Privacy policy
Privacy Policy for TacSync
TacSync (“the App”) is a tactical awareness app for airsoft milsim events. This policy explains what information is collected when you use TacSync, why it’s collected, and your rights regarding that information.
TacSync is operated by Adomas Alenovic (“we”), based in Lithuania. We are the data controller for the purposes of the EU General Data Protection Regulation (GDPR).
Contact: adomas@bettr.lt
1. Data we collect
Data you provide
- Callsign and avatar — displayed to other members of sessions you join.
- Chat messages — text, voice recordings, and photos you send inside a session.
- Map annotations — points of interest, lines, areas, and map templates you create or upload.
Data collected automatically while a session is active and location sharing is enabled
- GPS coordinates (latitude, longitude, accuracy, heading, speed) — used to show your position to other members of the same session, and stored as a historical breadcrumb trail for post-event review.
- Device battery level (as a percentage) — shown to teammates so they can see who is about to run out of power during the event.
- Timestamp of each location update.
Location is sampled roughly every 5 seconds while you are in an active session and have location sharing turned on, including while the app is in the background. You see a persistent notification (Android) or status-bar indicator (iOS) whenever background tracking is running, and you can stop it at any time by turning off sharing or ending the session.
Usage analytics
The app records simple usage events so we can understand how TacSync is used and improve it: when the app is opened, and when you create, join or view a session, start sharing your location, send a message, place a marker or line, or upload an overlay. Each event holds only its type (for example “text” or “photo”), the session it happened in, the time, the app version and the platform (iOS, Android or web), linked to your app’s anonymous ID. Events never contain your messages, your location or other content. They are first-party: stored with the rest of your data on our own backend, never sent to third-party analytics services, and never used for advertising.
Website analytics
When you visit tacsync.com we count page views so we know which pages are read. The website sets no cookies and stores nothing on your device. For each page view we record the page, the website or campaign that linked you here, your country (worked out from your IP address by our hosting provider) and whether you use a phone or a computer. To count unique visitors, your IP address and browser type are combined with a secret that changes every day and turned into a one-way code; the IP address itself is never stored, and the code can’t be linked to you or to your visits on other days. This data stays on our own backend and is never shared or used for advertising.
Data collected only transiently
- Camera image — used when you scan a session QR code. The camera feed is processed in memory only; we do not store photos or video from the camera.
- Authentication token — issued by our backend provider (Supabase) so that we can identify you across sessions. We do not collect email addresses unless you later opt in to email sign-in.
2. Why we collect this data
TacSync’s entire purpose is to share real-time situational awareness among members of a single airsoft session. Every piece of data collected is used to make that work:
| Data | Purpose | Legal basis (GDPR) |
|---|---|---|
| GPS coordinates | Show live position to teammates in the same session | Performance of the service you requested (Art. 6(1)(b)) |
| Breadcrumb trail | Post-session debrief for session members | Legitimate interest (Art. 6(1)(f)) — event review |
| Battery level | Show teammates when you are running low | Performance of the service (Art. 6(1)(b)) |
| Callsign / avatar | Identify you to teammates | Performance of the service (Art. 6(1)(b)) |
| Chat messages, annotations | Core collaborative features | Performance of the service (Art. 6(1)(b)) |
| Usage analytics | Understand how the app is used and improve it | Legitimate interest (Art. 6(1)(f)) |
| Camera (QR scan) | Join a session | Performance of the service (Art. 6(1)(b)) |
We do not use your data for advertising. We do not sell your data. We do not profile you for marketing purposes.
3. Who can see your data
- Other members of the same session can see your live position, breadcrumb trail, battery level, callsign, chat messages, and annotations.
- Members of other sessions cannot see any of this, even if they share a different session with you at another time. Session scoping is enforced at the database level (row-level security).
- The TacSync operator (us) can see all data stored on the backend as part of providing the service.
- No one else. We do not share data with advertisers, analytics brokers, or third parties for their own purposes.
4. Where your data is stored
Data is stored on Supabase, our backend provider, in their EU (Ireland) region. Supabase acts as a data processor on our behalf. Their security and compliance documentation is at https://supabase.com/security.
Map tiles are served by Mapbox. When you view the map, your IP address and map viewport are sent to Mapbox so they can serve tiles. Mapbox’s privacy policy is at https://www.mapbox.com/legal/privacy.
Over-the-air JavaScript updates are delivered via Expo EAS Update. Expo receives minimal telemetry (app version, runtime version, platform) when checking for updates.
5. How long we keep your data
All session data — location breadcrumbs, chat, annotations, photo and voice uploads — is retained indefinitely while the associated session exists, so that members can review past events. This is a deliberate product decision: airsoft events are worth looking back at.
You can request deletion of your data at any time (see Section 7).
6. Security
- All network traffic is encrypted in transit (HTTPS / TLS).
- Stored data is protected by per-row access control; other users of TacSync cannot read data from sessions they do not belong to.
- Authentication tokens are stored only on your device and on our backend.
No system is perfectly secure. If we discover a breach affecting your data, we will notify you without undue delay as required by GDPR Art. 34.
7. Your rights
Under GDPR you have the right to:
- Access — ask for a copy of the data we hold about you.
- Rectification — correct inaccurate data.
- Erasure — ask us to delete your data (“right to be forgotten”). Because session content is shared, deleting your account removes your personal identifiers and your location trail, but does not retroactively erase chat messages you sent to other members (similar to how leaving a group chat works). We will let you know the scope of deletion before proceeding.
- Portability — receive your data in a machine-readable format.
- Objection and restriction — object to or restrict specific processing.
- Withdraw consent — where processing is based on consent, withdraw it at any time.
- Complain to a supervisory authority. For Lithuania, that is the Valstybinė duomenų apsaugos inspekcija (VDAI).
To exercise any of these rights, email adomas@bettr.lt. We will respond within 30 days.
8. Children
TacSync is not directed at children under 13. We do not knowingly collect data from children under 13. If you believe a child has provided us with data, please contact us so we can delete it.
9. Changes to this policy
We may update this policy from time to time. The “Last updated” date at the top of this page will reflect the latest revision. Material changes will be announced inside the app.
10. Contact
For any question about this policy or your data:
Adomas Alenovic
Email: adomas@bettr.lt
Lithuania