PRIVACY POLICY

This is an English translation of the Russian original. In case of any discrepancy, the Russian original prevails.

Version of 10 October 2026. The previous version is dated 24 September 2026; this one specifies what other athletes see in the shared ranking and what your opponent sees in a match.

1. Who processes your data

The Onom app and this document belong to Ivan Kovalev, Republic of Kazakhstan. Address: Astana, Kravtsova St., 2. Phone: +7 702 636 44 86. Email: ik914735@gmail.com. Below we refer to ourselves as “we”.

Write to us at this email with any question about your data: we reply within thirty days, and usually sooner. This policy is also available on our website — you can open it without installing the app.

2. What this document is about

It explains what data we collect, why, who we share it with, how long we keep it and how you can delete it. We try to write without legal fog: if any part turns out to be unclear, write to us and we will rewrite it in the next version.

This document follows the rules of the App Store and Google Play, the Law of the Republic of Kazakhstan “On Personal Data and Their Protection”, Russian Federal Law No. 152-FZ and the European General Data Protection Regulation (GDPR).

3. What data we process

To create an account. Your email address is required: the verification code is sent to it, and there is no registration without it. If you sign in with Apple, Google or VK, we receive only an identifier and an email address from them; your password for these services is not passed to us and is not stored by us.

Profile — optional. First and last name, city, club, date of birth, sex, photo. You do not have to fill in any of this: the app works without it.

Sports data. Your sports rank and the document confirming it, if you attach one. Shooting results: points per arrow and per end, coordinates of hits on the target face, distance, type of target face and round, date and time of the training. Equipment: models of the bow, limbs, arrows and sight, their settings and measurements, as well as photos of the bow if you take them.

Technical data. Device model, operating system version and app version, interface language, IP address at the moment of a request to the server, error logs. We need this data to understand why something is not working for you.

App usage data. Which screens and features you open — analytics events with an installation identifier. What exactly they contain and what they do not is described in Section 4.

4. Analytics and what we do not collect

To understand which screens and features are used, where the app is inconvenient and where it breaks, the app records actions in it — events. An event is the name of an action plus a few numbers and labels: which screen is open; that a training was started, finished or abandoned; its format and distance; how many arrows it had; the average score and how many minutes it took; whether arrows were entered with the keypad or on the target face; the interface language; the role — athlete or coach; an error code; the time of the event.

Events do not contain the content of your records: no name, no email, no phone number, no points for individual arrows, no hit coordinates, no texts of notes and comments, no photos. The app lets only properties listed in advance into an event and discards everything else.

Events are tagged with an installation identifier — a random string that the app creates on your device. Events contain neither an account identifier nor an email address, and no profile of a person is built from them. The app does not use device advertising identifiers.

Events are first stored on the device and then sent in batches; without a network connection they wait until it is back. They are processed by the analytics service PostHog in its cloud in the European Union, in Frankfurt (Germany). Like any server, PostHog sees the device's IP address when receiving them; we ourselves do not add the IP address to events.

This data is confidential. We do not sell it, do not pass it to third parties for advertising and use it only to improve the app and our services. Analytics is covered by the consent to this policy that you give at registration; there is no separate checkbox for it.

We have no advertising networks or trackers. Apart from the analytics described above, the app contains no third-party module that would pass information about you to anyone else. We do not buy data about you from third parties and do not build an advertising profile of you. We do not read your contacts, messages or files on your phone. The app opens the camera and the photo library only when you yourself photograph your bow or attach a document, and takes only the one picture you have chosen. We do not receive your bank card details — only the app store sees them.

5. Where we get data from

You enter almost everything yourself. Some data arrives automatically when the app contacts the server: the technical information from Section 3 and the analytics events from Section 4. If you signed in with Apple, Google or VK, some data comes from them. If a coach invited you, we receive only the invitation from them — the coach does not see your data until you connect.

6. Why we process data

So that you can sign in to your account and find your trainings there from any device. To calculate and show your statistics. So that you can take part in the general ranking and online events, if you chose to. So that a coach can see your trainings — only the coach you connected, and only what you opened to them. To answer you in support. To understand why the app crashes and to fix it. To understand which screens and features are used and to improve the app and our services.

7. On what legal basis we do this

A contract with you. Without an email there is no sign-in, without results there are no statistics: we process this data because otherwise we cannot provide the service you pay for. You cannot withhold it — without it there will be no account.

Your consent. You give it at registration as a separate action and can withdraw it at any time. Consent is the basis for transferring data abroad, publishing results, taking part in the general ranking and the app usage analytics from Section 4.

Our legitimate interest. Error logs and protecting the service from hacking: here we rely on our interest in keeping the app working and intact. You have the right to object to such processing — how to do so is described in Section 13.

A legal requirement. We are obliged to keep some information even if you object: for example, the date and version of your consent.

Withdrawing consent does not cancel what was processed before the withdrawal, but it stops further processing.

8. What stays only on your phone

Training notes. While a note's “coach can see” switch is off, the note is not sent to the server and exists only on your device. If you turn it on, the note goes into the database together with the result. If you turn it off again, we delete it from the server.

There is a downside: local notes will not be restored if you lose your phone or delete the app. Export them in advance if they matter to you.

9. Who we share data with

The coach you connected. They see what you opened to them: results, insights, equipment, notes — each by a separate switch. You can disconnect the coach at any time.

The organizer of an event you registered for: your name, rank, category and results of that event.

