Privacy Policy
Golf Kingdom is designed to be played without telling us who you are. This page explains exactly what we store, why, where it lives, who else can see it, and how to get rid of it. The Cookies & Local Storage page is part of this policy.
1. Who is responsible
The data controller is the publisher of Golf Kingdom, named on the About page and in the app under ⚙️ Settings → 📜 Legal & privacy → About. Contact: support@golf-kingdom.com.
2. What we collect, and why
| Data | What it is | Why we keep it | Legal basis (EU/UK) |
|---|---|---|---|
| Random player id | An anonymous account created on your device the first time you play. Not tied to your name, phone number, Apple ID or Google account. | To tell your kingdom apart from everyone else's | Performance of our contract with you (the Terms) |
| Email and password | Only if you choose ⚙️ Settings → 🔐 Save / restore kingdom. The password is stored only as a salted hash by our authentication provider. | To sign you back in on a new phone. Nothing else: no newsletters, no marketing. | Consent, which you withdraw by resetting your save data |
| Kingdom save | Coins, crowns, jewels, buildings, clubs, statistics, settings, the version of the Terms you accepted and when, and a signature over the currency balances | Cloud backup so a lost phone does not lose your kingdom; the signature detects tampering | Contract; legitimate interest in preventing cheating |
| Published course | The holes you keep, the course name, its play count and ratings, the course record and its holder | So other players can play it and you can earn from their visits | Contract |
| Creator name | The unique handle you choose, shown on your course, records and leaderboards | So players know whose course they are playing | Contract |
| Profile card | Trophies and the public profile card: your kingdom name, motto, golfer look and gear, level, league and play statistics | Shown to other players who look you up | Contract |
| Plays, scores and event entries | Each round you post: course, strokes, par, time; event scores; design-challenge entries and the votes you cast | Leaderboards, records, event standings and prizes | Contract |
| Round receipts | For ranked event rounds: course seed, per-hole scores, app build and timestamps | To verify results before prizes are paid (Official Rules §5) | Legitimate interest in fair events |
| Follows, friend code, friend challenges | Creators you follow, your friend code, challenge results against friends | The social features you use | Contract |
| Ratings and reports | Ratings you give a course; reports you file against a course, with the reason | Course quality and moderation | Contract; legitimate interest in keeping the community clean |
| Referrals | When a new player opens a course link you shared: the course id, your player id and theirs | To credit your referral reward, once | Contract |
| Purchases | Which product was bought, confirmed by the store. Never your card number, billing address or the store's transaction receipt in full. | To deliver what you bought and fix missing purchases | Contract |
| Crash reports | The first five uncaught errors per session: the error text (up to 300 characters), a stack trace (up to 1,200 characters), the app build and your player id | To find and fix bugs | Legitimate interest in a working game |
| Milestone events | A short list of first-party events with the seconds since launch: app started, first hole built, first course published, first community round played, and a purchase completed (product id only) | To see where new players get stuck. This is our own code writing to our own database, not an analytics service | Legitimate interest in improving onboarding |
| Server logs | Our hosting providers log the IP address, browser type and request for each connection, as every server does | Security and rate limiting; providers keep them for a limited period | Legitimate interest in security |
We do not collect your precise location, contacts, photos, microphone, advertising identifier, device fingerprint or browsing history. There is no chat or messaging in the game; the only free text you can write is your creator name, your course name, your kingdom name and a short motto, all of which are public. The "kingdom location" you pick in the game is a scenery setting chosen from a list, not your real position.
3. What we do not do
- No advertising, no ad networks, no ad tracking, no advertising identifiers.
- No third-party analytics, attribution or session-recording SDKs. No fingerprinting. No cookies (see Cookies & Local Storage).
- We never sell personal information, and we do not share it for cross-context behavioural advertising as defined by California law.
- No profiling or automated decisions with legal or similarly significant effects. The only automatic decisions are game logic: rate limits on how many rounds, votes and reports an account can post per hour, and integrity checks that flag an account whose balances or event receipts do not add up (Official Rules §5). An account flagged this way is not paid an event prize automatically; email us and a person reviews it. A course reported by two different players is hidden from the Community automatically until a person reviews it (one report is queued for review without hiding anything).
4. What is public by design
Your published course and its name, your creator name, your profile card (kingdom name, motto, golfer look, level, trophies, league, statistics), your scores on leaderboards and course records, your event standings, your design-challenge entries and the number of times your course has been played are visible to every other player. Everything else, including your save, your email and your crash reports, is private to you and to us.
