Privacy Policy

Version 2026-09-06 · Effective September 6, 2026

This Privacy Policy explains how Birdies and Alibis LLC, a Utah limited liability company (“Birdies & Alibis,” “we,” “us,” or “our”), collects, uses, shares, and retains information through our website and web application (the “Service”).

1. Information we collect

We collect information that you, league or tournament organizers, and other users provide, including:

• account and profile details such as name, email, username, authentication identifiers, preferences, age or senior status, handicap information, league roles, and verification status;
• league, tournament, and golf information such as memberships, registrations, tee times, groups, flights, courses, tees, scorecards, attestations, standings, points, skins, prizes, winnings, check-ins, dues, and administrator-entered payment status;
• communications, invitations, announcements, feedback, and support correspondence;
• technical and security information such as device and browser details, IP address, authentication events, timestamps, rate-limit records, error logs, and audit activity; and
• limited payment metadata supplied by Stripe, such as customer, subscription, connected-account, checkout, payment, refund, status, amount, and billing-period identifiers. We do not intend to store full card or bank-account numbers.

Scorecard scanning

When an authorized administrator uses paper-scorecard import, the selected image is sent directly to Google Cloud Vision for optical character recognition. We do not intentionally save the source image in Firestore or Cloud Storage through that workflow. Recognized text, proposed scores, and administrator-approved results may be processed or saved. An administrator must review proposed results before importing them.

Course information

Course searches may send search terms to OpenGolfAPI and return course location, tees, yardages, ratings, slopes, pars, and hole handicaps.

2. How we use information

We use information to authenticate users; operate leagues and tournaments; provide scheduling, registration, scoring, standings, games, payments, check-in, messaging, and attestation; send transactional email; enforce plan limits; prevent abuse; secure, troubleshoot, and improve the Service; provide support; process billing and refunds; enforce agreements; and comply with law.

Website analytics

Google Analytics helps us understand page visits, referral campaigns, devices, and progress through signup links so we can improve the Service. We configure this measurement without Google Signals or advertising personalization. Google processes analytics information on our behalf and may use technical identifiers and analytics storage in accordance with its terms. You can select “Opt out of analytics” in the website notice or use “Privacy choices” later to stop future analytics collection.

We do not sell personal information or use the marketing website’s analytics for personalized advertising.

3. How information is shared

We share information as needed with league or tournament administrators and participants; with a person possessing an active guest-scorecard link; with Google/Firebase/Google Cloud for infrastructure, authentication, storage, logging, email, and OCR; with Stripe for billing and connected-account services; with OpenGolfAPI for course lookup; with contractors and professional advisers under appropriate duties; in a business transfer; or when required by law or reasonably necessary to protect users, the public, our rights, or the Service.

Tournament organizers may receive participant and transaction information through their Stripe connected account and may have their own privacy responsibilities.

4. Shared features and guest links

Names, scores, standings, groups, event information, and chat may be visible to authorized members or event viewers. An unexpired guest-scorecard link grants access without an account to the players assigned to that link. Treat it like a private invitation: do not forward it unless access is intended. Administrators can revoke links, and links expire automatically, generally between 12 hours and seven days.

5. Retention

• Eligible account data: deleted or de-identified within 45 days after a verified deletion request, subject to the exceptions below.
• Historical scores and standings: may remain while the associated league or tournament exists, with profile information de-identified where appropriate.
• Roster records: while the league or tournament exists; administrators receive at least 30 days to export after lockout, and we currently target a 90-day retrieval period.
• Financial tracking and Stripe transaction metadata: seven years.
• Policy acceptance records: seven years.
• Administrative audit records: three years.
• Support records: two years.
• Ordinary operational logs: 90 days; security and abuse logs: one year; incident records: three years.
• Transactional email delivery records: one year.
• League chat: up to 90 days and generally the newest 500 messages; event chat: until seven days after the event.

When we approve an affirmative deletion request, we may use a 30-day soft-delete period before purging eligible information. Cancellation or nonpayment does not itself request deletion. Backups may retain deleted information until they expire; our target is 90 days where technically feasible. We may restrict and retain information longer for legal obligations, disputes, fraud prevention, security, or legal holds.

6. Security

We use safeguards designed to protect information, including authentication, tenant-aware access controls, rate limiting, signed payment webhooks, secure transport, and audit records. No system is completely secure. Protect your credentials and guest links and report suspected unauthorized access.

7. Your choices and privacy requests

You may request access, correction, portability, or deletion by emailing admin@birdiesandalibis.com with the subject “Privacy Request.” This route is available to current and former users. We may verify your identity. We aim to acknowledge requests within 10 business days and respond within 45 days; when legally permitted, we may extend that period by up to 45 additional days after notice. We do not discriminate against users for exercising applicable privacy rights.

8. Children

The Service is not directed to children under 13. A person must be at least 16 to create and independently use an account. A golfer under 16 may participate without their own account when managed by an authorized adult organizer, parent, or guardian. Users under 18 must have parent or guardian permission where required.

9. United States processing

We operate the Service from the United States. Our providers may process information in the United States and other locations permitted by their terms.

10. Changes

We may update this Policy. We will post the new version and effective date and provide additional notice or request renewed consent when required.

11. Contact

Birdies and Alibis LLC
3217 W Winter Creek Circle
South Jordan, Utah 84095
admin@birdiesandalibis.com