1. Information We Collect

When you create a FlowGolf account, we collect your name, email address, phone number, and password (stored as a secure hash, never in plain text). We also track your Golfer Pace Rating (GPR), total rounds played, and basic account activity like when you signed up and last logged in.

If you enable an authenticator app for two-factor authentication, we store your authenticator secret encrypted and your recovery codes as one-way hashes, never in plain text.

If an organizer adds you to a group by phone number before you have an account, we create a placeholder account for that phone number so you can be added to the group. We text that number once with the booking details and a link to claim the account or remove the number. Anyone can remove a phone number at /remove-my-number, after which it will not be added to a booking again. Replying STOP to that text also stops future texts.

When you book a tee time, we store the booking details (course, tee time, price paid, group members, check-in status) and the amount charged. Payments are processed by Stripe — we store Stripe's reference IDs and the amount, never your card number.

We collect location data while you play a round from GPS trackers mounted on the course's golf carts. Course staff link a cart to you when they assign it for your round, and the app does not access your phone's location during a round. We use this data to calculate pace of play — how long you spend playing versus waiting — for your Golfer Pace Rating.

We also collect technical data such as your device's User-Agent string (stored with your login sessions), and, briefly, your IP address (used only to limit request rates, not stored).

2. How We Use Your Information

We use your information to:

• Create and secure your account, including sign-in sessions and two-factor authentication
• Process tee time bookings and payments
• Calculate your Golfer Pace Rating (GPR) from your on-course location data
• Let courses set a minimum GPR required to book certain tee times
• Send account and booking-related SMS and email messages
• Respond to messages you send through our contact form

Your GPR is calculated from your true playing time: the time your group takes to play, with the time spent waiting on the group ahead taken out. Skipped holes, driving through, or playing the wrong hole are tracked but do not affect your score. Your GPR is hidden until you've completed three analyzed rounds, and there is currently no way to opt out of GPR tracking while using the app.

3. Location Data

While a round is active, the app records your position (latitude, longitude, accuracy, altitude, speed, and heading) from the GPS tracker mounted on the cart assigned to you by course staff. The app does not access your phone's location during a round. We use this to figure out per-hole timing, waiting versus playing time, and similar pace-of-play details.

We reject location readings that are too imprecise (worse than 100 meters of accuracy), but we do not use a geofence, so a reading taken while you're briefly off the course property could still be recorded.

Raw location readings are deleted automatically 90 days after they're recorded. The per-hole timing and round summaries derived from that data are kept with your account.

4. Communications

We send SMS messages through Twilio for things like phone verification codes and waitlist/standby offers. Reply STOP to any message to opt out of SMS at the carrier level.

We send email through Resend for password resets, welcome messages, staff invitations, and booking confirmations or cancellations. If you use our contact form, we forward your name, email, course name, and message to our support team.

5. Data Sharing

We share information with the service providers that help us run FlowGolf:

• Stripe, for payment processing and paying out courses (subject to Stripe's Privacy Policy)
• Twilio, for SMS delivery (subject to Twilio's Privacy Policy)
• Resend, for email delivery
• Google Analytics, which records page views as you navigate the app — only after you accept on the analytics banner. It stays off until then, and you can change your choice below at any time
• Sentry, which receives error reports from the app to help us fix bugs
• Google, which serves map tiles on course maps and receives the map coordinates you view and your IP address
• Lightspeed, for courses that sync their tee sheet with their point-of-sale system (we do not currently send your personal details to Lightspeed)
• Golf courses you book with, who can see your name, phone number, GPR, and booking/check-in status to manage your tee time

Our infrastructure providers (Railway, Vercel, and Supabase) host our servers, web app, and database. We do not sell your personal information to third parties.

6. Data Retention

We keep your account, booking, and payment information indefinitely, for as long as you have an account, so your booking history and GPR stay accurate. Raw location readings are deleted automatically 90 days after they're recorded. The per-hole timing and round summaries derived from that data are kept with your account. You can request deletion of your account and associated data by contacting us; there is currently no self-service way to delete your account or export your data.

7. Security

We use industry-standard security measures including encrypted connections (TLS), secure password hashing, and token-based authentication, with SMS two-factor authentication for your account. Payment card data is handled entirely by Stripe and never touches our servers. Our server logs redact credentials before they're written.

8. Your Rights

You may:

• View and update your email, phone number, password, and settings from your profile page
• Opt out of SMS by replying STOP to any message
• Request access to or deletion of your account and data by contacting us at support@flowgolf.io — these requests are handled manually, as we don't yet have an automated export or deletion tool
• Change your analytics choice at any time, below

9. Changes to This Policy

We may update this policy from time to time. We will notify you of material changes via email or in-app notification.

10. Contact Us

If you have questions about this Privacy Policy, contact us at support@flowgolf.io.