Privacy policy.

Bagpipe Golf, a subsidiary of Taybuta, Inc. ("Bagpipe Golf," "we," "us") respects your privacy. This policy explains what information we collect when you use the Bagpipe Golf mobile app or website, how we use it, and the choices you have. By creating an account or using the app, you agree to the practices described below.

1. Information we collect

Information you give us

• Account information — email address, display name, and a password (or social sign-in token if you sign in with Apple, Google, or another provider). You can optionally add a phone number for SMS-based features (tournament alerts); the number isn't required to use the app.
• Profile information — your handicap index, home course, playing style, typical miss, and any other fields you choose to fill in on the Profile screen. You can edit or remove this information at any time.
• Bag / clubs — the clubs you've configured in your bag, with optional distances. This information stays in your account.
• Round data — scorecards you create, including course played, date, per-hole scores, putts, fairways hit, greens in regulation, and any other stats you choose to enter.
• Bet and tournament data — bet games you create or join, player rosters, hole-by-hole scoring entries, and the resulting settlement amounts. We process bet outcomes as informational scoring; we do not collect, hold, or transfer money.
• Friends — when you add another Bagpipe Golf user as a friend, their account becomes a mutual link in your account. You can remove a friend at any time.
• Tournament invites — when a tournament director sends an email invite, we store the invitee's email address along with a status (pending, accepted, expired, revoked) so the director can manage the invite list and the recipient can accept the invite.
• Issue reports — if you report a bug or send feedback, we collect the text of the report and any screenshots you attach.

Information collected automatically

• Round-of-play location — when you tap a course in search results, we use your device's location to surface nearby courses. The app does not continuously track your location; location is used only when you actively search for or open a course screen. iOS asks your permission via the standard Location prompt.
• Voice input — if you use the voice-input feature for shot advice or issue reports, the app uses your device's speech recognition service to transcribe what you say. The transcript is processed in the app and is not stored on our servers as raw audio.
• Push notification token — if you opt in to tournament push notifications, the app registers a Firebase Cloud Messaging (FCM) token with our backend so we can deliver tee-time, pairing, and update messages. You can turn off push at any time from Profile → Notifications or in your device settings.
• Crash and error reports — when the app crashes or hits an unhandled error, we send a crash report (stack trace, OS version, app build number, release tag) to Sentry. Crash reports do not include the content of your scorecards, bet games, or messages.
• Usage analytics — we use PostHog to record product usage (which screens are visited, which buttons are tapped, error rates, feature adoption). Analytics events are tied to your account — your user ID, email, display name, and handicap are attached as PostHog profile properties so we can debug account-specific issues and understand usage by segment. This is not anonymous analytics. You can ask us to opt your account out of analytics collection (see §6). We never sell analytics data and never use it for third-party advertising.
• Authentication metadata — when you sign in, Supabase records the timestamp of the sign-in along with a session token. This is standard authentication infrastructure.

Information we do NOT collect

• We do not collect contacts, calendar entries, or messages from your device.
• We do not collect health, fitness, or biometric data beyond what's required for Face ID / Touch ID device authentication (the biometric template never leaves your device — it stays in the iOS Keychain or Android Keystore).
• We do not collect microphone audio in the background. The microphone is only active when you explicitly tap the voice-input button.
• We do not collect photos in the background. Photos are accessed only when you choose to attach a screenshot to an issue report.

2. How we use your information

We use the information we collect to:

• Provide the core service — show your scorecards, run your bet games, render your tournament leaderboards, sync your data across your devices.
• Connect you with the friends, opponents, and tournament organizers you choose to play with.
• Send service messages: tee-time confirmations, tournament updates, password recovery emails, and other transactional notifications you've opted into.
• Improve the app — diagnose crashes, prioritize features that are actually being used, identify slow surfaces to optimize.
• Honor your account-deletion requests.
• Comply with our legal obligations.

We do not sell your personal information. We do not use your data to target third-party ads.

3. Third-party processors

We rely on a small set of trusted infrastructure providers to operate the app. Each is bound by a data processing agreement and is listed below so you know where your data flows:

We do not use third-party advertising networks.

Downstream developers and API users

If we make an API, SDK, join-code integration, or other data access available to a third-party developer, tournament-management partner, or course operator's own tooling, that access is governed by a separate agreement with us in addition to this Privacy Policy. Any such third party must handle data obtained through that access consistent with both this Privacy Policy and their own posted privacy policy, and may not use the API or the associated agreement in a way that conflicts with either. We vet and contractually bind the processors listed above, but we do not control what an independent third-party developer does with data once it leaves our systems through an access grant we did not directly process on our own infrastructure.

