Privacy policy

Effective from 1 October 2026. Last updated 1 October 2026.

This privacy policy explains what personal data Golf Buds collects when you use the Golf Buds app, golfbuds.co.uk and docs.golfbuds.co.uk, why we use it, who we share it with, how long we keep it, and the rights you have over it.

Who we are

Golf Buds is run by Adam Pascoe, trading as Golf Buds, 1 Chester Road, Saltney Ferry, CH4 0AG, United Kingdom.

Golf Buds is the data controller for the personal data described in this policy. That means we decide why and how it is used, and we are responsible for it under UK data protection law (the UK GDPR and the Data Protection Act 2018).

You can contact us about anything in this policy at support@golfbuds.co.uk.

What this policy covers

This one policy covers:

the Golf Buds app on iOS and Android
golfbuds.co.uk, our main website
docs.golfbuds.co.uk, where these pages live

“We”, “us” and “Golf Buds” mean the controller named above. “You” means anyone who uses the app or visits either website.

The data we collect and why

What	Where it comes from	Why we use it
Account: your email address, your password (stored only as a secure hash), whether your email is verified, and your sign-in sessions	You, when you sign up and sign in	To create your account, sign you in, keep you signed in, and send account emails such as your verification email
Sign-in providers: your name, your email address where the provider shares one, your profile photo link, and your account ID with that provider	Google, Facebook, GitHub or Apple, when you continue with one. Facebook and GitHub may share no email. Apple shares your name the first time only, and no photo	To sign you in and verify your account, and to fill in your display name. If a provider’s verified email matches an account you already have, the provider is linked to that account instead of creating a second one
Imported profile photo	Google, Facebook or GitHub, copied once when you first sign up with one	To show as your profile photo. We store our own copy in the private `avatars` storage bucket, never the provider’s link, and you can remove it in the app
Profile: display name, bio, region, a coarse location label, handicap and its status, home course, travel radius, your three visibility settings, and your account role	You, during profile setup and when you edit your profile	To show your profile to other golfers as your visibility settings allow, and to match you with suitable rounds
Rounds and playing history: rounds you host or join, the course, tee time, spaces, handicap range, description and joining policy, your place on the roster, and attendance and no-show records	You, the host and the other golfers in the round	To run rounds and build the playing history you and other golfers see
Device location for search: a one-off reading, rounded to about 1 km	Your device, only if you allow location access	To show rounds by distance when you search. It is used for that search only and is not saved to your profile or account
Round chat: messages you send in a round’s chat	You	To let the golfers in a round talk to each other. Messages are removed 24 hours after tee time (see below)
Posts: your posts, their categories, likes, comments, and the photos and videos you add	You	To show your posts to other golfers. Photos and videos are kept in the private `post-media` storage bucket and checked before they are published
Connections: your connection requests and connections	You and the other golfer	To show who you are connected to and have played with
Reports, blocks and moderation records: reports you file or that are filed about you (each keeps a snapshot of the reported content), host no-show reports, blocks, and any warnings, quarantines or suspensions with their history	You, other golfers and Golf Buds moderators	To keep golfers safe and let moderators review reports and act on them
Notifications and preferences: your in-app notifications, notification settings, and per-round chat mute and reminder choices. We store no push notification tokens	Golf Buds and your choices	To tell you in the app about your rounds, connections and safety notices
Feature access: whether you have tester or trial access to a feature, and when a trial ends	Golf Buds	To decide which features you can use
Account deletion progress: when you asked to delete your account and how far the deletion has got	You, when you delete your account	To run the grace period and finish the deletion
Data export file: a copy of your data in JSON format	Golf Buds, when you ask for it	To give you a copy of your data. It is kept in the private `data-exports` storage bucket
Apple revocation token: one Apple token for your account	Apple, when you sign in with Apple	Kept only so we can revoke your Apple sign-in when your account deletion is finalised
Technical data: sign-in and session records kept by Supabase, and request logs kept by Cloudflare when you visit either website, such as IP address, browser or device, and time	Your device or browser, automatically	To keep Golf Buds secure, prevent abuse and fix problems
Website forms: the email address you give the notify form on golfbuds.co.uk, and the name, email address, reason and message you send through its contact form	You	To tell you when Golf Buds launches (Kit keeps the notify list), and to answer your message (Resend delivers it to support@golfbuds.co.uk)

We use most of this data because it is needed to provide the service you signed up for. We use reports, moderation records and technical data because we have a legitimate interest in keeping golfers safe and Golf Buds secure. We use your device location and the notify form only because you chose to give them to us.

Google user data

When you continue with Google, Golf Buds asks Google only for your basic profile and email address. We receive your name, your email address, your profile photo link and your Google account ID.

How we use it: to sign you in and verify your account, to fill in your display name (which you can change), to copy your photo once as your profile photo, and to link Google to an existing Golf Buds account that has the same verified email address.
How we store it: in our Supabase database and, for your photo, in the private avatars storage bucket. Your email address is never shown to other golfers.
How we share it: only with the processors that run Golf Buds for us, listed below. Other golfers see only your display name and profile photo, as your visibility settings allow. We never sell Google user data and never use it to show you ads.

