YOUR DATA, ON THE RECORD.

Account information. When you sign up, we collect your email address and a password (stored only in hashed form) to create and secure your account.

Profile information. Your name, username, bio, golf level, favorite course, and profile photo — the details that make up your golf identity.

Golf activity. Rounds you log, including courses played, dates, tee information, and hole-by-hole scores.

Social activity. Posts and photos you share, likes, comments, and the golfers you follow or who follow you.

Technical data. Like most web services, our hosting automatically processes standard technical information such as device and browser type and pages visited, to keep the service running and secure.

We use the information above to:

• Run the core service — your feed, profile, scorecards, stats, and notifications.
• Compute your golf statistics, trends, and course records from the rounds you log.
• Show you relevant golfers, courses, and posts.
• Send account emails you request, such as password resets.
• Keep PingAces safe, troubleshoot issues, and improve the product.

PingAces is a social network, so your profile, posts, photos, and logged rounds are visible to other members. Your email address and password are never shown to other members.

We also share information with the service providers that help us operate PingAces — such as hosting, database, storage, and authentication providers — only as needed to run the service, and where required by law or to protect the rights and safety of PingAces and its members.

PingAces never sells your personal information and does not share it for cross-context behavioral advertising; we share only with service providers who process it on our behalf, or when required by law/to protect safety. This statement concerns disclosures by PingAces; content you choose to publish or send to other members is shared with those members according to your visibility choices.

• Lovable Cloud and its hosting, database, authentication and storage infrastructure providers process account records, uploaded media and network information to run and secure the service.
• Lovable AI Gateway and the selected AI model provider (OpenAI or Google, depending on the feature) process your submitted questions, relevant golf data, scorecard images or stored Timeline thumbnails to return requested AI results.
• Garmin processes connection and synchronization requests when you connect Garmin; Apple Push Notification service processes device tokens and notification payloads when you enable iPhone alerts.
• Google Fonts receives your network IP address and browser request information when fonts are downloaded. Google Analytics (GA4) receives analytics only after consent, with advertising signals disabled and identifier-bearing paths excluded.
• Sentry, only when configured, processes error diagnostics to identify faults. Default personal-information collection is disabled; diagnostic processing is separate from optional GA4 analytics.

These recipients provide the corresponding services; Garmin and Apple also operate your independent accounts/devices under their own terms. Network services necessarily receive IP addresses. Abuse protection uses short-lived counters keyed to your account or a hashed network address, not advertising profiles.

• Edit your profile, bio, and photo anytime from your profile page.
• Edit or delete any round you've logged from its scorecard page.
• Delete posts and comments you've created.
• Toggle follow, like, and comment notifications on the Activity page.
• Choose who sees your profile, stats and photos (Everyone, Aces, Only me) in Settings.
• Download a copy of your data from Settings.
• Delete your account in the app: Settings → Delete account. This permanently removes your account, your posts, rounds, messages and other data, every photo, video and scorecard you uploaded, and any Garmin connection.
• Report content and block members from any post, comment, message, profile, group or tee-up.

If you enable iPhone notifications, we store your device's push token, platform and registration information to deliver alerts through Apple Push Notification service (APNs). Apple processes the token and alert payload on our behalf for delivery; alerts may appear on your lock screen. Tokens are not sold or used for advertising. Change alert types in Settings or disable permission in your device settings. Tokens are removed on account deletion or when confirmed invalid.

Only after you accept analytics, Google Analytics 4 uses cookies such as _ga and _ga_* to measure visits, pages and activity, including browser/device information and approximate location derived by Google from network information. Google is our analytics service provider. We disable advertising personalization and Google Signals and do not send email addresses, push tokens or Garmin credentials as analytics parameters.

Reject analytics or withdraw permission at any time using Cookie settings in the footer. Global Privacy Control is treated as rejection. Essential account/session storage remains necessary to operate the service. See our Cookies page and Your Privacy Choices.

If you connect Garmin, we store only encrypted access tokens — never your Garmin password. We import your golf rounds, shots, clubs and stats. Disconnecting or deleting your account removes the connection. Connecting is optional and authorizes this processing. Garmin receives connection and sync requests; imported data is used for your scorecards, stats and the features you choose. You can disconnect in Settings. Imported rounds remain until you delete them or your account. Garmin's own privacy terms govern your Garmin account.

