Privacy Policy for BallCaddie

Introduction

BallCaddie - Software Secrets LLC ("we," "our," "us," or "Company") operates BallCaddie, available as a web application, mobile application, and website (collectively, the "Service"). This Privacy Policy explains what information we collect, how we use it, how we share it, and the rights you have regarding your data.

This policy applies to all users of BallCaddie, regardless of location. We are committed to transparency and compliance with applicable privacy laws in the jurisdictions where our users reside, including the General Data Protection Regulation (GDPR) in the European Union and European Economic Area, the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA) in California, the UK General Data Protection Regulation (UK GDPR) in the United Kingdom, the Personal Information Protection and Electronic Documents Act (PIPEDA) in Canada, the Lei Geral de Proteção de Dados (LGPD) in Brazil, and the Privacy Act in Australia.

Effective Date: April 14, 2026
Last Updated: August 5, 2026

Information We Collect

We collect personal information from you in several ways:

Information You Provide Directly

• Account Registration: When you create an account, we collect your name, email address, and any other information you provide during registration.
• Ball Fitting Quiz: Before you begin the ball fitting quiz, we ask for your first name and email address. We use them to send you a summary of your fitting result and a short series of follow-up emails about your match and BallCaddie Pro. If you complete the quiz, we also store the non-identifying result of that fitting (your match score, the recommended ball's specifications, and an estimated strokes-saved figure) so those emails can reference your actual result. This is separate from account registration — you do not need an account to take the quiz. Every one of these emails includes a one-click unsubscribe link, and unsubscribing stops them immediately. If you later create an account or purchase, we stop this series automatically.
• Payment Information: When you make a purchase or subscription payment directly through ballcaddie.com, payment information (including credit card details, billing address, and transaction history) is collected and processed by Stripe, Inc. (our third-party payment processor). We do not store your full payment card number; Stripe returns a customer identifier and the last four digits of the card, which we associate with your account. Subscriptions purchased through the iOS App Store are processed by Apple, and we receive only a limited purchase-receipt identifier (routed through RevenueCat, Inc., our mobile subscription infrastructure provider) confirming entitlement.
• Customer Support: When you contact us for support or assistance, we collect the information you provide in your message, including your name, email, and the details of your inquiry.
• Forms and Surveys: If you fill out forms on our website or mobile app, or participate in surveys, we collect the information you voluntarily provide.

Information Collected Automatically

• Device Information: We automatically collect information about the devices you use to access BallCaddie, including device type, operating system, mobile device identifiers, unique device IDs, and device settings.
• Usage Data: We collect data about how you interact with our Service, including features used, pages visited, time spent in the app, actions taken, and performance metrics.
• Diagnostic and Performance Data: When the Service crashes, hangs, or encounters an unhandled error, we collect a diagnostic event (stack trace, device and OS metadata, performance traces sampled at approximately 20% of sessions in production) and send it to Sentry, our crash and performance monitoring provider. See "Crash and Performance Monitoring" below for what is and is not included.
• Cookies and Tracking Technologies: We use cookies, web beacons, and similar technologies to collect information about your browsing behavior, preferences, and interactions with our Service (see the Cookies and Tracking Technologies section for details).
• Analytics Data: Our analytics tools collect information about your usage patterns to help us understand how users interact with BallCaddie and to improve the Service.

Information from Third Parties

• Third-Party Login Providers: If you log in using a third-party account (such as a social media account), we collect the information that third-party provider shares with us, which may include your name, email address, profile picture, and other publicly available information from that account.
• API Integrations: If you connect third-party services or integrate APIs with BallCaddie, we collect data necessary to facilitate those integrations.

How We Collect Information

We collect information through the following methods:

• Forms: Account registration forms, contact forms, feedback forms, and survey forms on our website and mobile app.
• Analytics Tools: Google Analytics and PostHog track your usage patterns and interactions with BallCaddie (with your consent). We also use DataFast, a privacy-focused web analytics service that measures aggregate site traffic and conversion goals without building cross-site profiles of you. If you reached us from a Google ad, we send Google Ads a one-way hashed (SHA-256) version of the email you enter at the quiz and a record of the conversion, so Google can measure the ad; Google cannot read the address from the hash.
• Crash and Performance Monitoring: Sentry (Functional Software, Inc.) receives diagnostic events when BallCaddie crashes, hangs, or encounters an unhandled error.
• Payment Processors: Stripe, Inc. (for web purchases at ballcaddie.com) and Apple Inc. (for iOS App Store subscriptions) collect and process payment information when you make a purchase. RevenueCat, Inc. is used to verify and deliver App Store subscription entitlements.
• Automatic Collection: Cookies, device identifiers, log files, and similar tracking technologies automatically collect data about your device and usage.
• Customer Support Channels: Email correspondence where you voluntarily provide information.
• API Integrations: Data exchanged when you connect third-party services to BallCaddie.
• Third-Party Login: Authentication data from third-party identity providers when you use social login features.

