This Privacy Policy explains how Airmail Drag, operated by Andrew Lawler, trading as Airmail Drag (sole trader, Australia) ("we," "us," or "our"), collects, uses, discloses, stores and deletes your personal information.

This policy applies to the Airmail Drag website at airmaildrag.com, the Airmail Drag application at app.airmaildrag.com, and our mobile applications (together, the "Service"). Account registration and sign-in — including Google sign-in — take place in the Airmail Drag application; this single policy covers both properties.

If you do not agree with this policy, please do not use the Service. Questions can be sent to andy@airmaildrag.com.

1. Summary

• We collect account details, cornhole gameplay data, and basic website analytics.
• We never sell your personal information, and we never share it with third parties for advertising or marketing purposes.
• If you sign in with Google, we request only your email address and basic profile (name and profile picture) — nothing else.
• You can request deletion of your account and personal data at any time by emailing andy@airmaildrag.com. See Section 11.

2. Information We Collect

2.1 Account information

Collected when you create an account or sign in:

• Email address — required, used as your account identifier.
• Name and username — required, displayed to other players.
• Profile photo / avatar — optional. Previously uploaded avatars are retained in an avatar history until your account is deleted.
• Authentication identifier — an internal ID linking your profile to your sign-in method (password, Google, or Apple). We never store your password in readable form, and we never receive your Google or Apple password.
• Email verification status.
• Subscription plan and player rank.

2.2 Optional profile information

Provided voluntarily during onboarding. You may leave these blank:

• How you discovered cornhole.
• What you enjoy about cornhole.
• Whether you consent to your responses being quoted publicly. We only publish these responses if you have given that consent, and you may withdraw it at any time.

2.3 Club and tournament organiser information

Collected only if you create or administer a club or tournament:

• Club or tournament director's name and email address.
• Contact phone number.
• Club or venue address, state and country.
• Club website and logo.
• A setting controlling whether your club contact email is shown publicly. It is hidden unless you choose to display it.

2.4 Gameplay and competition data

Generated as you use the Service:

• Tournament entries, team names, team membership, and invitations you send or accept.
• Check-in timestamps and entry status.
• Match results, scores, and per-round throw statistics (bags in, on and off the board; four-baggers).
• Aggregate performance statistics such as games played, games won, win percentage, streaks, and PPR, OPR and DPR ratings.
• Tournament history, seeding, and placings.
• Whether an entry fee has been marked as paid. This is a yes/no flag only — we do not store card numbers or other payment details.

2.5 Technical and usage information

Collected automatically when you visit our website, via Google Analytics (see Section 7):

• IP address, used by Google to derive approximate location at city level.
• Device type, operating system, browser and screen size.
• Pages visited, time on page, and the referring website.

We also process standard server logs necessary to deliver and secure the Service. We do not collect precise GPS location, contacts, photos beyond an avatar you deliberately upload, microphone or camera data.

3. Google User Data

Google sign-in is optional. If you choose it, Airmail Drag requests only the following scopes:

• .../auth/userinfo.email — your email address. Used to create and identify your account, to let you sign back in, and to send essential service emails such as verification and password reset.
• .../auth/userinfo.profile — your name and profile picture. Used to populate your player display name and avatar so other players can recognise you in tournaments.

We request no other Google scopes. We do not access, request or store your Gmail, Google Drive, Google Contacts, Google Calendar, YouTube data, or any other Google service.

Google user data is stored in our Appwrite Cloud database alongside the rest of your profile, is retained for as long as your account is active, and is deleted when you delete your account (see Section 11). We do not transfer Google user data to any third party except our hosting and infrastructure provider acting on our instructions, and we never use it for advertising.

You can revoke Airmail Drag's access to your Google Account at any time via Google Account permissions. Revoking access prevents future Google sign-in but does not by itself delete data already stored — use the deletion process in Section 11 for that.

3.1 Limited Use disclosure

Airmail Drag's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

4. How and Why We Use Your Information

We do not use your personal information for advertising, profiling for marketing, or automated decision-making that produces legal or similarly significant effects.

5. Information That Is Publicly Visible

Airmail Drag is a competition platform, so some information is public by design. The following may be visible to anyone, including people without an account:

• Your name or username, avatar, and player statistics where you appear in a tournament.
• Team names, seeds, match results and live scores on public scoreboard and bracket pages.
• Club listings, including club name, venue, address, website and logo.
• A club director's email address, only where the club has chosen to display it.
• Optional profile responses, only where you have consented to public quoting.

Your email address is never displayed publicly on a player profile, scoreboard or bracket.

6. How We Share Information

We do not sell your personal information, and we do not share it with third parties for their own marketing purposes. We share information only with the following service providers, who process it on our instructions:

• Appwrite Cloud — database, authentication, file storage and serverless functions. Stores all account, club and gameplay data. Appwrite privacy policy.
• Google Analytics (Google LLC) — website usage measurement. Receives the technical and usage data described in Section 2.5. Google privacy policy.
• Google Maps Static API (Google LLC) — renders club location maps on our clubs page. Your IP address and browser information are sent to Google when a map image loads.
• Payment providers — subscription payments are handled entirely by third-party payment processors under their own privacy policies. We receive confirmation of your subscription status only; we never receive or store your card details.
• Our web host — serves the website and processes standard server logs.

