Spotter / Nscit Ballistics App Privacy Policy
Last updated: November 2, 2026.
1. Who we are and what this policy covers
Nova Outdoor Alliance LLC ("we", "us" or "our") is responsible for the processing described in this policy. It applies to the Spotter / Nscit Ballistics mobile app on Android and iOS and the account, device, cloud profile and support services used by the app.
Contact us about privacy or your personal data at chauncyzhang0618@gmail.com. Please identify the app in your message.
Shopping on nscit.us is covered separately by the website privacy policy. Opening a store page from the app brings you to that website; its shopping and website practices should not be read as a description of all app features.
2. Information we process and why
Account information. When you register, sign in or reset your password, we process the email address or phone number you use, your password or verification code, your account identifier and account profile information. We use this information to create and authenticate your account, deliver verification messages and recover access. Our account service receives passwords and stores password hashes.
Apple and Google sign-in. If you choose a supported third-party sign-in option, we process the provider's user identifier, sign-in token or authorization code, and the email, profile and verification information supplied by that provider. This can include name or profile-image information where included in the provider's response. We use this information to authenticate you and maintain the connection to your app account. We do not receive your Apple or Google password. Sign in with Apple is offered on iOS; Google sign-in is supported on Android and iOS.
Phone and session information. Updated versions send an app-generated random installation identifier with account requests, along with the phone model or device name and client platform. The identifier is stored in local app data and is not an IMEI, MAC address, OAID or Spotter serial number. Signing out does not reset it. Clearing local app data can create a new identifier; restoring a device backup may restore the previous value. Our services also process IP address, User-Agent, session identifiers, sign-in and activity information, and request logs to maintain sessions, manage account access, protect the service and investigate faults. The app stores session credentials and account information locally so it can keep you signed in; it may also remember the phone number you last entered.
Connected devices. Bluetooth features process nearby compatible-device identifiers, broadcast names, pairing information and device information to discover, connect to and communicate with your device. Pairing information is stored locally. When you confirm cloud binding, we send your device serial number, model, binding source and firmware versions to our service and associate them with your account. We maintain binding status and related history to provide device-management services. Unbinding a device does not erase all historical records.
Ballistic profiles. The app stores your ballistic profiles and settings locally. These may include firearm and projectile parameters, muzzle velocity, zeroing and environmental settings, and ballistic tables. When you choose cloud upload, the profile data is sent to our service and stored under your account so you can retrieve it. An environmental value entered in a profile is part of that profile; it does not by itself mean the app has obtained your geographic location.
Device feedback. When you send device feedback, the app reads a diagnostic snapshot from the connected device and sends the device log, serial number, app version, submission time, time-zone information and report identifiers to our support service under your account. We use the report and its parsed diagnostic events to investigate technical problems. Authorized support and technical personnel may access it for that purpose. A completed report may remain locally while upload is pending or unsuccessful; the app removes that pending copy after it confirms a matching server receipt. Removing the pending copy does not remove the server report. Local app troubleshooting records may also be copied to the clipboard when you choose that action.
Updates and online content. When you check for firmware updates or load online content, our services process the request and relevant version information to return compatible updates or content. Download and content providers receive the network information needed to deliver the requested resources.
3. Permissions and platform differences
Bluetooth access enables device discovery, connection, configuration, diagnostics and firmware transfers. iOS also declares Bluetooth background capability. Android permission prompts differ by Android version and may include Bluetooth, Nearby devices or location permission associated with device discovery. You can manage permissions in your phone settings; denying or revoking a required permission can prevent the corresponding feature from working.
Our Bluetooth business functions do not send GPS coordinates to our backend. This does not exclude location inferred by a sign-in provider from an IP address, as described below. Older app versions may send a phone-runtime identifier with account requests; depending on Android version and runtime, it may be derived from IMEI, MAC address or a runtime-generated value. Updated versions replace this login metadata with the random installation identifier described in section 2. This change does not erase previously stored session records; those records remain subject to section 6.
Android releases can declare additional phone, account, storage, media or camera-related permissions through their runtime and packaged components. A permission declaration does not mean that every feature reads or uploads that category of data. Our device-feedback feature sends device diagnostic logs; it does not provide a photo-library or camera-upload feature. We describe the actual app features and native providers separately below.
4. Service providers and other recipients
Alibaba Cloud hosts our primary application servers and MySQL account database in Singapore. Alibaba Cloud SMS delivers phone verification messages; the service has mainland China and international delivery routes. Alibaba Cloud OSS in Hangzhou, China supplies firmware and online content. These services process the account, message, stored-data or network information needed for their respective functions. Firmware storage is distinct from our account database and device-feedback database.
Tencent enterprise email delivers email verification messages and processes recipient addresses, message contents and delivery information. If you contact our privacy mailbox, Google/Gmail processes the email and information you choose to include. Authorized support and technical personnel use relevant account or diagnostic information to handle faults and privacy requests. We require providers processing personal data on our behalf to protect it consistently with this policy and applicable requirements.
