Privacy Policy

Last updated: [date — draft]

1. Introduction

This Privacy Policy ("Policy") explains how Round Update ("we," "us," or "our") collects, uses, discloses, and retains information when you use the Round Update application at app.roundupdate.com and related domains (the "Service"), operated by [LEGAL ENTITY NAME], a [STATE] [ENTITY TYPE] located at [ADDRESS]. [LEGAL ENTITY NAME] is the controller (and, where applicable, the "business") responsible for the personal information described in this Policy.

This Policy is incorporated into and forms part of the Round Update Terms of Service. By using the Service you acknowledge this Policy. Where applicable law requires consent for a specific processing activity, we will obtain that consent separately and this Policy does not itself serve as that consent.

2. Summary

In plain terms: Round Update is built to work without an account. We collect the information needed to run live golf scoring and sharing — the names and scores you enter, and, if you choose, your email, phone number, photos, and comments. Anyone you give a round's link to can see that round's contents. We use a small number of service providers to run the app. We do not sell or share your personal information as those terms are defined under U.S. state privacy laws, we do not use third-party advertising or analytics trackers, we do not use your content to train artificial-intelligence models, and — as of the current version of the app — we do not collect your precise geolocation or your age. The sections below give the detail.

This summary is provided for convenience only and does not modify the sections that follow.

3. Information You Provide

• Player names. The names entered for players in a round. Because one person often sets up a round for a group, a name you did not enter yourself may be entered by someone else in your group. See Section 8 (Information About Other People).
• Email address. If you choose to sign in, the email address you provide, used to send a one-time sign-in code and to associate saved rounds with your account.
• Phone number. If you opt in to follow a round by text message, the mobile number you provide, used to send SMS notifications about that round.
• Handicaps and scores. Self-reported handicap information and the golf scores entered during a round.
• Hole updates, comments, and photos. Text updates and photos posted to a round, and comments posted to a round's discussion. Photos may contain embedded metadata (such as EXIF data); [CONFIRM WHETHER THE APP STRIPS EXIF/GPS METADATA ON UPLOAD AND STATE IT HERE].
• Profile details. If you create an account, an optional display name and an optional avatar photo.
• Round security details. A PIN you set to protect a round's editor link. PINs are stored in hashed (not plain-text) form.
• Communications with us. If you email us or submit a request, the contents of that message and any information you include in it, retained so we can respond and keep a record of the request.

4. Information Collected Automatically

• Device identifiers and local storage. To make the Service work without an account, we store small identifiers and settings in your browser's local storage — for example, a random per-device identifier, which player you have identified as in a round, and whether you have accepted our legal terms. These stay on your device until cleared.
• IP address and technical data. When you use the Service, our hosting and security providers receive your IP address and standard request information (such as browser type, referring page, and general timestamps), used to operate the Service, prevent abuse, and enforce rate limits. For rate-limiting we store IP addresses only in a hashed form.
• Bot-protection signals. On certain actions (signing in, creating a round, or signing up for notifications) we use a bot-protection challenge that processes your IP address and browser signals to distinguish people from automated scripts.
• Diagnostic and error information. If the Service encounters an error, limited diagnostic information may be logged to help us diagnose and fix it. [CONFIRM WHETHER ANY ERROR-MONITORING SERVICE IS IN USE AND ADD IT TO THE PROVIDER TABLE IF SO.]

5. Consent and Acceptance Records

When you accept our Terms and this Privacy Policy — for example, when starting a round, requesting a sign-in code, or joining a round — we keep a record of that acceptance for our legitimate interest in demonstrating agreement and for compliance with electronic-contracting requirements. This record includes the date and time, the version of the legal terms accepted, a device identifier and (if signed in) your account identifier, the email address used at sign-up (for the sign-up action only), your IP address, and your browser's user-agent string. These records are kept internally and are not shown to other users.

6. Information We Do Not Collect or Do

• Precise geolocation. The current version of the Service does not collect, use, or share your device's precise geolocation. (Weather shown for a round is based on the golf course, not on your device.)
• Age or date of birth. We do not ask for your age. Please see Section 17 (Children's and Teens' Privacy) regarding use by minors.
• Sensitive personal information. We do not intentionally collect categories of information treated as "sensitive personal information" or "special category" data under applicable law — such as government identifiers, precise geolocation, racial or ethnic origin, religious beliefs, health information, biometric data, union membership, sexual orientation, immigration status, or the contents of your private communications. We do not use or disclose sensitive personal information for any purpose that would require an opt-out right under U.S. state law. If you voluntarily include such information in free-text fields or photos, you do so at your own election and we ask that you not.
• Third-party advertising and analytics trackers. We do not embed third-party advertising networks or third-party analytics/tracking scripts in the Service, and we do not engage in cross-context behavioral advertising or targeted advertising.
• Payment information. The Service does not process payments and does not collect payment-card information. Any wager tracked through the app is settled between players outside of Round Update.
• Automated decision-making and profiling. We do not use your personal information to make decisions that produce legal or similarly significant effects about you, and we do not engage in profiling in furtherance of such decisions.
• AI model training. We do not use your User Content or personal information to train, fine-tune, or improve generative artificial-intelligence or machine-learning models, and we do not permit our service providers to do so with information they process on our behalf. [CONFIRM CONTRACTUAL RESTRICTIONS WITH EACH PROVIDER.]

