Privacy policy.

Bagpipe Golf, a subsidiary of Taybuta, Inc. ("Bagpipe Golf," "we," "us") respects your privacy. This policy explains what information we collect when you use the Bagpipe Golf mobile app or website, how we use it, and the choices you have. By creating an account or using the app, you agree to the practices described below.

1. Information we collect

Information you give us

• Account information — email address, display name, and a password (or a social sign-in token if you sign in with Apple or Google, where that option is offered). You can optionally add a phone number so a tournament organizer can text you alerts such as tee times, delays and results; those texts are sent from the organizer's own phone, not by us. The number isn't required to use the app and isn't shown to other players.
• Profile information — your display name, your handicap, and any other optional fields you choose to fill in on the Profile screen. You can edit or remove this information at any time.
• Round data — scorecards you create, including course played, date, per-hole scores, putts, fairways hit, greens in regulation, and any other stats you choose to enter.
• Side game, tournament and league data — side games, tournaments and leagues you create or join, player rosters (including the names of guest players a director adds), league RSVPs and dues status, hole-by-hole scoring entries, and the resulting standings and settlement amounts. We process side-game and bet outcomes as informational scoring only: players settle those wagers between themselves, and we never collect, hold, or transfer money between players. Money we do handle — plan subscriptions, event passes, and card entry fees where a director has enabled them — is described in the next bullet.
• Billing information — when you buy a plan, an event pass, or pay a card entry fee, the payment is taken by Stripe on a Stripe-hosted checkout page. We never receive or store your full card number, expiry, or security code. What reaches our systems is the Stripe customer and subscription identifiers, the plan you bought, its status and renewal date, the amount, and the billing email — enough to show you what you are on and to unlock the right features. If you are a director collecting entry fees by card, Stripe also holds the payout details you give it directly.
• Friends — when you add another Bagpipe Golf user as a friend, their account becomes a mutual link in your account. You can remove a friend at any time.
• Tournament invites — when a tournament director sends an email invite, we store the invitee's email address along with a status (pending, accepted, expired, revoked) so the director can manage the invite list and the recipient can accept the invite.
• Issue reports — if you report a bug or send feedback, we collect the text of the report and any screenshots you attach.

Information collected automatically

• Round-of-play location — when you search for a course, we use your device's location to surface nearby courses. The app does not continuously track your location; location is used only when you actively search for or open a course screen. iOS asks your permission via the standard Location prompt.
• Voice input — if you use voice input to describe an issue report, the app uses your device's speech recognition service to transcribe what you say. The transcript is processed in the app and is not stored on our servers as raw audio.
• Push notification token — if you opt in to tournament push notifications, the app registers a Firebase Cloud Messaging (FCM) token with our backend so we can deliver tee-time, pairing, and update messages. You can turn off push at any time from Profile → Notifications or in your device settings.
• Crash and error reports — when the app or the bagpipegolf.com website crashes or hits an unhandled error, we send a crash report (stack trace, OS / browser version, app build number, release tag, and the URL path that triggered the error on the website) to Sentry. Crash reports do not include the content of your scorecards, side games, or messages. On the website your user ID may be attached to a crash report when you're signed in (so we can distinguish account-specific bugs from general ones); email and IP address are NOT sent.
• Usage analytics — we use PostHog to record product usage (which screens are visited, which buttons are tapped, error rates, feature adoption). Analytics events are tied to your account — your user ID, email, display name, and handicap are attached as PostHog profile properties so we can debug account-specific issues and understand usage by segment. This is not anonymous analytics. You can ask us to opt your account out of analytics collection (see §6). We never sell analytics data and never use it for third-party advertising.
• Website analytics — on the public pages of bagpipegolf.com (not inside your signed-in account pages, payment pages, invite links or sign-in forms), we use Google Analytics, loaded through Google Tag Manager, to understand how visitors find and use the site: pages viewed, the link or campaign that brought you, approximate location (city level), device and browser type. Google Analytics sets first-party cookies to tell visits apart. It is not tied to your Bagpipe account, and we do not enable Google's advertising features.
• Authentication metadata — when you sign in, Supabase records the timestamp of the sign-in along with a session token. This is standard authentication infrastructure.

Information we do NOT collect

• We do not collect contacts, calendar entries, or messages from your device.
• We do not collect health, fitness, or biometric data beyond what's required for Face ID / Touch ID device authentication (the biometric template never leaves your device — it stays in the iOS Keychain or Android Keystore).
• We do not collect microphone audio in the background. The microphone is only active when you explicitly tap the voice-input button.
• We do not collect photos or files in the background. Photos and files are accessed only when you choose one: a screenshot attached to an issue report, a logo or sponsor image for a tournament you run, or a roster file you import.

2. How we use your information

We use the information we collect to:

• Provide the core service — show your scorecards, run your side games, render your tournament and league leaderboards, sync your data across your devices.
• Connect you with the friends, opponents, and tournament organizers you choose to play with.
• Send service messages: tee-time confirmations, tournament updates, password recovery emails, and other transactional notifications you've opted into.
• Improve the app — diagnose crashes, prioritize features that are actually being used, identify slow surfaces to optimize.
• Honor your account-deletion requests.
• Comply with our legal obligations.