DCloud App engine, provided by Digital Heaven (Beijing) Network Technology Co., Ltd., runs the app and supports performance and fault diagnosis. DCloud discloses processing device/environment information, a random anonymous identifier, app and SDK information, error stacks, startup timing and memory use. The packaged iOS engine also declares crash diagnostics. Disabling the separate uniStatistics feature does not turn off every engine diagnostic function. See the DCloud engine privacy policy.
Google Sign-In is integrated through the JY-GoogleSignin plugin. When used, Google may process account/profile information, user and device identifiers, IP address, approximate location inferred from IP, and sign-in/SDK usage information for authentication, security and diagnostics. The information Google processes is not all sent to our backend; our sign-in receipt is described in section 2. See Google Sign-In data practices and the Google privacy policy.
Sign in with Apple is provided by Apple Inc. Apple supplies a provider identifier and the name/email information you authorize, which may include a private relay address. Apple may use account and device-use information for fraud prevention. When deleting an Apple-linked app account, we request fresh authorization where needed to revoke the app's Apple authorization. See Sign in with Apple and privacy.
Updated Android releases disable the runtime's default MSA OAID component. Older Android releases may still contain that component, which supports OAID access depending on platform and runtime configuration. We do not use it for advertising. It is separate from the app-generated installation identifier. Provider information is available from the Mobile Security Alliance.
Our own Spotter OTA component performs local Bluetooth transfers with the connected device. It is not a separate external advertising or analytics recipient. Opening a Shopify store page is separately covered by the website privacy policy.
5. Storage, security and international processing
Our primary application servers and account database are in Singapore. Local app data is also stored on your phone. Firmware/content delivery is configured in Hangzhou, China. Depending on your location and the providers involved, information may be processed outside your country, including in Singapore, China and countries used by Apple, Google or messaging providers. The primary storage location does not describe every recipient's processing location.
The app connects to our API using HTTPS with certificate verification. Verification email delivery uses TLS to the mail provider. The account service uses password hashing and session controls, and support-report access is restricted by ownership or authorized support permissions. These measures do not mean that every internal connection or every stored backup is encrypted. No method of transmission or storage is completely secure.
Where applicable law requires safeguards for international transfers or restricts a transfer, those requirements apply to our processing. Contact the privacy address for information about the arrangements applicable to your data or to exercise your rights.
6. Retention and account deletion
We retain account information and cloud profiles while needed to provide the service. We retain feedback and operational logs only while needed for troubleshooting, security or applicable legal obligations. Account deletion covers your account profile, authentication methods and sessions, cloud ballistic configurations, device-binding records, device feedback and associated app update records. It does not erase your separate Apple or Google account or automatically erase data already stored on your physical Spotter device.
To request deletion, open Settings in the app and select Delete account, or visit the account deletion page. Follow the account-verification steps and explicitly confirm deletion. You may need to sign in again or complete Apple reauthorization. Do not send a password or verification code to the privacy mailbox.
Keep the deletion receipt so you can check the status even after you are signed out. A submitted or pending request is not a statement that erasure has finished. After verification is complete and the request is accepted for processing, account access is disabled and our privacy contact coordinates completion with the technical team. We aim to complete verified requests within 30 days and provide the outcome through the request-status page; contact us with your request reference if you need assistance.
If the account also has transactions, business-support records or records subject to a legal obligation, we review those dependencies before completion. We will explain any information that must be retained, the reason and the applicable period. Such a review is not reported as completed deletion. A minimal deletion record may remain to demonstrate fulfillment, provide status and prevent deleted data being restored.
Logical database backup copies are retained for no more than 30 days; the currently configured cloud automatic database and log backup retention is 7 days. Backup expiry is separate from deletion in the active service. Deleted account data must be removed again before a backup is restored to an accessible service. We maintain a restricted deletion journal for that purpose while needed to cover restorable copies and the deletion process.
Logging out, uninstalling the app or unbinding a device does not itself delete your cloud account. To delete data stored only on your phone or connected hardware, use the relevant local controls; cloud account deletion is not a factory reset of the device.
7. Your choices and privacy rights
You can manage permissions in your device settings, choose whether to use third-party sign-in, choose whether to upload profiles, and choose whether to send device feedback. Revoking a permission or stopping a feature does not automatically erase information previously sent to our services.
Depending on the law that applies to you, you may have rights to access, correct, delete or obtain a copy of your information, to object to or restrict certain processing, or to withdraw consent where processing relies on consent. Contact chauncyzhang0618@gmail.com to make a request or raise a concern. Applicable exceptions and identity verification may apply. Where available under local law, you may complain to your data-protection authority.
8. Age eligibility
The app is intended for people aged 16 and over and is not intended for children under 16. A parent or guardian who believes a child under 16 has provided personal information should contact chauncyzhang0618@gmail.com so that we can investigate and coordinate removal. Local legal requirements may impose additional conditions on use or consent.
9. Changes and contact
We will publish changes to this policy on this page with an updated date, and provide additional notice where required. Privacy questions and requests should be sent to Nova Outdoor Alliance LLC at chauncyzhang0618@gmail.com.