7. How We Use Information, and Our Legal Bases

We use the information described above to:

• provide the Service — creating and displaying rounds, scores, leaderboards, updates, comments, and photos to the people a round is shared with;
• authenticate sign-ins and associate saved rounds with your account;
• send the notifications you opt into (for example, SMS updates about a round you follow);
• look up golf-course information and show weather for a course;
• secure the Service, prevent abuse and fraud, debug errors, and enforce rate limits;
• maintain records of acceptance of our legal terms;
• respond to your questions, requests, and privacy-rights requests; and
• comply with legal obligations, establish or defend legal claims, and enforce our Terms.

We do not use personal information for materially different, unrelated, or incompatible purposes without first providing notice and, where required, obtaining your consent.

Legal bases (for users in the EEA, UK, and Switzerland)

Where the EU/UK GDPR or comparable law applies, we rely on the following legal bases:

[CONFIRM WITH COUNSEL WHETHER THE GDPR APPLIES TO YOUR USER BASE; IF IT DOES, A LEGITIMATE-INTERESTS ASSESSMENT SHOULD BE DOCUMENTED FOR EACH LEGITIMATE-INTERESTS BASIS ABOVE.]

8. Information About Other People

The Service is designed so that one person can set up a round on behalf of a group. That means information about you — such as your name, score, or a photo you appear in — may be entered by another user rather than by you.

• If you enter information about others: you are responsible for having a lawful basis and, where required, their permission, and for honoring any request from them to remove it. See the Terms of Service, Section 6.
• If your information appears in a round you do not control: you may contact the person who created that round, or contact us at [CONTACT EMAIL] and we will make reasonable efforts to assist, including by removing the information where we are able to do so.

9. How Information Is Shared and Made Public

• With people you share a round with. Anyone who has a round's share link can view that round's scores, updates, comments, and photos. Share links are unlisted but are not secret: anyone who obtains a link — including by it being forwarded — can view the round. Do not post anything you would not want everyone with the link to see.
• Among participants. Players and followers of a round can see the names, scores, and posts associated with that round.
• Service providers. We disclose information to the providers listed in Section 10, who process it on our behalf under written agreements that limit them to processing for our specified purposes and prohibit selling or retaining it for their own purposes.
• Sponsor content. The Service may display sponsor or promotional content. This content is served by us and does not involve third-party ad-tracking of you. We do not disclose your personal information to sponsors.
• Legal and safety. We may disclose information if required by law or valid legal process, or where we believe in good faith that disclosure is necessary to protect the rights, safety, or property of Round Update, our users, or the public. Where permitted by law, we will make reasonable efforts to notify you of a legal demand for your information before disclosing it.
• Business transfers. If Round Update is involved in a merger, acquisition, financing, reorganization, or sale of assets (including in bankruptcy), information may be transferred as part of that transaction. We will require the recipient to honor this Policy or provide notice and, where required, a choice before your information becomes subject to a materially different policy.

We do not sell your personal information, we do not share it for cross-context behavioral advertising or targeted advertising, and we have not done so in the preceding 12 months. We do not knowingly sell or share the personal information of consumers under 16 years of age.

10. Service Providers and Subprocessors

We rely on the following providers to operate the Service. Each processes only the information needed for its function and is bound by a written agreement restricting its use of that information:

[MAINTAIN THIS LIST AS PROVIDERS CHANGE; CONSIDER PUBLISHING A DATED SUBPROCESSOR PAGE AND A NOTIFICATION MECHANISM FOR CHANGES. LINK EACH PROVIDER'S OWN PRIVACY TERMS IF DESIRED.]

11. Categories of Personal Information (U.S. State Law Disclosure)

The following table describes, for the preceding 12 months, the categories of personal information we collect using the category labels found in the California Consumer Privacy Act, as amended ("CCPA/CPRA"), and comparable state laws.

[VERIFY EACH ROW AGAINST THE CURRENT DATA MODEL BEFORE PUBLICATION; THIS TABLE MUST BE UPDATED AT LEAST EVERY 12 MONTHS UNDER CCPA/CPRA.]

