1. Who we are and what this covers
Flights & Fairways ("we," "us") makes a mobile app that golf clubs and leagues ("Clubs") use to run their season. This policy explains how we handle personal information in the app, on this website and in the services behind them (the "Service"). It should be read alongside our Terms of Use.
Much of the information in the Service is entered by your Club's admins so they can run the Club. For that information, we act on the Club's behalf. If you have questions about why your Club records something, ask its admins. We're glad to help as well.
2. Information we collect
You give us
- Account details: your email address and, if you choose one, a password. We store passwords only in hashed form. You can also sign in with a one-time email link.
- Profile: your name, username, optional phone number and optional profile photo.
- Your golf: scorecards (hole by hole or totals), photos of paper scorecards you choose to upload, sign-ups, call-offs, check-ins and skins opt-ins.
- Messages and notes: announcements, Sick & Shut-In notes and well wishes, and anything you send us through support.
Your Club's admins add
- Your role (member, guest or admin), membership year, handicap and handicap history, and flight.
- Your fees, dues, fines and fund contributions, whether each has been paid, and how (for example, "cash" or "Venmo"). We never receive card or bank details for these. Money changes hands outside the app.
- Pairings, starting holes, approved scores and results.
- If you're listed in the Sick & Shut-In registry: a short public status (for example, "recovering at home"), dates, and optionally a private note visible only to admins. This could include information about your health. See below.
- Club details: the Club's name, city, logo, contact person and phone number, courses, schedule and rules.
Collected automatically
- Push notification token: if you allow notifications, a device token and your device's platform (iOS or Android), so we can send you Club notifications. We also record whether a notification was delivered and opened, which admins see as totals.
- Service logs: our servers keep standard technical logs, such as IP address, request time and error details, to keep the Service running and secure. We don't use them to build profiles.
- Audit trail: changes to key records, like who approved a round or marked a fee paid, are logged so Clubs can see who changed what.
From app stores
- When a Club subscribes, Apple or Google processes the payment. Through our subscription provider we learn which Club bought which plan, its status and renewal dates. We never see your card number.
We don't collect your precise location, contacts, microphone audio, health data from your device, or browsing activity in other apps. The camera and photo library are used only when you choose to attach a scorecard or logo, and only the photo you pick is uploaded.
3. How we use information
- To provide the Service: running your Club's schedule, sign-ups, pairings, scoring, skins, standings, fees and registry.
- To send the notifications you've allowed, plus essential emails such as sign-in links and password resets.
- To manage the Club's subscription and access.
- To answer support requests.
- To keep the Service secure, prevent abuse and fix problems.
- To comply with the law and enforce our Terms.
Where laws such as the GDPR apply, our legal bases are performing our contract with you and your Club, our legitimate interest in running a secure and reliable service, your consent (for push notifications and optional photos, which you can withdraw), and legal obligations.
4. Who can see your information
| Who | What they see |
|---|---|
| Members of your Club | Your name, photo, role, flight and handicap; the outings you're signed up for and your group; approved scores, results, standings and skins; announcements; public Sick & Shut-In notes. |
| Your Club's admins | Everything members see, plus your email and phone, draft and submitted scores, your fees and payment status, notification delivery statistics, admin-only Sick & Shut-In notes, and the Club's audit log. Admins can export Club data. |
| Other Clubs | Nothing. Each Club's data is kept separate. |
| Us | We access data only when we need to: to provide support you ask for, keep the Service secure, fix problems or meet legal obligations. |
Health information in Sick & Shut-In
The Sick & Shut-In registry helps a Club look after a member who's unwell. We ask Clubs to keep the public status general and to record private details only with the member's or family's consent. Admins can edit or remove entries, and you can ask your Club or us to remove an entry about you at any time.
5. Service providers
We share information only with providers that help us run the Service, under contracts that limit how they may use it:
- Hosting and database: servers we operate, running the open-source Supabase platform, which stores account, Club and photo data.
- Network and security: Cloudflare, which carries traffic to our servers and protects them from attacks.
- Push notifications: Expo's push service, Apple Push Notification service and Google Firebase Cloud Messaging, which receive your device token and the notification text.
- Subscriptions: RevenueCat, together with Apple and Google, which process and confirm the Club's purchases. They receive the Club's identifier and purchase details, not member data.
- Email delivery: a transactional email provider that sends sign-in links and password resets.
We may also disclose information when the law requires it, to protect people's safety or our rights, or as part of a merger or sale of the business, in which case this policy would continue to apply to your information.
6. What we don't do
We don't sell or rent personal information. We don't share it for cross-context behavioral advertising. We don't show ads. The app contains no third-party analytics or advertising SDKs and doesn't track you across other companies' apps or websites.
7. Retention and deletion
- We keep your information while your account is active and your Club uses the Service.
- Deleting your account: ask us from the email address you sign in with (see Contact). Within 30 days we delete your account, profile, photo and push tokens. Your name may remain on past approved results, skins and ledger entries, which the Club needs for its records, unless you ask us to anonymize them. Admin-entered notes about you are deleted.
- Deleting a Club: a head admin can ask us to close the Club. We then delete its data within 30 days.
- Deleted data may remain in encrypted backups for a limited period until they are overwritten.
- We keep limited records longer where the law requires it or to resolve disputes.
8. Your choices
- Notifications: turn push notifications off in the app's settings or in your device settings.
- Profile: update your details in the app's settings, or ask your Club's admins to correct information they manage, such as your name, handicap or fees.
- Photos: uploading a scorecard photo or profile picture is optional.
- Leaving: ask your Club's admins to remove you, or ask us to delete your account, at any time.
9. Your privacy rights
Depending on where you live (for example, California or other U.S. states with privacy laws, the EU, UK or Canada), you may have the right to access, correct, delete or get a portable copy of your personal information, to object to or restrict some processing, and to withdraw consent. We don't sell or share personal information for targeted advertising, so there's nothing to opt out of there. We won't treat you differently for using your rights.
To make a request, email [email protected]. We'll verify it's you, usually by replying to the email on your account, and respond within the time the law allows (normally 30 or 45 days). An authorized agent can make a request for you with your written permission. If we act for your Club on some information, we may pass your request to its admins. If you're not satisfied, you can complain to your local data protection authority.
10. Security
We use encryption in transit (HTTPS), hashed passwords, per-Club access controls enforced by the database, role-based permissions and restricted administrative access. No system is perfectly secure, though. If we learn of a breach that affects you, we'll notify you and any authorities as the law requires.
11. Children
The Service isn't directed to children under 13, and we don't knowingly collect personal information from them. If you believe a child under 13 has given us information, contact us and we'll delete it.
12. Where data is stored
We operate the Service from the United States, and information is stored and processed there. If you use the Service from elsewhere, your information will be transferred to the U.S., where privacy laws may differ from your own. Where the law requires, we use appropriate safeguards for those transfers.
13. This website
This website sets no cookies, uses no analytics or advertising tags, and loads its fonts and images from our own server. The contact form doesn't send anything to us directly. It opens your own email app with your message filled in. Our web host keeps standard server logs, such as IP address and pages requested, for security.
14. Changes to this policy
We'll update this policy as the Service changes. If we make a significant change, we'll tell you in the app or by email before it takes effect. The date at the top shows the current version.
15. Contact
Questions, requests or concerns: [email protected], or use our contact page.