Privacy Policy

Account information. When you create a GoLo account, we collect your name and your email address and/or phone number, which identify you across rounds. Your password is handled and stored in hashed form by our authentication provider. You may optionally add a handle/nickname, a handicap index, a home club, a Venmo username, and a profile photo.

Golf activity data. We collect the round scores, game formats, handicap inputs, course selections, and settlement tallies you enter or generate while using the app.

Location data. Android 1.2.0 (27) requests approximate location only (ACCESS_COARSE_LOCATION), never precise location (ACCESS_FINE_LOCATION). On iOS and the web, the system may supply precise or approximate location. With your permission, we use your device's location to find and rank nearby golf courses when you search for one, so you can pick the course you're playing. Your location goes only to our own backend (Supabase, see Section 3), which uses it to find courses and sort them by distance; we do not send it to any other service. We do not attach your location to the round — the round records the course you selected. Your most recent coordinates are cached on your own device for 24 hours so repeat searches don't ask again. Opening round setup reuses the reading within that window and restarts its 24-hour lifetime; a typed course search can also send the cached reading as a distance tie-break. Course and player search text goes to our own read-only search functions. We conservatively declare location and in-app search history as not ephemeral while backend request-log retention remains unconfirmed. You can deny or revoke location permission at any time in your device or browser settings; core scoring features still work without it.

Profile photo. If you choose to upload a profile photo, we store it to display you to other players. We do not collect round or course photos.

Crew. If you add other players to your Crew, we store that connection, and each of you can see the other's name, handle, profile photo and handicap. We also store the Crew invitations you send and receive. We never show a Crew member your email address or phone number.

Push notification data. The native Android and iOS apps use an in-app inbox only: no native push token is collected and no native push is sent. Browser push is optional. If you enable notifications in your browser, we store a push subscription for your device so we can send you the alerts described in Section 2.

Communications. If you contact support@golo.golf, we retain that correspondence to respond to you.

Support reports. If you send a report from Contact support inside the app, we store what you wrote along with details about the app itself — the version and build you are running, which screen you were on, your platform and screen size. We show you those details before you send, and we remove sign-in tokens, email addresses, phone numbers and money amounts from the text of your report. You may attach a screenshot; that is always your choice, and never automatic. These reports are included when you download a copy of your data. We delete your reports and any screenshots when you delete your account.

We do not knowingly collect information from children under 13, and GoLo is not directed to children.

We use the information above to: operate and maintain your account; calculate scores and game formats; help you find and tag the course you're playing; show other players in your group who you are; share your Venmo username, if you save one, only with a player who owes you in an open settle-up (see Section 4); respond to support requests; and understand, in aggregate, how the Service is used (for example, how many organizers complete a second round), using counts rather than individual profiles.

GoLo notifies you in the app's inbox and, if you allow notifications for GoLo in your browser, with push alerts. We use notifications only for these six categories, each of which you can switch off individually in the app:

• Live scoring — scores as other players in your round enter them
• Round activity — players joining, side games flagged, and rounds ended without settling up
• Round finished — when it's time to settle up
• Side-game terms — side-game terms to review, and replies to terms you set
• Settle-up requests — settle-up requests, and when one is marked sent or confirmed
• Crew — Crew invites, and when someone joins your Crew

Every category appears in your in-app inbox unless you switch it off. The one exception is an invitation to a round, and a reply to one you sent, which always reaches your inbox. Push alerts are sent only after you allow them, and only for Round finished, Side-game terms and Settle-up requests.

We do not send promotional or marketing push notifications. We do not use your data to sell targeted advertising, and we do not sell your personal information to third parties.

We share information with the service providers who help us run GoLo, under confidentiality and data-processing obligations:

• Netlify — hosts and delivers the app
• Supabase — provides our backend database, authentication, and file storage
• Push-notification infrastructure — the browser and operating-system push services that deliver optional alerts to your device

These providers do not have independent rights to use your data beyond providing services to GoLo.