12. Cookies and Similar Technologies

Round Update relies primarily on browser local storage (described in Section 4) rather than advertising cookies. Some providers — for example, our bot-protection provider — may set their own cookies or similar technologies strictly necessary to deliver their service. We do not use cookies for third-party advertising, retargeting, or cross-site tracking.

Global Privacy Control and Do Not Track

Because we do not sell or share personal information or engage in targeted advertising, there is no opt-out for us to apply. We nonetheless [DO / DO NOT — CONFIRM] recognize opt-out preference signals such as Global Privacy Control (GPC). We do not respond to Do Not Track browser signals, as no common standard for them has been adopted.

[CONFIRM WHETHER A COOKIE BANNER OR CONSENT MECHANISM IS REQUIRED FOR YOUR AUDIENCE — IT LIKELY IS IF YOU HAVE EEA/UK USERS, EVEN FOR PROVIDER-SET COOKIES.]

13. Data Retention

We keep personal information only for as long as reasonably necessary for the purposes described in this Policy, or for a longer period where required by law or to establish, exercise, or defend legal claims. Our current retention practices are:

[SET SPECIFIC RETENTION PERIODS WITH COUNSEL — CCPA/CPRA AND GDPR BOTH REQUIRE STATED PERIODS OR THE CRITERIA USED TO DETERMINE THEM. A POLICY THAT SAYS ONLY "AS LONG AS NEEDED" IS NOT COMPLIANT.]

14. Security

We maintain administrative, technical, and physical safeguards designed to protect personal information against unauthorized access, disclosure, alteration, and destruction. These include row-level access controls that restrict database reads and writes, encryption in transit (TLS) and at rest [CONFIRM], hashed storage of round PINs, hashing of IP addresses used for rate-limiting, bot-protection on sensitive actions, and access to production systems limited to personnel who need it.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. You are responsible for keeping access to your email account secure and for deciding with whom you share round links and PINs.

Breach notification

If we become aware of a security incident affecting your personal information, we will notify you and applicable regulators as required by law and without undue delay. [ESTABLISH AN INCIDENT-RESPONSE PLAN AND CONFIRM NOTIFICATION TIMELINES — GDPR REQUIRES REGULATOR NOTIFICATION WITHIN 72 HOURS; U.S. STATE DEADLINES VARY.]

15. Your Rights and Choices

Depending on where you live, you may have some or all of the following rights regarding your personal information:

• Know and access. Request confirmation of whether we process your personal information and a copy of it, including the categories collected, sources, purposes, and recipients.
• Correct. Request correction of inaccurate personal information.
• Delete. Request deletion of your personal information, subject to legal exceptions.
• Portability. Request a copy of personal information you provided to us in a portable, machine-readable format, and where technically feasible, transmission to another controller.
• Opt out. Opt out of any sale, sharing, or targeted advertising. As noted above, we do not engage in these activities.
• Limit use of sensitive personal information. We do not collect sensitive personal information for purposes requiring this right.
• Withdraw consent. Where processing is based on consent, withdraw it at any time. Withdrawal does not affect processing carried out before withdrawal.
• Object and restrict. Where the GDPR applies, object to processing based on legitimate interests and request restriction of processing in certain circumstances.
• Non-discrimination. We will not deny you service, charge different prices, or provide a different level of quality because you exercised these rights.

How to submit a request

Submit requests to [CONTACT EMAIL] [OR VIA THE IN-APP PRIVACY REQUEST FORM AT [URL]]. We will acknowledge receipt within 10 business days and respond within 45 days, with one extension of an additional 45 days where reasonably necessary, and we will inform you of any extension. Where the GDPR applies, we will respond within one month, extendable by two further months for complex requests.

Verification

To protect your information, we will take reasonable steps to verify your identity before acting on a request. For account holders, this generally means confirming control of the email address associated with the account. For requests concerning data collected without an account, we may ask for the round link, device identifier, or other information sufficient to match the request to the data. If we cannot verify a request, we will notify you and explain why.

Authorized agents

You may use an authorized agent to submit a request on your behalf. We may require written proof of the agent's authority, verification of your own identity, and direct confirmation from you that you granted the authority.

Appeals

If we decline a request in whole or in part, you may appeal by replying to our decision or writing to [CONTACT EMAIL] with the subject line "Privacy Appeal." We will respond to an appeal within 45 days (or the period required by your state's law) with a written explanation of our decision. If your appeal is denied, you may contact your state attorney general or, in the EEA/UK, lodge a complaint with your local supervisory authority. [SEVERAL STATES — INCLUDING VIRGINIA, COLORADO, CONNECTICUT, AND TEXAS — REQUIRE AN APPEAL PROCESS; CONFIRM DEADLINES WITH COUNSEL.]

