The boring but important stuff

Privacy & Cookie Policy

Effective date: April 9, 2026 · Last updated: September 28, 2026

GolfSync is operated by Golf Sync LLC.

The short version

We collect what we need to run GolfSync — your name, email, golf data, and, if you pay for an event, the payment details Stripe needs. We don't sell your data. We don't use ad cookies. We do use Plausible Analytics, a privacy-friendly, cookieless service that doesn't collect personal data or track you across sites. Scanned scorecard images get processed and discarded — we keep the numbers, not the photo. Delete your account any time and we delete its data straight away; backups and logs roll off within 30 days.

Detail below.

Privacy Policy

Information We Collect

Things you give us directly:

Account information: name, email address, username, password (hashed)
Profile data: handicap, phone number, home address (optional)
Activity data: rounds booked, scores posted, friends, messages
Paired watch devices: if you pair a smartwatch to enter scores, we store a device record — the round it is paired to, the watch platform, a device token, and the times it was paired and last used. See Connected Watches and Wearables below.
Payment data: processed securely by Stripe — we do not store card numbers
How you found us: when you create an account we ask how you heard about GolfSync. Answering is optional. We use it in aggregate to understand which channels work.
Push notification tokens: if you allow notifications, we store the token your device's operating system issues so we can send you round and event alerts. It identifies the install, not you personally, and it is deleted when you turn notifications off, delete your account, or uninstall the app.
Event photographs: organizers and participants can upload photos to an event gallery. A photo may show identifiable people. An organizer can mark a gallery public, which publishes those photos on that event's public page and may include them in a screen display at the venue. This is different from the scorecard scanning below — gallery photos ARE stored. If you appear in a photo you want removed, email privacy@golfsync.io or ask the organizer.
Event roles and sign-ups: if you volunteer for an event or act as a scoring official, we record your name, the contact details you give for that role, the shifts or holes assigned to you, and the credential that lets you record scores.
Rosters and event invitations: an organizer or coach can add you to an event or roster by name, and sometimes by email address, before you have an account. We hold that entry so the event can be run and so you can claim your own scores later. If you never claim it, you can ask us to delete it — you do not need an account to make that request.
Sponsor impressions: when a sponsor's logo is displayed to you on a leaderboard or event page, we record that a display happened, on which surface, and for which event, so we can report a sponsor's reach to that sponsor. See Sponsors and Advertising below, including how to opt out.
App update checks: the mobile app checks for over-the-air updates on launch. That check goes to Expo (our app-update provider) and carries the app version, platform, and update channel — not your identity or your golf data.
Camera & photos (mobile only): when you scan a paper scorecard, the captured image is sent to our OCR service to extract pars, yardages, and strokes. The image is processed in-memory and is not retained on our servers after processing. Only the extracted text values (numbers, hole counts) are saved to your round.
GPS location (mobile only, with permission): used to show tournaments and golf courses near you. Your precise GPS location is only used while you're actively using the app and is not stored on our servers.
IP address & approximate region: like most web services, our servers receive your IP address with each request. We use MaxMind GeoLite2 to derive your approximate region (e.g., state/metro) from your IP so we can show you relevant local sponsors. We do not store your raw IP address for this purpose, but the derived region may be retained and associated with your account. This is used only to serve locally relevant sponsors — it is not used to track you across other apps or websites. See the IP-Based Location section below for detail.
Sponsor Network listings: if you list a business in the Golf Sync Sponsor Network, we collect your business's name, website and industry; your name and email address; where and how your business likes to sponsor; and a record of your consent (the wording you agreed to, when, and a scrambled form of the IP address it came from). See Golf Sync Sponsor Network below.

IP-Based Location (Sponsor Region Targeting)

We distinguish between two kinds of location:

Precise GPS (mobile, opt-in) — used live to find nearby courses and tournaments. Not stored on our servers.
IP-derived region — our servers use MaxMind GeoLite2 to translate the IP address of your request into an approximate geographic region (roughly state or metro level). We do not retain the raw IP address for sponsor targeting; the derived region may be retained and linked to your account so we can show sponsors relevant to where you are. This region data is used solely to select which local sponsors to display. We do not sell it, and we do not use it to build cross-app or cross-site advertising profiles.

MaxMind GeoLite2 data is processed locally within our infrastructure. IP-to-region lookups do not send your IP address to MaxMind at request time.

