Privacy Policy

Account information: email address, username, and anything you choose to add to your profile (name, home state, handicap, profile picture).

Content you create: photos and captions you post, scorecards you upload (including photos of physical scorecards), course check-ins, and who you follow or block.

Automatically collected: basic usage and performance data via Vercel Analytics and Speed Insights, for example which pages are visited and how fast they load. This is aggregate usage data, not tied to sensitive personal activity.

AI-processed data: when you upload a scorecard photo, it's sent to an AI vision model, currently Anthropic's Claude via the Vercel AI Gateway, to read the strokes off the image. The photo and the extracted data are stored in your account as described above.

• To operate the Service: show your posts to the right audience based on your privacy setting, power the bucket list and scorecard reader, maintain your follow graph.
• To keep the Service safe: review reports, enforce our Terms of Service, prevent abuse.
• To improve the Service: understand what features are actually used, from aggregate analytics.

If we add paid features, this section will be updated first, naming the specific payment processor, before that launches.

We do not sell your personal information.

• Supabase, which hosts our database, authentication, and file storage.
• Vercel, which hosts the app and provides analytics and AI Gateway infrastructure.
• Anthropic, via the Vercel AI Gateway, which processes scorecard photos you choose to upload, to read the scores.
• OpenGolfAPI, which we pull public course data from; we don't send them your personal data.
• Other Puffin Blue users, according to your privacy setting (public, followers-only, or private), which you control in Account Settings.
• Law enforcement or others, only if required by law.

We don't share your data with advertisers or data brokers.

• Privacy setting: control who sees your posts (public, followers-only, or private) in Account Settings.
• Blocking: block any user; they won't be notified.
• Delete your account: permanently delete your account and personal data at any time from Account Settings.
• Delete individual content: comments can be deleted individually; a full post can currently be archived (hidden from your profile and feed) or removed entirely by deleting your account, but there is not yet a way to permanently delete a single post while keeping the rest of your account.
• Access your data: contact us at hello@puffinblue.com to request a copy of your data.

We keep your data as long as your account is active. If you delete your account, your data is removed from our live systems immediately; residual copies in routine backups are purged within 30 days, except where we're required to retain something longer, such as an active abuse report.

Puffin Blue isn't intended for children under 13, and we don't knowingly collect data from them.

We rely on Supabase's infrastructure, including encrypted storage and row-level access controls, to protect your data, but no system is completely secure. Let us know right away if you suspect unauthorized access to your account.

Some additional rights and disclosures may apply to you under laws like the GDPR or CCPA. We haven't fully scoped this yet. If you're a resident of one of these places, contact us at hello@puffinblue.com before relying on this policy for those specific purposes.

We'll post updates here and update the "last updated" date above. We'll communicate material changes more directly, for example with an in-app notice, where appropriate.

Questions about this policy or your data: hello@puffinblue.com.