Privacy Policy
What we collect, why we hold it, who else touches it, and how to get it back or get it deleted. Written to be read rather than to cover us.
On this page
1. The short version
We collect the email address you sign up with, a securely hashed password, whether you are paying, and anything you deliberately enter — such as a golf round you log. We do not sell your data, we do not share it with advertisers, and we never see your card number.
Email hello@divotlab.com and we will send you a copy of everything we hold, or delete it.
2. What we collect
When you create an account
- your email address;
- a password stored only as a salted PBKDF2-SHA512 hash — we cannot read your password and could not tell you what it is;
- the date the account was created, and whether you opted in to the newsletter;
- your access state: whether a subscription is active, and any trial or gift expiry date;
- a referral code, if you arrived through one.
When you subscribe
- a Stripe customer identifier, which lets us match a payment to your account;
- your subscription status and renewal date.
Card numbers, expiry dates and CVCs are handled entirely by Stripe and never reach our servers or our database.
When you use My Game
- golf rounds you choose to log: the course and tee, the date, your score, and the round statistics you enter;
- your handicap index, which we calculate from those rounds rather than collect;
- practice sessions and drill attempts, if you use the practice tools.
This is the most personal data on the site, and it exists only because you typed it in. It is used to show you your own game and is never published, sold, or attached to your name anywhere another user can see.
When you play Fantasy or Survivor
- the golfers you picked, your scores and your Survivor streak;
- the username you choose, which is visible to other players on the leaderboards, including any private league you join — so pick one you are happy for strangers to see;
- if you have entered a game, we may email you a reminder before entries close and your result afterwards. Every one of those emails has a link that switches them off.
When you play Daily Nine
Daily Nine needs no account, and almost nothing about it leaves your browser.
- the round you are playing, and your played / average / streak / best figures, are stored on your device only. We never receive them, which also means they do not follow you to another phone or survive clearing your browser data;
- when you finish a round we receive the total score on its own — a number like 34, and nothing else — so the card can tell you how your round compared with everyone else's that day. It is added to a count of how many rounds scored each total. There is no account, no device identifier and no timestamp attached, so it cannot be traced back to you or read back as your individual round;
- those daily counts are deleted after a few days.
Automatically
- standard web server logs, including IP address and browser, kept briefly for security and abuse prevention;
- anonymised usage analytics — see cookies and analytics.
3. Why we hold it
| Data | Purpose | Basis |
|---|---|---|
| Email and password hash | Sign you in and secure your account | Performing our contract with you |
| Subscription and Stripe ID | Take payment and grant Pro access | Performing our contract with you |
| Rounds and practice data | Show you your own game | Performing our contract with you |
| Newsletter opt-in | Send Lab Notes | Your consent, withdrawable any time |
| Daily Nine score totals | Show how a round compared with the day's other rounds | Our legitimate interest — the total is not linked to you |
| Server logs | Security, abuse prevention, debugging | Our legitimate interest |
| Analytics | Understand which pages are useful | Our legitimate interest |
4. Who processes it
We use a small number of service providers. Each receives only what it needs, and none of them are permitted to use your data for their own purposes.
| Provider | What it does | What it sees |
|---|---|---|
| Stripe | Payments and billing portal | Email, payment details, subscription history |
| Vercel | Hosting for the site and API | Request logs, IP addresses |
| Upstash | Account and session storage | Account records and sessions |
| Neon | Database for the archive, Pick 5 and My Game | Logged rounds, practice data, game entries |
| Beehiiv | Newsletter delivery | Email address, subscription tier |
| Resend | Transactional email such as sign-in codes | Email address, message contents |
| Google Analytics | Aggregate site usage | Anonymised usage events |
Tour statistics come from DataGolf. That is a one-way relationship — we read golf data from them and send them nothing about you.
Some providers operate outside your country, including in the United States. Where personal data is transferred internationally we rely on the provider’s own safeguards, such as standard contractual clauses.
5. Cookies and analytics
We do not run advertising cookies and we do not use third-party ad trackers.
We use Google Analytics to see which pages people find useful, in aggregate. We use browser storage on your own device to keep you signed in, remember the tab you were on, and hold a practice session that has not synced yet. That storage never leaves your browser except where it is explicitly sent to sign you in or save your work.
You can clear it at any time through your browser settings. Doing so will sign you out.
6. How long we keep it
- Account data — while your account exists, and deleted on request.
- Rounds and practice data — while your account exists, because its value is the history.
- Payment records — retained by Stripe and by us for as long as tax and accounting law requires, typically six to seven years. This is the one category we cannot delete on request.
- Server logs — a short rolling window.
- Daily Nine score counts — three days, then deleted automatically. Nothing in them identifies anyone, so there is nothing here to delete on request.
- Newsletter subscription — until you unsubscribe, which every email lets you do in one click.
7. Your rights
Wherever you live, you can ask us to:
- show you everything we hold about you;
- correct anything that is wrong;
- delete your account and its data, subject to the payment-record exception above;
- export your data in a portable format — including your logged rounds;
- stop marketing email, instantly, via any unsubscribe link.
Email hello@divotlab.com and we will respond within 30 days. There is no charge and you do not have to give a reason.
If you are in the UK or EU you also have the right to complain to your data protection authority. If you are in California, we confirm plainly that we do not sell or share personal information, so there is nothing for you to opt out of.
8. Security
Passwords are stored as salted PBKDF2-SHA512 hashes at 100,000 iterations, never in a readable form. Traffic is encrypted in transit. Payment credentials never touch our systems. Access to production data is limited to the people who operate the service.
No system is perfectly secure, and we will not claim otherwise. If a breach ever affects your data we will tell you, and we will tell you what actually happened.
9. Children
Divot Lab is not intended for anyone under 18, and we do not knowingly collect data from children. If you believe a child has created an account, email us and we will remove it.
10. Changes
If we change this policy, the “last updated” date above changes with it, and we will email account holders about anything material. We will not quietly start doing something new with data you already gave us.
11. Contact
Questions, requests, or a copy of your data: hello@divotlab.com.
See also our Terms of Service.