How We Use Your Information

To provide and improve the GolfSync service
To send transactional emails (round invites, payment receipts, account notices)
To send marketing and product update emails — you may opt out at any time in your account settings
To detect and prevent fraud or abuse
To comply with legal obligations

How We Share Your Information

We don't sell your personal data. We do share with:

AWS — cloud infrastructure hosting all application data
Stripe — payment processing; subject to Stripe's Privacy Policy
Amazon SES — transactional and marketing email delivery
Plausible Analytics — privacy-friendly, cookieless product analytics used site-wide to understand aggregate usage (pages viewed, referrers, approximate country). Plausible does not use cookies, does not collect personal data, and does not track you across other sites. Subject to Plausible's Data Policy. You can opt out of Plausible measurement by appending ?plausible_ignore=true to a GolfSync URL, which sets a local flag telling Plausible to ignore your visits, or by enabling “Do Not Track” in your browser.
Google Sign-In — if you choose to sign in with Google, we receive your Google account's email address, name, and profile picture to create your GolfSync account. We do not access any other data on your Google account and we do not post back to Google on your behalf. You can revoke this access at any time via your Google Account settings.
Apple Sign-In — if you choose to sign in with Apple, we receive the name and email address (or Apple-provided private relay email) that Apple shares to create your GolfSync account. We do not access any other data from your Apple account. You can manage or revoke this access at any time in your Apple ID settings under “Sign in with Apple.”
Garmin, Apple and Google (watch platforms) — our watch apps are distributed through Garmin's Connect IQ store, the Apple App Store and Google Play. On a Garmin watch connected to your phone, the app's HTTPS requests to Golf Sync are carried by Garmin's own software on that paired phone. Data you enter is submitted to Golf Sync LLC, not to Garmin, Apple or Google, and none of them has responsibility or liability for it. See Connected Watches and Wearables below.
OpenAI — the AI assistant on your dashboard sends your typed messages to OpenAI's API to generate responses, and the mobile app sends scanned scorecard images to OpenAI's vision API to extract pars/yardages/strokes (no image is retained after processing). Both are processed under OpenAI's Privacy Policy. We do not use your assistant messages or scanned cards to train AI models. Do not include sensitive personal information in assistant messages.
Nominatim / OpenStreetMap — when you search for tee times by zip code, your zip code is sent to the Nominatim geocoding service (operated by the OpenStreetMap Foundation) to look up geographic coordinates. No account or personal data is transmitted. Subject to the OSMF Privacy Policy.
Organizers who list an event on the Golf Sync Sponsor Network: at a listed business's direction, we show its directory details, including its contact's name and email address, to organizers of golf events near it that have an active listing, so they can contact it about sponsoring. We record each time an organizer is shown a business's contact details.
Law enforcement when required by law
Other users only to the extent necessary (e.g., your username and score are visible to friends)
A player's parent or guardian — only where that player's coach has linked them, and only to that player's own information. See Team Programs, Players and Guardians below.

AI Assistant

The “What would you like to do?” assistant on your dashboard is AI (OpenAI), not a human. What you type goes to OpenAI to generate a reply, under their data handling practices. We don't use your assistant messages to train models.

Connected Watches and Wearables

If you pair a smartwatch — Garmin (Connect IQ), Apple Watch, or Wear OS — to enter scores, the watch stores a scoped device token so it can identify you, and sends the tournament, hole number and stroke count you enter to Golf Sync. Your name, team name and standing are sent back to the watch to display. We do not collect GPS, heart rate, or any other sensor or fitness data from your watch.

A stroke you enter is written to the watch's own storage before we try to send it, and stays there until our server confirms it (up to 60 holes), so a dead spot on the course does not cost you a score. When you pair a Garmin we also store a device record — the round it is paired to, the platform, a device token, and the times it was paired and last used.

Data you submit through these watch apps is submitted to Golf Sync LLC and not to Garmin, Apple or Google. Garmin, Apple and Google have no responsibility or liability for that data. Our Garmin app is distributed through Garmin's Connect IQ store, and on a Garmin connected to your phone the app's requests to Golf Sync are carried by Garmin's own software on that phone; your use of Garmin devices is subject to Garmin's privacy policy.

A watch pairing is limited to one round and can only post strokes to that round. You can unpair a watch at any time from Golf Sync on the web, and a pairing is revoked automatically when you sign your card at the end of the round. Unpairing stops that watch posting immediately.

Team Programs, Players and Guardians

Schools and clubs use GolfSync to run a golf team. This works differently from an ordinary account, so it is worth spelling out.

Players do not have GolfSync accounts. A coach adds a player to a roster by name, optionally with a graduation year. The player reaches their own scores through a one-time code that links the app on their device — there is no username or password for a player, and we do not ask a player for an email address, a phone number or a date of birth.

What we hold about a player is the information their coach or their team records: their name, their rounds and scores, practice attendance, and whether they replied to a scheduled session. Coaches can also write private notes about a player; a coach can choose to share an individual note with that player, and unshared notes stay with the coaching staff.

