Privacy policy
Last updated: 8 October 2026. Applies to the MakeReady website and portal (makeready.be), its API and the MakeReady tablet app for Android and iOS.
MakeReady is an open scoring platform for practical shooting matches and trainings. This policy explains which personal data MakeReady processes, why, where it is stored, who can see it and which rights you have. MakeReady does not sell personal data, shows no advertising and uses no analytics or tracking tools.
Who is responsible
MakeReady is operated by the MakeReady team (the "operator"), reachable at privacy@makeready.be. For the account and the platform itself the operator is the controller. For the registrations and results of a match, the organising club or organiser decides which data is entered and who may see it; MakeReady processes that data on their behalf and on yours. Questions about a specific match can also be put to its organiser.
What we process and why
| Data | Purpose | Legal basis (GDPR) |
|---|---|---|
| Account: e-mail address, first and last name, a hashed password (PBKDF2; the password itself is never stored), whether your e-mail address is verified, your club memberships and roles | Signing in on the website and the tablets, managing clubs, matches and scoring rights, sending password-reset and verification e-mails | Contract (providing the service you signed up for) |
| Competitor registrations: name, club, division, categories, power factor, optional team name and chrono measurement (bullet weight, velocities), competitor number and squad, and optionally a link to your MakeReady account | Running the match: squads, scoring, rankings, team and category standings; finding your own results under "My results" | Contract and the legitimate interest of the organiser in running the match |
| Scores: times and individual shot times, hits per target, penalties with their reasons, DNF/DQ with the reason, the competitor's signature drawn on the tablet when approving a score, the range officer who recorded it, the tablet and the timer used, and every correction as a separate revision | Calculating results and keeping a verifiable, tamper-evident scoring record (corrections never overwrite earlier revisions) | Contract and the legitimate interest of the organiser and competitors in correct, auditable results |
| Competitor directory per club: name, club, division, power factor, categories and account link of competitors a club registered before | Autocomplete when the same club registers you again. Each club only sees its own directory; nothing is shared between clubs | Legitimate interest of the club (faster registration) |
| Devices: a random device identifier, the tablet name, platform and app version, and the device sign-in token (stored only as a SHA-256 hash on our side) | Letting tablets sync scores securely, also after working offline | Contract |
| Security records: an audit log of administrative actions (who changed what and when), shown per match or training as its change log to the staff and admins of that event, and the e-mail address and IP address of failed sign-in attempts | Accountability, detecting abuse and blocking password-guessing attacks (rate limiting) | Legitimate interest (security of the service) |
MakeReady does not ask for and does not process special categories of data (such as health data), payment data or your location.
The tablet app
- Stored on the tablet: the matches you downloaded, scores waiting to be sent, and for every account that signed in on that tablet its profile, device token and a salted hash of the password, so the same credentials also work offline. Signing out removes the current sign-in; "Remove from tablet" deletes a match's local copy. Uninstalling the app deletes all of it.
- Bluetooth: used only to connect to a shot timer (SG Timer, AMG Lab Commander) and receive shot times. On Android 11 and older, Android requires the location permission for Bluetooth scanning; the app does not read or store your location.
- Camera: used only to scan the QR code of the local hub tablet. Images are processed on the device and are neither stored nor sent anywhere.
- Local network: when a tablet acts as the local hub, the tablets on the same Wi-Fi exchange scores and the "on the range" panel directly with each other; this stays inside that network until a tablet with internet forwards the scores to MakeReady.
- The app contains no advertising, analytics or third-party tracking libraries.
Who can see your data
- Results are visible according to the visibility the organiser chose for the match: public (everyone, including on scoreboards and the public API), club (members of the organising club) or private (the organiser, the club's staff and admins). Public results show your name, club, division and scores.
- The name of the person who created a match or training is shown with it.
- Organisers, range officers and club admins see the registrations and scores of the matches they manage, and its change log (who changed what and when, which range officer and tablet recorded each score). To link a registration to your account, the organiser of a match can look up MakeReady accounts by the start of the e-mail address or name (at least three characters, a few results at a time); they then see the e-mail address and name of the matching accounts, nothing else.
- Club portals: a club can connect its own member portal to MakeReady with an API key. It then sends registrations to MakeReady and receives the results of that club's matches. That club processes the data under its own privacy policy.
- Service providers (processors) that run MakeReady for us: Cloudflare (hosting of the website, API and database, worldwide network) and, when e-mail is enabled, Resend (delivery of password-reset and verification e-mails). They process data only on our instructions. Transfers outside the European Economic Area are covered by the EU standard contractual clauses or an adequacy decision.
- We disclose data to authorities only when the law requires it.
Cookies and browser storage
The website sets one cookie, mkr_session: a strictly necessary, HTTP-only sign-in cookie that expires after 14 days or when you sign out. The portal also keeps a random identifier for your browser in local storage (mkr_web_device) to label corrections made from the web. There are no advertising, analytics or third-party cookies, so no cookie banner is needed.
How long we keep data
- Account: until you ask us to delete it (see below).
- Match data (registrations, scores, signatures): as long as the match exists in MakeReady; the organiser can delete a match with everything in it at any time. Results are a sporting record, so we keep them otherwise.
- Sign-in sessions and device tokens: 14 days (web) or 180 days (tablets), then they expire and are removed.
- Password-reset and verification links: valid for 2 and 48 hours, removed afterwards.
- Failed sign-in attempts: removed after one day.
- Audit log: kept for accountability as long as the platform runs.
Deleting your account and data
Request the deletion of your data with the form on that page, or, when signed in, under Profile → Delete my account. You can also send an e-mail to privacy@makeready.be from the address of your account with the subject "Delete my account". We delete your account, sign-ins and device tokens and remove the link between your account and your registrations within 30 days, and confirm by e-mail. Registrations and scores in matches stay part of the results of those matches, without the link to your account; if you ask for it in the form, your name and club are also removed from your registrations (the scores stay, anonymised, so the other competitors' rankings do not change). We keep a record that the request was received and handled. On the tablet, signing out and uninstalling the app removes all data stored there.
Your rights
You can ask for access to your data, correction, deletion, restriction of processing, data portability (for example the results as CSV) and you can object to processing based on legitimate interest. You can correct your name yourself under Profile on the website. Send requests to privacy@makeready.be; we answer within one month. You also have the right to lodge a complaint with a data protection authority, in Belgium the Gegevensbeschermingsautoriteit / Autorité de protection des données (dataprotectionauthority.be).
Security
All traffic uses HTTPS. Passwords are stored with PBKDF2, and tokens, device tokens and API keys only as SHA-256 hashes. Access to matches, clubs and the API is checked on the server for every request, failed sign-ins are rate limited, and administrative actions are logged.
Children
MakeReady is meant for people taking part in or running shooting matches. Junior competitors can be registered by their club or organiser; an account of their own is only for users old enough to consent under the law of their country (in Belgium 13 years), or with a parent's consent.
Changes
When this policy changes, the date at the top changes with it. Substantial changes are announced on the website.
Contact
Questions about privacy or this policy: privacy@makeready.be.