3acks club apps
Privacy notice
Platform privacy information for 3acks club apps.
Last updated 4 November 2026
Who this notice covers
3acks provides the platform for club apps on iOS and Android and the club staff website. This page describes platform features available to participating club apps. The features enabled and the app-specific notice depend on your club and app version.
Account information supports sign-in, your profile, app membership and member-card access. Club staff use the website to manage club content, promotions and aggregated engagement reports.
Your app-specific notice identifies its operator and enabled data practices. This general platform information does not replace that notice. For the operator details or retention schedule that applies to your app, contact us with your club/app name.
Website cookies and browser storage
The staff website uses browser local storage for sign-in and requested workspace features. It does not currently add advertising cookies, visitor analytics cookies or third-party tracking scripts. App usage reporting described below is separate from tracking visitors to this website.
- Sign-in: Supabase stores session tokens under
northbridge-staff-session(a legacy technical key shared by the staff portal, not your club name) so you remain signed in across visits. Tokens are sensitive credentials, but your password is not stored by this website. Successful sign-out removes the saved session; closing a tab does not sign you out. - Password recovery: a temporary PKCE verifier uses
3acks-staff-recovery-code-verifierin local storage so a requested reset link can be verified in the same browser. It is removed when exchanged; a new reset request replaces the previous verifier. Recovery session tokens stay in page memory, separately from the normal staff session, and do not survive a page reload. - Announcement recovery: a pending send request is saved under
northbridge-notification-send:…, scoped to your account email on the legacy route. Workspace routes use a separate key scoped to the service, user, workspace and environment. It contains the announcement and its retry identifier, and is removed after a confirmed send. An unconfirmed request remains across visits, including sign-out, to prevent duplicate publication. - Saved reports: presets you explicitly save use
3acks-report-presets-v1:…, scoped to your account. They contain report settings, not downloaded analytics results. They remain until you remove them or clear website data. - This notice: dismissing it stores
3acks-storage-notice-v1in local storage across visits until you clear website data or we change the notice version. Session storage is a fallback if persistent storage is blocked. Private browsing or browser storage-clearing settings may cause the notice to return. You can reopen it using “Storage notice”. Dismissal is not consent to tracking and does not enable tracking.
Use a trusted device and sign out when finished. Anyone with access to the same browser profile may be able to access saved data. Clearing website data removes these local records, including pending-send recovery; check announcement history before sending again. Blocking browser storage may prevent sign-in or sending announcements, while report exploration remains available without saved presets.
Supabase processes authentication and database requests. Cloudflare hosts the website and may process network and security logs. External content images contact their hosting providers and can disclose your IP address. If optional tracking is introduced, we will update this notice and provide a choice before activating it where consent is required.
Information we use
| Information | Purpose |
|---|---|
| Account and profile | Your sign-in email, authentication information, linked sign-in identity and the profile details you provide support account access and account management. |
| App membership and member card | Membership status and member-card credentials support membership access and checks by authorised club staff. |
| Notification preferences | Selected categories and device registration tokens support the notifications you choose to receive. These registrations are separate from your account. |
| App usage events | Recorded app activity helps staff understand which content, features and promotions are used. |
| In-app feedback | If you send feedback, we store your message, topic, optional rating and screenshot with your account. App version, iOS version and phone model are included only when you choose to share them. Authorised club administrators review feedback in the staff portal. If you ask for a reply, they can use your account email to respond manually. |
| Support enquiries | Your email and the information included in your request are used to reply, verify ownership and handle your request. |
| Operational and security information | Service providers may process network information and logs to operate, secure and troubleshoot the services. |
Club staff sessions use browser storage to keep authorised staff signed in. App preferences, public content caches and session information may also be stored on your device.
Feedback choices
Feedback is optional. Check screenshots for private information before sending them. You can leave out screenshots and device details, and choose whether you want an email reply. Failed submissions are saved on your phone for manual retry; the saved draft is removed after a confirmed send, sign-out or account closure. Feedback is not sent automatically when connectivity returns.
Submitted feedback remains linked to your account until account deletion removes its messages and screenshots. Marking a message as resolved records a staff review; it does not delete the message or send an email. The staff portal keeps feedback in page memory rather than saving it in browser local storage.
App usage reporting
Usage reporting depends on the club configuration and app version; some builds disable collection entirely. Where enabled, it may include guests, and Android builds may have no in-app opt-out switch. It helps club staff understand app activity, improve content and measure promotion engagement. Earlier Android versions may still have an optional switch. iOS reporting depends on the installed version and its available controls.
When enabled, events may include a random installation identifier, session and visit identifiers, platform, app version, event time, screen, stable content identifiers, promotion views, deliberate actions and link opens. For links opened inside the app, events may include the destination hostname, page-load outcomes, foreground duration and scroll depth.
These usage events do not include your name, email, account ID, membership number, password, form values, membership QR code, precise location or advertising identifier. Full destination URL paths and query strings are not included in these events.
Club staff see aggregated reports. Installation counts represent app copies, not verified individual people. Sponsor reporting describes recorded exposure and engagement; it does not prove purchases. Sponsors do not receive staff access to raw installation, session or journey identifiers through these reports.
Changing the signed-in account in Android, including deletion, clears queued usage events, changes the random usage identity and requests erasure of that installation’s previous raw history. New activity uses the new identifier. An offline erasure request needs a later connection to finish; uninstalling the app before it finishes can remove the local request.
Service providers and external links
Cloudflare hosts the club website. Supabase provides backend services such as account authentication, database storage and app media. Apple and Google services may be involved in sign-in and notification delivery, depending on the app and your choices.
These providers process information needed to supply their services and may process operational or security information under their own terms. Processing locations depend on the configured service and the provider.
If you open a club, sponsor or other external website, that website has its own privacy practices and may use cookies or collect information you provide there. Opening an external website does not give it your app authentication credentials.
Keeping and deleting data
Account, profile and app membership records are kept while your account is active and removed through the account-deletion process, subject to any applicable legal requirements. See account deletion to request removal.
Raw usage retention and scheduled cleanup depend on your club’s backend configuration. The app-specific notice or support can confirm the applicable periods. Where enabled, account-boundary erasure can remove an installation’s previous raw history sooner.
Notification settings are separate from account deletion. Operational logs, support correspondence and backups have separate retention schedules. Contact us for the schedule that applies to your request. Backups expire under provider retention and are not rewritten by an account deletion.
Event history is not a permanent billing ledger. Removal and retention cleanup can change historical reporting totals.
Your choices and rights
You can use the app’s controls to manage notification preferences, update available account details and delete your account. You can also control notifications through your device settings.
Depending on the law that applies to you, you may have rights to request access to your personal information, correction, deletion, restriction, portability or to object to particular processing. Send privacy requests to privacy@3acks.com. We may need to verify your identity before responding.
If you have concerns about how a request is handled, contact us. You may also be able to raise a concern with the data protection authority in your jurisdiction.
Contact 3acks
For privacy questions and data requests: privacy@3acks.com.
For account deletion and app support: support@3acks.com.
We will update this notice when the apps’ data practices change. The date at the top shows when this notice was last updated.