Privacy policy

1. Who we are

Birdied is run by Scott M Limited, the company named above. For the purposes of UK data protection law, Scott M Limited is the controller of the personal data this policy describes. Questions about it go to us through the contact page named at the end of this policy.

Our ICO registration number is ZC281233.

2. What we collect

Your account. Your email address and display name. If you sign up with a password we keep a bcrypt hash of it, never the password itself. If you sign in with Google we keep your Google account identifier, the name Google gives us and the web address of your Google profile picture. If you sign in with Apple we keep your Apple account identifier, the email address Apple gives us and, if you shared it, your name. We also keep an Apple refresh token, sealed under encryption, so that when you delete your account we can ask Apple to revoke Birdied's access. We also keep whether your address has been verified, your role, and when you accepted the Terms of Service and this policy.

Your consent record. When you accept the terms and this policy we record the time, the version you accepted, your IP address and your browser's user agent string. This is the evidence that you agreed.

What you add. Your rounds (course, date, score, notes, tees, holes played, the people you played with, your pars, birdies, eagles, albatrosses and holes in one, and whether the round was imported), your ratings and reviews, your lists, your wishlist, your home courses, your friend links, your comments and reactions, the feedback you send us, including a score, the course suggestions and course requests you make, the reports and blocks you make, and the notifications about your activity. The people you played with are either friends who are members, kept by their display name and a link to their account, or anyone else, kept by the name you type. When you import rounds from a file we keep the rounds we create from it, not the file. When you fill a round from a picture, the picture never leaves your phone: it is read there by your phone's own text recognition, and neither the picture nor the text read from it is sent to Apple or Google. Only the round you confirm, and the course name you search for, reach us. We keep the round you confirm, not the picture.

Courses from your photos. Finding courses from your photo library is switched off today. When we offer it in the phone apps, your phone reads the date and the place already stored on the photos you allow, and suggests courses you may have played. The reading stays on your phone. The place stored on a photo, its GPS, stays on your phone. After you confirm a suggestion, we save the course and the date. On an iPhone you can allow your whole library, a limited set of photos, or pick the photos yourself. On an Android phone you pick the photos. The reading runs while you have Birdied open. You can remove that access in your phone's settings, and a suggestion you dismiss stays dismissed on your phone.

The waitlist and the Birdied letter. If you join the waitlist we keep the email address you gave, its status and timings, whether you asked for the Birdied letter, and which member invited you. If you subscribe to the letter we keep your address, the time you confirmed it and, later, the time you unsubscribed.

Nearby. When you ask for golf courses near you on the Atlas, we use your approximate device location for that request only. Coordinates leave your device solely as rounded parameters on the nearby-courses request (about 100 metre precision). We never store them - not in your account, not in our database, and not in analytics. We do not track your location continuously, do not use background location, and do not use location for advertising or tracking.

How you use Birdied. Our analytics provider, PostHog, receives the pages you open, where you arrived from, the actions you take in the app, a session replay of the web page with typed text masked, and the technical details of any error. Each event carries your IP address, from which PostHog can derive an approximate location. Section 6 says exactly what is sent and what we strip first.

Server logs. Our web server keeps a request log with the IP address, the page requested, the browser's user agent string and the time, and rotates it after about 14 days. Our API keeps its own log for about 30 days; when it records a fault it records your member identifier and the route, never your email address.

Photos. Photo upload is switched off today. If it opens, the photos you attach to a round or a review will be kept with them and this policy will say where.

3. Why we use it, and the legal basis

UK data protection law asks us to name a lawful basis for each thing we do with your data. These are ours.

We do not send marketing email other than the letter you asked for. If you have an account, you may also get occasional notices about your own account and about new features, each with a one-click way to stop them. We do not use your data for advertising, and we make no decisions about you by automated means that have a legal or similar effect on you.

4. Who can see what

Reviews. The text, stars and sub-ratings of a review are public on the course page: visitors who are not signed in, and search engines, can read them, without your name. A signed-in member sees your display name beside your review. The average rating and review count of a course feed the structured data that search engines read.

Rounds. Your rounds, with score and notes, are visible to your accepted friends on the feed and on your profile. Who you played with, typed names included, is shown to you and to your accepted friends when they open the round. If a friend names you on their round, their accepted friends see your name there too. A single round's course, date and notes can be opened by anyone who has its share link; the link shows no score and no names.

Passport summary and year card. Anyone who has the link can open your Passport summary and your year card. They show your display name and your totals: courses, countries, rounds and the countries you have played most. They do not show your rounds, your friends, your photo or your email, and they are marked so that search engines do not index them.

Lists and the wishlist. A list is private to you and to any friend you add as an editor. A list you share is open to anyone with its link and shows no name. Your wishlist is yours alone: friends see only how many courses are on it, and a course page shows an anonymous count of members who want to play it.

