Privacy Policy

Who we are

Discaddie is a disc golf caddie application. The data controller responsible for your personal information is:

• Discaddie, contactable at bogey@discaddie.com

This policy covers the website at discaddie.com, the Discaddie mobile and web application, and the Course Designer at map.discaddie.com.

What we collect

We collect only what is necessary to provide the service. This includes:

• Account information: your email address, username, and hashed password when you create an account
• Practice data: shot records, distances, session logs, and putting challenge results that you enter while using the app, plus the warm-up and workout programmes you complete. We do not store heart rate, steps, weight, or any other body data.
• Disc bag data: the discs you add to your bag and their flight characteristics
• Caddie plans: hole plans and round caddie strategies you create, including any notes you write in them
• Location: when you run the Max Distance drill, we save the precise GPS position you threw from with that session. Otherwise your location stays on your phone. It is used to show where you are on the map and to work out distances, and it is not sent to us. Location needs your permission. You can say no, and the app still works, just without the GPS features.
• Session tokens: authentication tokens stored locally on your device to keep you logged in

We do not collect payment information, contacts, or any device or advertising identifiers. We do not use advertising trackers, and there are no crash reporting or analytics tools in the app. The only analytics we use are Google Analytics and Microsoft Clarity on the website, and only if you accept cookies (see Cookies & local storage below).

Why we collect it

Each type of data has a specific purpose:

• Account information is required to create and secure your account. The legal basis is performance of a contract (GDPR Article 6(1)(b)).
• Practice, bag, and caddie data is the core content of the service. Without it the app cannot function. The legal basis is performance of a contract (GDPR Article 6(1)(b)).
• Location from Max Distance sessions is stored so the session keeps where you threw from. It only happens if you allow location access on your device, and you can turn that off at any time in your phone's settings. The legal basis is performance of a contract (GDPR Article 6(1)(b)).
• Session tokens are necessary to keep you authenticated between sessions. The legal basis is legitimate interest (GDPR Article 6(1)(f)).
• Website analytics (Google Analytics and Microsoft Clarity) only run if you accept them in the cookie banner. The legal basis is your consent (GDPR Article 6(1)(a)). You can withdraw it at any time under Cookie settings. This does not affect processing that happened before.

How we store it

All app data is stored securely using Supabase, a GDPR-compliant cloud infrastructure provider. Your app data is stored within the European Union. Supabase does not access or use your data for their own purposes.

Passwords are never stored in plain text. They are hashed using bcrypt before storage.

We do not sell your personal data or share it for marketing.

Third-party services

We use the following third-party services to operate Discaddie:

• Supabase Inc. (supabase.com): database, authentication, and file storage. Data is stored in the EU. Supabase is certified under the EU-U.S. Data Privacy Framework.
• Google (Google Analytics): website usage analytics, loaded only if you accept analytics cookies. Google is certified under the EU-U.S. Data Privacy Framework.
• Microsoft (Microsoft Clarity): recordings of how you use the website (clicks, scrolling, mouse movement) and heatmaps, loaded only if you accept analytics cookies. Microsoft keeps recordings for 30 days, and click and heatmap data for 9 months. It may also use the data to improve its own products, as described in the Microsoft Privacy Statement. Microsoft is certified under the EU-U.S. Data Privacy Framework.

Apart from the services listed above, and Nominatim and Esri when you use the Course Designer (see below), no other third parties have access to your personal data.

Course Designer (map.discaddie.com)

The Course Designer is the tool for drawing course layouts at map.discaddie.com. It is in beta. This is what happens with your data there.

• Without an account: you can use the Course Designer without logging in. Your courses are then saved only in your own browser (local storage). We do not receive them.
• With an account: when you log in and save a course to your account, it is stored in our database at Supabase (see How we store it). When you log out, the courses synced from your account are removed from the browser.
• Place search: when you search for a place, your browser sends what you typed, and your IP address, to Nominatim, the search service of the OpenStreetMap Foundation (UK). It happens when you search, not before.
• Satellite images: the map tiles come from Esri (USA). Your browser fetches them directly, so Esri sees your IP address and which part of the map you are looking at.
• Paths and woods: if you are logged in, you can fetch map data for the area you are looking at. Our server gets it from OpenStreetMap (Overpass), so the request comes from our server and not from your browser. To prevent misuse, we count how many times you fetch per day. The count is deleted when your account is deleted.
• What we can see: to be able to stop misuse, admins at Discaddie can see the email address and the usage (number of courses and storage used) of users who use the Course Designer.
• Waiting list: if you sign up on the waiting list, on the website or in the Course Designer, we save your email address in our database so we can send you an invitation. You can ask us to delete it at any time.