Parents and guardians get read-only access, and only if a coach grants it. A coach invites a parent by email address. A parent cannot attach themselves to a player — someone who knows the family has to vouch for them. Once linked, a guardian can see that player's statistics and practice schedule and nothing else. Specifically, a guardian cannot see other players on the roster, cannot see a coach's notes, and cannot change anything: no scores, no replies, no messages.

Access ends when it should. A coach can revoke a guardian at any time, effective immediately. Taking a player off the roster ends every guardian's access to that player, and archiving a program at the end of a season stops access to it for coaches and guardians alike. Removing a player ends access but does not by itself erase the record — to have a player's information deleted outright, email privacy@golfsync.io.

Data Retention

Your data sticks around as long as your account is active. Delete your account from settings any time and we delete your account data immediately. Copies in our backups and logs roll off within 30 days.

Your Rights

Depending on where you live, you may have the right to:

Access the personal data we hold about you
Correct inaccurate data
Request deletion of your data
Opt out of marketing communications
Lodge a complaint with a supervisory authority (EU/UK users)
Opt out of the “sale” or “sharing” of personal information. We do not sell your personal information.
Opt out of region-based sponsor targeting and sponsor impression reporting — see Sponsors and Advertising for how.
Appeal a decision we make about one of these requests. If we decline, we will tell you why and how to appeal, where the law that applies to you provides an appeal.

To exercise any of these rights, email privacy@golfsync.io (or support@golfsync.io). We will verify your request and respond within the period required by the governing regulations — generally 30 days, and up to 45 days for a request under the CCPA. If we need more time for a complex request, we will tell you within that window and explain why. We won't discriminate against you for exercising these rights.

Email Preferences

Opt out of marketing emails any time from Account Settings. Transactional emails (round invites, payment receipts, security notices) can't be disabled — they're part of how the service works.

Security

We use the standard kit: HTTPS everywhere, encrypted storage, hashed passwords. One deliberate exception: the device token held by a paired watch is stored unhashed, because the watch presents it on every request and we have to match it. That token is scoped to a single round, can only post scores, and you can revoke it at any time by unpairing the watch. No system is bulletproof — pick a strong unique password and tell us immediately if you suspect someone got in.

Sponsors and Advertising

GolfSync shows sponsors — the local businesses that pay to support an event. There are no third-party ad networks, no advertising cookies, and no cross-site or cross-app tracking. Two things happen that you should be able to see and control:

Which sponsors you are shown. We use your approximate region, derived from your IP address as described above, to choose locally relevant sponsors. We do not use your precise GPS location for this.

What we report back to a sponsor. When a sponsor's logo is displayed to you, we record that a display happened, the surface it happened on, and the event it belonged to, so we can tell that sponsor how much reach they got. Reports to sponsors are aggregate counts. We do not tell a sponsor who you are, and we do not build a profile of you for advertisers.

Your opt-out. You can tell us to stop using your region to choose sponsors and to stop counting your impressions in sponsor reporting. Email privacy@golfsync.io and we will apply it to your account and confirm. Once applied, your region is never looked up — we do not geolocate your connection at all — and no impression of yours is recorded. With it applied, you still see an event's own sponsors — they are part of the event, the same way a banner on the first tee is — but your region is not used to choose them and your impressions are not counted.

Some state privacy laws, including the CCPA as amended by the CPRA, may treat region-based sponsor selection or impression reporting as “sharing” personal information for cross-context behavioral advertising, whether or not cookies are involved. The opt-out above is offered so you can decline it regardless of how it is classified.

If There Is a Data Breach

If we discover a breach of security that has led to the unauthorized acquisition of your unencrypted personal information, we will notify you and the authorities that the law requires us to notify, in the manner and within the timeframes that the applicable law sets. Those timeframes differ by state and by country.

Our notice will tell you what happened, what categories of information were involved, what we have done about it, and what you can do — and we will not wait for certainty about every detail before telling you something is wrong. Where the law lets us notify you by email we will use the address on your account, so keep it current.

We investigate every suspected incident. If you think someone has accessed your account, email security@golfsync.io and change your password.

State Privacy Notices (U.S.)

More than twenty U.S. states now give residents specific privacy rights. The rights in Your Rights are offered to everyone, whatever state you live in. This section collects the disclosures those laws ask to see in one place.

Categories of personal information we collect, and why: identifiers (name, username, email, phone, postal address) to create and run your account; commercial information (event registrations, purchases, contributions) to process what you buy; internet activity (pages viewed, features used) to operate and improve the Service; approximate geolocation derived from IP to select local sponsors; precise geolocation, only while you actively use the mobile app, to find nearby courses; audio-visual information (photographs you or an organizer upload); and professional or education-related information, in the narrow case of a school or club team program. The Information We Collect section lists these in full.

