Privacy policy
Effective date: 2026-10-15
StraightCue is a pool-drill training app: a library of drills, a drill editor, and a record of your practice. This policy says what personal data the app and the website collect, why, who else touches it, how long it is kept, and how you delete it. It is written to be read, not skimmed; it is short because the app collects little.
StraightCue is a product of Comotoca (comotoca.com), Spain ("we"). Contact for anything in this policy: privacy@comotoca.com.
What we collect
Account. Your email address, whether it has been verified, and either a password (stored only as a salted hash; we cannot read it) or, if you sign in with Apple, Google or Facebook, the identifier the provider sends us for you. For Sign in with Apple we also store a token Apple gives us for the sole purpose of telling Apple to revoke your sign-in when you delete your account. Email verification and password reset use one-time links sent to your address; the tokens in them are stored hashed and expire.
Profile. What you choose to enter: a display name, a Fargo rating, a preferred table size. All optional.
Training data. The drills you create or edit, the training sessions and tests you record (which drill, when, each attempt's result, scores), and notes you write on a session (running a routine records its drills as training sessions). This is the content of the app; it exists so you can see it.
Purchases. If you subscribe to StraightCue Pro through the App Store, Apple sends us signed records of the purchase and of every later event (renewal, cancellation, expiry, refund). We store those records as Apple sends them: the subscription and transaction identifiers, the product, prices and currency, the storefront country, purchase, expiry and revocation dates, offer details, and whether the subscription will renew. From them the app knows you are a subscriber. We never see your payment card or billing address; Apple handles payment. Apple attaches your StraightCue account id to the transaction so that its later notices reach the right account.
Sessions and logs. Each sign-in creates a session token (stored hashed) with the type of client (web or iOS), the browser or app identifier it sent, and when it was last used, so you can see and revoke your sessions. Our server keeps a request log with the IP address, time, path and status of each request, and operational messages that can name your account id or your Apple sign-in identifier, used to operate the service and investigate abuse. The web app keeps your session token in your browser's local storage; it sets no cookies.
What we do not collect. No analytics or tracking SDK, no advertising identifiers, no location, no contacts, no device fingerprinting. We do not use the Google or Facebook SDKs: when you sign in with them, your device obtains a signed identity token from the provider and sends it to us; what the provider records about that sign-in is governed by its own policy.
Why
We process this data to provide the service you asked for (your account, your drills and records, your subscription), to keep it secure (verification, hashed secrets, session control, abuse investigation), and to meet legal obligations such as keeping records of paid transactions. Where consent is the legal basis (an optional profile field, a provider sign-in you choose to use), you give it by the act itself and withdraw it by removing the data or deleting the account.
Who else touches the data
- DigitalOcean, LLC hosts our server and database in its San Francisco, United States region. All data in this policy is stored there, encrypted in transit.
- Resend, Inc. delivers our transactional email (verification and password-reset links). It receives your email address and the message.
- Apple Inc. when you use Sign in with Apple or subscribe through the App Store; Apple's privacy policy applies to what Apple collects.
- Google LLC and Meta Platforms, Inc. only if you sign in with them, and only as the issuer of the identity token your device sends us.
We do not sell personal data, share it for advertising, or give it to anyone else except as required by law. If we add a provider, for example for off-site backups, we name it here before it receives data.
International transfer
If you are outside the United States, your data is transferred to and stored in the United States, where our hosting provider operates. By using StraightCue you accept this transfer; where the law requires a safeguard, we rely on our providers' standard contractual clauses.
How long
Account, profile, training and subscription data stay for as long as your account exists. Database backups are kept for up to 90 days and then deleted, so a deleted account disappears from backups within 90 days. Records of paid transactions are kept, detached from any account, for the period Spanish tax and commercial law require, at most six years from the transaction. Server logs are kept for up to 30 days. Session tokens expire after 30 days or when you revoke them.
Your rights and controls
- See and change your profile and training data in the app at any time.
- Export: email us and we send you a copy of your data in a machine-readable form within 30 days.
- Delete your account yourself, immediately, in the app (Settings → Delete account) or in the web app. Deletion removes your account, profile, sessions, sign-in identities, training data and subscription at once, and asks Apple to revoke your Sign in with Apple (a best-effort request; a failure does not stop the deletion). One thing stays: the records of paid transactions described under "Purchases", detached from the deleted account, because tax and commercial law require us to keep them (see "How long"). An active App Store subscription is not cancelled by deleting the account: cancel it in your Apple ID settings, or Apple keeps charging you.
- Correct, restrict or object: email us. You may also complain to a data-protection authority; ours is the Spanish Data Protection Agency (AEPD, aepd.es), and if you live elsewhere in the EU/EEA or the UK you may use your own.
Children
StraightCue is not directed at children under 13, or under the age at which your country lets you consent to an online service without a parent. We do not knowingly collect data from children; if you believe a child has an account, email us and we will delete it.
Security
Connections use TLS. Passwords are hashed with argon2; session and email tokens are stored hashed; the server refuses weak passwords and limits sign-in attempts. No system is perfectly secure, and we will notify affected users of a breach as the law requires.
Changes
We will post changes on this page and update the effective date. A change that reduces your rights or widens what we collect is announced in the app before it takes effect.
Contact
privacy@comotoca.com