Feed, comments and reactions. Only your accepted friends see your activity. A comment on a member's activity can be read by that member and by all of their friends, with the commenter's name and photo. There is no public feed and no following.

Your name, photo and email. Your display name appears wherever your content does, as above, and on an invitation you send. Your profile picture is seen by your friends and by members who share a comment thread with you; it is never on a review, a Passport summary or a year card. Your email address is seen only by you and by our administrators, and is never shown to another member. If a member invites an address that already belongs to an account, the inviter is told that the address is already a member.

Administrators. Our administrators can see the member list (email, display name, photo, role, whether the address is verified, whether the account is suspended), the reports queue with a short excerpt of the reported content and its author's name, the audit log of their own actions, the waitlist and letter lists, course requests with the requester's name and email, and the feedback you send. They cannot open your rounds, your reviews, your lists, your wishlist or your feed.

Search engines. Our sitemap lists public pages only, such as course and place pages, never a member page. Passport, year card, round and shared list pages carry a no-index instruction.

5. Cookies and storage on your device

We do not show a cookie banner. This is what the site and the app store in your browser or on your phone, and why.

Your sign-in. On the web, your session token and a snapshot of your account (your name, email and settings, so the app can paint before it asks the server) are kept in the browser's local storage until you sign out. The app sends that token to the API on each request, and the API does not set a session cookie. A token lasts 7 days, and the app renews it while you use Birdied, up to 30 days from when you signed in. When you sign in with Google, three short-lived cookies on api.birdied.app carry the handshake and only the server can read them: the sign-in itself for 10 minutes, and your analytics identifier and a flow identifier for 5 minutes each. On a phone, the session token and the account snapshot are kept in the device's secure store. Which way you last signed in (Google, Apple, or email and password) is remembered on the device so the sign-in sheet can mark it; signing out keeps it and deleting your account clears it.

Analytics (PostHog). PostHog sets a first-party cookie on birdied.app (its name begins with ph_) that lasts a year and holds a device identifier, your anonymous or member identifier and a session identifier, keeps the same state in local storage, and keeps per-tab session state and a short queue of events in session storage. In the app on a phone, PostHog keeps its state in the app's own files.

Your preferences. Theme, units, fewer animations, painted countries, the journey line and the record rail are remembered in local storage on the web and in the secure store on a phone. So are your first-run progress, the flag that you have logged a first round, your invite wave, and a note that you have been shown the verify-email prompt.

Drafts and returns. On the web, the email you type into the waitlist form is kept in local storage until you submit it, so nothing is lost if you leave. A pending invitation, an action you started before signing in and the page to return to after a Google sign-in are kept until they are used. On the web the Google sign-in verifier lives in that tab only. On a phone it is kept in the secure store for 10 minutes. A phone keeps your place on the Atlas for 7 days so it can bring you back after a restart.

Map tiles. On the web a service worker caches OpenFreeMap tiles for 30 days so the Atlas paints quickly. On a phone the map keeps a tile cache of up to 100 MB.

6. Who we share it with

We do not sell your personal information. These are the companies and services that handle it for us, each under a contract with us or, where it says so, under its own terms as an independent controller.

Hetzner (hosting). Our server and database run on a Hetzner Cloud server.

Cloudflare (network). Every request to birdied.app and api.birdied.app passes through Cloudflare's network, which protects the site and sees your IP address and request headers. Cloudflare also rewrites email addresses on our pages so that scrapers cannot read them.

PostHog (product analytics). We use PostHog to understand how Birdied is used and to diagnose errors. PostHog is hosted in the European Union and is our processor. In the browser, analytics, session replay and error reports go to birdied.app (a first-party path we proxy to PostHog); they do not go to a PostHog domain from your browser. The app on a phone sends them to PostHog's EU servers directly. As you move through the app, PostHog receives the address of each page you view, the page or site you arrived from, and any marketing-campaign tags in the link you followed. It also receives a record of certain in-app actions - for example logging a round, writing a review, sharing a course, joining the waitlist, or sending an invitation - along with a session identifier. PostHog also receives your interactions with the interface - such as clicks and taps, and where on the page they happen - to help us understand which parts of Birdied are used. On the web we also record a session replay of the page (how it was used), including for visitors who are not signed in. Text typed into form fields is masked before it is stored. Console-log and performance timing data may be included with that replay. When something goes wrong, PostHog also receives the technical details of the error. When you are signed in, we send PostHog your account identifier, your email address and your name, so this activity can be attributed to your account. When you join the waitlist, we send the email address you submitted, the waitlist status, and whether you joined through the form or through Google. If you start a waitlist request and leave without submitting an email, the attempt is recorded without contact details. Our API also sends PostHog its own sign-in and sign-up events, keyed to the same identifiers.

