Privacy

Location

iOS, watchOS and Android ask for your permission before the app sees a single fix, and the app only asks for location while you are using it — never in the background for its own purposes.

On Android, while a round is on, the app keeps reading the GPS with the screen off so the distances are right when you look again; a notification stays on screen the whole time, and reading stops when the round ends. Nothing about this changes where the position goes: it stays on the phone, as described here.

Every distance is computed on the device, from a course package that is already on the device. That is why a round works with no signal, and it is also why nothing needs to be uploaded: there is no server to compute against.

Without an account your position is not stored anywhere but the device, not attached to an identity, not shared with anyone and never used for advertising — with one exception, the pin of a hole, which you can switch off and which is described in the next paragraph. Signing in changes one thing: the start and end point of each shot you record are uploaded, tied to your account — see “Your account, if you create one”. Your friends never get a position: what they can see is the name of the course and a hole number — see “What your friends see”. You can withdraw location permission at any time in the system Settings; the app then cannot show distances, and says so rather than guessing.

In Settings, “Share where the pin is” is on unless you switch it off, and the first time there is a pin to share the app tells you before sending anything, with “OK” and “Don’t share”. It is sent during the round, hole by hole: when you hole out with at least two putts, the spot on the green your last putt was hit from; when you drag the flag on the map during a round, where you left it. That point goes with the course and its version, the hole, the day, whether it came from a putt or a drag, whether it sits right at the edge of the green as drawn, whether the phone knew you were at the green (yes or no, never where), and a random identifier for this installation — never your position at any other moment, your round, your score, your club or your name. It is sent without your account, even when you are signed in; if you have sent us a suggestion or a problem while signed in, this installation is tied to your account, and deleting the account deletes its pins too. Other players see a suggested pin only when at least two phones agree to within 4 metres, as one point worked out on our server — never anybody’s individual report — and it is never applied unless they tap it. Reports are deleted 90 days after the day they are for; what is kept after that is only each hole’s agreed point for that day, with no identifier.

Your account, if you create one

Signing in is never required — the whole app, every distance, the whole round, works forever with no account. If you choose to sign in, on iPhone it is with Sign in with Apple only, native, no third-party SDK: Apple hands the app your name, only the first time you ever grant it, and an email address, which can be the private relay address Apple generates instead of your real one.

On Android it is with your Google account, through the sign-in panel Android itself shows (Google’s Credential Manager): Google hands the app a signed token with your name and email address, which our server checks once to create or open your account. The app never sees your Google password, and asks Google for nothing else — not your contacts, not your Drive, not your activity. Everything below about an account applies the same on Android.

Once you are signed in, whatever is already on your phone uploads once: your saved rounds — course, holes, walked distance — the start and end point of each recorded shot, which club you used, your bag, your favourite courses, and your units. That data is stored on the infrastructure we run on Supabase, tied to your account. Signing out ends the session only; nothing on the phone or on the server is touched.

Deleting your account is one screen, inside the app — or, if you no longer have the app, an email to support@18bogeys.app from the address of your account, and we delete it the same way within 30 days — and it deletes for real: your profile and your name with its history, every round, every shot position, your bag and your favourites, your photo, your shared index and your shared bag, your friendships, your invitations and your profile link, the friend requests you sent or received, your blocks and mutes, everything your friends could see about your rounds, your notification devices and settings, and the suggestions and problem reports you sent while signed in — and with them, from the phone you sent them from, what it had sent before you signed in and the pins it shared. The function that does it stops and reports a failure, rather than success, if your profile, a round, a friendship, your name history, an activity item, a notification device or a friend request survives it; everything else is removed together with the profile it belongs to.

Three things are kept on purpose. A report someone else filed about your name keeps the name that was reported, so that deleting an account cannot erase a moderation record. A report you filed stays, with your account removed from it. And our audit log keeps a line saying that the account was deleted, when, and how many rows of each kind went — numbers, never content — plus the lines recording any change we made to your name, with the reason we wrote.

Your name

With an account you have a name: the one Apple or Google gives the app the first time you sign in, or one you type. It is what your friends see, and what anyone holding your profile link or one of your invitations sees — see “Friends”. Apart from that, you can add a photo and choose to share your estimated index and your bag with your friends — each is optional, and each has its own section below. There is no username.

