Privacy Policy

Last updated November 6, 2026

This policy describes what Where I've Golfed ("we," "us") collects, how we use it, and the rights you have over it.

Account information you provide

When you create an account, we collect:

• Email address — used to authenticate you and recover your account.
• Display name — shown on your profile and to your friends.
• Username — shown in friend search and on your profile.
• Avatar image (optional) — shown on your profile and to your friends.

You can create your account either by entering an email address and password, or by using Sign in with Apple. If you use Sign in with Apple, Apple confirms your identity to us and shares your name and an email address; we never see your Apple password. You choose your username in the app either way, since Apple does not provide one.

If you choose "Hide My Email" when signing in with Apple, the address we receive is a private relay address ending in @privaterelay.appleid.com rather than your real one. Messages we send to it are forwarded to you by Apple, and we never learn the address behind it. You can stop that forwarding at any time in your device settings under Apple ID → Sign in with Apple, though doing so means we can no longer reach you about your account.

If you do not create an account, the app stores course data locally on your device only. No information is sent to our servers in anonymous mode.

Content you create in the app

As you use Where I've Golfed, you create the following content, which is stored on our servers and visible only to you (and, if you accept friend requests, to your friends):

• Courses you've played — the course's name, address, latitude/longitude (sourced from Google Places when you select the course; we do not record your own location), the date you played, your personal notes, your rating, your score, and how many times you've played.
• Trips — names, dates, color tags, and any notes you add.
• Photos — pictures you upload to courses or trips. Photos may contain other people, locations, license plates, or other personal information that you choose to include. We do not strip EXIF metadata from your uploaded photos.
• Your home course designation — which of your played courses you've marked as your home course.
• Friends and friend requests — the list of people you've accepted as friends and pending requests in both directions.

Information generated automatically

• Authentication tokens — needed to keep you signed in. Stored securely on your device and on our authentication provider (Supabase).
• Timestamps — when records were created and last updated.
• IP address and standard server logs — collected by our infrastructure providers (Supabase, Google Cloud, Mapbox) when your device makes requests. We do not use these for tracking across services.
• App usage analytics — which in-app actions you take (for example, logging a course, creating a trip, or sharing a passport card), plus basic device and app-version information, collected through our analytics provider (PostHog) so we can understand which features people use. This is first-party product analytics only — it is never used for advertising, never shared with ad networks or data brokers, and does not involve tracking you across other companies' apps or websites.

What we do not collect

• We do not collect your real-time location or GPS data. The latitudes and longitudes in the app are for golf courses you select, not for you.
• We do not collect biometric data. Face ID or Touch ID, if used, is handled by your device and never sent to us.
• We do not collect device advertising identifiers (such as IDFA on iOS) and do not show the App Tracking Transparency prompt.
• We do not collect health or fitness data.
• We do not access your contacts list, calendar, or photo library beyond photos you explicitly select.
• We do not collect your phone number.

Third parties who process your data

The following service providers process your data on our behalf under Data Processing Agreements. We do not sell your data to advertisers or data brokers.

• Supabase — authentication, database storage, file storage. Hosts our backend infrastructure.
• Google Cloud (Places API) — search queries and selected course details. Powers course search; queries are sent through our server, not directly from your device.
• Mapbox — map rendering and tile delivery. Displays the map view in the app.
• Apple — iOS app distribution, Sign in with Apple authentication, and operating the private email relay for users who choose "Hide My Email."
• PostHog — in-app feature usage events (e.g. course logged, trip created, passport card shared), device/app-version metadata. Helps us understand which features people use.

Your rights and how to exercise them

You can exercise most of these directly in the app; for anything not available in-app, contact us at the address below.

• Access: View all your data in the app at any time via the Map, Passport, and Profile tabs.
• Correction: Edit your display name, username, avatar, course details, and trip details directly in the app.
• Deletion: Delete individual courses and trips at any time. Delete your entire account in Profile → Delete Account. Account deletion removes your profile, all your courses, all your trips, all your photos, and your authentication credentials. Photos are removed from storage within 30 days of account deletion.
• Portability: Contact us to request a copy of your data.
• Withdrawal of consent: Delete your account at any time to withdraw consent for all processing.

If you are an EU resident exercising rights under GDPR, or a California resident exercising rights under CCPA/CPRA, the same flows apply. We do not differentiate by jurisdiction — everyone gets the same access, correction, deletion, and portability rights.

Children under 13

Where I've Golfed is not directed at children under 13. The app is positioned for golfers of all ages above that line, and we do not market to children. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has created an account, contact us below and we will delete the account promptly.

Photo content

Photos you upload may contain personal information about other people (faces, license plates, identifying backgrounds). By uploading a photo, you confirm that you either took it yourself or have permission to use it, that you have permission from any identifiable individuals to share their image (or the photo was taken somewhere they had no reasonable expectation of privacy), and that it doesn't infringe copyright or violate our Terms of Service. We do not strip EXIF metadata from uploaded photos — if that matters to you, strip it yourself before uploading.

Data retention

• Active accounts: We retain your data for as long as you have an active account.
• After account deletion: Database rows are deleted immediately. Photo files are removed from storage within 30 days.
• Anonymous-mode data: Stored only on your device. Cleared when you uninstall the app or clear your device's app data. We never receive a copy.

Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be surfaced in-app before they take effect. The "last updated" date above always reflects the most recent change.

Contact

For privacy-related questions, requests to exercise your rights, or to report a concern about a child's account, contact us at whereivegolfed@gmail.com.