We may also disclose information where required by law, to enforce our Terms of Service, to protect the rights or safety of users, or in connection with a sale or transfer of the business (in which case this policy will continue to apply, or you will be notified of any change).

7. Cookies and Similar Technologies

We use a small number of cookies and similar technologies:

• Essential session storage — our authentication provider stores a session token in your browser so you stay signed in. The Service cannot function without it.
• Analytics cookies — Google Analytics 4 sets first-party cookies named _ga and _ga_<container-id> to distinguish visitors and measure sessions. These typically expire after two years.

We do not use advertising cookies, retargeting pixels, cross-site tracking, or social media tracking pixels.

You can block or delete cookies through your browser settings, or opt out of Google Analytics across all websites using the Google Analytics Opt-out Browser Add-on. Blocking essential session storage will prevent you from signing in.

8. Where Your Data Is Stored

Airmail Drag is operated from Australia, but your data is stored on Appwrite Cloud infrastructure located in the European Union (Frankfurt, Germany). Google Analytics and Google Maps may process data on servers in the United States and other countries.

This means your personal information may be transferred to and processed in countries other than your own. Where such transfers involve personal data protected by UK or EU law, they are made under the European Commission's Standard Contractual Clauses or another lawful transfer mechanism offered by the relevant provider.

9. Data Retention

• Account and profile data — retained while your account is active, and deleted within 30 days of a verified deletion request.
• Avatar images and avatar history — deleted together with your account.
• Gameplay and tournament results — historical match records are retained as part of a tournament's permanent competition record, but are anonymised when you delete your account so that they are no longer linked to you or your email address.
• Analytics data — retained by Google Analytics for up to 14 months.
• Records required for tax, accounting or legal compliance — retained for as long as Australian law requires, typically five years.

10. Your Rights

Airmail Drag complies with the Australian Privacy Principles under the Privacy Act 1988 (Cth). If you are in the United Kingdom or the European Economic Area, you also have rights under the UK GDPR / EU GDPR. Subject to applicable law, you may:

• Access the personal information we hold about you, and request a copy.
• Correct information that is inaccurate, out of date or incomplete.
• Request deletion of your personal information (see Section 11).
• Request a portable copy of your data in a machine-readable format.
• Object to, or request restriction of, processing based on our legitimate interests.
• Withdraw consent at any time where processing is based on consent.
• Opt out of non-essential emails.

To exercise any of these rights, email andy@airmaildrag.com. We will respond within 30 days, and we will not charge a fee or discriminate against you for making a request. We may ask you to verify your identity before acting.

If you are unhappy with our response, you may complain to the Office of the Australian Information Commissioner (OAIC), or to your local supervisory authority if you are in the UK or EEA.

11. Account and Data Deletion

You can have your Airmail Drag account and personal data deleted at any time.

How to request deletion:

1. Email andy@airmaildrag.com with the subject line "Account deletion request".
2. Send the request from the email address registered to your Airmail Drag account, so we can verify it is you.
3. We will confirm receipt within 7 days and complete the deletion within 30 days.

What is deleted:

• Your account and sign-in credentials.
• Your email address, name, username, and any optional profile responses.
• Your avatar and avatar history files.
• Any Google user data we received through Google sign-in.
• Club contact details, where you are the sole owner of the club.

What is retained in anonymised form:

• Historical match scores and tournament results, so that competition records and other players' statistics remain accurate. These are stripped of your name, email and profile and cannot be used to identify you.
• Records we are legally required to keep, such as payment and tax records.

If you signed in with Google, you should also revoke access at myaccount.google.com/permissions.

12. Security

We protect your information using:

• Encryption in transit via HTTPS/TLS across the website, application and APIs.
• Encryption at rest for data held in Appwrite Cloud.
• Hashed, salted password storage — we never store passwords in readable form.
• Role-based access controls, so records are only readable by those permitted to see them.
• Restricted administrative access, limited to the operator of the Service.

No method of transmission or storage is completely secure, so we cannot guarantee absolute security. If we become aware of a data breach likely to result in serious harm, we will notify affected users and the OAIC as required by the Notifiable Data Breaches scheme.

13. Children's Privacy

Cornhole is a family sport and players of all ages take part in tournaments. Airmail Drag is not directed at children under 13, and we do not knowingly create accounts for children under 13 without verifiable parental consent. If you are under the age of majority in your jurisdiction, you must have permission from a parent or guardian to use the Service and to provide us with personal information.

If you believe a child has provided us with personal information without appropriate consent, contact andy@airmaildrag.com and we will delete it promptly.

14. Changes to This Policy

We may update this Privacy Policy from time to time. We will revise the "Last updated" date at the top of this page, and for material changes we will provide notice within the Service or by email before the change takes effect. Continued use of the Service after a change takes effect means you accept the updated policy.

15. Contact Us

For any privacy question, request or complaint, including data access and deletion requests, contact:

We aim to respond to all privacy enquiries within 30 days.