We store account identifiers, name, optional email and photo, handicap, preferences, buddy links, shared outings, rosters, waitlists, chat, safety reports, blocks, support requests, moderation actions and notification records. Round scores are optional and stored in your account when signed in. They are private by default. If you choose to share a score, other confirmed players in that outing can see it. You can make a score private again or remove it in History. Rounds you log yourself, including your scores and comments, are private. Signed-in logs are saved to your account. Demo logs and scores stay on your device or browser. Data is used to operate and secure the app, coordinate golf, moderate content and respond to support. We do not sell personal information, use targeted advertising or track activity across other companies’ apps.

You choose whether to use the photo library. Photos are resized and compressed on-device; camera access is not requested. New cloud uploads are encrypted in the database and stay pending until a moderator approves them. Only you and authorized moderators can view a pending photo. Approved photos require authentication and current owner, accepted-buddy or confirmed-active-roster access. Blocks and restrictions prevent ordinary cross-user viewing. Protected image responses discourage caching; the app does not intentionally save them to disk. Local demo photos remain in demo storage on your device/browser.

Chat is limited to confirmed players and the host. Basic server filtering screens shared text; it cannot detect every harmful message. Photos receive human pre-publication review, not external AI screening. Safety menus on buddies and rosters provide report/block actions without chat access; outing screens also allow reporting shared details. Private reports may be reviewed by authorized operators. Blocking hides messages and profile details, removes buddy connections, stops direct chat alerts and cancels applicable pending invitations/waitlists. It does not silently remove confirmed players from a third party’s round. Moderators can remove content and restrict abusive accounts while leaving support and deletion available.

Quick Add keeps recipient phone numbers on-device and opens the Messages composer; you choose whether to send. Native iPhone login uses Sign in with Apple. Web/Android login uses the configured Manus account service. Render hosts the API, the managed database stores shared data and encrypted photos, and Expo supports app delivery, hosting and push. Chat pushes contain no message preview. Course search sends deliberate course/place text to OpenGolfAPI without your account identity; a direct provider fallback is available. Search history is not saved to your profile. Maps and booking sites have their own policies.

Removing a new private photo deletes approved and pending encrypted image bytes from the active database. Approving a replacement deletes the prior approved bytes; rejecting it removes the pending image. Profile → Delete account and data removes active account content, private photos, hosted outings, your logged rounds and comments, authored chat, related reports, rosters, waitlists, buddies, blocks, support requests, reminders and device tokens. Local deletion does not wait for Apple availability. A minimal pending cancellation notice may retain the course, outing date/time and recipient reference without the deleted host’s identity. It expires after seven days; its details are cleared after we submit it for delivery or decide not to send it, or during our next successful cleanup after expiry. An encrypted Apple token is retained for revocation retries for up to seven days, then erased. A tombstone retains only the provider identifier and deletion time for up to 366 days, covering older sessions. New sessions are bound to the exact account instance. Explicit re-registration starts a new account without revalidating old-account tokens. Security records/provider backups can persist under applicable retention cycles. Old object-storage photo links are no longer anonymously signed or displayed by the updated app; previously issued signed links may remain valid until provider expiry, and physical legacy-object erasure requires provider handling.

Use demo mode without signing in, edit your profile, deny photo/notification permissions, change preferences, decline invites, leave outings/waitlists, delete messages, report content, block/unblock golfers, sign out or delete your account.

Email the developer without an account, or use the signed-in support form. We aim to check safety reports and email daily and respond within 24 hours; urgent threats are prioritized. For immediate danger, contact emergency services. Golf Bros is not directed to children under 13 and does not knowingly collect their information.