Sensitive personal information. We do not collect government identifiers, financial account numbers, precise health data, biometric data, racial or ethnic origin, religious belief, sexual orientation, or the contents of your mail. We do not collect payment card numbers — Stripe does. A handicap index is a golf statistic, not health information, and we do not treat it as such or share it as such.

Sale and sharing. We do not sell personal information, and we have not sold personal information in the preceding twelve months. We do not share personal information for cross-context behavioral advertising by a third party. See Sponsors and Advertising for the one activity that could be characterized that way, and its opt-out.

The Sponsor Network. A business listed in the Sponsor Network directs us to disclose its contact details to organizers with an active listing. We treat that as a disclosure the business directs, not a sale, and the business can stop it at any time by removing its listing.

Retention. We keep your personal information while your account is active and delete it immediately when you delete the account (copies in backups and logs roll off within 30 days), except where we must keep a record longer to comply with tax, accounting, or legal obligations — a payment record, for instance.

How to exercise a right. Email privacy@golfsync.io, or use the controls in Account Settings. We will verify your identity against the account before acting. An authorized agent may submit a request on your behalf with written permission that we can verify. We do not charge for this and we do not discriminate against you for asking.

Residents of California, Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah and Virginia — among others — have rights of this kind under their own state statutes. Where your state grants a right this policy does not name, you have it anyway: email us and we will honor it.

Children's Privacy

GolfSync is not directed to children under 13, and we do not knowingly collect personal information from anyone under 13. If you are under 13, please do not use GolfSync or provide any information about yourself. If you believe a child under 13 has provided us with personal information, please contact us at privacy@golfsync.io and we will delete that information promptly and terminate any associated account, consistent with the Children's Online Privacy Protection Act (COPPA).

How we check. Creating an account requires you to confirm you are at least 13, and our Terms of Service make that a condition of using the Service. We do not otherwise verify age at sign-up. If we learn an account holder is under 13 we close the account and delete the information.

Team rosters. A coach who adds a player to a team roster is responsible under our Terms of Service for confirming that the player is 13 or older, and for obtaining whatever parental permission their school or club requires. A roster entry is created by the coach, not by the player: we do not ask a rostered player for an email address, a phone number or a date of birth.

Team players aged 13 to 17. Our team program features are used by high schools and clubs, so some players on a roster are minors aged 13 or older. Their information is entered by their school or club coach rather than by the player, and the school or club is responsible for obtaining whatever parental permission its own policies and local law require before adding a player. We do not ask these players to create an account, and we do not collect an email address, phone number or date of birth from them. See Team Programs, Players and Guardians for exactly what is held and who can see it.

A parent or guardian may ask us at any time to show them what we hold about their child, correct it, or delete it — email privacy@golfsync.io. You do not need a GolfSync account to make that request, and we will verify it before acting. A coach can also take a player off the roster at any time, which immediately ends everyone's access to that player, including any guardian's.

Cookie Policy

What Are Cookies?

Small text files your browser stores on your device. We use them only where strictly necessary — to keep you signed in and to remember your cookie consent choice. We do not set cookies for advertising, and our usage analytics (Plausible) are cookieless.

Cookies We Use

Cookie	Purpose	Type	Duration
auth_token	Keeps you signed in to GolfSync	Essential	Session / 7 days
gs_cookie_consent	Remembers your cookie consent choice	Essential	1 year
__stripe_mid, __stripe_sid	Set by Stripe.js on payment/checkout pages for fraud prevention and to secure your payment session. Present only when you reach a Stripe-powered checkout.	Essential (payments)	__stripe_mid: 1 year · __stripe_sid: 30 min

No advertising cookies and no cross-site tracking cookies. We measure aggregate usage with Plausible, which is cookieless and sets none of the cookies above.

Managing Cookies

Your browser controls cookies. Disabling the auth_token cookie signs you out. Every browser handles cookie settings a little differently — check your browser's help if you need to block, delete, or get notified about them.

Where We Operate

GolfSync is operated from the United States and is directed to users in the United States. Our apps are listed in app stores that are available worldwide, but we do not market the Service to residents of other countries and we do not design it around the requirements of their privacy laws.

If you use GolfSync from outside the United States, your information is transferred to and processed in the United States, where privacy law differs from your own. Where this policy mentions rights or timeframes drawn from the EU/UK General Data Protection Regulation, we offer those as a matter of policy — they are not a representation that the Service operates a GDPR compliance program, that we have appointed a representative in the EU or UK, or that we have put a specific transfer mechanism in place. If you are in the EU or UK and want your information deleted, email privacy@golfsync.io and we will do it.

Contact

GolfSync is operated by Golf Sync LLC. Privacy questions or data-subject requests? Email privacy@golfsync.io or support@golfsync.io, or hit the Support page. Postal mail: Golf Sync LLC, 8301 Fulham Dr, Richmond, VA 23227.