You can change your name twice yourself; setting one when you have none does not count. After that, write to support. Every name you have had is kept in a history, with its date and where it came from — Apple, you, or us — which you can read, and which is deleted with your account.

We can change or remove a name too — after a report, for instance, or when you ask us to. Each time needs a written reason, which is recorded in our audit log, and it never uses up your own changes. If we remove your name, the app tells you, and the next one you choose is free.

Your photo

A photo is optional. Without one, the app shows your initials, drawn on the phone.

You choose it with the iOS photo picker — on Android, the system photo picker — which runs outside the app: the app never sees the rest of your library and never asks for access to it. There is no camera in this version.

Before it leaves the phone, the app crops it square, makes it 512 × 512 pixels and removes all its metadata — including the place where it was taken.

It is stored in a private storage area on the infrastructure we run on Supabase, tied to your account. Only you and your friends can see it. Not someone who opens your invitation or your profile link, not a stranger who scans your QR, not the website: they see your name, as before. On a friend's phone it is kept only in the app's memory while they use it, never written to disk. It is not shown on the watch, in notifications or on the image of a shared round.

Changing it deletes the previous one; removing it leaves your initials. When a friendship ends, that person stops being able to load it.

Anyone who is your friend can report it. We can look at a reported photo to deal with the report, and we can remove it; that deletes it and leaves your initials. Deleting your account deletes it.

Friends

Friends need an account on both sides, and nobody becomes your friend without you. There are three ways. You show a QR in person and the other person scans it: the friendship is made at once, because you are both there. You send an invitation link: whoever opens it sees your name and can send you a request, and you become friends only when you accept it — so a link forwarded to a group gives nobody a friendship without you. Or someone opens your profile link and sends you a request, which you accept, decline, or decline and block.

The QR contains a random code and nothing else — no name, no identifier. It works once, for 30 minutes, only one is alive at a time, and closing the screen deletes it. An invitation link works once, for 14 days. Whoever opens either one in the app sees your name before deciding.

Your profile link, 18bogeys.app/u/…, is one per account and lasts until you change it. Anyone who has it — in the app, or in a browser without signing in — sees your name and nothing else: no identifier, no rounds, no location. The page is marked so search engines do not index it. From the app, they can send you a request. You can regenerate the link, and the old one stops working the same moment, or switch it off. Blocking someone makes your link read as not found to them in the app; a browser that is not signed in cannot be told apart from anyone else, so to take your name away from a person who already has the link, regenerate it.

When someone sends you a request you see their name. If you decline, they are never told — to them it still reads “requested” — and the same person cannot ask again for 30 days. A person can receive at most 20 new requests a day, and send at most 20.

You can remove a friend or block anyone at any time. A block works both ways — neither of you sees the other's activity and no notification goes between you — and the person you block is never told. Friendships, invitations, requests, blocks and mutes are stored under your account on the infrastructure we run on Supabase, and they are kept until you delete your account; a friendship or a request also ends when the other person deletes theirs.

What your friends see

When you are signed in and play a round, your friends can see that you are playing, at which course, and which hole you are on. When you finish, they see the course, your score and its difference from par, how many holes you played, and whether it was your best round at that course or your first time there. That is all the activity there is.

Never a position. What the app sends is the name of the course and a hole number; the coordinate stays on your phone, whatever you share.

Every round is shared with your friends unless you make it private, with a switch when you start it. A private round produces nothing.

“Playing” disappears when you finish or abandon the round, and friends stop seeing it after six hours in any case. A finished round stays visible to your friends — including to someone who became your friend after you played it — until you remove the friend or delete your account.

Only your friends see this, and us. It is not public and not searchable, there are no likes and no comments, and it is in the order things happened, not ranked by anything.

Tapping a friend opens their profile: their photo or initials, their name, since when you are friends, and the finished rounds they shared — the same ones as in the activity list, never a private round. Rounds played before signing in never appear.

Two more things appear there only if that person switches them on, and both are off unless they do: their estimated index (the number, how many rounds it counts, and the date — it is our estimate, not an official handicap) and their bag (which clubs, and the brand and model of each if they wrote one — never a distance). Switching either off deletes our copy at once. Nobody is told when you switch something off: the section is simply not there.

