Privacy policy

Last updated 4 September 2026. This policy applies to the ClubCard Golf iPhone app and the organizer website at app.clubcardgolf.com.

Who we are

ClubCard Golf is a tournament platform for golf clubs. Players score rounds on their phone. Organizers run events on the web. Questions: support@clubcardgolf.com.

What we collect

We collect only what the product needs to run a tournament:

Account: name, email, password (stored by our auth provider, never in plaintext), optional phone number, optional handicap index and GHIN number, and an optional profile photo you choose from your library.
Club and tournament records: club membership, registrations, teams, playing groups, scores, hole captures, closest- to-the-pin and other contest measurements you or your group enter, and the name plus drawn signature you and your marker put on a returned scorecard.
Friends and notices: friend requests you send or answer, who you are friends with, who you signed up for a tournament with, and the in-app notices those actions create (a request, an acceptance, or a friend entering you in a club event).
Sign-in protection: a Cloudflare Turnstile token when you sign in, used only to tell humans from bots.
On-device cache: the phone stores your session and an offline copy of the active tournament so scoring still works without signal. That copy stays on the device.
Rules assistant (optional): a question you type and, if you attach one, a photo of a rules situation. Those are sent to answer that question and are not stored. Closing scoring drops the chat on the phone.

We do not collect precise or coarse location, contacts, microphone, or advertising identifiers. A profile photo is optional and comes from the photo you pick — we do not access the rest of your library. Camera is used only when you take a photo for the Rules assistant. The Tournaments home card may fetch a public forecast for the course (not your phone) so it can show a high and low around tee-off. We do not run analytics SDKs or ad networks. We do not track you across other companies' apps or websites, so we do not show an App Tracking Transparency prompt.

How we use it

Account data identifies you to your club and signs you in. Tournament data is the scorecard: live leaderboards, skins, closest-to-the-pin, and the rest of the competition. A Rules question and optional photo are used only to return a USGA Rules of Golf answer. We do not sell personal data. We do not use it for advertising.

Who we share it with

Infrastructure processors that host the service, under contracts that require them to protect the data as we do:

Supabase (authentication, database, storage, realtime) — United States.
Vercel (the organizer website) — United States.
Vercel AI Gateway and Anthropic, when you use the Rules assistant. The question and any attached photo go to the model to produce the answer and are not kept by ClubCard Golf.
Cloudflare (Turnstile bot check on sign-in).
Resend (transactional email such as confirmations and invitations).
OpenGolfAPI / OpenStreetMap contributors, when a club imports a course. That is map data, not your account.

Players in the same club or tournament can see the names, optional profile photo, and scores that belong to that event. That is the product. Members of a club can also see a directory of that club: each member's name, optional photo and handicap index, and the events in that club they have played. Email addresses and phone numbers are not shown in the directory. Friends can enter each other in club events that are open to the club; you agree to that when you accept a friend request, you are notified when it happens, and you can withdraw yourself while sign-ups are open. Declining a request stops that person from asking again.

Retention and deletion

You can delete your account from the iPhone app (Account → Delete my account) or from the website (profile circle → Security). Deletion removes your login and personal details (name, email, phone, handicap, GHIN, profile photo), your friendships and your notices. Tournament scores you already entered stay on the card, attributed to "Deleted Player", because rewriting history would change other people's results. If you are the only administrator of a club, transfer that role first — a club cannot be left with no admin.

You can also email support@clubcardgolf.com to ask what we hold or to request deletion.

Children

The app is built for adult golfers and club organizers. It is not directed at children under 13, and we do not knowingly collect personal information from them.

Security

Access is scoped by row-level policies in the database. Passwords meet a 12-character class requirement and are checked against known leaks. Optional authenticator-app two-factor is available on the website.

Changes

If this policy changes in a material way we will update the date above and post the new policy at this URL. Continued use after that date is acceptance of the update.