Last updated: 11 July 2026
Golf with Mates ('we', 'us', 'our') respects your privacy. This policy explains who we are, what personal data we collect, why we collect it, who we share it with, and the rights you have under the EU General Data Protection Regulation (GDPR).
1. Who we are
Golf with Mates is operated from Sweden. For all questions about your personal data or this policy, contact us at hello@golfwithmates.com. We are the data controller for the personal data described below.
2. Data we collect
We only collect what is needed to run the service:
- Account data: email address, display name, optional handicap index, optional avatar image, optional Swish number (for settling bets between you and your friends), preferred unit (yards/metres), language preference, and an automatically generated friend code.
- Round and game data: rounds you create or join, scores, picked-up holes, friends you add, side-bet configurations and claims, photos you attach to feedback, and course corrections you submit.
- Guest data: if you join a round without an account using a join code, a guest session ID is stored in your browser to keep you in the round. No email is required for guest play.
- Authentication and device metadata: sign-in timestamps, OAuth provider (if you use Google or Apple sign-in), push notification token (if you opt in), and basic device/browser information used for session diagnostics and PWA/native app install detection.
- Technical data: anonymised crash reports (Sentry), aggregate page-view analytics (Plausible - cookieless, no personal identifiers), and email delivery logs (sends, bounces, suppressions).
3. Legal basis for processing
Under GDPR Article 6 we rely on: performance of a contract for your account, rounds, scores, friends and bet tracking; legitimate interests for security, abuse prevention, anonymised analytics and crash reporting; and your consent where it is specifically required (for example, optional photo uploads).
4. How we use your data
We use your data to provide scoring, leaderboards and informal bet tracking, to deliver transactional emails (account, round invites, round-complete summaries, password resets), to keep the service secure and prevent abuse, and to improve the product. We never sell your data and never use it for advertising.
5. Who can see what inside the app
Other players in your round can see your display name, handicap, scores and avatar. Hosts can additionally see join requests and approval status. Round-complete summary emails include a generated scorecard image hosted at a public URL - it is not indexed by search engines, but anyone with the link can view it.
6. Sub-processors
We use a small number of trusted sub-processors, all bound by data-protection agreements:
- Lovable Cloud (Supabase infrastructure, EU region) - database, authentication, file storage and edge functions.
- Lovable Email - delivery of transactional emails.
- Sentry (EU region) - anonymised crash and error reports.
- Plausible Analytics (EU) - cookieless, privacy-friendly aggregate page-view analytics with no personal identifiers.
- Firebase Cloud Messaging (Google) - delivery of push notifications on Android devices, only when you opt in.
7. International data transfers
Primary processing of your personal data takes place inside the EU. Where any sub-processor needs to transfer data outside the EU/EEA, we rely on the European Commission's Standard Contractual Clauses or an equivalent safeguard.
8. Data retention
Account, round and friend data is kept for as long as your account is active. If you delete your account from the Profile page, all personal data and round entries linked to you are permanently removed within 30 days. Email delivery logs and aggregate analytics may be retained longer for security and audit purposes. Suppressed-email entries are retained indefinitely so we can continue to honour your unsubscribe.
9. Your GDPR rights
Under GDPR you have the right to:
- Access: request a copy of the data we hold about you.
- Rectify: correct inaccurate data via your Profile page or by contacting us.
- Erase: delete your account and all associated data at any time from the Profile page.
- Object, restrict or port your data, and lodge a complaint with the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY).
10. Email preferences
We only send transactional emails (account verification, password resets, round invites, round-complete summaries). These are sent based on our legitimate interest in delivering the service. Every transactional email contains a one-click unsubscribe link that adds you to our suppression list and stops future sends to that address.
11. Local storage on your device
We use your browser's local storage only for essential app functionality: keeping you signed in, remembering your language preference, holding your guest session ID, storing PWA install hints, and buffering scores entered while offline (the score queue). We do not use tracking cookies or third-party advertising cookies.
12. Security
We protect your data with encryption in transit (HTTPS), Row-Level Security policies on every database table, role-based access for administrators, password hashing handled by our authentication provider, and rate limiting on public endpoints. No system is perfectly secure, but we treat your data with care.
13. Children
Golf with Mates is not directed at children under 16, which is the age of digital consent under Swedish implementation of the GDPR. We do not knowingly collect personal data from children under 16. If you believe a child has provided us with data, contact us and we will delete it.
14. Changes to this policy
We may update this policy occasionally. Material changes will be notified by email or with an in-app notice before they take effect.
15. Contact
Questions about your data or this policy? Email us at hello@golfwithmates.com