Notifications

Notifications are only about friends: what a friend did — started playing, finished a round, played their best round at a course, or became your friend — and someone asking to be your friend. Never news, never offers, never reminders.

Notifications are iPhone-only for now: the Android app sends none and stores no notification token. The app asks iOS for permission only once you have your first friend. If you allow it, our server stores the token Apple assigns to this app on your phone, tied to your account, and whether your phone is set to Spanish or not, so that notifications arrive in your language. Up to ten phones per account. Signing out removes that phone's token, and so does Apple telling us a token no longer works.

You can switch each kind off separately, and mute a single friend without them knowing. A mute only silences notifications: that friend's activity still appears in the app.

When you start or finish a round, your phone asks a function we run on Supabase to notify your friends. When a friendship is made, the phone that made it asks the same function to tell the other person. It works out who should get it — your friends, minus anyone blocked in either direction, anyone who muted you and anyone who switched that kind off — and sends the text through the Apple Push Notification service, which is how every iPhone notification is delivered. The text carries your name — and, for a round, the course and your score — plus internal identifiers the app uses to open the right screen; Apple carries it to your friends' phones, and discards it after an hour if it could not be delivered. A request notification carries Accept and Decline, which answer it without opening the app, and Apple discards it after 24 hours if it could not be delivered. No other company is involved.

Reporting a name, a photo or a bag

If a friend's name, photo or the text in their bag (a brand or model they typed) is offensive or impersonates someone, you can report it — the name also from an invitation, a profile link or a request — as offensive, impersonation, or another reason in your own words, up to 500 characters. At most 20 reports a day.

A report is stored with who filed it, who it is about, the reason, your text if you wrote one, and a copy of the name or the bag text as it was at that moment — for a photo, which photo — taken by our server rather than sent by your phone. Only we can read reports. The person reported is never told who reported them; the only thing they ever learn is that their name was removed after a report, if we remove it.

Reports are kept after they are dealt with, for now with no end date. If you delete your account, the reports you filed stay without your account attached, and a report about your name keeps that name.

Sharing a round

At the end of a round you can make an image of it: the course, the date, your score, the drawn map with its credit, and — if your profile link is on — a small QR of it. The image is drawn on your phone and leaves it only if you share it, through the iOS share sheet, to wherever you choose. We never receive it.

The QR on it is your profile link: anyone who sees the post can scan it, see your name and send you a request. If you do not want that, switch the link off before sharing — the image then carries no QR — or regenerate it afterwards.

The round log, which stays on your phone

From version 0.1.0 (30) of the iPhone app, the app keeps a log of each round you play, on your iPhone, so that when a distance looked wrong you can send it to us and we can see what happened. It is on by default. The switch is in Settings, under “Round log”, and is called “Save a log of my rounds”; turned off, nothing more is written, and it stays off through every update. Earlier versions kept no log unless you turned on a switch hidden among the test tools.

While it is on, the app adds one line per accepted GPS fix to a file for that round, in its own storage: the time, the course and hole, the par, the raw coordinate, the smoothed coordinate the engine used, the accuracy the GPS reported and whether the position had gone stale, the distances that were on screen, how many hazards were listed, whether the app was on screen (and, on the watch, whether the workout was running), why the hole changed when it did, and which device took the fix. A demo round is not logged.

It keeps your last 5 rounds or the last 30 days, whichever is fewer; older ones are deleted when a round starts or ends. If you play with the Apple Watch, the watch keeps its own lines for the round and, when the round ends, hands them to your iPhone over the direct link between the two, where they are kept next to the phone’s. The watch sends them nowhere else, and if the switch on the iPhone is off, the iPhone does not keep them. The watch’s Settings show the iPhone’s choice; the switch itself is on the iPhone.

Nothing in the log is sent to us, or to anyone, on its own. It leaves your iPhone only if you share it yourself with the system share sheet — “Export logs”, in the same section, or “Send this round’s log” at the end of a round — and you choose where it goes. “Delete logs” erases them all, and deleting the app deletes them with everything else.

Usage statistics, which you can switch off

From version 0.1.0 (30) of the iPhone app, the app counts how it is used, so that we can see what works and what to fix: which screens are opened, whether a round is started and finished, how long the first distance takes to appear, which features are used and when something fails. Earlier versions send none of this, and the watch sends nothing.

