Security & privacy
What actually protects your information, stated as it is.
Encrypted in transit
Everything the app sends and receives goes over HTTPS (TLS), so it can't be read on the network or the range Wi-Fi.
Encrypted at rest
Your data is stored with Supabase on Amazon Web Services in the US (Ohio). The database, its backups and stored photos are encrypted on disk (AES-256), and every connection to the database must be encrypted.
Contact details encrypted individually
Guest shooters' email addresses and phone numbers get a second layer: each one is encrypted on its own (AES-256) with a key kept in a separate vault, so even a copy of the database doesn't reveal them. Only staff of that guest's events can see them.
On your phone
Your sign-in is kept in the iPhone Keychain, on this device only (never synced to iCloud). A copy of your events and unsynced scores is kept in the app's private storage, which iOS encrypts with your passcode. Signing out or deleting your account clears both.
No passwords to steal
You sign in with Apple, so MOA Top Shot never stores a password, and "Hide My Email" works.
Who can see what is enforced by the server
Every table has access rules checked by the database itself (row-level security), not just hidden in the app. Someone who isn't in your event can't read its roster or scores, even with a modified app, and only staff can change scores. Contact details of guest shooters are visible only to staff of their events.
Private by default
Range day guns, range logs and target photos are visible only to you; target photos are in a private store with no public links. Team scoring codes are visible only to organizers.
Photos
Profile pictures are private: only you, people in your events and organizers who can add you to an event can open them, through links that expire. Event graphics (flyers, logos) are meant to be shared, so anyone with the link can open those.
What we don't collect
No location, contacts, microphone or health data, no payment cards (entry fees are paid to organizers outside the app), no ads and no third-party tracking or analytics. Your information is never sold.
Who can access everything
The MOA Top Shot system administrator can access all data, only to run the service, help with problems and keep people safe. That role exists only in the database and can't be granted through the app.
Deleting your data
Delete your account any time in Settings. Your sign-in, email, name, photo, gender, affiliations, guns, range log and target photos are erased right away. Scores you shot in other people's events stay on their results as "Former shooter", without your name.
Full details are in our Privacy Policy. Found a security problem? Email spotter@moatopshot.com.