Privacy policy

Who is responsible

Pub Golf is run by Tobias Berg, a private individual in Sweden, who is responsible (the controller) for your personal data. Contact: support@pub-golfen.com.

What we collect

• Account: your name, email address and profile picture from your Google sign-in, or just your email address if you sign in with an email link, and a picture you upload yourself.
• Rounds: the rounds you create or join, your display name in them, scores, check-ins, mini-game answers and votes, challenges and chat messages.
• Photos and videos: check-in photos you take during a round, and videos you record as proof of a challenge. Hidden details in photos and pictures you upload (such as where and with which phone they were taken) are removed when they are uploaded.
• Location: your position while the play screen is open, to check you in at stops and show players on the round's map. Only your latest position is kept.
• Notifications: your push subscription (a technical address for your device), which notifications you've switched off and your language.
• Invites, co-organisers, reports and blocks you make or receive, community challenges you publish, and, if your account is suspended, when and why.
• Email invitations: when an organiser invites someone by typing an email address, we store that address with the round and who sent it, and email a join link. This also applies if you don't have an account: the address is only used for that one email and is deleted after 30 days. The organiser is responsible for only inviting people who'd want to hear from them.
• Error reports: when a screen crashes, the error message, page address and device type are sent to our server log so we can fix it.

Why we use it

Only to run the service: to sign you in, run rounds and games, show scores and photos to the players in your round, send the notifications you've asked for, keep the community safe (reports and blocks) and fix problems. We don't sell your data, show ads or build advertising profiles.

The legal basis is our agreement with you to provide the service (GDPR article 6.1 b); for an email invitation to someone without an account, our and the organiser's legitimate interest in passing on the invitation (article 6.1 f). Location and notifications are only used when you allow them on your device, and you can switch them off at any time.

Who can see what

• Players, organisers and co-organisers in a round see your display name, picture, scores, check-ins, photos, challenge videos, chat messages and, while the round is on, your position on the map.
• The results page of a finished round and the spectator view are visible to anyone with the link or spectator code.
• Community challenges you publish are visible to all users, with your name.
• Admins can see reported content to handle reports.

Service providers

We use these providers to run the service. They handle data on our behalf only as needed:

• Vercel — runs the app (in Stockholm) and stores photos, videos and pictures.
• Supabase — the database (in Stockholm).
• Google — sign-in.
• Resend — sends the sign-in link when you sign in by email, and round invitations by email when an organiser chooses to send one; it receives your email address.
• Apple, Google and Mozilla push services — delivering notifications to your device.
• OpenStreetMap — the map images, and turning stop addresses that organisers type into map positions. When a map is shown, your device loads the images from OpenStreetMap's servers, which see your IP address; no other personal data is sent.

Where your data is

The app and the database run in Stockholm, Sweden. Vercel and Supabase are US companies and may process some data outside the EU (for example for file storage, support or security). Such transfers are covered by the EU–US Data Privacy Framework and the EU's standard contractual clauses in their data processing agreements, which we have with both.

Cookies and storage on your device

We only store what the app needs to work or what you've chosen yourself, so we don't ask for consent. There are no analytics, advertising or third-party cookies.

• authjs.session-token, authjs.csrf-token, authjs.callback-url (cookies) — keep you signed in and protect the sign-in. Removed when you sign out; the session lasts up to 30 days.
• NEXT_LOCALE (cookie) — the language you picked. Kept for a year.
• spectator-… (cookie) — lets you follow a round after entering its spectator code. Kept for 7 days.
• App cache (service worker) — the offline page and check-in photos you've already seen, so they load quickly. Emptied when you sign out.
• Session storage — a note that the app just reloaded itself after an update, so it doesn't do it twice.

How long we keep it

Your data is kept until you delete your account, or until the organiser deletes a round. Error reports are kept for a limited time in our hosting provider's logs. Handled reports, with the copy of the reported content, are deleted after six months. Email invitations are deleted after 30 days.

When you delete your account (Profile → Delete account), your account, picture, notification settings and blocks are removed, and in other people's rounds your chat messages, photos, challenge videos and locations are deleted and your name is replaced with an anonymous tag. Your scores stay so the other players' results still add up. Rounds you organise are handed to a co-organiser, or deleted if there is none.

Deleted data can remain in the database's backups for a limited time, at most 30 days, before it is overwritten.

Your rights

You can see and change your details in your profile, download a copy of your data (Profile → Download my data), and delete your account yourself at any time. You also have the right to access, correct, delete and move your data, and to object to or restrict how it's used. Contact us at support@pub-golfen.com for anything the app doesn't let you do yourself.

If you think we handle your data wrongly, you can complain to the Swedish Authority for Privacy Protection (IMY), imy.se.

Contact

Questions about privacy: Tobias Berg, support@pub-golfen.com. We may update this policy; the date above shows the latest version.