Each record says what happened, when, and a few facts about it: the course and the hole, how many shots were recorded, and a distance or a GPS accuracy only as a band, such as “under 1 km”. With it go the app version, the iOS version, the kind of iPhone, the language, yards or meters, the App Store country, whether it is a TestFlight or an App Store copy, and whether you are signed in — yes or no, not who you are.

Never a position: no record carries a coordinate, and the app strips anything that looks like one before it is kept. Never anything you type. When something fails, only the kind of error and its code, never its message.

Records are sent in batches, never during a round, to our database on Supabase. They carry the same random identifier for this installation that your answers about a course and your feedback use — not Apple’s advertising identifier, and not the identifier for vendor of the course-request form. The records themselves do not say who you are. If you have ever sent us something while signed in, that installation is tied to your account, and deleting your account deletes these records too.

Outside the European Union, the European Economic Area, the United Kingdom and Switzerland it is on from the start, and the welcome screen says so. In those countries, judged by your App Store country, it is off until you turn it on: until then the records wait on your phone for up to 30 days and are sent only if you do. The switch is in Settings, under “Help improve 18 Bogeys” → “App usage”. Turning it off stops it at once and deletes what was waiting on the phone.

We keep each record for 90 days. After that only daily totals remain, with no identifier, for 13 months. An installation that has not been seen for 13 months is deleted with everything tied to it. Nobody else gets any of it: not for advertising, and not for sale.

The diagnostic log

Separately, the app keeps a small diagnostic log in its own storage — a line when a round starts or ends, when a layup is planned, when a course fails to load. It holds no coordinates and no identifiers, and the file itself is never uploaded: nothing in the app reads it back. What the app does send about its use is the section above, and only that.

Apple Watch and Health

On the watch the app starts a golf workout while you play. That is what keeps the GPS running when your wrist drops and the screen goes off, and it records the round as a workout in your own Health app. It asks your permission first, it never reads your health data, and the round works without it — you just have to keep the screen awake.

The watch and the phone hand settings and course data to each other directly, over the link Apple provides between your own two devices. There is no server in the middle.

An email address left on the old waitlist

This site used to have a waitlist, and it no longer does: the app is on the App Store. The addresses people left are still stored, with the language they were reading in and the fact that they came from here.

They are kept, not used. The only thing they could still be used for is a single email saying the app is out, if we decide to send one — nothing else, and never a newsletter.

They are kept in a database we run ourselves, hosted on Supabase, which processes them on our behalf and does nothing else with them. They are never sold, never rented, never given to an advertiser, and never used for a newsletter.

The list cannot be read from outside at all. The table has row-level security switched on with no policy that permits a read, and the public API’s permission to read it has been revoked — two independent locks, either of which would be enough.

Ask us to delete yours and we will, with no questions and no "are you sure" email. The address is at the bottom of this page.

Asking us to map a course

The form that asks us to map a course has no account and no email field, deliberately: what is not collected cannot leak. We keep what you typed — the name, its web page, the city and country if you filled them in, and your note — and which of the three languages you were reading in. From this site, nothing else, and nothing that identifies you.

Asking from the app, “Is yours missing?” sends the same fields straight to 18bogeys.app, plus one more: an identifier for your phone that iOS gives the app (Apple’s identifier for vendor — not the advertising identifier, and it changes if you delete the app). It is stored with the request so that one phone counts once per course and cannot send more than 20 requests a day. It is not tied to your account, even if you are signed in, and nothing else is joined to it. Requests are kept with no end date; dealing with one only changes its status.

The queue cannot be read from outside. The public API’s permission to read that table has been revoked, so the form can add a request and cannot be used to find out what has already been asked for. We never write back to you — there is no address to write to. The course turning up in the app is the answer.

Sending feedback or reporting a problem

At the bottom of “Me”, “Send feedback or report a problem” sends us what you write: whether it is a suggestion or a problem, your text (up to 2,000 characters) and the language the app is in. Only if you switch on “Attach the app version and phone model” does it also send those two — the model as iOS names it, for instance “iPhone16,2”; otherwise nobody fills them in. There is no email field: without an account we cannot write back, and the answer is the app getting better.

