Privacy Policy

1. Overview

Pin & Paper ("we," "us," or "our") operates a golf league management platform. This policy explains what data we collect, how we use it, who we share it with, and the rights you have over it. By using the platform, you agree to the practices described here.

2. Data We Collect

Account data

When you create an account, we collect your name, email address, and a hashed password. We never store passwords in plain text.

League and roster data

Commissioners enter and manage league information including: player names, email addresses, phone numbers, starting handicaps, scores, standings, event registrations, and internal commissioner notes. This data is entered by the commissioner and stored in association with their league.

Score and handicap data

Scores submitted by players or entered by commissioners are stored per event. The platform calculates and stores league-internal handicap values based on submitted scores. These are not USGA Handicap Index™ values.

Billing and payment data

Payments are processed by Stripe. This includes the commissioner's one-time league activation fee, a player's one-time League Pass, and — for players who choose it — the monthly Premium Player Pass subscription. We store the Stripe customer ID and the status of each purchase in our database, along with records of billing events (amounts, dates, status) for accounting and support purposes. We never see or store payment card details — those are held exclusively by Stripe under their own privacy and security standards.

Pin & Paper does not process player entry fees or payouts. Fee tracking records (paid/unpaid status) entered by commissioners are stored in the platform but involve no financial data from players.

Communications data

When the platform sends emails on a commissioner's behalf — invitations, event reminders, score notifications, and announcements — those messages are delivered via Resend. Resend may retain delivery logs and bounce/open tracking data in accordance with their own privacy policy.

Usage and log data

We collect basic server-side logs and use product analytics (PostHog) to understand how the platform is used — page views, feature usage, and general traffic patterns. We also use error monitoring (Sentry) to detect and fix problems; where session replay is used for debugging, all text you type and personal content is masked before it leaves your browser. We do not use advertising tracking, and we do not sell usage data.

Scorecard images & third-party AI

If you use the optional scorecard photo feature, the image you upload is stored in our Supabase storage and is also sent to Anthropic, a third-party AI provider, solely so its model can read the printed values off the card (for example, each hole's stroke index) and return them to the platform. This is the only purpose the image is used for.

The image is transmitted to Anthropic only to perform that single extraction. Under Anthropic's commercial terms, data sent through their API is not used to train their AI models. We do not send scorecard images to any other AI provider, and we do not use them for any purpose beyond reading the card.

3. How We Use Your Data

• To provide and operate the Pin & Paper platform — authentication, league management, score tracking, standings, and communications.
• To process league activation fees, League Pass purchases, and Premium Player Pass subscriptions via Stripe.
• To send transactional emails — account verification, league invitations, event reminders, results notifications — via Resend.
• To text you a promo code, when you provide your phone number and consent at an in-person event, via Twilio — a one-time transactional message, not marketing.
• To investigate and resolve support requests.
• To understand platform usage and improve the product.

We do not use your data for advertising. We do not sell your data to third parties.

4. Who We Share Data With

We share data only with the infrastructure providers required to operate the platform:

• Supabase — Database, file storage, and authentication. All data at rest is stored in Supabase's infrastructure.
• Stripe — Payment processing — league activation, League Passes, and Premium Player Pass subscriptions. Stripe holds payment card details; we hold only the Stripe customer ID and purchase status.
• Resend — Transactional email delivery. Recipient email addresses and message content are transmitted to Resend for delivery.
• Twilio — Transactional SMS delivery. When you give us your phone number (with your consent) to receive a promo code, that number is shared with Twilio solely to send you that text. We do not use it for marketing without your opt-in.
• Vercel — Application hosting and infrastructure. Request logs may be retained by Vercel per their data handling policies.
• PostHog — Product analytics — page views and feature usage, associated with your account so we can understand and improve the product. No advertising use.
• Sentry — Error monitoring. When something breaks, technical details of the error are captured; personal content in session replays is masked in your browser before transmission.
• Anthropic — Third-party AI for scorecard reading. Scorecard photos you upload are sent to Anthropic's model to read the printed values off the card (such as hole stroke indexes) and are not used to train AI models.
• GolfCourseAPI — Course search. Your course search terms are sent to this provider to look up course, tee, and rating data. No personal data is included.

Each provider operates under their own privacy policies and data processing agreements. We do not share your data with any other parties.

5. Public Profiles & Career Pages

If you enable a public profile, other users can find you by username and see your display name, competitive record, and rating. Your shareable career page shows your first name and last initial, your competitive record, and match history — it never shows your email address, phone number, or full last name.

Public profiles are optional and can be turned off at any time in your profile settings. League standings are visible to members of that league.

6. Player Data & Commissioner Responsibility

Player data — names, contact details, scores, handicaps — is entered into the platform by commissioners. Commissioners are responsible for ensuring they have appropriate permission to enter and manage this data on behalf of the players in their league.

Players who wish to access, correct, or remove their data from a specific league should first contact their commissioner. Players may also contact us directly at support@pinandpaper.co.

7. Data Retention

Account data is retained while your account is active. League data — scores, standings, roster history, and event records — is retained after a season ends to preserve the league's history for participants.

You may request deletion of your account and associated data at any time by contacting us. Some data may be retained for legal, accounting, or fraud-prevention purposes even after a deletion request.

8. Security

We use industry-standard practices to protect your data: encrypted connections (HTTPS), hashed passwords, and row-level access controls so commissioners see only their own leagues and players see only leagues they belong to. No security system is perfect, but we take reasonable precautions to protect data in our care.

9. Cookies

We use session cookies required for authentication. We do not use advertising cookies or third-party tracking cookies. Vercel may set cookies for performance or DDoS mitigation purposes.

10. Your Rights

Depending on your location, you may have rights to access, correct, delete, or export the personal data we hold about you. To make a request:

• Contact us via the contact form, or
• Email support@pinandpaper.co with "Data Request" in the subject line.

We will respond to data requests within 30 days.

11. Referral & Creator Program Data

If you use our referral links or participate in the Creator Program, we collect and store additional data to attribute referrals and calculate rewards. See the Referral Program Rules for how the programs work.

• Referral cookies — when you click a referral link we set a cookie (30-day window) so a resulting signup can be attributed to the referrer.
• Referral codes and links — the codes and links associated with your account, and the codes you arrive through.
• Attribution records — which account referred which new account, frozen at the time the referred account is created.
• Creator analytics — for approved creators, aggregate performance data such as clicks, signups, and conversions on your links.
• Commission and payout records — earned commissions, their status (pending, payable, paid), payout history, and — when required for payouts — the tax information you provide.

Payouts and any tax reporting are handled through Stripe and, where applicable, a payout provider. We use referral data to operate the programs and prevent fraud, not for advertising.

12. Changes to This Policy

We may update this policy as the platform evolves. We will notify you of material changes by email or in-app notice before they take effect.

13. Questions

Questions or concerns about your data? Contact us or email support@pinandpaper.co.