verifies their identity using a COPPA-approved method (a small refundable card authorisation, or a government-ID check via Stripe Identity). No account is created and no data is persisted on the child until the parent completes verification.

**Child-account restrictions.** Accounts for players under 16 are private by default and cannot upload a custom avatar, receive marketing email, or purchase a paid plan directly. Players under 13 receive additional protections including no personalised AI coaching content and parental review of free-text notes.

**Public participation.** A parent or guardian may authorise their child to take part publicly — appearing on leaderboards, in player search, and on club rosters under the nickname they choose, on the same terms as an adult player. This is described in the consent notice and is not the default: until a parent authorises it against the current consent text, the account stays private. A parent may withdraw the authorisation at any time, after which the child is removed from those surfaces.

**Parental rights.** A parent or guardian may at any time review the child's data, download a copy, request deletion, or withdraw consent — by following the link in the consent confirmation email or by emailing privacy@baggers.app. We honour these requests within one month (Art. 12(3) GDPR / COPPA reasonable means). We keep parental-consent records for three years after the account is closed for legal-defence purposes (Art. 6(1)(f)).

For full plain-language detail, see our Children's Privacy Notice at /privacy/children.

12. Changes to This Policy

We will notify you in-app and require renewed consent for material changes. The latest version, version number and effective date are shown at the top of this page.

13. Contact

**Privacy queries / data subject requests:** privacy@baggers.app

**Controller:** CORNHOLE, obrt za usluge i trgovinu, vl. Marin Barišić, OIB 57812107056

**Postal address:** Vilima Korajca 22, 10000 Zagreb, Croatia