Bagpipe Golf, its parent company Taybuta, Inc., and any other facility or LLC owned by Taybuta, Inc. are not responsible or liable for a third party's improper, unauthorized, or unlawful use, storage, or disclosure of data obtained through such access. That liability rests solely with the third party responsible for the misuse. If you believe a third-party integration has misused your data, contact us at the address in §10 and report it to that third party directly.

4. International data transfers

Our backend runs in the United States. If you use Bagpipe Golf from outside the United States, your data will be transferred to, stored, and processed in the United States. By using the app, you consent to this transfer. We rely on standard contractual clauses or equivalent safeguards for transfers from the European Economic Area, the United Kingdom, and Switzerland where applicable.

5. Data retention

• Account data — kept for as long as your account exists.
• Round, bet, and tournament data — kept for as long as your account exists.
• Crash and analytics events — retained for up to 12 months then aggregated or deleted.
• Push notification tokens — refreshed continuously by the device; stale tokens are pruned automatically.
• Tournament invites — retained until accepted, revoked, or expired, then archived for one year to support audit.

When you delete your account (see §6), all data tied to your account is deleted from our active systems within 30 days. Backup copies may persist for up to 90 days before being permanently erased.

6. Your choices and rights

Delete your account

You can delete your Bagpipe Golf account at any time from Profile → Delete Account. The deletion flow removes:

• Your profile and authentication record
• Your rounds, bets, and tournaments
• Your friends list (and your entry from your friends' lists)
• Your issue reports

Known limitation: image attachments (screenshots) you included with an issue report are not currently deleted automatically when you delete your account — the report text is removed, but the uploaded image file may remain in our storage. We're working on closing this gap; until then, avoid attaching screenshots that show sensitive personal information, and email us (§10) if you want a specific attachment removed.

Some information may be retained where law requires (for example, financial recordkeeping where Bagpipe Golf has handled real money; we currently do not).

Aggregate metrics survive deletion. Deleting your account removes your personally-identifying records, but aggregate counts derived from your activity — for example, totals used for app-wide metrics like rounds played, bets settled, or tournaments run — may continue to exist as part of our overall usage statistics. These counts are not linked back to your identity once your account is deleted.

Access and correct your data

You can view and edit most of your data in-app. For a full data export, email us at the address in §10 below.

Opt out of notifications

You can disable push, email, SMS, and in-app notifications per category (Tournament, Social, System) at Profile → Notifications.

Opt out of analytics

Analytics are used for product improvement; we don't sell them. If you'd like to disable PostHog event reporting entirely, email us — we can flag your account as opted-out.

Region-specific rights

If you are in California, the EEA, the UK, or another jurisdiction with statutory privacy rights, you may have additional rights including the right to know, the right to delete, the right to portability, and the right to opt out of "selling" or "sharing." Email us to exercise any of these rights. We will not discriminate against you for exercising your rights.

7. Children's privacy

Bagpipe Golf is not intended for children under 13 (or the equivalent minimum age in your country). We do not knowingly collect information from children. If we learn we've collected information from a child, we'll delete it.

8. Security

We use industry-standard encryption in transit (HTTPS for every API call, TLS for every database connection) and at rest (provider-managed encrypted storage on Supabase). We use Supabase Row Level Security to enforce per-user access controls at the database layer. Authentication uses PKCE; biometric credentials never leave your device.

No system is perfect. If you believe your account has been compromised, email the address in §10 and we'll help you secure it.

9. Changes to this policy

This policy is subject to change at any time, with or without notice. When we update it, we'll update the "Last updated" date at the top of this page, and we'll make reasonable efforts to notify active users in-app or by email when the changes are material — but your continued use of the Service after a revised policy is posted constitutes your acceptance of it, whether or not you received a direct notice.

10. Contact us

Privacy questions, data export requests, or rights inquiries:

Bagpipe Golf, a subsidiary of Taybuta, Inc.
Privacy contact: privacy@bagpipegolf.com
Mailing address: 2119 Greenspire Dr, Casper, WY 82604

11. Governing law

This policy is governed by the laws of the State of Colorado, without regard to its conflict of laws principles.

Questions? hello@bagpipegolf.com