It goes with the random identifier for this installation that your answers about a course already use, so that one phone can send at most five a day. If you are signed in, the message is tied to your account and we see it with your name. Without an account it is anonymous: we only see a short tag worked out from that identifier, enough to tell that three messages came from the same phone, and never the identifier itself.

It is stored in our database on Supabase, and only we can read it. Deleting your account deletes everything you sent while signed in and, if you sent anything that way, everything the same phone sent before you signed in. A message from a phone that never sent one while signed in is tied to nobody, and it is deleted once that installation has not been in touch with our server for 13 months.

Course data

Course geometry comes from OpenStreetMap contributors and is used under the Open Database License 1.0. Aerial photos come from public sources with open licences: NAIP, from the United States Department of Agriculture through USGS The National Map, in the public domain; and in South Tyrol, the 2023 orthophoto of the Autonomous Province of Bolzano, under CC0 1.0.

That data travels towards you and never away from you: downloading a course tells us nothing about you, because there is nothing to tell.

Showing you a course that does not ship inside the app means asking 18bogeys.app for the course list and for that course’s package. Those requests use no cookies and no analytics, they do not build a history of who looked at what, and a course you have already downloaded keeps working offline — the courses that ship inside the app work with no network from the first launch. Starting a round with a signal also asks our server for today’s suggested pins on that course; that request says which course and which day, and nothing else.

The aerial photo behind a hole does not come from us. Where there is an open-licence public photo — the USGS in the United States, the Province of Bolzano in South Tyrol — the app asks that server for it directly and keeps it on the phone. Like any website you visit, that server sees your connection’s IP address, which area was asked for (so, which course), when, and the app’s name and version. The app sends it no account, no identifier, no cookie and no position: the photo is chosen from the course map, so the request is the same whether you are on the tee or on your sofa. What those servers keep is governed by their own policies: usgs.gov/privacy-policies for the USGS and provincia.bz.it/it/privacy.asp for the Province of Bolzano. In Settings, under “Aerial photo”, “Download” can be “Always”, “Wi-Fi only” or “Never”, and “Delete” removes the photos already saved. Without a photo the map is drawn just the same, and the distances do not change.

Opening a club’s page asks our server for that club’s news — maintenance, tournaments, closures. The only thing the request says is which club. It uses no cookies and no analytics, and nothing on our side records who asked; if you are signed in, the request carries your session the way every request to our server does, and that changes nothing. The news itself is headlines and links taken from the club’s own public website. The answer is kept on your phone so you can read it without a connection, and it is thrown away once it is out of date.

Tapping «Request» on a course we have not mapped yet tells our server which course it is (its OpenStreetMap id and name, and its city and country when known), your language, and a random identifier created on this installation so that one phone counts once. Nothing else: no name, no position, no account.

If you answer how a course worked at the end of a round (or when you come back to one you left unfinished), the app sends your answers with a random identifier for this installation, the course and its version, and how many holes you played; never your name, your location or your score.

If, when you request a course, you ask to be told when it is ready, the app also sends the notification token Apple gives this phone. It is used only for notices about that course — that it is ready, or that we could not build it automatically and our team is looking at it — and it is deleted when the course becomes available or after 90 days, whichever comes first. You can say no and still request the course.

What the app does not do

No advertising and no advertising SDK. No third-party analytics. No tracking across other apps or websites — the app never shows the tracking permission prompt, because there is nothing it could track you with. No password to manage, ever: the only ways to sign in are Sign in with Apple on iPhone and your Google account on Android, and it is always optional. Nothing is sold to anybody, ever. The photo servers are public agencies with no code of theirs inside the app: we give them nothing, and they learn only what any website learns from a visit.

This is checkable rather than promised: signed out, the only requests the app makes are for course files, club news and today’s suggested pins — public, and the same for everyone — for aerial photos, from the public servers named above, and for things you send: a course request, when you send one yourself (with this phone’s notification token only if you asked to be told when it is ready), your answers about a course, when you choose to give them, a suggestion or a problem report, when you write one, and the pin of a hole, while sharing it is on — and, from version 0.1.0 (30), the usage statistics above, while they are on. Signing in is the one exception, and everything it involves is above: your account, your name and your photo, friends and their notifications. Two companies take part, each for one job: Supabase runs our database and our server function on our behalf, and Apple signs you in and delivers notifications. We give neither of them anything for advertising, and there is nobody else.