The legal basis for saving courses on your account is performance of a contract (GDPR Article 6(1)(b)). The legal basis for the daily count and for admins seeing email and usage is legitimate interest in preventing misuse (GDPR Article 6(1)(f)). The legal basis for the waiting list is your consent (GDPR Article 6(1)(a)). You withdraw it by asking us to delete your email.

For Nominatim and Esri, see their own privacy policies. We do not control what they do with the data they receive.

How long we keep it

We keep your data for as long as your account is active. When you delete your account yourself, all associated personal data is permanently deleted straight away. If you ask us by email, we do it within 30 days. What is deleted, and how, is under Delete your account.

Delete your account

You can delete your account yourself, in the app or at app.discaddie.com. Open My Profile in settings, tap Delete account and confirm with your password. Your account and your data are deleted straight away. This cannot be undone.

This is deleted:

• Your profile and username
• Your email address and login
• Your bag and the discs in it
• Your caddie plans and round plans, including your notes
• Your practice sessions and stats, including Max Distance throw locations, and the workouts you have completed
• Your Course Designer courses and the daily count of map data fetches
• Your email on the waiting list, if you signed up

You can also email bogey@discaddie.com and ask us to delete your account. We delete it, with everything listed above, within 30 days.

Your rights under GDPR

As a resident of the EU/EEA you have the following rights regarding your personal data:

• Right of access: you can request a copy of all data we hold about you
• Right to rectification: you can correct inaccurate or incomplete data
• Right to erasure: you can request deletion of your account and all associated data
• Right to restrict processing: you can ask us to pause processing your data in certain circumstances
• Right to data portability: you can request your data in a structured, machine-readable format
• Right to object: you can object to processing based on legitimate interest
• Right to withdraw consent: where processing is based on consent, you may withdraw it at any time

To exercise any of these rights, email bogey@discaddie.com. We will respond within 30 days.

If you believe your rights have been violated, you have the right to lodge a complaint with the Danish data protection authority: Datatilsynet (datatilsynet.dk).

Cookies & local storage

No cookies are set before you choose. The first time you visit, a banner asks whether analytics are okay. Nothing loads until you decide. Your choice lasts 12 months. Then we ask again.

If you accept, we use Google Analytics to understand how the site gets used: which pages people read, and how they find us. This sets analytics cookies (for example _ga) that help us count visits and improve the site. We use it to make Discaddie better, nothing more. No advertising, and we do not sell the data.

We also use Microsoft Clarity, which records how you use the site (clicks, scrolling and mouse movement) and builds heatmaps, so we can see what isn't working. It only runs if you accept, and never on the password reset page. Microsoft keeps recordings for 30 days and click and heatmap data for 9 months. Microsoft may also use the data for its own products (see Third-party services).

If you decline, no analytics cookies are set and neither Google Analytics nor Microsoft Clarity ever loads. If you accept and later change your mind, both stop and their cookies are deleted straight away. Data already sent to Google and Microsoft is not deleted by this.

This is everything the website stores:

• discaddie:cookie-consent (local storage, not a cookie). Set by Discaddie. Remembers your cookie choice and when you made it. Valid for 12 months. Then we ask again. Set when you make a choice, as the banner needs it to work.
• _ga (cookie). Set by Google Analytics. Tells visitors apart. Expires after 2 years. Only if you accept.
• _ga_47QXGQKHRT (cookie). Set by Google Analytics. Keeps track of your session. Expires after 2 years. Only if you accept.
• _clck (cookie). Set by Microsoft Clarity. Tells visitors apart. Expires after 1 year. Only if you accept.
• _clsk (cookie). Set by Microsoft Clarity. Keeps track of your visit. Expires after 1 day. Only if you accept.

You can change your mind at any time. Use the Cookie settings button in the bottom left corner of any page to reopen the banner and update your choice.

The Discaddie app stores an authentication token in your device's local storage to keep you logged in between sessions. This token is used solely for authentication and is never shared with third parties.

Security

We take reasonable technical and organisational measures to protect your data against unauthorised access, loss, or misuse. These include encrypted data transmission (HTTPS), hashed password storage, and row-level access controls ensuring users can only access their own data.

In the event of a data breach that affects your rights and freedoms, we will notify the relevant supervisory authority within 72 hours as required by GDPR Article 33.

Changes to this policy

If we make significant changes to how we handle your data, we will update this page and revise the date at the top. For material changes, registered users will be notified by email.

Age requirement

Discaddie is intended for users aged 13 and older. We do not knowingly collect personal data from anyone under 13. If you believe a person under 13 has provided us with personal data, please contact us at bogey@discaddie.com and we will delete it promptly.

Contact

Questions, requests, or concerns about this policy or your data? Reach us at bogey@discaddie.com. We will get back to you personally.