What leaves the app, and what we remove first. Before any page address or referrer is sent to PostHog, our app passes it through a single filter. That filter:

This filter removes credentials from the addresses we send; it does not stop the addresses themselves from being sent. Which pages you visit, and where you arrived from, still leave the app and are processed by PostHog as described above. Location coordinates on a nearby-courses request are stripped from diagnostic reports. Product analytics may record that you used near-me (for example a distance band, result count, or permission outcome) but never the coordinates themselves.

Resend (email delivery). We use Resend to send you account and service email - for example verifying your address, resetting your password, confirming a waitlist request, and letting you know when your place is ready. Resend acts as our processor for these messages: to deliver the mail it receives the recipient address, the subject, and the message itself. Our email is sent from noreply@birdied.app, and Resend's own privacy policy governs the data it handles on our behalf. The Birdied letter is sent from a separate sending address where Resend records which links you click; account and security email never carries that tracking.

OpenFreeMap (map tiles). The Atlas loads its map tiles, fonts and terrain from tiles.openfreemap.org directly into your browser or the app. Like any web server it sees your IP address, your browser's user agent string and the part of the map you are looking at. We send it nothing about you.

Google (sign-in and profile pictures). When you sign in with Google, Google is an independent controller under its own privacy policy. We receive only your basic profile: name, email address and the address of your profile picture. That picture is loaded from Google's servers by whoever sees it on Birdied, so Google sees their request as it would any image request.

Google ML Kit and Apple Vision (reading a picture). When you fill a round from a picture, the picture never leaves your phone. It is read there by the phone's own text recognition, running on the device: Google's ML Kit on an Android phone and Apple's Vision on an iPhone. The picture and the text read from it are not sent to Google or to Apple. Only the round you confirm, and the course name you search for, reach us. On Android, ML Kit sends Google metrics about its own performance and use, such as the device model, the app version and how long a read took, under Google's privacy policy.

Apple (Sign in with Apple). You can sign in with Apple on the web, on iOS and on Android. We receive an identifier for your Apple account, an email address, and, the first time only, the name you choose to share. If you choose to hide your email, the address we receive is a private relay address that Apple forwards to you. When you delete your Birdied account we use the sealed refresh token we keep to ask Apple to revoke Birdied's access to your Apple account. Apple's own privacy policy governs the data Apple collects.

Photo hosts on course pages. Some course pages show a photo of the course that is loaded straight from the site that hosts it, for example Wikimedia Commons or a site named in OpenStreetMap. That host sees your request as any image host does.

Backups. Copies of our database are kept as backups for up to 12 months in off-site bucket storage, and for 30 days on the server that runs Birdied. Data held only in a backup is never served on the site again.

Weather. Course conditions come from MET Norway and monthly climate averages from Open-Meteo, each asked with the course's coordinates only. Nothing about you goes with the request.

Links that leave Birdied. A course's own website, Rome2Rio and Google Maps open under their own policies when you choose to follow a link. A Get there link carries the course's location, and a Rome2Rio link carries your home course's location as the starting point.

The law. We will disclose personal data where the law requires it, for example to comply with a court order or a lawful request from a regulator.

7. Where your data goes

PostHog processes our analytics in the European Union. Cloudflare, Resend, Google and Apple are companies with servers around the world, so some of your data may be handled outside the United Kingdom. Where that happens we rely on the UK's adequacy regulations for the European Economic Area, and otherwise on the International Data Transfer Agreement or the UK Addendum to the EU standard contractual clauses in that provider's terms.

8. How long we keep it

9. Children

You must be at least 13 to hold a Birdied account. We do not knowingly collect personal information from anyone younger, and if we learn that we have, we will delete it.

10. Your rights

Under UK data protection law you have the right to:

To exercise any of these rights, or if you cannot sign in, write to us through the contact page, from the email address on your account.

You can delete your Birdied account yourself at any time, from inside the app or from a browser. Deleting it is permanent.

When you delete your account, we remove the following from our live systems straight away:

A few things remain for a limited time or in a form that no longer identifies you:

You do not need to be able to sign in to have your account deleted. Write to support@birdied.app from the email address on your account and ask us to delete it. We use the sending address to confirm the account is yours, then delete it as described above and reply to let you know.

11. Security

Every connection to Birdied is encrypted in transit. Passwords are hashed with bcrypt and are never stored in plain text. The cookies that carry the sign-in handshake cannot be read by scripts in the page. Sign-in and other doors are rate limited, and suspending an account ends its sessions. No service can promise perfect security, and if we learn of a breach that affects you we will tell you and the regulator as the law requires.

12. Changes to this policy

We may update this policy as Birdied changes. We will tell you about a significant change through the app or by email before it takes effect, and the date at the top of this page shows when it was last changed.

13. Contact

Questions about this policy: write to us from the contact page.