Services we no longer use. Before October 10, 2026, two independent services were also involved. When you searched for courses near you, our server sent an approximate location (rounded to roughly one kilometer), or a place name you typed, to OpenStreetMap's Nominatim service to find your city. For some courses, your device loaded a course photo directly from Unsplash, which received your device's IP address and basic browser information, as any website does when it serves an image. Neither service received your name, email address, or account information. GoLo no longer uses either one.

We do not name an analytics or crash-reporting provider because we do not use one. GoLo does not collect product-analytics or crash telemetry from your device today. If that changes, we will update this Policy before any such collection begins.

GoLo lets players keep a running scoreboard of who owes whom for their side games, in the amounts the players agreed among themselves (usually dollar amounts, such as so much per skin). This is strictly a scorekeeping ledger. GoLo never processes, transmits, holds, or facilitates any transfer of money, and never charges or stores payment card information. Marking a tally "settled" is a manual, informational action taken by the user; any actual exchange of money between players happens entirely outside the app, at the users' own discretion, and GoLo has no visibility into or responsibility for it. If you save a Venmo username, we share it only with a player who owes you in an open settle-up, as a link to your public Venmo profile. When that player taps Open Venmo, GoLo first tries to copy a note with the amount to their device's clipboard so they can paste it in Venmo. A Copy amount and note button copies the amount and a note on request. No amount is placed in the link, GoLo sends nothing to Venmo and receives nothing back, and GoLo is not connected to Venmo or any payment service. GoLo is not a payment, wagering, or money-services product.

• Access and correction: Edit your profile in the app, or email support@golo.golf.
• Export your data: Use You → Download my data in the app, or the export option on /delete-account, to download a copy of the records we hold about your account.
• Delete your account: Use You → Delete account in the app, or go to /delete-account on the web — that page works whether or not you are signed in. If you cannot access your account, email support@golo.golf from the address on the account with "Delete My Account" in the subject line, and we will verify and act on your request.
• Location and notifications: Turn individual notification categories off in the app, and manage or revoke location and notification permissions anytime in your device or browser settings.
• Marketing communications: You may opt out of non-essential emails via the unsubscribe link or by contacting support.

We retain your account and activity data while your account is active.

When you delete your account, we delete your profile — name, handle, email, phone, handicap, home club, Venmo username — along with your profile photo, in-app support reports and any screenshots attached to them, notifications, push devices, invitations, Crew connections and Crew invitations, and any rounds nobody else played in. We process verified deletion requests within 30 days; deletions you run yourself in the app or on the web take effect immediately.

Rounds you played with other people are shared records and are not deleted. Those rounds, the participant rows that carry the scoring and settlement math, and any settlement records between you and another player are retained for the other players, in anonymized form: your name is replaced with "Former player" and your email, phone, and profile photo are removed. This keeps their leaderboard and history intact. Text other players already received, such as notifications or round summaries, may still show your name.

We use industry-standard technical and organizational measures (encryption in transit, access controls, row-level authorization, hosted infrastructure with reputable providers) to protect your information. No system is perfectly secure, and we cannot guarantee absolute security.

GoLo is currently offered only within the United States. If you access the Service from outside the U.S., you do so on your own initiative and are responsible for compliance with local laws; we do not currently design GoLo to meet the requirements of non-U.S. privacy regimes (e.g., GDPR).

We may update this Privacy Policy from time to time. We will post the revised version at /privacy with an updated effective date, and material changes will be communicated via the app or email.

GoLo Golf LLC — Bend, Oregon, United States Email: support@golo.golf

This section applies to the public website at golo.golf. The website can use one optional tool, Google Analytics, provided by Google LLC. It loads only after you choose Allow analytics, either in the notice shown on your first visit or under Privacy choices. Until you allow it, and if you decline, it isn’t loaded and nothing is sent to Google for analytics. The website works the same either way.

