Privacy Policy

Version 2026-10-01 · Effective October 1, 2026

This Privacy Policy explains how Birdies and Alibis LLC, a Utah limited liability company (“Birdies & Alibis,” “we,” “us,” or “our”), collects, uses, shares, and retains information through our website and web application (the “Service”).

1. Information we collect

We collect information that you, league or tournament organizers, and other users provide, including:

• account and profile details such as name, email, username, authentication identifiers, preferences, age or senior status, handicap information, league roles, and verification status;
• league, tournament, and golf information such as memberships, registrations, tee times, groups, flights, courses, tees, scorecards, attestations, standings, points, skins, prizes, winnings, check-ins, dues, and administrator-entered payment status;
• communications, invitations, announcements, feedback, and support correspondence;
• technical and security information such as device and browser details, IP address, authentication events, timestamps, rate-limit records, error logs, and audit activity; and
• limited payment metadata supplied by Stripe, such as customer, subscription, connected-account, checkout, payment, refund, status, amount, and billing-period identifiers. We do not intend to store full card or bank-account numbers.

Scorecard scanning

When an authorized administrator uses paper-scorecard import, the selected image is sent directly to Google Cloud Vision for optical character recognition. We do not intentionally save the source image in Firestore or Cloud Storage through that workflow. Recognized text, proposed scores, and administrator-approved results may be processed or saved. An administrator must review proposed results before importing them.

Course information

Course searches may send search terms to OpenGolfAPI and return course location, tees, yardages, ratings, slopes, pars, and hole handicaps.

2. How we use information

Information needed to run the Service

We use account and golf information to authenticate users and provide leagues, tournaments, scheduling, registration, scoring, standings, games, payments, check-in, messaging, and attestation. We also use operational information to send transactional email, enforce plan limits, prevent abuse, secure and troubleshoot the Service, provide support, process billing and refunds, enforce agreements, and comply with law. Authorized platform administrators can review internal totals from application records, such as the number of leagues, roster profiles, events, and tournaments. These operational totals do not depend on Google Analytics consent and are not sent to Google as a substitute for declined analytics.

Optional usage analytics

Usage measurement is separate from the account, golf, and payment information needed to provide the Service. Wherever optional measurement is enabled on our website or web application, you can reject optional tracking, allow analytics only, or allow analytics and advertising measurement. Optional tracking is off until you choose. All choices leave account, scoring, and security features available. Existing analytics-only consent does not authorize advertising measurement.

If you allow analytics, Google Analytics processes page visits, selected clicks, browser and device information, and campaign information. Where application conversion tracking is enabled, it also measures successful account creation, first league or tournament creation, and qualifying paid subscription events to help us understand and improve the experience. Purchase events include an opaque transaction identifier, currency, and amount, not payment credentials. We do not send names, email addresses, scorecard contents, passwords, or card details through these analytics events. Analytics uses cookies and identifiers: excluding those entered details does not make all usage measurement anonymous or remove its privacy implications.

Optional advertising measurement

If you also allow advertising measurement, Google may use advertising cookies and ad-click identifiers, such as GCLID, to associate conversions with our ads, report campaign performance, and help optimize advertising. We keep Google Signals, enhanced conversions using customer contact details, and personalized advertising off. We do not sell personal information. This permission is for measurement, not permission to send your account or scorecard contents to Google Analytics.

Changing your measurement choice

Use “Privacy choices” wherever optional measurement is enabled to change or withdraw your choice for future collection. We remember your choice for up to six months using a first-party preference cookie and browser storage; the production website and app use a shared-subdomain preference when optional measurement is enabled. Withdrawal does not erase information already processed; contact us for privacy requests. Google processes information under its applicable terms; see how Google uses information from sites and apps.

3. How information is shared

We share information as needed with league or tournament administrators and participants; with a person possessing an active guest-scorecard link; with Google/Firebase/Google Cloud for infrastructure, authentication, storage, logging, email, and OCR; with Stripe for billing and connected-account services; with OpenGolfAPI for course lookup; with contractors and professional advisers under appropriate duties; in a business transfer; or when required by law or reasonably necessary to protect users, the public, our rights, or the Service.

Tournament organizers may receive participant and transaction information through their Stripe connected account and may have their own privacy responsibilities.

4. Shared features and guest links

Names, scores, standings, groups, event information, and chat may be visible to authorized members or event viewers. An unexpired guest-scorecard link grants access without an account to the players assigned to that link. Treat it like a private invitation: do not forward it unless access is intended. Administrators can revoke links, and links expire automatically, generally between 12 hours and seven days.

5. Retention

• Eligible account data: deleted or de-identified within 45 days after a verified deletion request, subject to the exceptions below.
• Historical scores and standings: may remain while the associated league or tournament exists, with profile information de-identified where appropriate.
• Roster records: while the league or tournament exists; administrators receive at least 30 days to export after lockout, and we currently target a 90-day retrieval period.
• Financial tracking and Stripe transaction metadata: seven years.
• Policy acceptance records: seven years.
• Administrative audit records: three years.
• Support records: two years.
• Ordinary operational logs: 90 days; security and abuse logs: one year; incident records: three years.
• Transactional email delivery records: one year.
• League chat: up to 90 days and generally the newest 500 messages; event chat: until seven days after the event.

When we approve an affirmative deletion request, we may use a 30-day soft-delete period before purging eligible information. Cancellation or nonpayment does not itself request deletion. Backups may retain deleted information until they expire; our target is 90 days where technically feasible. We may restrict and retain information longer for legal obligations, disputes, fraud prevention, security, or legal holds.

6. Security

We use safeguards designed to protect information, including authentication, tenant-aware access controls, rate limiting, signed payment webhooks, secure transport, and audit records. No system is completely secure. Protect your credentials and guest links and report suspected unauthorized access.

7. Your choices and privacy requests

You may request access, correction, portability, or deletion by emailing admin@birdiesandalibis.com with the subject “Privacy Request.” This route is available to current and former users. We may verify your identity. We aim to acknowledge requests within 10 business days and respond within 45 days; when legally permitted, we may extend that period by up to 45 additional days after notice. We do not discriminate against users for exercising applicable privacy rights.

8. Children

The Service is not directed to children under 13. A person must be at least 16 to create and independently use an account. A golfer under 16 may participate without their own account when managed by an authorized adult organizer, parent, or guardian. Users under 18 must have parent or guardian permission where required.

9. United States processing

We operate the Service from the United States. Our providers may process information in the United States and other locations permitted by their terms.

10. Changes

We may update this Policy. We will post the new version and effective date and provide additional notice or request renewed consent when required.

11. Contact

Birdies and Alibis LLC
3217 W Winter Creek Circle
South Jordan, Utah 84095
admin@birdiesandalibis.com