Privacy Policy
Last updated: June 2026
This page explains what SwingStakes ("we", "us") collects, how we use it, and the choices you have.
Information we collect
- Account info: email address, display name, username, optional handicap, optional bio, optional home course, and an optional avatar emoji you pick in-app. Authentication is handled by Supabase Auth — passwords are hashed (we never see plaintext), or you can sign in with Apple or Google (we receive only the ID token and basic profile fields the provider returns).
- Gameplay data: rounds you play, hole-by-hole scores, the games you configure (Wolf, Skins, Nassau, etc.), per-hole stakes amounts you set, and the round summary. SwingStakes is a digital scorecard — we do not process payments. Stakes amounts are numbers users track between friends and settle outside the app.
- Social connections: friend requests, friendships, group memberships, and any blocks you create against other users.
- Push notification tokens (web/installable app only): if you opt in to push notifications on the web or installed (PWA) version, your browser push endpoint and encryption keys are stored in the
push_subscriptions table so we can deliver notifications you've enabled. The native iOS and Android apps do not register for or collect push tokens.
- Reports you file: if you report another user or content via the in-app Report flow, we record your user ID, the reported user/content, and the reason in the
content_reports table for moderation review.
- Device info: basic browser/device metadata (user agent, app version) for error logs and stability analytics.
- Precise location (optional, only when you use a location feature): SwingStakes uses your device’s GPS in two places: (1) once, when you tap “Use my location” on the course-selection screen, to look up courses near you; and (2) during a round, if you turn on the GPS rangefinder, to show your live distance to the green. In its default mode the rangefinder reads your location continuously while the hole-play screen is open, so the distance updates as you walk; a Battery Saver mode in Settings switches this to a single reading only when you tap. Either way your location is processed on your device to compute the distance and is not stored by us or tied to your identity. GPS stops when the app is backgrounded or the screen is off, we never request location in the background, you can turn the rangefinder off entirely in Settings, and you can always search for a course by name instead. See “Third-party services” below for where lookups are performed.
- Mapped green coordinates (optional): if you map a green — by walking and dropping its front/center/back during a round, or tapping them on the satellite map — those green coordinates (plus your user ID as the contributor) are saved to our database so everyone who plays that course gets distances. This is the location of the course’s green, not a record of where you are.
How we use it
- To run your rounds, track stats, unlock achievements, and surface leaderboards.
- To deliver push notifications you opt into on the web/installable app (friend requests, round invites, round recaps, achievement unlocks).
- To enforce community safety (review and act on reports, honor blocks).
- To improve the product: debugging errors, understanding usage, shipping new features.
What we don't do
- We don't sell your data, ever.
- We don't process real-money wagers. SwingStakes never handles money; settlement between friends happens outside the app.
- We don't share your gameplay with anyone outside the friends and groups you chose.
- We don't track you across other apps or websites.
Third-party services
To run the app we share the minimum data necessary with a few service providers. Each processes it only to provide its service to us — we do not use advertising networks or cross-app tracking SDKs.
- Supabase — our database and authentication provider. Hosts your account, rounds, and notifications described above.
- Apple & Google — if you choose Sign in with Apple or Google, they handle the sign-in and return a verified ID token plus the basic profile fields you approve.
- OpenStreetMap (Overpass API at
overpass-api.de and Nominatim at nominatim.openstreetmap.org) — when you tap “Use my location,” your GPS coordinates are sent to these OpenStreetMap services to find nearby golf courses and your city name; and when you use “Auto-fill greens” on the mapping screen, the course location is sent to look up published green outlines. Coordinates are used for the lookup and are not retained by us.
- Esri / ArcGIS World Imagery (
server.arcgisonline.com) — the “map this course” satellite screen loads aerial map tiles from Esri so you can place greens visually. Only the map area you’re viewing is requested; no account, gameplay, or location data is sent.
- GolfCourseAPI (
api.golfcourseapi.com) — when you search for a course, the course name or city text you type is sent to return matching courses and tee details. No account or gameplay data is sent.
- QRServer (
api.qrserver.com) — when you share a friend-invite link, the invite URL (which contains your username) is sent to generate the QR-code image shown in the share sheet. Nothing else is sent.
- Sentry (
sentry.io) — if crash reporting is enabled in a given build, anonymized crash and error diagnostics (and your user ID, to de-duplicate reports) are sent so we can fix stability issues. No names, emails, scores, or message content are sent, and it is never used for advertising or tracking.
Storage & security
Data is stored by Supabase (Postgres) with row-level security. Passwords are hashed; we never see or store them in plain text. Push endpoints and report records are restricted by RLS so only you can see your own data, and only our moderation team can read aggregated reports.
Your controls
- Edit your profile, display name, handicap, bio, and tone setting any time in Settings.
- Toggle each notification category independently in Settings → Notifications.
- Privacy: make your full profile visible only to friends (Settings → Privacy → Private profile), or hide individual stats/handicap/rounds/badges/friends list.
- Block users in their profile via the “···” menu → Block. Manage blocked users in Settings → Safety → Blocked users.
- Delete your account in Settings → Account → Delete account. Your auth record, profile fields (display name, email, avatar, handicap, bio, home course), push subscriptions, blocks, friend connections, group memberships, and notifications are permanently deleted. Your scores in rounds shared with other players remain in those rounds’ history but show as “Deleted User” so other participants’ round records stay intact.
Children
SwingStakes is intended for users 18 and older. We do not knowingly collect data from anyone under 18. If we learn we've collected data from a minor, we will delete it promptly.
Contact
Questions? Email swingstakes@gmail.com.
← Back to app