How We Use Your Information

We process your personal information for the following purposes:

• Provide the Service: To deliver, maintain, and improve BallCaddie, including user authentication, account management, and technical support.
• Billing and Payments: To process payments, manage subscriptions, send invoices, and maintain billing records.
• Communication: To respond to your inquiries, send transactional emails (confirmations, receipts, password resets), and provide customer support.
• Analytics and Research: To analyze usage patterns, understand user behavior, and conduct research to improve our Service and user experience.
• Marketing and Promotional Communications: To send promotional emails, updates about new features, and marketing materials (you can opt out of promotional communications at any time).
• Security and Compliance: To detect, prevent, and address fraud, abuse, security incidents, and other harmful activities; to comply with legal obligations; and to protect the rights, property, and safety of BallCaddie, our users, and the public.
• Legal Compliance: To comply with applicable laws, regulations, court orders, and government requests.

Lawful Bases for Processing (GDPR/UK GDPR)

For users in the EU, EEA, and UK, we process personal information on the following lawful bases:

• Contract: Processing necessary to provide the Service and fulfill our obligations to you.
• Legitimate Interests: Processing for analytics, marketing, security, fraud prevention, and service improvement, balanced against your privacy rights.
• Consent: For marketing communications, non-essential cookies, and certain tracking activities (obtained via cookie consent banners and opt-in mechanisms).
• Legal Obligation: Processing required to comply with applicable law.

Information Sharing and Disclosure

We Do Not Sell Your Data

BallCaddie does not sell, rent, or share your personal information with third parties for their marketing or commercial purposes.

Limited Sharing with Service Providers

We share personal information with third parties only when necessary to provide our Service or comply with legal obligations:

• Payment Processors: We share billing identifiers and transaction metadata with Stripe, Inc. (for direct web purchases), with Apple Inc. (for iOS App Store subscriptions), and with RevenueCat, Inc. (for mobile entitlement verification) strictly to process payments and manage subscriptions.
• Analytics Providers: With your consent, we share usage data with Google Analytics (Google LLC) and PostHog, Inc. to analyze how users interact with our Service and improve performance. We also share aggregate, non-cross-site usage and conversion data with DataFast, a privacy-focused analytics service that runs on our website without advertising cookies. If you reached us from a Google ad, we send Google Ads a one-way hashed (SHA-256) version of the email you enter at the quiz and a record of the conversion, so Google can measure the ad; Google cannot read the address from the hash.
• Authentication, Database, and Hosting: We use Google Firebase (Firebase Authentication, Firestore, Cloud Functions, and Firebase Hosting, all provided by Google LLC) to authenticate accounts, store your Ball Caddie data, run server-side code, and serve the Service.
• Transactional Email: We use Resend, Inc. to deliver transactional emails such as password resets, Pro welcome / cancellation notices, and receipts.
• Legal and Compliance: We may disclose information when required by law, court order, or government request, or to protect the security, rights, and safety of our users and the public.

All third-party service providers are contractually obligated to use your information only as necessary to provide their services to us and to maintain the confidentiality and security of your data.

Crash and Performance Monitoring

We use Sentry, a service operated by Functional Software, Inc., to monitor application stability and diagnose problems in BallCaddie. When the Service encounters a crash, an unhandled error, an unresponsive UI ("app hang"), or a performance issue, Sentry receives a diagnostic event from your device.

The information sent to Sentry includes:

• Stack Traces: The technical record of what code was running when the issue occurred.
• Device and OS Metadata: Basic information such as operating system version, device model, browser version, and app version.
• App-Hang and Performance Traces (iOS app only): In the iOS app, performance and app-hang traces are sampled at approximately 20% of sessions in production. Our website and web app send error events only — no performance traces.
• Account Identifier: If you are signed in, the opaque user ID issued by Firebase that identifies your BallCaddie account.
• Pro Entitlement Flag (iOS app only): A tag indicating whether the account holds an active Pro subscription, so we can filter issues by entitlement.

