Privacy Policy

1. Who we are

DiscGolfer (“the App”, “we”) is a disc-golf scoring and community service operated by Digikamu Oy, a company based in Finland. Digikamu Oy is the controller of personal data processed through the App. The App is available on the web and may also be distributed as native iOS and Android apps.

2. What data we collect

• Account data — email address, username, and display name you provide at sign-up. Optional: profile bio and avatar image.
• Game data — scores, bet events, settlement records, course selections, and hole data you enter during rounds.
• Location data — a nearby-course search sends a surrounding-area query to our backend; your live position on an in-round map is used on your device. If you choose to capture a tee or basket position, we save its precise coordinates, accuracy and capture time with your account ID. Accepted positions appear on shared course maps. We do not save a movement history.
• Social data — friend connections, group chat memberships, chat messages, emoji reactions, and photos you choose to share in group chat.
• Favorites & preferences — course favorites, hidden games, and layout proposals.
• Technical data — IP address, browser/device type, and basic request logs automatically collected by our hosting provider for security and abuse-prevention purposes. Client-side error reports (scope + short message) are written to an admin-only log so bugs can be diagnosed.

We do not collect payment information, advertising identifiers, contacts, or data from third-party services. We do not send Apple Watch HealthKit data to our servers, track you across other apps or websites, or use analytics cookies.

3. How we use your data

• To provide and operate the App (authentication, score tracking, bet settlement).
• To let you find and connect with other players (friend search by username).
• To maintain and improve the shared course catalog (proposals, admin review).

We do not use your data for advertising, profiling, or automated decision-making.

4. Legal basis (GDPR)

• Contract — processing is necessary to provide the service you signed up for (Art. 6(1)(b) GDPR).
• Legitimate interest — basic security logging and abuse prevention (Art. 6(1)(f) GDPR).

5. Data processors & hosting

• Supabase — database, authentication, file storage, and API hosting. Your data is stored in an EU-hosted Supabase project (Frankfurt / AWS eu-central-1). All personal data — account records, game scores, photos, chat messages — resides in the EU. Supabase's operating entity (Supabase Inc.) is US-registered; the corporate-level processing agreement covers any administrative access by their support engineers under Standard Contractual Clauses.
• Vercel Inc. (USA) — web application hosting and edge delivery. Vercel serves the application code and static assets; it does not store your personal data. Request-level logs (IP, user-agent, path) pass through Vercel for up to 90 days. Processed under their DPA with SCCs.

We do not sell, share, or rent your data to any other third parties.

6. Data retention

Your account data and game history are retained as long as your account exists. When you delete your account there is a 14-day grace period during which you can restore it; after that, all associated personal data (profile, scores, bet events, friend connections, chat messages you authored, photos you uploaded) is permanently deleted automatically. Rounds you played with others stay visible to those co-players with your entry anonymized. Technical logs (IP, request metadata) are retained for up to 90 days and then deleted automatically. Admin error logs in client_errors are pruned to the last 30 days.

Rounds you played with other users remain visible to those users in their own history, because those records are shared game data — not just yours. Your personal profile row is removed so your name appears as a guest entry on their side of the record.

7. Deleting your account

You can delete your account from inside the App at any time:

1. Sign in.
2. Open Profile.
3. Scroll to Delete account.
4. Confirm. You'll be signed out immediately; you can restore within 14 days, after which erasure is permanent and automatic.

Alternatively, email the contact address in Section 13 and we'll erase your account on your behalf within 30 days.

8. Your rights

Under GDPR you have the right to:

• Access — request a copy of your personal data.
• Rectification — correct inaccurate data (you can edit your username and display name in the App).
• Erasure — delete your account and all associated data (see Section 7 for in-app steps).
• Data portability — receive your data in a machine-readable format (JSON export on request).
• Object / restrict — object to processing based on legitimate interest.
• Lodge a complaint — with the Finnish Data Protection Ombudsman (tietosuoja.fi) or your local supervisory authority.

To exercise any of these rights, contact us at the email below.

9. Cookies & local storage

The App uses browser localStorage to persist your authentication session and in-progress game state, plus a short-lived cache of feed data (home, history, profile) so the app paints instantly on repeat visits. We do not use tracking cookies, analytics cookies, or third-party cookies. No cookie consent banner is required because we do not set any cookies beyond what is strictly necessary for the service to function.

10. Children

The App is not directed at children under 13 (USA COPPA) or under 16 (EU GDPR). We do not knowingly collect personal data from children under these thresholds. If you believe a child has created an account, contact us and we will delete it within 7 days.

11. Mobile app & platform notices

The iOS and Android apps deliver the service as a mobile app with device features you can allow or decline: location for course maps and distances, notifications, the Apple Watch companion app (iOS), and the camera or photo library for profile pictures. We do not collect the IDFA, Android Advertising ID, or another cross-app tracking identifier. If you allow native notifications on iOS, we save a device push token with your account to deliver them. The website is also installable from your browser as a Progressive Web App.

On Apple Watch, if you allow Health access, the App reads heart rate and active energy during a round and saves a workout to your device's Health store when the round lasts at least five minutes. Shorter workouts are discarded. HealthKit data is not sent to our servers.

Where the App is distributed via a platform app store (Apple App Store, Google Play), the platform may collect install and crash diagnostics under its own policy. Depending on your device settings, some crash diagnostics may be available to us in the developer console.

12. Changes to this policy

We may update this policy from time to time. Material changes will be communicated within the App. Continued use after changes constitutes acceptance.

13. Contact

Controller: Digikamu Oy, Finland. For privacy questions, data-access requests, or erasure requests, email rajajussi@gmail.com or call +358 44 033 8559. We respond within 30 days as required by GDPR.