Privacy

What is stored

Your account

• Your email address, which is also your username.
• A one-way hash of your password. The password itself is never stored and cannot be recovered from the hash — which is why a forgotten password is reset rather than looked up and sent to you.
• The date you signed up.
• Whether your address has been confirmed, and any address change you have requested but not yet confirmed.
• Counters used to lock an account temporarily after repeated wrong passwords.

Your golf data

• The players you track — their display names and when they were created.
• Your clubs, and their make, model, loft and shaft details.
• Every shot: the launch-monitor measurements, the date, and any note or tag on it. Weather values are stored where your file supplied them.
• A record of the files you have imported — the file name, its size, when it was imported and how many rows were used — so importing the same file twice doesn't duplicate your shots.

What is not stored

• No analytics, no advertising identifiers and no third-party trackers. Three cookies are set, all strictly functional: one keeps you signed in, one protects forms against cross-site submission, and one (acaAffinity) is set by the hosting platform to keep your requests on the same instance. None of them track you, and none are shared with anyone.
• No location beyond whatever your launch monitor put in the file you uploaded.
• No payment details. There is nothing to pay for.

The server keeps operational logs — that a request happened, and errors when they occur — which include IP addresses. Those exist to keep the service running and to make abuse visible. Log lines about account emails deliberately record the account's internal identifier rather than the address itself, so the logs are not a list of who has an account.

Why

Your email address exists so you can sign in and so you can get back in when you forget your password. That is the whole reason it is required, and it is why it has to be confirmed: an address nobody has proven they own is useless for recovery, and worse than useless if it belongs to somebody else.

Your shots exist because they are the point of the app. Averages, trends and the personal baselines used in live practice are computed from your own data and nobody else's.

Who can see it

You. Your shots, players and sessions are private to your account, and that boundary is enforced on every database query rather than by hiding links — two accounts can each have a player called "Stevenson" and they are entirely separate datasets that never meet.

Whoever operates this deployment has administrative access to the server and its database, as is true of any hosted application. Your data is not sold, rented, shared for advertising, or handed to any third party for their own purposes.

The service runs on cloud infrastructure and, when email is enabled, uses a mail provider to deliver confirmation and password-reset messages. Those providers process what they must in order to host the service and deliver those messages, and nothing further.

How long

Your data is kept until you delete it. There is no automatic expiry, because a shot from three years ago is exactly what a trend needs.

When you delete a player, its shots and clubs are removed immediately. When you delete your account, everything goes — players, clubs, shots, staged import rows, import history and the sign-in record itself. There is no soft-delete flag, no recycle bin, and no copy held back for later.

One honest caveat: the database has an operational backup window kept for disaster recovery, so deleted rows can persist in those backups until they age out. Backups exist so a failure doesn't lose your data, and they are not queryable or used to restore individual records.

Your controls

All of these are self-service. None of them require contacting anybody.

• See what's held. Your data lists the exact counts.
• Take it with you. Download everything as a single JSON file, including the units each measurement is stored in so the numbers still mean something elsewhere. Your password hash is deliberately excluded — it is a credential, not data.
• Correct it. Rename players and merge duplicates from your players.
• Delete part of it. Delete an individual player and its shots.
• Delete all of it. Close your account from your data. It asks for your password and a typed confirmation, and then it is done.
• Change your address. From your account. The new address must be confirmed, and the old one is told the change was requested.
• Cut off other devices. Sign out every other browser and device from your account, or by changing your password.

How it's protected

• Traffic to the site is encrypted, and the connection between the app and its database is encrypted with a verified certificate. The app refuses to start otherwise.
• Passwords are stored as salted one-way hashes, never in a form that can be read back.
• The keys that sign your sign-in cookie are themselves encrypted at rest, so a copy of the database is not a set of working logins.
• The app authenticates to its database as a managed identity with no password, so there is no database credential to leak.
• Repeated wrong passwords lock an account temporarily, and sign-in, registration and password-reset requests are rate limited per IP address.
• Password reset links last two hours and work once. Email confirmation links last 24 hours.

No system is perfect, and this is a small application rather than a bank. What is claimed here is what is actually implemented — nothing more.

Changes

If this policy changes in a way that affects what is collected or who can see it, the date at the top changes with it.

Questions about any of this go to bmh178@scarletmail.rutgers.edu.

See also Terms and Help.