Sentry is configured not to collect personally identifying information by default. We do not send your email address, your name, or your IP address to Sentry. We do not enable Sentry's Session Replay feature, so we never record your screen. Before an event leaves your device, a pre-send filter additionally removes fields whose names suggest sensitive content (in the iOS app) and scrubs URLs and event properties that could carry email addresses or access tokens (on the web).

Diagnostic data is retained by Sentry per the data retention settings on our project. For Sentry's own privacy practices, see https://sentry.io/privacy/.

No Third-Party Marketing

We do not share your personal information with third parties for their own marketing or advertising purposes without your explicit consent.

Data Retention

We retain your personal information for as long as necessary to provide BallCaddie, fulfill the purposes described in this policy, and comply with applicable legal and tax regulations.

Retention Periods by Data Type

• Account Information: Retained for the duration of your account and for a reasonable period after account deletion to comply with legal and tax obligations.
• Payment Information: Retained as required by tax and financial regulations, typically as long as necessary for accounting, auditing, and legal purposes.
• Usage and Analytics Data: Retained for a reasonable period to improve our Service; older analytics data may be aggregated or deleted periodically.
• Customer Support Records: Retained for a reasonable period to assist with future inquiries and resolve disputes.
• Marketing Communications: If you unsubscribe, we retain your email address on our suppression list to honor your opt-out preference.
• Device Identifiers and Cookies: Retained for the duration specified in each cookie's settings; most session cookies expire when you close your browser.

We review our retention practices regularly and delete data when it is no longer necessary. You may request deletion of your personal information at any time by contacting us (subject to legal and contractual limitations).

Your Privacy Rights

The rights available to you depend on your location. Below is a summary of your privacy rights under applicable laws.

Rights for EU/EEA and UK Residents (GDPR/UK GDPR)

You have the following rights:

• Right of Access: You may request a copy of the personal information we hold about you.
• Right to Rectification: You may request correction of inaccurate or incomplete personal information.
• Right to Erasure ("Right to be Forgotten"): You may request deletion of your personal information, subject to legal and contractual exceptions.
• Right to Restrict Processing: You may request that we limit how we process your information for certain purposes.
• Right to Data Portability: You may request a copy of your personal information in a structured, machine-readable format for transfer to another service provider.
• Right to Object: You may object to processing based on legitimate interests or marketing communications.
• Right to Withdraw Consent: If processing is based on your consent, you may withdraw that consent at any time.
• Right to Lodge a Complaint: You may file a complaint with the European Data Protection Board (https://edpb.europa.eu/) or your local supervisory authority.

Rights for California Residents (CCPA/CPRA)

You have the following rights:

• Right to Know: You may request what personal information we collect, use, and share about you.
• Right to Delete: You may request deletion of personal information we have collected from you, subject to legal exceptions.
• Right to Correct: You may request correction of inaccurate personal information.
• Right to Opt Out of Sale or Sharing: You may direct us not to sell or share your personal information. (Note: We do not sell or share your data for cross-context behavioral advertising, but you may submit an opt-out request.)
• Right to Opt Out of Automated Decision Making: You may opt out of automated decision-making that produces legal or similarly significant effects concerning you.
• Right to Non-Discrimination: We will not discriminate against you for exercising your privacy rights.
• Right to Appeal: If we deny your request, you may appeal our decision.

California residents may submit requests by emailing support@ballcaddie.com. You may also designate an authorized agent to submit requests on your behalf.

Rights for UK Residents (UK GDPR)

UK residents have substantially the same rights as EU/EEA residents under the UK GDPR (see above). You may lodge complaints with the Information Commissioner's Office (https://ico.org.uk/).

Rights for Canadian Residents (PIPEDA)

You have the following rights:

• Right to Access: You may request access to personal information we hold about you.
• Right to Accuracy: You may request correction of inaccurate personal information.
• Right to Withdraw Consent: You may withdraw consent for processing, subject to legal obligations.
• Right to Complain: You may lodge a complaint with the Office of the Privacy Commissioner of Canada (https://www.priv.gc.ca/).

