Privacy

The Czar is a scorekeeping app for a golf group. It has no accounts, no advertising and no analytics, and it collects nothing about you beyond what a scorecard needs.

Last updated 14 September 2026.

There is no account

You never give us an email address, a password or a phone number, because the app never asks for one. On first launch your device is issued an anonymous identifier by our backend provider. It is a random value. It is not linked to you, your device's advertising identifier, or anything else, and it exists only so the app can tell your rounds apart from someone else's.

The one thing you type about yourself is a display name, and it is whatever you want it to be. It is shown to the other players in your rounds.

What is stored

When you create or join a round, the following is saved to our database:

• Your display name, and your anonymous identifier.
• The round: its name, the course name and date, the tee times, the join code, the number of groups, and which format each group is playing.
• The pairings — who is in which tee group, and which side of a match they're on.
• Whether each player is in the round's skins, and whether the host has put them in or out of the Big Game by hand.
• The scores: a stroke count per player per hole, plus which device last changed it and when, so a correction can be attributed.
• The par and yardage of each hole, copied from the course card when the round is created.
• The results the round settles on — the cut, and the blind draw's pairs.
• If you use a code to watch a round rather than play in it: your anonymous identifier, which round it is, and when you started watching. No display name is stored for a watcher, because the app never asks for one.
• If you subscribe to host rounds: your anonymous identifier, whether the subscription is active and until when, and which plan it is. That is all — the payment itself is Apple’s, and no card, receipt or Apple ID reaches us. Joining a round with a code never involves any of this.

That is the whole list. There are no other fields. Nowhere in the app is there a place to enter an email address, a phone number, a postal address, a date of birth, a handicap index or a payment method, and no such data is stored.

What is not collected

• No analytics or crash reporting. The app contains no analytics, attribution, advertising or crash-reporting software of any kind.
• No tracking. Nothing you do is tracked across other apps or websites, and no data is shared with data brokers or advertisers.
• No device permissions, with one exception you trigger yourself. The app never asks for your location, camera, contacts, microphone or notifications, because it uses none of them. If you choose Save Image when sharing a result card, iOS asks for permission to add that one picture to your Photos. That is add-only: the app never reads your photo library.
• No device identifiers. No advertising identifier, no device fingerprint.
• No contacts or address book access. Players are invited by reading them a five-character code.

Who can see your data

The other players in a round can see it. That is the point of the app — a shared leaderboard only works if everyone can see everyone's scores. Your display name, your scores and your results are visible to every player in a round you are part of, and to anyone watching that round with its code.

People outside a round cannot. Access is enforced at the database with row-level security: a request only returns rows for rounds you belong to or are watching. There is no public listing of rounds, and knowing a round exists is not enough to read it — you need its join code.

Using a code always makes you visible to the round. Joining as a player puts your name on the roster. Choosing to watch instead adds you to a count of watchers that everyone in the round can see. There is no way to read a round without the round knowing.

Watching is read-only, and that is enforced at the database rather than by hiding buttons: a watcher can never write a score, change a pairing or alter a result.

Who else is involved

Supabase

The database, the anonymous authentication and the live sync are hosted by Supabase, acting as our processor. Everything described above is stored there.

Apple

Hosting a round is a subscription bought through Apple’s App Store. Apple handles the payment end to end — the card, the receipt, the renewal, the refund — under Apple’s privacy policy. The app never sees your payment details.

RevenueCat

RevenueCat confirms with Apple that a subscription is real and current, and tells us. What it receives is the App Store receipt and your anonymous identifier — the same one described above — and nothing else about you. It is what lets the app know a host is subscribed without our ever handling a payment.

GolfCourseAPI

When a host searches for a course while setting up a round, the text they type is used to look the course up in GolfCourseAPI’s catalogue. Your phone does not contact them directly — the search goes to Supabase, which forwards it and keeps a copy of the result so that the next person looking for the same course does not cause another lookup.

The search text is stored, and it is not linked to you. What is kept is the words typed and the courses they matched — no identifier, no account, no name, nothing that says who searched or which round it was for. A stored search is discarded after 30 days. Course cards themselves — the pars and yardages for a course — are kept indefinitely, because a golf course is not personal information and holding it is what stops the same course being looked up over and over.

A course lookup happens only during round creation. Once the course is chosen, its pars and yardages are copied into the round and nothing is contacted again, which is also why the app keeps working with no signal.

Course data from GolfCourseAPI.

What stays on your phone

Some things are kept locally and never leave the device except as described above:

• Your anonymous session token, so you stay signed in between launches.
• Scores you have typed but not yet saved, so that a hole entered out of signal survives the phone closing the app.
• Which rounds you've hidden from your own history.

The app writes a round's join code to your clipboard when you tap to copy it. It never reads your clipboard.

Deleting the app removes all of this local data.

Keeping and deleting data

A round is kept so the group can look it up later. The host of a round can delete it from inside the app, which permanently removes that round and every score, pairing and result in it, for everyone. It cannot be undone.

To have your data deleted, email hello@theczargolf.com and we will remove it. Because there is no account, please send the message from a context that lets us find the round — the round's name and date, and the name you played under.

One consequence of having no account is worth stating plainly: if your device loses its anonymous session — by deleting the app, or by an authentication failure — there is no way to restore access to the rounds it was in. The data still exists for the other players in those rounds, but your device is issued a new identifier and cannot be reconnected to the old one.

Children

The app is not directed at children under 13 and we do not knowingly collect data from them. If you believe a child has entered data, email us and we will remove it.

Your rights

Depending on where you live, you may have the right to access, correct, export or delete your data. Email hello@theczargolf.com and we will help. Given how little is stored, most of it is already visible to you inside the app.

Changes

If this policy changes, the date at the top changes with it. If a change is significant, we will say so in the app.

Questions about any of this: hello@theczargolf.com