App: FirstShot (Android) · package cz.firstshot.app

Draft version: 1.0 · Prepared: 11 October 2026

Effective date: 11.10.12026

Contents

• 1. Who is responsible for your data?
• 2. What FirstShot does
• 3. Information processed by the app
• 4. Why information is used
• 5. Who may receive information
• 6. International processing
• 7. How long information is kept
• 8. Security
• 9. Your privacy rights
• 10. Account deletion
• 11. Children
• 12. Changes and contact
• Owner references

1. Who is responsible for your data?

The proposed data controller for FirstShot is Anna Nicole Kucerova, Panenska 29, Jablonec nad Nisou 46601, Czech Republic. General contact and privacy requests: info@nicolesport.com.

These details were supplied for FirstShot. The existing website policy spells the name “Anna Nicole Kučerová.” The controller should confirm the exact legal spelling and legal status before publication. No company registration number was supplied for this draft. A Data Protection Officer contact has not been provided; the controller should confirm whether one is required.

This policy applies to the FirstShot Android application and, once enabled, its separate FirstShot account and membership API. It does not cover the separate NICOLE GOLF LAB PRO application or other nicolesport.com services.

2. What FirstShot does

FirstShot records golf rounds, scores, practice sessions and statistics. The current Android version stores golf records in a local database on your device. It does not intentionally synchronize scorecards, practice notes or shot-by-shot statistics to the FirstShot server.

The app also contains optional FirstShot account and membership functions. Those functions send account and purchase-verification data to the FirstShot API over HTTPS. The API source is prepared, but the plugin has not been activated on the live website at the date of this draft. Account and purchase processing described below applies when that backend is enabled.

The current Android manifest requests internet access. It does not request location, camera, microphone or contacts permissions. The current Android project does not include a dedicated advertising or analytics SDK. Clicking a link or banner that opens another website takes you outside the app; that website’s own privacy policy then applies.

3. Information processed by the app

Golf information stored on your device

When you use the app, it may store golf course and tee names, course details you enter, round dates and scores, hole-by-hole information, putts, penalties, bunker and fairway/GIR details, shot category, club, direction, distances and lies, green-hit selections, notes, practice categories, practice counts and duration, manually entered handicap information, and app preferences such as language and units.

These records remain in the app’s local database unless you choose to share them using an Android sharing feature. The app’s Android configuration currently permits system backup. Depending on your device and backup settings, Android or Google backup services may copy app data to your configured backup destination. The controller should confirm the exact backup behavior and disclose it in the final Data safety declaration.

FirstShot account information

If you register, the account form requests your first name, last name, email address and password. The server stores the name and email and a password hash; it is designed not to store the password in plain text. The account system also processes an account identifier, account status, FirstShot administrator flag and membership status/expiry date.

For sign-in, the app receives a session token. The Android app stores the token in encrypted shared preferences protected by a key held in Android Keystore. The server stores a hash of the session token, its creation and expiry times, and last-use time. Sessions are currently designed to expire after 30 days.

Password recovery and security data

If you request a password reset, the system processes your email address and creates a random reset token. The server stores a hash of that token and its expiry/use status; the reset link is designed to expire after 60 minutes and to be used once. The WordPress email delivery configuration sends the reset link to the supplied email address.

The API uses an HMAC-derived IP fingerprint for rate limiting and abuse prevention. The website host may separately receive or log connection data such as IP address, request time, request path or user-agent information under its own operational configuration. The exact server-log fields and retention period have not yet been confirmed.

Premium purchases and gift codes

If you make a purchase through Google Play, Google Play processes the payment. FirstShot does not receive or store your payment-card number. The app sends the product identifier and Google Play purchase token to the authenticated FirstShot API so the server can ask Google Play to verify the purchase. The backend is designed to store a hash of the purchase token, the product identifier, transaction/order reference where available, purchase type and status, verification/consumption timestamps, and the related Premium entitlement.

For a paid gift, the backend may generate a redeemable code. It stores a hash of the code and an encrypted copy so it can show the code to the purchaser; it also processes expiry and redemption status. Gift redemption links the code to the recipient’s FirstShot account.

The account and purchase backend is not yet live and Google Play products have not yet been configured. These purchase disclosures describe the implementation prepared for activation; verify them against the final Play Console products and live server before publication.

Support messages

If you contact the controller at the email address above, the controller will process the information and attachments you include so it can respond to your request. The underlying email provider is configured by the website operator and has not yet been identified for this draft.