Rights for Australian Residents (Privacy Act)

You have the following rights:

• Right to Access: You may request access to personal information we hold about you.
• Right to Correction and Completion: You may request correction of inaccurate personal information.
• Right to Complain: You may lodge a complaint with the Office of the Australian Information Commissioner (https://www.oaic.gov.au/).

Rights for Brazilian Residents (LGPD)

You have the following rights:

• Right of Access: You may request access to your personal information.
• Right of Rectification: You may request correction of inaccurate data.
• Right of Deletion: You may request deletion of data (subject to LGPD exceptions).
• Right to Data Portability: You may request your data in a portable format.
• Right to Opt Out of Processing: You may object to processing for certain purposes.
• Right to Complain: You may file a complaint with the Autoridade Nacional de Proteção de Dados (ANPD) (https://www.gov.br/anpd/).

How to Exercise Your Rights

To exercise any of your privacy rights, please contact us at:

Email: support@ballcaddie.com

Please include sufficient detail in your request so we can identify you and locate your information. We will respond to your request within the timeframes required by applicable law, typically within 30 days. In some cases, we may request additional information to verify your identity. If we cannot fulfill your request, we will explain the reason and provide information about appeals or complaints.

Children's Privacy

BallCaddie is not intended for children under the age of 13, and we do not knowingly collect personal information from children under 13. If we become aware that we have collected personal information from a child under 13, we will take steps to delete such information and terminate the child's account promptly.

Consistent with our Terms of Service, users under 18 may use BallCaddie only with the involvement and supervision of a parent or legal guardian. For users between 13 and 18 years old, we collect minimal personal information and use it only to provide the Service. We do not use data from minors for advertising or marketing.

If you are a parent or guardian and believe your child has provided personal information to BallCaddie without your consent, please contact us immediately at support@ballcaddie.com, and we will take appropriate action.

International Data Transfers

BallCaddie operates globally, and your personal information may be transferred to, stored in, and processed in countries other than your country of residence. These countries may have data protection laws that differ from those in your home country.

Transfer Mechanisms

When we transfer personal information internationally, we implement appropriate safeguards:

• Standard Contractual Clauses (SCCs): For transfers from the EU/EEA to countries outside the EU/EEA, we use Standard Contractual Clauses approved by the European Commission.
• Adequacy Decisions: Where applicable, we rely on adequacy decisions by relevant authorities that deem recipient countries to have adequate privacy protections.
• Consent: We may obtain your explicit consent for transfers to countries without equivalent data protections.

Data Processing Locations

Your information is primarily processed in the United States, the European Union, and other jurisdictions where BallCaddie operates. By using BallCaddie, you consent to the transfer of your personal information to countries outside your country of residence, including the United States, for the purposes described in this policy.

Security Measures

We implement comprehensive technical and organizational measures to protect your personal information from unauthorized access, alteration, disclosure, and destruction:

• Encryption: Data transmitted to and from BallCaddie is encrypted using industry-standard TLS/SSL encryption.
• Secure Storage: Personal information is stored on secure servers with restricted access, firewalls, and intrusion detection systems.
• Access Controls: We limit access to personal information to employees and service providers who need it to perform their job functions, and we require them to maintain confidentiality.
• Authentication: Account access is protected by passwords and, where available, multi-factor authentication.
• Data Minimization: We collect and retain only the personal information necessary to provide the Service.
• Regular Security Audits: We conduct regular security assessments and penetration testing to identify and remediate vulnerabilities.
• Incident Response Plan: We maintain an incident response plan to detect, respond to, and mitigate security breaches.

While we implement strong security measures, no system is completely secure. We cannot guarantee absolute security of your personal information. If you believe your account or personal information has been compromised, please contact us immediately at support@ballcaddie.com.

Cookies and Tracking Technologies

BallCaddie uses cookies, web beacons, pixels, and similar tracking technologies to enhance your experience, remember your preferences, and analyze usage patterns.

Types of Cookies Used

• Essential Cookies: These cookies are necessary for the basic functionality of BallCaddie, including authentication, session management, and security. They do not require consent.
• Analytics Cookies: We use cookies from Google Analytics and PostHog (with your consent) to collect information about how you use BallCaddie, including pages visited, features used, and time spent in the app. DataFast sets a first-party visitor identifier used only to measure our own site's traffic and conversions. These help us understand user behavior and improve our Service.
• Preference Cookies: These cookies remember your preferences and settings, such as language selection and display preferences, so you don't have to reconfigure them on each visit.
• No Advertising Cookies: We do not use advertising or marketing cookies, and no partner places cookies on your device to track your activity across other websites for advertising purposes.