5. Who else sees data (processors)
- Supabase Inc. hosts our database and authentication on servers in the United States, with row-level security so only your own session can write your rows. Supabase processes data for us under its data processing agreement, which includes the European Commission's standard contractual clauses for transfers out of the EU and UK.
- Vercel Inc. hosts this website and the browser version of the game, and keeps standard server logs.
- Apple Inc. and Google LLC handle app distribution and payments as independent controllers under their own privacy policies. Apple's App Store and Google Play tell us which product you bought, not who you are.
No one else receives personal data, except if the law requires it, to protect players or enforce the Terms, or if the game changes hands (in which case this policy continues to apply and you will be told).
6. International transfers
The publisher and its providers are in the United States. If you play from the European Economic Area, the United Kingdom or Switzerland, your data is transferred to the United States under the standard contractual clauses in our providers' agreements, and you keep every right listed in section 9.
7. How long we keep it
- Your account and everything tied to it: for as long as the account exists. Deleting the account (section 8) removes it all at once.
- Crash reports and milestone events: deleted automatically 60 days after they are written. These rows carry your random player id but no name or email.
- Round receipts and event scores: kept for the event and for as long as prizes may be disputed, then with your account.
- Reports you file: until the report is resolved.
- Support emails: in our mailbox until the matter is closed, and routinely cleared afterwards.
8. Delete your data
In the app: ⚙️ Settings → 🗑️ Reset save data. After a confirmation, the app deletes your online account and every row tied to it (save, profile, published course, scores, event entries, receipts, ratings, follows, friend challenges, referrals and reports you filed), erases the kingdom on the device and restarts as a brand-new anonymous player. It needs an internet connection so the online part can happen; offline it refuses and tells you. It is permanent, and any purchased or earned virtual items are gone with it (Refund Policy §5).
What deletion leaves behind: crash reports and milestone events from the last 60 days keep the random player id that no longer belongs to any account, with no way to link it back to you, and are purged on their normal 60-day schedule; course records you set on other players' courses show the score without your name; and the stores keep their own purchase records under their policies.
By email: write to support@golf-kingdom.com from the address you linked, or from any address with your creator name and enough detail to identify the kingdom, and we delete the same data within 7 days.
9. Your rights
Wherever you live, you can ask us what we hold about you, have it corrected, have it deleted, receive a copy of it in a machine-readable form, object to or restrict our use of it, and withdraw any consent you gave. Email support@golf-kingdom.com; we answer within 30 days and never charge for a first request. Because most players are anonymous, we may ask you to prove the kingdom is yours (for example by writing from the linked email, or by naming your creator name and a recent score).
- European Economic Area, United Kingdom, Switzerland: the rights above are those in Articles 15–22 of the GDPR and UK GDPR. Our legal bases are in the table in section 2. Where we rely on legitimate interests you may object, and we will stop unless we can show compelling grounds. You may also complain to your national supervisory authority (in the UK, the Information Commissioner's Office).
- California and other US states with privacy laws: we collect identifiers (the random id, and email if linked), user content (courses, names), gameplay information (scores, plays), commercial information (products bought) and diagnostics (crash reports) for the purposes above. We do not sell personal information, do not share it for cross-context behavioural advertising, and have not done so in the past 12 months. You have the right to know, delete and correct your information, and not to be discriminated against for using those rights. An authorised agent may act for you with your written permission.
- Brazil, Canada, Australia and elsewhere: you have the rights your local law provides; the email above is the way to use them.
10. Children
Golf Kingdom is for players aged 13 and over (Terms §2). We do not knowingly collect personal information from children under 13, and the game asks for none: no name, no birth date, no email is needed to play. If you believe a child under 13 has linked an email, tell us and we will delete the account. Players between 13 and 18 need a parent's permission; parents can use the same email to exercise any right on their child's behalf.
11. Security
All traffic uses HTTPS. Database access is restricted per session by row-level security; currency balances are signed on the server so a tampered save is detected; passwords are hashed by our authentication provider and never seen by us; the service key that can read every row lives only in server functions, never in the app. No system is perfectly secure, so link an email if your kingdom matters to you, and tell us at once if you think your account was used by someone else.
12. Changes
If this policy changes in a way that matters, the app will tell you on launch and the version number above will change. Earlier versions are available on request.
13. Contact
support@golf-kingdom.com, subject "Privacy". Business details are on the About page.