4. Why information is used

The controller expects to use information to provide the golf logging and statistics features, create and secure FirstShot accounts, deliver password-reset messages, activate or manage Premium and gifts, prevent abuse, troubleshoot service problems, answer requests, comply with legal obligations and establish or defend legal claims.

The proposed GDPR legal bases are performance of the requested service or account contract, compliance with legal obligations for applicable transaction records, and the controller’s legitimate interests in preventing abuse and protecting the service. The controller must verify and document the applicable basis for each activity before publication. The app does not currently include a marketing signup or dedicated advertising/analytics SDK.

5. Who may receive information

The controller does not intend to sell personal information. Information may be processed by or disclosed to the following parties only as needed for the functions described above:

• Google Play / Google: payment processing and server-side verification of Google Play purchases. Google handles payment credentials under its own terms.
• The hosting provider for nicolesport.com and the WordPress API: account, authentication, membership, gift and security records. The specific hosting provider and storage region must be added before publication.
• The configured email-delivery provider: password-reset and support emails. The provider and its processing region must be confirmed.
• Android/Google backup services: only to the extent your device/account backup configuration includes FirstShot app data.
• Authorities, professional advisers or successor entities: where legally required or reasonably necessary to protect rights, safety or the operation of the service, subject to applicable law.

The app’s account database is separate from WordPress user accounts used by NICOLE GOLF LAB. FirstShot account deletion is designed not to delete or modify those other accounts.

6. International processing

Google and the website’s hosting or email providers may process information in more than one country. The exact hosting and email providers, processing locations and any transfers outside the European Economic Area have not been confirmed for this draft. Before publication, the controller must identify those providers and document an applicable adequacy decision, standard contractual clauses or other required safeguard where a transfer mechanism is needed.

7. How long information is kept

Local golf data remains on your device until you delete it or remove the app, subject to Android system-backup behavior and the device’s backup settings. The app does not currently provide server synchronization of golf records.

Account records are designed to remain until account deletion or another valid reason for removal. When you delete a FirstShot account in the app, the current backend code deletes the account record, sessions, password-reset tokens and membership entitlements. The code also removes the buyer association and order reference from purchase records while retaining a hashed purchase token and limited product/status/timing data for replay prevention and security. Gift purchaser association is removed, while code/redemption records may remain. A security audit event may remain with a numeric account reference.

The plugin does not yet define a complete retention schedule or maximum retention periods for account-deletion audit events, purchase-prevention records, host logs, email records, backups or support correspondence. The controller must set and publish those periods before activating the service. Do not publish this draft until that retention schedule and actual deletion behavior have been reviewed.

8. Security

The app and API are designed to communicate over HTTPS. Passwords are stored on the server as hashes rather than plain text. Session and password-reset tokens are stored as hashes on the server; the app encrypts its session token using Android Keystore-backed AES-GCM. The plugin encrypts selected server-side secrets and recoverable gift codes. Access to account administration is restricted by the plugin’s authorization checks.

No online service can guarantee absolute security. Protect your password and contact the controller promptly if you suspect unauthorized access. The controller should validate the production server’s TLS, hosting access controls, backups and incident-response process before enabling accounts or purchases.

9. Your privacy rights

Depending on applicable law, you may request access to your personal data, correction of inaccurate data, deletion, restriction of processing, portability, or object to processing based on legitimate interests. Where processing is based on consent, you may withdraw consent without affecting processing that occurred before withdrawal. You may also complain to a supervisory authority.

Send requests to info@nicolesport.com. The controller may ask for reasonable identity verification before acting on a request. In the Czech Republic, the supervisory authority is the Office for Personal Data Protection (Úřad pro ochranu osobních údajů): https://uoou.gov.cz/en.

10. Account deletion

A signed-in user can request deletion from the FirstShot app and must re-enter the current password. Deleting a FirstShot account does not delete local golf records from the device. The current plugin source does not yet provide a confirmed public, external account-deletion webpage. The controller must publish an accessible web deletion-request page and enter its URL in Google Play Console before a public release that permits account creation.

11. Children

The app currently has no age-verification flow, and the controller has not supplied an age policy for FirstShot. The intended minimum age and any parental-consent process must be decided and added before publication. If you believe a child has provided personal data inappropriately, contact info@nicolesport.com.

12. Changes and contact

The controller may update this policy when the app, backend, providers or applicable law changes. The published version should show its effective date and be available through a public, non-geofenced URL and from within the app.

Privacy contact: info@nicolesport.com

Proposed controller: Anna Nicole Kucerova

Address: Panenska 29, Jablonec nad Nisou 46601, Czech Republic

w.