Self-service options

• Account deletion. If you have an account, you can delete it from your account settings. Deleting your account removes the rounds you created; rounds you only joined as a player are kept but are unlinked from your account.
• Removing content. You can delete a round you control. If your information appears in a round controlled by someone else, see Section 8.
• SMS opt-out. Reply STOP to any notification text to stop receiving messages.
• Local storage. You can clear the identifiers Round Update stores by clearing your browser's site data for the Service.

16. Additional U.S. State Disclosures

California

California residents have the rights described in Section 15 under the CCPA/CPRA, and may also request, once per year and free of charge, information about disclosures of personal information to third parties for their direct marketing purposes under California's "Shine the Light" law (Cal. Civ. Code § 1798.83). We do not make such disclosures. California residents under 18 who are registered users may request removal of content they posted, as described in Section 15 and Cal. Bus. & Prof. Code § 22581.

Other states

Residents of [Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, Virginia — CONFIRM THE CURRENT LIST OF EFFECTIVE STATE LAWS WITH COUNSEL AT PUBLICATION] have comparable rights to access, correct, delete, and obtain a portable copy of their personal information, and to opt out of sale, targeted advertising, and certain profiling. Requests may be submitted as described in Section 15.

Nevada

Nevada residents may submit a verified request directing us not to sell certain covered information. We do not sell covered information as defined by Nevada law.

Washington and Nevada health data

We do not collect "consumer health data" as defined by the Washington My Health My Data Act or Nevada SB 370. Golf scores and self-reported handicaps are not health data. [CONFIRM WITH COUNSEL IF THE APP EVER ADDS FITNESS, STEP-COUNT, OR BIOMETRIC FEATURES — THIS ANALYSIS WOULD CHANGE.]

17. Children's and Teens' Privacy

The Service is not directed to children under 13, and we do not knowingly collect personal information from children under 13. We do not ask for age, so we rely on users to comply with the age requirement in our Terms. If you are a parent or guardian and believe your child under 13 has provided us personal information, contact us at [CONTACT EMAIL] and we will delete it promptly.

We do not knowingly sell or share the personal information of consumers under 16, and we do not process the personal information of known minors for targeted advertising or profiling.

[IF YOU EXPECT USE BY MINORS 13–17, OR USERS IN JURISDICTIONS WITH HIGHER AGE THRESHOLDS (16 UNDER GDPR IN SOME MEMBER STATES), CONFIRM YOUR APPROACH WITH COUNSEL. ALSO REVIEW STATE AGE-APPROPRIATE DESIGN CODE LAWS AND ANY APPLICABLE APP-STORE AGE-SIGNAL REQUIREMENTS, WHICH HAVE BEEN AN ACTIVE AREA OF LEGISLATION AND LITIGATION.]

18. International Users and Data Transfers

Round Update is operated from [COUNTRY/STATE], and our providers may process and store information in the United States and other countries. If you use the Service from outside [COUNTRY], you understand your information may be transferred to and processed in countries whose data-protection laws may differ from those of your own country.

Where we transfer personal information out of the EEA, UK, or Switzerland, we rely on [the European Commission's Standard Contractual Clauses and the UK International Data Transfer Addendum / the EU-U.S. Data Privacy Framework and its UK Extension and Swiss Extension — SELECT AND CONFIRM WITH COUNSEL], together with supplementary measures where appropriate. You may request a copy of the relevant safeguards by writing to [CONTACT EMAIL].

EU/UK representative and Data Protection Officer

[IF YOU OFFER THE SERVICE TO EEA OR UK USERS, ART. 27 GDPR MAY REQUIRE AN APPOINTED REPRESENTATIVE IN THE EU AND/OR UK. LIST THEIR NAME AND CONTACT DETAILS HERE, OR STATE THAT NO REPRESENTATIVE IS REQUIRED AND WHY. WE HAVE NOT APPOINTED A DATA PROTECTION OFFICER BECAUSE OUR PROCESSING DOES NOT MEET THE ART. 37 THRESHOLDS — CONFIRM WITH COUNSEL.]

Right to complain

If you are in the EEA, UK, or Switzerland, you have the right to lodge a complaint with your local data-protection supervisory authority. We would appreciate the chance to address your concerns first at [CONTACT EMAIL].

19. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will revise the version number and "last updated" date at the top of this Policy. If the changes are material — for example, a new category of information collected, a new purpose of use, or a new disclosure recipient — we will provide advance notice through the Service, by email where we have your address, or by presenting the updated Policy for acceptance, and where required by law we will obtain your consent before applying the change to previously collected information. Prior versions are available on request at [CONTACT EMAIL].

20. Contact

Questions, requests, or complaints regarding this Privacy Policy can be sent to:

[LEGAL ENTITY NAME] · [CONTACT EMAIL] · [MAILING ADDRESS]

For privacy-rights requests, please use the subject line "Privacy Request" so we can route and log it promptly.