Privacy policy

CaddyCompass holds the minimum personal data needed to run a golf course directory and help golfers find people to play with. We don't sell your data, we don't show adverts, and we don't send marketing emails.

Who we are

CaddyCompass is the controller of the personal data described here, which means we decide how and why it's used. For anything about your data, email [email protected].

What we hold and why

The legal basis for each use is in brackets: contract means we need it to provide the service you signed up for, legitimate interests means it's needed to run the site safely and doesn't override your rights, and consent means only if you say yes.

• Account: your email address, display name and optional avatar photo, used to sign you in and to put your name on what you post (contract).
• Sign-in and security: a record of each signed-in session, including the IP address and browser it came from, to keep accounts secure and investigate misuse. Sign-in links expire after 15 minutes (legitimate interests).
• Golfer profile: handicap, home area, experience level and the preferences you choose, used to fill in your posts, requests and reviews and to show courses near you (contract).
• Tee-time posts and join requests: the course, time, details and note in a post or request, and the contact number you give when posting or asking to join a round (contract).
• Reviews, photos and scorecards: reviews you write, photos you add and rounds you log (contract). Photos are scanned for viruses and re-saved before they go live, which strips hidden details such as camera location data (legitimate interests).
• Emails we send: sign-in links, and a notification when someone asks to join your round or accepts your request. They're part of the service, not marketing (contract).
• Messages to us: your name, email address and message when you use the contact form, so we can reply. When you send one, a Cloudflare Turnstile spam check looks at your browser and IP address (legitimate interests).
• Usage analytics: only if you choose “Accept all” on the cookie banner, Google Analytics records which pages are visited and how the site is used, under a random ID rather than your name. Page addresses can include a place you searched near. You can withdraw consent at any time; see the cookie policy (consent).
• Page statistics: Cloudflare Web Analytics counts page views and measures how fast pages load for every visitor. It doesn't use cookies or any other storage on your device and doesn't identify you (legitimate interests).
• Technical logs and bot checks: like any website, our hosting and security providers log standard request details (IP address, browser, page requested), and Cloudflare checks browsers for automated bot traffic, to keep the site running and secure (legitimate interests).

Who can see what

• Anyone visiting the site can see your tee-time posts (your display name, home area, experience level, handicap, the course, time and your note), your reviews (display name, month written and handicap if you've set one) and photos you add to a course page.
• The host of a round you ask to join sees your name, experience level, handicap and note.
• Phone numbers are swapped only when a host accepts a request: the host then sees the requester's number and the requester sees the host's. They're never shown publicly and never put in emails.
• Your email address, avatar and scorecards aren't shown to other golfers.
• Our administrators can see account, request and notification details where they need to, to run the site, deal with reports and answer support requests.

Who processes it

These providers handle data on our behalf and only on our instructions:

• Railway hosts the website, database, email worker and virus scanner.
• Cloudflare sits in front of the website to protect it and speed it up, so every visit passes through it. It also stores the photos golfers upload, measures page views and loading speed, and runs the contact form's spam check.
• Resend sends our emails: sign-in links, join-request notifications, and contact-form messages to our team.
• Google provides the optional analytics.
• GitHub stores our nightly database backups.

Some features load directly from other services in your browser. Location search sends the postcode or town you type to postcodes.io, an open UK geocoding service, to find its coordinates; no account data or identifiers are included. Search map views load map data from OpenFreeMap's servers, and the map on each course page is embedded from openstreetmap.org. These services, like any web request, also receive standard request metadata (IP address, user agent) and handle it under their own privacy policies. Links to club websites and to Google Maps directions take you to sites with their own policies too.

Some of our providers are based in, or process data in, the United States. Where personal data leaves the UK, it's protected by a transfer mechanism recognised under UK law, such as the UK extension to the EU-US Data Privacy Framework or the ICO's International Data Transfer Addendum.

How long we keep it

• Your account, profile, posts, join requests, reviews and scorecards: until you delete your account. You can delete reviews and logged rounds yourself at any time, and we'll remove a post or request if you ask.
• Photos you add: until you or we remove them. They stay on course pages, without your name, if you delete your account, so remove any you want gone first.
• Sign-in sessions: expire after 7 days without use.
• Contact-form messages: as long as we need them to deal with your message and any follow-up.
• Analytics: no more than 14 months, in Google Analytics.

Deleted data can remain in our nightly database backups for up to 14 days, until those backups expire.

Your rights

Under UK GDPR you can ask for a copy of your personal data, have it corrected or deleted, restrict or object to how we use it, and receive it in a reusable format. Where we rely on consent, you can withdraw it at any time. Most of your details can be edited from your account page, and you can delete your account there yourself: that removes your profile, tee-time posts, join requests, reviews and scorecards. For anything else, email [email protected] and we'll respond within one month.

If you're unhappy with how we've handled your data, please tell us first so we can put it right. You can also complain to the Information Commissioner's Office at ico.org.uk.

Children

CaddyCompass accounts are for adults aged 18 and over. If you think a child has created an account, contact us and we'll delete it.

Changes

When the way we handle data changes, we'll update this page and the date at the top. If a change significantly affects how we use your data, we'll make it clear on the site before it takes effect.