Privacy Policy
Last updated: 18 July 2026
1. Who we are
Bonnie Dancer is operated by Craig Anderson, a sole trader based in Scotland, United Kingdom.
As the data controller, Craig Anderson is responsible for deciding how and why your personal data is used.
Contact: canderson8489@gmail.com
2. What data we collect
We collect only the data needed to provide the app. This includes:
Account information
Your name and email address, collected when you create an account.
Dancer profiles
The name, grade, and optionally date of birth and SOBHD card number of each dancer you add. This data belongs to you and is only visible to you.
Competition results
Competition names, dates, locations, dances entered, and placings that you record in the app.
Photos
Competition photos you choose to upload. These are stored securely and only visible to you.
Payment information
If you subscribe, your payment is processed by Stripe. We do not store your card details — Stripe handles all payment data under their own privacy policy.
Push notification token
If you enable push notifications, we store a device token to send you competition reminders. This is never used for marketing.
Technical data
IP addresses and browser information processed by our hosting provider (Vercel) in the normal course of serving the app. We do not use analytics tools and do not track your behaviour within the app.
3. Why we use your data
We process your data under the following lawful bases:
- ▸Contract performance: To create and manage your account and provide the features you signed up for.
- ▸Legitimate interests: To keep the app secure, fix bugs, and improve reliability. We do not use your data for profiling or advertising.
- ▸Consent: To send push notifications — you can withdraw consent at any time in your device settings.
- ▸Legal obligation: To retain payment records as required by UK law (typically 7 years).
4. Who we share data with
We do not sell or share your data with third parties for marketing. Your data is shared only with the following service providers, solely to operate the app:
Supabase — Database and authentication
Frankfurt, Germany (EU)
All app data is stored here. Supabase is EU GDPR compliant.
Vercel — App hosting and content delivery
Global CDN (EU edge nodes used where possible)
Serves the app to your device.
Stripe — Payment processing
United States (EU Standard Contractual Clauses in place)
Handles subscription payments. We never see your card number.
5. How long we keep your data
- ▸Account and dancer data is kept for as long as your account is active.
- ▸If you delete your account, your data is permanently deleted within 30 days.
- ▸Payment records are retained for 7 years as required by UK financial regulations.
- ▸Push notification tokens are deleted if you withdraw consent or delete your account.
6. Cookies and local storage
We use cookies solely for keeping you signed in (authentication session cookies set by Supabase). We do not use advertising, tracking, or analytics cookies.
We also use your device's local storage to save draft competition entries so they are not lost if you close the app. This data never leaves your device unless you submit it.
7. Children's data
Bonnie Dancer is designed for parents and guardians of Highland dancers. Accounts must be created by an adult (18+). Dancer profiles may include information about children; as the account holder, you are responsible for ensuring you have the right to enter and store this information.
We do not knowingly collect personal data directly from children under 13.
8. Security
Your data is stored in Supabase's EU infrastructure with row-level security — meaning your data can only be accessed by your account. Connections are encrypted in transit (HTTPS/TLS). Passwords are hashed and never stored in plain text.
No system is completely secure. If you have concerns about your account, contact us immediately at canderson8489@gmail.com.
9. Your rights under UK GDPR
You have the following rights regarding your personal data:
Right of access
Request a copy of the personal data we hold about you.
Right to rectification
Ask us to correct inaccurate or incomplete data.
Right to erasure
Ask us to delete your data. You can also do this directly by deleting your account in Settings.
Right to portability
Request your data in a portable format.
Right to restrict processing
Ask us to limit how we use your data in certain circumstances.
Right to object
Object to processing based on legitimate interests.
To exercise any of these rights, email canderson8489@gmail.com. We will respond within 30 days.
You also have the right to lodge a complaint with the UK's supervisory authority: the Information Commissioner's Office (ICO) at ico.org.uk.
10. Changes to this policy
We may update this policy from time to time. If we make significant changes, we will notify you within the app. The date at the top of this page always reflects the most recent version.