What Google Analytics collects

• Pages and navigation: the pages you view and in what order, when you view them, how long a visit lasts, and the website you came from (its address without the query string).
• Interactions: clicks and taps on links and buttons, how far you scroll, when you start or submit a form (not what you type), and use of features such as FAQ answers, filters, share buttons, and app-store buttons.
• Device and approximate location: browser, device type, operating system, screen size, and language, and an approximate location, such as country, region, or city, that Google estimates from your IP address.
• Performance and errors: page-loading and responsiveness measurements, and script errors on our pages, with anything that looks like an email address or phone number removed first.
• Identifiers: random identifiers stored in cookies, listed below, that let Google Analytics recognize the same browser across pages and later visits.

What you type into the website’s forms is not sent to Google Analytics. Our events contain labels, such as which link or button was used or which contact topic was chosen, not anything you typed. As each page loads, whether or not you allow analytics, the website also removes from the page address any query parameter it doesn’t use and any campaign parameter whose value contains an @ or a long run of digits, as an email address or phone number would, or is over 100 characters; a part of the path that looks like one is replaced with “redacted”, and such a fragment is dropped.

Why we use it

To understand how the website is used, find pages or steps that confuse people, improve the website’s content and usability, and find and fix errors and slow pages. GoLo does not use Google Analytics to identify individual visitors or for advertising.

Cookies and browser storage

If you allow analytics, these first-party cookies are set on golo.golf. Google’s default lifetime for them is two years, which Chrome limits to 400 days. The Cookie Policy lists the same storage.

Your choice itself is saved in your browser’s local storage under the name golo.analytics.consent.v2, as “granted” or “denied,” whichever way you choose, so the website can respect it on your next visit. The same value is also saved under the older name golo.analytics.preference, so pages still open from an earlier version of the website respect a decline too. Both stay until you change your choice or clear your browser’s site data.

What Google receives and how it may use it

When Google Analytics is on, your browser sends the information above, with your IP address, directly to Google. The Google Analytics tag sends this measurement data to more than one Google web address (for example, google-analytics.com and google.com); your analytics choice controls all of them, and none are sent until you allow analytics. Google processes this data to provide the service to GoLo. On October 20, 2026, GoLo turned off all of the Google Analytics data-sharing settings, so Google does not use data collected since then to improve its own products and services, include it in benchmarking or modeling, give its technical support staff access to it, or make recommendations to GoLo. Before that date, those settings were on. GoLo has also turned off Google signals and ad-personalization signals in its tag, has turned off Google signals data collection in its Google Analytics property, and does not allow ads personalization for its Google Analytics data. Learn more in How Google uses information from sites or apps that use our services.

Your choices

• Allow or decline at any time under Privacy choices, linked from the footer of every page. The choice is saved in this browser.
• If you decline after allowing, the page reloads without Google Analytics (other open tabs stop collecting at once and reload the next time you leave them), and the website deletes the Google Analytics cookies it can reach (_ga, _ga_36182P0H4D). Cookies on Google’s own domains can only be removed in your browser’s settings. Declining stops new collection; it doesn’t delete what was already sent.
• If your browser sends a Global Privacy Control signal, the website keeps Google Analytics off, even if you allowed it earlier. This is how GoLo has chosen to treat that signal on this website.
• If your browser won’t let the website store your choice, the website can’t remember it: an Allow lasts only until the page is closed or reloaded, and you will be asked again.
• Google offers a browser add-on that blocks Google Analytics on all websites: Google Analytics opt-out add-on.

Links to Google Play

If you reach the website through one of GoLo’s own campaign links, such as the QR code on a printed table tent or the link in one of our social profiles, and then tap the Google Play button, that button’s link carries the campaign link’s names: its source, medium, and campaign (for example, table_tent, print, and golo_launch_2026q4_sim_bay). They are fixed labels GoLo chose for its own links, not information about you. Google Play uses them as an install referrer, so GoLo can see which campaigns lead to installs of the app. Because they are part of the link you choose to follow, they are passed to Google Play whether or not you allowed Google Analytics. Google receives them when you open Google Play, under Google’s own privacy policy. If you reach the website any other way, the Google Play link carries no campaign names.