We do not sell your personal information. We do not use your data to target third-party ads.

3. Third-party processors

We rely on a small set of trusted infrastructure providers to operate the app. Each is bound by a data processing agreement and is listed below so you know where your data flows:

We do not use third-party advertising networks.

Downstream developers and API users

If we make an API, SDK, join-code integration, or other data access available to a third-party developer, tournament-management partner, or course operator's own tooling, that access is governed by a separate agreement with us in addition to this Privacy Policy. Any such third party must handle data obtained through that access consistent with both this Privacy Policy and their own posted privacy policy, and may not use the API or the associated agreement in a way that conflicts with either. We vet and contractually bind the processors listed above, but we do not control what an independent third-party developer does with data once it leaves our systems through an access grant we did not directly process on our own infrastructure.

Bagpipe Golf, its parent company Taybuta, Inc., and any other facility or LLC owned by Taybuta, Inc. are not responsible or liable for a third party's improper, unauthorized, or unlawful use, storage, or disclosure of data obtained through such access. That liability rests solely with the third party responsible for the misuse. If you believe a third-party integration has misused your data, contact us at the address in §10 and report it to that third party directly.

4. International data transfers

Our backend runs in the United States. If you use Bagpipe Golf from outside the United States, your data will be transferred to, stored, and processed in the United States. By using the app, you consent to this transfer. We rely on standard contractual clauses or equivalent safeguards for transfers from the European Economic Area, the United Kingdom, and Switzerland where applicable.

5. Data retention

• Account data — kept for as long as your account exists.
• Round, side game, tournament and league data — kept for as long as your account exists.
• Crash and analytics events — retained for up to 12 months then aggregated or deleted.
• Push notification tokens — refreshed continuously by the device; stale tokens are pruned automatically.
• Tournament invites — retained until accepted, revoked, or expired, then archived for one year to support audit.

When you delete your account (see §6), all data tied to your account is deleted from our active systems within 30 days. Backup copies may persist for up to 90 days before being permanently erased.

6. Your choices and rights

Delete your account

You can delete your Bagpipe Golf account at any time from Profile → Delete Account. The deletion flow removes:

• Your profile and authentication record
• Your rounds, side games, tournaments and league memberships
• Your friends list (and your entry from your friends' lists)
• Your issue reports

Known limitation: image attachments (screenshots) you included with an issue report are not currently deleted automatically when you delete your account — the report text is removed, but the uploaded image file may remain in our storage. We're working on closing this gap; until then, avoid attaching screenshots that show sensitive personal information, and email us (§10) if you want a specific attachment removed.

Some information may be retained where law requires. Records of payments we have processed (plan subscriptions, event passes and card entry fees: the amount, date, plan and Stripe identifiers) are kept for as long as tax and accounting law requires, even after you delete your account.

Aggregate metrics survive deletion. Deleting your account removes your personally-identifying records, but aggregate counts derived from your activity — for example, totals used for app-wide metrics like rounds played, side games settled, or tournaments run — may continue to exist as part of our overall usage statistics. These counts are not linked back to your identity once your account is deleted.

Access and correct your data

You can view and edit most of your data in-app. For a full data export, email us at the address in §10 below.

Opt out of notifications

You can disable push, email, SMS, and in-app notifications per category (Tournament, Social, System) at Profile → Notifications.

Opt out of analytics

Analytics are used for product improvement; we don't sell them. If you'd like to disable PostHog event reporting entirely, email us — we can flag your account as opted-out.

To stop Google Analytics on the website, block or clear cookies for bagpipegolf.com in your browser, or install Google's Analytics opt-out add-on.

Region-specific rights

If you are in California, the EEA, the UK, or another jurisdiction with statutory privacy rights, you may have additional rights including the right to know, the right to delete, the right to portability, and the right to opt out of "selling" or "sharing." Email us to exercise any of these rights. We will not discriminate against you for exercising your rights.

7. Children's privacy

Bagpipe Golf is not intended for children under 13 (or the equivalent minimum age in your country). We do not knowingly collect information from children. If we learn we've collected information from a child, we'll delete it.

8. Security

We use industry-standard encryption in transit (HTTPS for every API call, TLS for every database connection) and at rest (provider-managed encrypted storage on Supabase). We use Supabase Row Level Security to enforce per-user access controls at the database layer. Authentication uses PKCE; biometric credentials never leave your device.

No system is perfect. If you believe your account has been compromised, email the address in §10 and we'll help you secure it.

9. Changes to this policy

This policy is subject to change at any time, with or without notice. When we update it, we'll update the "Last updated" date at the top of this page, and we'll make reasonable efforts to notify active users in-app or by email when the changes are material — but your continued use of the Service after a revised policy is posted constitutes your acceptance of it, whether or not you received a direct notice.

10. Contact us

Privacy questions, data export requests, or rights inquiries:

Bagpipe Golf, a subsidiary of Taybuta, Inc.
Privacy contact: support@bagpipegolf.com
Mailing address:
Taybuta, Inc.
3800 Buchtel Blvd
P.O. Box 100532
Denver, CO 80250

11. Governing law

This policy is governed by the laws of the State of Colorado, without regard to its conflict of laws principles.

Questions? hello@bagpipegolf.com