Golfmate

Privacy Policy

Last updated: 14 May 2026

1. Data controller

Golfmate ("we", "us", "our") is the data controller for personaldata processed through the Golfmate app (golfmate.io) and associated services, pursuant to Sections 13 and 14 of Regulation (EU) 2016/679 (GDPR).

Privacy enquiries: [email protected]. Data Protection Officer: [email protected].

Personal data may also be processed on our behalf by appointed Data Processors (hosting providers, software providers, social networks). The full list is available on request. Your data may also be shared with club managers related to your booking and affiliated companies.

2. What we collect

We collect only what is needed to run the service:

Account & profile data: Name, email address, display handle, handicap index, tier, optional photo, optional phone number, and optional city. Provided at signup or in Edit Profile.

Match & score data: Rounds you host or join, tee times, courses, hole-by-hole scores, and validation decisions you submit.

Social data: Connection requests, accepted friendships, and messages sent inside a match chat.

Contact list (optional): Emails, phone numbers, and contact IDs from your device agenda — only if you grant permission — to help you find and invite friends. You can revoke this permission in your device OS settings at any time.

Location: Approximate GPS coordinates if you use the "Near me" filter orthe Explore map. Used only in-session; never stored on our servers.

Usage & navigation data: IP address, browser/device type, pages visited, timestamps. Retained up to 90 days for security and debugging.

3. How and why we use it

Contract performance: Account management, sign-in, match organisation, score recording, reservations, rankings, and in-app notifications. Lawful basis: performance of a contract with you.

Consent-based processing: Contact list access, ranking publication, marketing communications, push/email/SMS notifications, social content sharing. You may withdraw any consent at any time without affecting prior processing.

Legitimate interest: Security and fraud prevention, product R&D, IT maintenance, and smooth site navigation (session cookies).

Legal obligation: Complying with applicable law and lawful requests from authorities.

There are no automated decision-making or profiling processes. We do not sell your data or use it for advertising.

4. Who we share it with

Other Golfmate users: Your name, handle, handicap, tier, and profile photo are visible to signed-in users. Your email is never shown publicly.

Supabase (data processor): Database, authentication, and realtime backend (Supabase, Inc., USA). Data stored in EU-West regions where available.

Cloudflare (data processor): Web hosting. Processes request metadata (IP, headers) to serve the site.

Club managers: Where you participate in club-organised matches, club managers may access relevant match data for organisational purposes (with your consent).

Some processors may transfer data outside the EU. Where they do, we rely on Standard Contractual Clauses or equivalent safeguards.

5. Data retention

Account, profile, match, and score data: retained for 10 years from your last access, or until you delete your account — whichever is first. Deleting your account removes your data from the live database within 30 days.

Contact list data: retained only while consent is active. Match chat messages: deleted when the associated match is deleted. Server logs: purged after 90 days.

To request deletion, email [email protected] with the subject"Delete my Golfmate account" from your registered address.

6. Your rights (GDPR)

Access (Art. 15): Obtain confirmation that we process your data and receive a copy.

Rectification (Art. 16): Correct inaccurate or incomplete data (also available in-app via Edit Profile).

Erasure (Art. 17): Request deletion ("right to be forgotten") where data is no longernecessary, consent is withdrawn, or processing is unlawful.

Restriction (Art. 18): Restrict how we process your data while a dispute is pending.

Portability (Art. 20): Receive your data in a structured, machine-readable format.

Objection (Art. 21): Object to processing based on legitimate interest or for direct marketing.

Withdraw consent: Withdraw any consent at any time; this does not affect prior processing.

To exercise any right, email [email protected]. We will respond within 30 days. You also have the right to lodge a complaint with your competent supervisory authority (e.g. the UK ICO at ico.org.uk).

7. Cookies and local storage

The web app uses browser local storage to keep you logged inbetween sessions (via Supabase's session token). Facilitationcookies used for session navigation are based on legitimate interest and expire at end of session. No third-party tracking, analytics, or advertising cookies are set.

8. Security

All data is transmitted over HTTPS. Passwords are never stored — authentication is handled by Supabase Auth. Database rows are protected by row-level security policies scoped to the authenticated user. Service-role credentials are never embedded in the client bundle.

9. Children

Golfmate is not intended for users under 18. We do not knowingly collect data from children. If you believe a child has created an account, contact us at [email protected] and we will delete it promptly.

10. Changes to this policy

We may update this policy as the product evolves. Material changes will be communicated via an in-app notice at least 14 days beforethey take effect. The "Last updated" date at the top always reflectsthe current version.