We do not ask for access to your Gmail, contacts, calendar or any other Google data. If you delete your account, your Google sign-in is removed with it.

We use these service providers (processors) to run Golf Buds. Each one handles your data only on our instructions:

Supabase: hosts the app’s database, sign-in, file storage and scheduled jobs.
Cloudflare: hosts golfbuds.co.uk and docs.golfbuds.co.uk and keeps their request logs.
Kit: keeps the notify list for the golfbuds.co.uk notify form.
Resend: delivers messages sent through the golfbuds.co.uk contact form.
Apple: receives your Apple token when we ask Apple to revoke your Apple sign-in at the end of a deletion.

When you sign in with Google, Facebook, GitHub or Apple, that provider handles your sign-in under its own privacy policy. It is a separate controller, not our processor.

Other golfers see what your profile shows, as your visibility settings allow, along with the rounds, chat messages, posts and comments you share with them. Golf Buds moderators can see what they need to review a report.

Some of these providers are based outside the UK, so your data may be processed abroad. When it is, we rely on the safeguards UK data protection law provides for international transfers.

We may also share data when the law requires it, or when it is needed to protect someone’s safety. We never sell your personal data or use it to show you ads.

How long we keep it

We keep your account data for as long as you have an account. Some kinds of data follow their own rules.

Round chat

The app tells every round:

Messages in this chat are removed 24 hours after tee time.

The removal is permanent: an hourly job deletes the messages from our database, not just from view. If a message was reported, the report keeps a snapshot of it so a moderator can still review it.

When you delete your account

Your profile is hidden from other golfers straight away, and a grace period of 14 days starts. If you sign back in during those 14 days, the deletion is cancelled. After that, the deletion is finalised.

When you delete your account, five kinds of record are kept, shown against the name “Deleted golfer”:

Rounds you played stay in other golfers’ history, shown as “Deleted golfer”.
Messages you sent stay in round chats, shown as “Deleted golfer”.
Comments you left on other golfers’ posts stay, shown as “Deleted golfer”.
Reports and moderation records about your account are kept, so deleting can’t erase them.
Reports you filed about other golfers stay open, without your name on them.

We keep these records so other golfers’ playing history and conversations stay true, and so deleting an account can never erase a record of harm.

Everything else that is about you is removed when the deletion is finalised:

your display name, photo, bio, region, coarse location label, home course, travel radius and handicap
your email address and every sign-in method connected to your account
your connections and the blocks you placed
your posts and likes, with their photos and videos removed from storage within about a day
your notifications, notification settings and per-round choices
your feature access and any data export files

Your Apple token

If you signed in with Apple, we revoke your Apple token with Apple and delete it when your deletion is finalised. The deletion goes ahead even if Apple cannot be reached.

Data export files

A data export opens through a private link that works for 24 hours. The file is removed when your account deletion is finalised.

Technical data and website forms

Supabase and Cloudflare keep their technical logs for a limited period that they set. Kit keeps your email address on the notify list until you unsubscribe, which you can do from any email it sends. We keep contact form messages for as long as we need to deal with them.

Deleting your account and your rights

To delete your account in the app, open the Profile tab and tap Delete my account. The next screen explains what happens and what we keep. Tap Delete my account at the bottom, and Golf Buds asks you to confirm:

Delete your account? Your profile disappears from Golf Buds now. After 14 days your name, photo, email and handicap are permanently removed. Sign back in before then to cancel.

Tap Delete account to go ahead, or Keep my account to stop. If you change your mind later, sign back in within the grace period and your account is restored. Otherwise, a job that runs every hour finalises the deletion. If you sign in after the grace period has ended, the deletion is finalised straight away instead.

If you cannot use the app, you can ask us to delete your account by emailing support@golfbuds.co.uk. Tell us which account it is, and we may ask you to confirm that it is yours. Deleting your account explains the whole process.

You can download a copy of your data at any time, whether or not you delete your account. On the Delete my account screen, tap Download my data in the Before you go card.

Under UK data protection law you have the right to:

access the personal data we hold about you
rectification: have inaccurate data corrected
erasure: have your data deleted
restriction: ask us to limit how we use your data
portability: receive your data in a format you can reuse
objection: object to how we use your data

To use any of these rights, email support@golfbuds.co.uk. We will reply within one month.

If you are unhappy with how we have handled your data, you have the right to complain to the Information Commissioner’s Office (ICO), the UK’s data protection regulator. We would welcome the chance to put things right first.

How we protect your data

Every connection to the app’s servers and to both websites uses HTTPS.
Row-level security in the database means each golfer can reach only the data they are allowed to see.
Photos, videos, avatars and data exports are kept in private storage buckets.
Files are shared through signed links that stop working after a set time.
The secret keys that run Golf Buds are held only on our servers, never in the app.

Age

Golf Buds is for adults aged 18 and over.

We do not knowingly collect personal data from anyone under 18. If you think someone under 18 has an account, email support@golfbuds.co.uk and we will delete it.

Course data

The golf course details in the app are facility information, not personal data:

Changes to this policy

When we change this policy, we update the date at the top of the page and add a row here.

Date	Change
1 October 2026	First published.

Contact

To ask about this policy, exercise your data rights, or report a problem, email support@golfbuds.co.uk.