How long the data is kept

GoLo keeps Google Analytics event- and user-level data available for analysis for 14 months. Google’s aggregated standard reports are not limited by that setting. To ask about or request deletion of website analytics data, email info@golo.golf. Google Analytics doesn’t identify visitors to GoLo by name, so we may need the identifier from your browser’s _ga cookie to find data about you.

Before opt-in (October 19, 2026)

On October 19, 2026, from about 6:07 PM to 9:12 PM Pacific, Google Analytics loaded for visitors who had not declined and whose browser did not send a Global Privacy Control signal. Since then it loads only after you allow it.

Earlier session recordings (Microsoft Clarity)

From October 19, 2026 to October 20, 2026, the website also offered Microsoft Clarity, provided by Microsoft Corporation, under the same choice. If you allowed analytics in that period, Clarity recorded how you used our pages (the page content you were shown and your clicks, taps, scrolling and mouse movement, with form entries masked) as session replays and heatmaps, and set the cookies _clck and _clsk, which the website now deletes on your next visit. On October 19, from about 7:04 PM to 9:12 PM Pacific, Clarity ran unless a visitor declined or their browser sent a Global Privacy Control signal. Microsoft collected or received that personal data through Clarity to provide Microsoft Advertising and its other products and services, and its Clarity Terms of Use let it use the data for any purpose described in the Microsoft Privacy Statement, including creating user profiles for purposes that include advertising. Microsoft states that recordings are kept for 30 days, and heatmaps, dashboard data and a sample of recordings for up to 9 months. Questions go to info@golo.golf.

GoLo does not sell personal information for money, does not show ads, and does not use personal information to target advertising to you. GoLo has not linked its website analytics to any advertising account, has turned off Google signals and ad-personalization signals in its Google Analytics tag, and no longer uses Microsoft Clarity.

Google can use some information it receives through Google Analytics under its own terms, within the account settings described in Website Analytics. From October 19, 2026 to October 20, 2026, the website also used Microsoft Clarity, whose terms allow Microsoft to use personal data it collects through Clarity for any purpose described in the Microsoft Privacy Statement, including Microsoft Advertising and building profiles for purposes that include advertising. Depending on where you live, a privacy law could treat a disclosure like that as a “sale” or “sharing” of personal information. GoLo has not concluded that it is. GoLo stopped using Clarity for that reason; Google Analytics loads only if you allow it and stays off when your browser sends a Global Privacy Control signal.

If these practices change, we will update this policy and provide any notice, consent, or opt-out required by law before beginning the new practice.

This section applies only to the public golo.golf website, not to the Android app. Website account-free forms and analytics do not add an SDK or data flow to Android 1.2.0 (27).

• Website download-link requests: the phone number you enter when you ask us to text you an app download link, together with delivery status and related technical records.
• Where a website sign-up came from: when you join the newsletter or ask for a download link on the website, we also keep where that visit started: the path of the first page you landed on (not the rest of its web address), the domain of the website that referred you, and up to four names from the link you followed, if it carried them: its source, medium, campaign, and placement. We store the source only if, once converted to lower case, it is at most 64 characters of letters, digits, dots, hyphens, and underscores, with no @ sign, no run of seven or more digits (even if separated by spaces, dots, hyphens, or underscores), no UUID, and no run of 16 or more characters made only of the letters a–f and digits. We store the medium, campaign, and placement only when, together with the source, they exactly match a combination from GoLo’s own list of tagged-link names; otherwise we store none of the three. Apart from the page path and these names, we keep nothing from the link. We use these details only to count, in aggregate, which pages, websites, and links bring sign-ups.

Website support, download-link, email and text-message records are generally retained for up to 24 months unless a longer period is needed to resolve the request or comply with law. Website analytics retention and controls are described above. For website privacy requests, email info@golo.golf. The app account deletion and retention rules are in the app sections above.