Photos and videos you upload — to your Golf Timeline, posts or scorecard scans — are stored so we can show them to you and the people you choose. We read the date and GPS location saved in a photo (EXIF) to match it to courses and rounds.

We use your device location only while you use live scoring, and only with your permission, to show distances to the green and save shots you mark.

Ace, our AI golf assistant, sends your questions and golf stats to our AI provider to answer you. The golf-photo check sends small thumbnails of your Timeline uploads to the same provider to tell golf photos apart. Scorecard scanning sends the image you submit for extraction. These requests are processed through Lovable AI and its underlying model providers to supply the feature you request, not for advertising. Do not include sensitive information about yourself or others in AI questions or uploads. AI answers can be wrong.

We keep your information for as long as your account is active. Content you delete — such as posts, comments, and rounds — is removed from the service. If you delete your account, account data is removed from active systems within 30 days and residual backup copies expire within 90 days. Backups are isolated from normal use; if restored, deletion must be reapplied. We retain only information necessary for legal obligations, unresolved disputes, fraud prevention or safety, for the period justified by that need, and then delete or de-identify it. Consent choices remain in your browser until cleared or replaced; Google Analytics cookies normally expire within two years, unless you withdraw consent sooner. This retention policy also governs our service providers.

We use reasonable technical and organizational measures to protect your information, including encrypted connections and access controls on stored content. No method of transmission or storage is completely secure, so we cannot guarantee absolute security — but protecting member data is a core part of how we build PingAces. If a breach affects your personal data, we will notify affected members and relevant authorities as required by applicable law, without undue delay and within legally required timeframes, explaining known risks and protective steps.

PingAces is for people aged 13 or older only. It is not directed at children under 13, and we do not knowingly collect personal information from them. If you believe a child has created an account, contact us and we will remove it.

• Contract: creating accounts, providing social features, messages, scorecards and requested integrations.
• Consent: optional analytics, device permissions and other processing where consent is required. You may withdraw consent at any time without affecting earlier lawful processing.
• Legitimate interests: keeping the service secure, preventing abuse, handling reports and improving essential reliability, balanced against your rights.
• Legal obligations: complying with valid legal requests and applicable recordkeeping or safety requirements.

Subject to applicable law and exceptions, California residents may know/access the categories and specific pieces of personal information collected, delete it, correct inaccuracies, opt out of sale or sharing, limit qualifying uses of sensitive personal information, and exercise rights without discrimination. We do not sell or share personal information for cross-context behavioral advertising and do not use sensitive information to infer characteristics or for purposes requiring a limitation opt-out. You may still submit an opt-out or limitation request. Authorized agents may submit requests with proof of authority; we may also verify the consumer.

Categories collected in the preceding 12 months depend on the features you use. Sources are you, your activity/device, connected Garmin data and other members' interactions. Purposes are operating the service, requested features, safety and consented analytics. Disclosures are to relevant service providers, recipients you select, or law/safety recipients as described above.

Subject to applicable exceptions, you may access and correct your information, request erasure, receive a portable copy, restrict processing, object to processing based on legitimate interests and withdraw consent. You may complain to your local data protection authority (including the UK Information Commissioner's Office). We do not make legally or similarly significant decisions solely through automated processing.

Email support@pingaces.com for access, deletion, correction, limitation or other rights requests, or use Settings → Download my data / Delete account. We verify identity through your signed-in account or proportionate additional checks; never email your password or private keys. We respond within 45 days, or sooner when applicable law requires (normally one month for EU/UK requests). If a lawful extension is necessary, we explain why and provide the expected date within the original deadline.

We honor Global Privacy Control (GPC) as an opt-out of sale/sharing and as rejection of optional analytics, including a previously accepted choice. Because we do not sell/share for cross-context advertising, no such processing occurs regardless. Browsers' legacy Do Not Track (DNT) signals are not standardized; we do not separately change processing for DNT. Use GPC or Cookie settings to control optional analytics. This disclosure addresses California's CalOPPA requirement.

PingAces and our providers may process data in the United States and other countries whose laws differ from your own. For transfers from the EU/EEA or UK that require safeguards, we use legally recognized mechanisms such as adequacy decisions or standard contractual clauses and the UK addendum, as applicable, with supplementary protections where needed. Contact support@pingaces.com for information about applicable safeguards.

If we make material changes to this policy, we will update the date above and, where appropriate, notify members in the app. Continuing to use PingAces after a change means you accept the updated policy.

Questions about this policy or your data? Email us at support@pingaces.com.