Other athletes — only if you yourself turned on publishing of results. It is off by default. Then the shared ranking shows: your name in the form you chose in your profile, bow class, gender, age group (not your date of birth), rank, club, city unless you have hidden it, and the totals of your sessions over the last 14 days — distance, date, score, number of arrows, tens and Xs. The arrows themselves, arrow plots and notes do not go into the ranking. Turn publishing off and your ranking record is erased from the server.

Your opponent in a match — the person you gave your code to, the one you challenged or whose challenge you accepted. They see your name, bow class, distances, rank, club, city unless you have hidden it, your profile photo and, in the match itself, your arrows and arrow plots. Your date of birth and gender are not passed to the opponent.

Whoever hosts our servers. The hosting company physically stores the data but has no right to use it.

The analytics service PostHog — only the events from Section 4: with the installation identifier, without your name, email or the content of your records.

App stores — the fact that a subscription has been paid. No sports data goes there.

We pass data to government authorities only if the law requires it and we have received a properly issued document.

Everyone who receives your data is bound by one rule: protect it no worse than described in this policy and do not use it for their own purposes. With the hosting company this is written in the contract, with the coach — in the app's terms. Whoever breaks it, we stop the transfer to them.

10. Where we store data and transfers abroad

We rent two servers. Data of citizens of Russia is recorded, systematized, accumulated, stored, updated and retrieved in a database located in the Russian Federation: this is required by Article 18 of Federal Law No. 152-FZ. Data of citizens of Kazakhstan is stored in a database located in the Republic of Kazakhstan: this is required by Article 12 of the Law “On Personal Data and Their Protection”.

If you live in another country, your data is kept on one of these two servers, and for you this is a transfer abroad. We make it on the basis of your consent, which you give at registration and can withdraw.

The analytics events from Section 4 are stored separately from these servers — in the PostHog cloud in the European Union, in Frankfurt (Germany). For residents of Russia, Kazakhstan and other countries outside the European Union this is also a transfer abroad, and it is also based on the consent you give at registration.

If you are in the European Union, the law requires us to warn you directly. The European Commission has not recognized the level of data protection in Russia and Kazakhstan as adequate, and we do not have the EU standard contractual clauses. This means it will be harder for you to protect your rights there than at home, and you give your consent knowing this. You can withdraw it at any time: this deletes the account, because the app does not work without the server.

11. How long we keep data

As long as the free month or the subscription is active. If you have not taken out or renewed a subscription, the account and records are kept for one more month: if you come back during that time, everything is in place. After that we delete the account, and a week before that we remind you by email. Error logs are kept for ninety days. Information about your consent and its date is kept as long as we keep the data itself, as the law requires.

12. How we protect data

The connection to the server is encrypted. Only the app developer has access to the database. The rank document is stored separately from the rest of the data. We keep a log of access to the data.

We do not promise absolute protection — it does not exist. If a data breach affecting you happens, we will notify you by email and notify the supervisory authority within the time limits set by law.

13. Your rights

To find out what data about you we have and get a copy of it as a file. To receive it in a form suitable for transfer to another service. To correct inaccurate data directly in your profile. To delete your account and all data. To demand that processing be stopped without deleting the data while we look into your complaint. To object to processing that we carry out on the basis of our legitimate interest. To withdraw consent. To disconnect the coach and turn off publishing of results. To complain to the supervisory authority of your country.

To exercise any of these rights, you do not need to write a formal request: almost everything is done with a button in the app. If a button is missing, write to us and we will do it ourselves.

14. How to delete your account and data

In the app: Profile, the “Data” section, the “Delete account” row. Before deletion we will offer to export everything to a file — after deletion there will be nothing to restore.

On the website: on the account deletion page; the link to it is in Section 19. You do not need to open the app for this.

What happens next: we delete your profile, results, equipment together with photos, rank and the document, and notes. Your data does not stay with your coach either — there is no reason to keep the data of a deleted account. Deletion takes up to thirty days and cannot be undone. If the law of your country requires it to be done faster, we do it faster.

15. Children

People take up archery from childhood, and the app is designed for athletes of any age. We do not set a minimum age of our own.

However, by law, consent to the processing of a child's data is not given by the child. If you are under eighteen, the account is created with the permission of a parent or another legal guardian: we ask about this at the registration step and save the answer together with the date. In the European Union this threshold is lower — sixteen years, and some countries have lowered it to thirteen.

There are no ads in the app for anyone, and beyond what is listed in Section 3 we collect nothing about children.

16. Subscription payment

For the first month the app works in full and free of charge. You do not need to add a card, and we do not charge anything. If after a month you decide to stay, you take out and pay for the subscription through the App Store or Google Play and cancel it there as well. Card details are processed by the store; it only tells us that the subscription is active.

17. Automated decisions

We do not make automated decisions about you. Statistics and hints in the app are calculations based on your own results, not an assessment of you as a person. These calculations do not affect access to the services.

18. Changes to this policy

If the scope of data or the way we use it changes, we will update this page and show the change in the app before it takes effect. The version date is at the top of the document. We keep previous versions and send them on request.

19. How to contact us

Email: ik914735@gmail.com. Address: Astana, Kravtsova St., 2, Republic of Kazakhstan. Phone: +7 702 636 44 86.

You can delete your account without opening the app — on the account deletion page on our website; the link is on the “About the app” screen. The user agreement and the text of the consent to data processing are there too.

If our answer does not satisfy you, you have the right to contact a supervisory authority: in Russia — Roskomnadzor, in Kazakhstan — the authorized body for personal data protection, in the European Union — the supervisory authority of your country.