Managing Your Cookie Preferences

• Browser Controls: Most web browsers allow you to refuse cookies or alert you when cookies are being sent. You can manage cookie settings through your browser preferences. Note that disabling cookies may limit certain features of BallCaddie.
• Opt-Out of Analytics: You can opt out of Google Analytics tracking by visiting https://tools.google.com/dlpage/gaoptout or installing the Google Analytics Opt-out Browser Add-on.
• Cookie Consent Banner: When you first visit BallCaddie, we display a cookie consent banner allowing you to accept or decline non-essential cookies.

The iOS App and Tracking

Our iOS app does not track you across other companies' apps or websites. It does not use the Identifier for Advertisers (IDFA), does not request App Tracking Transparency permission (because it performs no tracking that would require it), and its Apple privacy manifest declares no tracking and no tracking domains. The analytics inside the app (PostHog and Sentry) measure only your use of BallCaddie itself and are linked at most to your BallCaddie account identifier.

Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will notify you by:

• Posting the updated policy on BallCaddie with a new "Last Updated" date
• Sending you an email notification at the email address associated with your account
• Requiring you to accept the updated policy before continued use of the Service

Your continued use of BallCaddie after such notifications constitutes your acceptance of the updated Privacy Policy. We encourage you to review this policy periodically to stay informed about how we protect your personal information.

Platform Privacy Requirements

Apple iOS App Store

BallCaddie is available on the Apple App Store and complies with Apple's App Store Review Guidelines regarding privacy and data protection.

App Privacy Details and Data Transparency: The data practices described in this Privacy Policy align with the App Privacy Details (privacy nutrition labels) configured in App Store Connect. Our App Privacy Details clearly disclose all data collected by BallCaddie and third-party SDKs, including the purposes for collection, whether data is linked to user identity, and whether data is used for tracking across other apps and websites.

Data Collection and Use: In the iOS app we collect your email address, your BallCaddie account identifier, the content you create in the app (quiz answers, saved fittings, round logs, Caddie Mode sessions), purchase/entitlement status, and product-interaction analytics. Data is collected to provide the Service, communicate with you, process purchases, perform analytics, and for security and legal compliance. The third-party SDKs in the app are Firebase (authentication and data storage), RevenueCat (subscription entitlements), PostHog (product analytics), and Sentry (crash and performance monitoring).

No Tracking: The iOS app performs no cross-app or cross-site tracking. Its Apple privacy manifest declares no tracking and lists no tracking domains, it does not use the Identifier for Advertisers (IDFA), and it does not present an App Tracking Transparency prompt because none is required. We do not share personal information with third parties for their marketing purposes.

Push Notifications: The iOS app does not currently send push notifications and does not collect push device tokens. If we add push notifications in the future, we will update this policy and request the standard iOS notification permission first.

Data Deletion and User Rights: You can delete your BallCaddie account and associated personal data directly in the app (Profile > Delete Account), at https://ballcaddie.com/delete-account, or by contacting support@ballcaddie.com. Deletion requests are processed within 30 days. You also have rights to access, correct, and port your data as described in the Your Privacy Rights section of this policy.

Children: BallCaddie is not intended for children under 13, and under-18 use requires parental involvement as described in our Terms of Service and the Children's Privacy section above.

Data Security: We implement encryption, secure storage, access controls, and regular security reviews to protect user data from unauthorized access and disclosure.

Contact Information

Privacy Contact Email: support@ballcaddie.com

Company / Legal Entity: BallCaddie - Software Secrets LLC

Service / Product Name: BallCaddie

Website: https://ballcaddie.com/

Mailing Address:
155 31st Street
Ogden, UT 84401

Response Time: Privacy requests are answered within the timeframes described in the Your Privacy Rights section.

Supervisory Authority Links (for applicable jurisdictions):

• European Union / European Economic Area: https://edpb.europa.eu/
• United Kingdom: https://ico.org.uk/
• California: https://cppa.ca.gov/
• Canada: https://www.priv.gc.ca/
• Brazil: https://www.gov.br/anpd/
• Australia: https://www.oaic.gov.au/