Privacy & Cookie Policy

Information We Collect

Things you give us directly:

• Account information: name, email address, username, password (hashed)
• Profile data: handicap, phone number, home address (optional)
• Activity data: rounds booked, scores posted, friends, messages
• Payment data: processed securely by Stripe — we do not store card numbers
• Camera & photos (mobile only): when you scan a paper scorecard, the captured image is sent to our OCR service to extract pars, yardages, and strokes. The image is processed in-memory and is not retained on our servers after processing. Only the extracted text values (numbers, hole counts) are saved to your round.
• GPS location (mobile only, with permission): used to show tournaments and golf courses near you. Your precise GPS location is only used while you're actively using the app and is not stored on our servers.
• IP address & approximate region: like most web services, our servers receive your IP address with each request. We use MaxMind GeoLite2 to derive your approximate region (e.g., state/metro) from your IP so we can show you relevant local sponsors. We do not store your raw IP address for this purpose, but the derived region may be retained and associated with your account. This is used only to serve locally relevant sponsors — it is not used to track you across other apps or websites. See the IP-Based Location section below for detail.

IP-Based Location (Sponsor Region Targeting)

We distinguish between two kinds of location:

• Precise GPS (mobile, opt-in) — used live to find nearby courses and tournaments. Not stored on our servers.
• IP-derived region — our servers use MaxMind GeoLite2 to translate the IP address of your request into an approximate geographic region (roughly state or metro level). We do not retain the raw IP address for sponsor targeting; the derived region may be retained and linked to your account so we can show sponsors relevant to where you are. This region data is used solely to select which local sponsors to display. We do not sell it, and we do not use it to build cross-app or cross-site advertising profiles.

MaxMind GeoLite2 data is processed locally within our infrastructure. IP-to-region lookups do not send your IP address to MaxMind at request time.

How We Use Your Information

• To provide and improve the GolfSync service
• To send transactional emails (round invites, payment receipts, account notices)
• To send marketing and product update emails — you may opt out at any time in your account settings
• To detect and prevent fraud or abuse
• To comply with legal obligations

How We Share Your Information

We don't sell your personal data. We do share with:

• AWS — cloud infrastructure hosting all application data
• Stripe — payment processing; subject to Stripe's Privacy Policy
• Amazon SES — transactional and marketing email delivery
• Plausible Analytics — privacy-friendly, cookieless product analytics used site-wide to understand aggregate usage (pages viewed, referrers, approximate country). Plausible does not use cookies, does not collect personal data, and does not track you across other sites. Subject to Plausible's Data Policy. You can opt out of Plausible measurement by appending ?plausible_ignore=true to a GolfSync URL, which sets a local flag telling Plausible to ignore your visits, or by enabling “Do Not Track” in your browser.
• Google Sign-In — if you choose to sign in with Google, we receive your Google account's email address, name, and profile picture to create your GolfSync account. We do not access any other data on your Google account and we do not post back to Google on your behalf. You can revoke this access at any time via your Google Account settings.
• Apple Sign-In — if you choose to sign in with Apple, we receive the name and email address (or Apple-provided private relay email) that Apple shares to create your GolfSync account. We do not access any other data from your Apple account. You can manage or revoke this access at any time in your Apple ID settings under “Sign in with Apple.”
• OpenAI — the AI assistant on your dashboard sends your typed messages to OpenAI's API to generate responses, and the mobile app sends scanned scorecard images to OpenAI's vision API to extract pars/yardages/strokes (no image is retained after processing). Both are processed under OpenAI's Privacy Policy. We do not use your assistant messages or scanned cards to train AI models. Do not include sensitive personal information in assistant messages.
• Nominatim / OpenStreetMap — when you search for tee times by zip code, your zip code is sent to the Nominatim geocoding service (operated by the OpenStreetMap Foundation) to look up geographic coordinates. No account or personal data is transmitted. Subject to the OSMF Privacy Policy.
• Law enforcement when required by law
• Other users only to the extent necessary (e.g., your username and score are visible to friends)
• A player's parent or guardian — only where that player's coach has linked them, and only to that player's own information. See Team Programs, Players and Guardians below.

AI Assistant

The “What would you like to do?” assistant on your dashboard is AI (OpenAI), not a human. What you type goes to OpenAI to generate a reply, under their data handling practices. We don't use your assistant messages to train models.

Data Retention

Your data sticks around as long as your account is active. Delete your account from settings any time and we permanently remove your personal data within 30 days.

Your Rights

Depending on where you live, you may have the right to:

• Access the personal data we hold about you
• Correct inaccurate data
• Request deletion of your data
• Opt out of marketing communications
• Lodge a complaint with a supervisory authority (EU/UK users)
• Opt out of the “sale” or “sharing” of personal information (California/CCPA users). We do not sell your personal information.

To exercise any of these rights, email privacy@golfsync.io (or support@golfsync.io). We will verify your request and respond within 30 days as required under the GDPR and CCPA. If we need more time for a complex request, we'll tell you within that window. We won't discriminate against you for exercising these rights.

Email Preferences

Opt out of marketing emails any time from Account Settings. Transactional emails (round invites, payment receipts, security notices) can't be disabled — they're part of how the service works.

Security

We use the standard kit: HTTPS everywhere, encrypted storage, hashed passwords. No system is bulletproof — pick a strong unique password and tell us immediately if you suspect someone got in.

Children's Privacy

GolfSync is not directed to children under 13, and we do not knowingly collect personal information from anyone under 13. If you are under 13, please do not use GolfSync or provide any information about yourself. If you believe a child under 13 has provided us with personal information, please contact us at privacy@golfsync.io and we will delete that information promptly and terminate any associated account, consistent with the Children's Online Privacy Protection Act (COPPA).

Team players aged 13 to 17. Our team program features are used by high schools and clubs, so some players on a roster are minors aged 13 or older. Their information is entered by their school or club coach rather than by the player, and the school or club is responsible for obtaining whatever parental permission its own policies and local law require before adding a player. We do not ask these players to create an account, and we do not collect an email address, phone number or date of birth from them. See Team Programs, Players and Guardians for exactly what is held and who can see it.

A parent or guardian may ask us at any time to show them what we hold about their child, correct it, or delete it — email privacy@golfsync.io. You do not need a GolfSync account to make that request, and we will verify it before acting. A coach can also take a player off the roster at any time, which immediately ends everyone's access to that player, including any guardian's.