Privacy Policy

1. Who we are

Strokes & Stakes (“we,” “us,” or “the app”) is an independent web application based in Texas, USA. The service is available at strokesandstakes.com and as a Progressive Web App (PWA) installable on phones and tablets.

This policy explains what information we collect when you use Strokes & Stakes, how we use it, and what choices you have. By using the service, you agree to the practices described here.

2. What we collect

Information you give us

• Account information: your email address and a password (stored as a salted hash by our authentication provider, Supabase). You cannot create an account without these.
• Profile details: display name, golf handicap, and optional home club name. You may update or remove these at any time.
• Round data: golf rounds you create or join — course, date, players, hole-by-hole scores, par values, side bets, wager amounts, and settlement results.
• Buddy connections: requests you send or accept to connect with other players.
• Invitations: email addresses you enter to invite friends to a round or to be your buddy.

Information collected automatically

• Usage and device data: via Google Analytics 4, we collect anonymized data about which pages you visit, how long you stay, your approximate location (city level, derived from IP), device type, browser, screen size, and referring website.
• Cookies and local storage: we use browser cookies and localStorage to keep you signed in, remember preferences, and back up an in-progress round so it survives a page reload.
• Push subscription tokens: if you opt in to notifications, your browser provides us a token that lets us send push messages. The token does not identify you personally.

Information from third parties

• Golf course data: when you search for a course, we proxy your query to the GolfCourse API and store the returned course details (name, location, tee boxes, hole pars, stroke index) so we can use them in your round.

3. How we use your information

We use the information we collect for the following purposes:

• Provide the service: create your account, save your rounds, calculate scores and settlements, sync data across your devices, and display live round views to people you invite.
• Send notifications: transactional emails (round invites, buddy requests, buddy acceptance confirmations, and post-round “rival activity” summaries) and push notifications you have opted into.
• Improve the app: understand which features are used, where users get stuck, and how to make the product better.
• Communicate with you: reply to support requests, respond to feedback, and send occasional product announcements (you can opt out of marketing emails at any time).
• Keep the service safe: detect abuse, prevent fraudulent signups, and enforce our Terms of Service.
• Comply with law: respond to lawful requests from courts, regulators, or law enforcement.

4. Who we share it with

We do not sell your personal information. We share data only with the service providers (“sub-processors”) that help us run the app, and only as needed:

• Supabase — hosts our database, handles authentication, and powers realtime updates. (Supabase privacy)
• Resend — delivers our transactional emails. (Resend privacy)
• Google Analytics 4 — provides anonymized usage analytics. (Google privacy)
• Google Fonts — serves the typefaces we use. Loading the fonts shares your IP address with Google.
• GolfCourse API — provides course and hole data when you search for a course. Search terms are sent to the API to return results.
• Web hosting provider — serves the application files.

We may share your information with other players you choose to connect with (e.g., your name, handicap, and scores in a shared round are visible to the other players in that round). Public profile pages, if you choose to enable one, display your name, avatar, and a summary of your win/loss record to anyone with the link.

We may also disclose information if required by law, in response to a valid legal process, or to protect the rights, property, or safety of our users or others.

If the business is ever sold or transferred, your information may be transferred to the new owner as part of that transaction. We will notify you and update this policy if that happens.

5. Cookies & tracking

We use a small number of cookies and similar storage technologies:

• Essential cookies: set by Supabase to keep you signed in. The app does not function without these.
• Analytics cookies: set by Google Analytics 4 to measure traffic and usage. These are not used for advertising.
• LocalStorage: we store a backup of your in-progress round, your preferences, and a few feature flags directly in your browser.

You can clear cookies and localStorage at any time through your browser settings, or use a private/incognito window to browse without storing data. Doing so will sign you out and remove any local round backups.

6. Children's privacy

Strokes & Stakes is intended for users 13 years of age and older. We do not knowingly collect personal information from children under 13.

If you believe a child under 13 has created an account or provided personal information to us, please email us at support@strokesandstakes.com and we will promptly delete it.

7. Data retention

• Account information is kept for as long as your account is active.
• Round history is kept indefinitely so you can revisit past rounds, leaderboards, and rivalries. You may delete individual rounds at any time.
• Backup copies may persist in encrypted backups for up to 30 days after deletion.
• Anonymized analytics data is retained according to the default Google Analytics 4 retention window (currently up to 14 months).

If you delete your account, we will remove your profile, buddy connections, and personal identifiers within 30 days. We may retain anonymized round data (with your name replaced) where it appears in another player's round history, so we do not corrupt their record of past games.

8. Your rights & choices

Regardless of where you live, you can:

• Access the personal information we hold about you by signing in to your profile.
• Correct your display name, handicap, email, and home club at any time from the profile screen.
• Delete individual rounds, buddy connections, or your entire account.
• Opt out of email notifications via the unsubscribe link in any email we send, and disable push notifications in your browser settings.

If you are in the European Economic Area, United Kingdom, or Switzerland

You have additional rights under the General Data Protection Regulation (GDPR), including the right to portability, restriction of processing, objection to processing, and the right to lodge a complaint with your local data protection authority. To exercise these rights, contact us at support@strokesandstakes.com.

If you are a California resident

Under the California Consumer Privacy Act (CCPA / CPRA), you have the right to know what categories of personal information we collect, to request a copy or deletion of your data, and to opt out of any “sale” or “sharing” of personal information. As noted above, we do not sell your information.

9. Security

We take reasonable steps to protect your information:

• All traffic between your device and our servers is encrypted with HTTPS / TLS.
• Passwords are never stored in plain text; they are hashed by Supabase using industry-standard algorithms.
• Our database is hosted on Supabase, which provides encryption at rest and access controls.
• Sensitive API keys (such as the GolfCourse API key) are kept server-side via Edge Functions and never exposed in the browser.

No system is perfectly secure, however. We cannot guarantee absolute security, and you use the service at your own risk. If you become aware of a security issue, please email us at support@strokesandstakes.com.

10. International users

Strokes & Stakes is operated from the United States. If you access the service from outside the US, you understand that your information will be transferred to, stored, and processed in the US, where data protection laws may differ from those in your country.

11. Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will revise the “Last updated” date at the top. If the changes are material, we will notify you by email or with an in-app notice before they take effect. Continued use of the service after an update means you accept the revised policy.

12. Contact us

If you have any questions, concerns, or requests about this Privacy Policy or how we handle your information, reach out:

• Email: support@strokesandstakes.com
• Based in: Texas, USA