Privacy Policy

What Standing Tee collects about you, who else sees it, how long it is kept, and what happens when you ask for it to be removed.

What we collect

When you sign in

Signing in sends you to Apple or Google, and what they hand back is what we store: your name, your email address, and the web address of your profile picture. If you signed in with Apple and chose to hide your email, what we receive and store is the relay address Apple generated, not your real one.

We also store the sign-in tokens your provider issues — the access, refresh and identity tokens — in our database, in plain text. They are what keeps you signed in without asking for your provider password. We name them explicitly because “we store your profile” would not tell you they exist, and one of them contains a second copy of your name and email.

What a league holds about you

The display name you are known by in that league, and your GHIN number if you give one.
Your handicap index over time — each value we recorded, not just the current one.
Every score you have entered or had entered for you, hole by hole.
Who played in each round, who submitted the card, who approved it, what each person owed or was owed, and who has been paid.
A league’s admins may record your email address on its roster, so that signing in with that address joins you to it, and we email that address once to tell you. Only the league’s owners and admins see it.

You can be on a league’s roster without ever having signed in — an administrator can add you as a name on a card. Everything above applies to those records too.

If you unsubscribe from that email, or mark it as spam, we keep a one-way fingerprint of the address rather than the address itself, so that no league emails it again.

If you ask to join a league through its link, its owners and admins see your name and the email address you signed in with, whether or not they approve you.

When an administrator corrects money

If an administrator changes what a round settled at, we keep a permanent record of it: each person’s payout before and after, and the reason the administrator typed. That reason is free text written by another person, and a realistic one names a golfer. The same is true when an administrator reverses a recorded payment, or sends a scorecard back to the golfer who entered it with a reason for fixing it. This matters again further down, under deleting your account.

When support fixes a problem

To fix problems, Standing Tee support can view and correct a league’s data. Every change made through our support tools is recorded, with the reason for it — free text again, which can name a golfer.

When you read a scorecard from a photo

If you photograph a scorecard so the scores can be read from it, we keep the photo for a short time. A card usually carries the names and scores of everyone who played on it, so the photo may show other golfers’ names and scores as well as yours. To read it, we send it to Amazon Web Services, together with the names of the round’s players so each row can be matched to a golfer, and a model they run for us reads the scores off it. What it reads is only a suggestion: nothing is saved until the person entering the card accepts it.

The photo can be seen by the member who took it and by the league’s administrators and scorers, and by no one else — not other members of the league, and nobody in another league. We also keep a record that a photo was read: who took it, when, for which round, and what reading it cost. That record holds no names and none of the scores read from the card. Once the person entering the card finishes, it also notes which golfers’ cards the photo was matched to, and it keeps that after the photo itself is deleted. How long the photo itself is kept is set out below.

What our web server records

The server writes one line per request, and that line includes the IP address your device connected from. It stays on the server; it is not copied anywhere else.

Who else receives it

Apple or Google, because signing in sends you to them — so your provider knows you are signing in here. Nothing about your golf is ever sent back to them: no scores, no handicap, no league, no money.
Amazon Web Services. The server runs there, backups of the database are stored there, and the server’s logs may be copied into their log service. They are our hosting provider — they store it for us, and nobody there is sent it to look at. A scorecard photo is also sent to them to be read, by a model they run for us in the United States, and is stored with them until it is deleted. Email the app sends you goes out through their email service, which receives your address and the message.
Our certificate provider receives an operator’s email address so the site can have an HTTPS certificate. It receives nothing about you.

That is the whole list. The more useful half is what we checked is not happening:

Analytics or tracking of what you do here: none.
Crash or error reports sent off this server: none.
Email sent to you by the app itself: a league’s notices, to its owners and admins, who can each turn them off; and one email to a person whose address a league’s admin records, saying they were added and how to sign in.
Content loaded from another company’s site when you open a page: none. That includes the fonts, which are served from here rather than fetched from a font provider as you read.

We do not sell your data, and we do not share it with anyone for advertising. There is no advertising here to share it for.

Cookies and what your browser stores

Every cookie we set is there to sign you in: the one that keeps you signed in afterwards, one that remembers which page to return you to, and short-lived ones that protect the sign-in exchange itself while it is happening. None of them is used to build a profile of you or to follow you to other sites, and there are no others — which is why you are not being asked to accept anything. We describe them anyway, because a cookie you are not asked about is still a cookie you are entitled to know about.

Your browser also keeps something on your own device: if you enter scores while out of signal, the unsent card is held in your browser’s local storage until it can be sent — the hole numbers, the stroke counts, and which player each score is for. It is filed under your own user id, and that is deliberate: on a phone or tablet two people share, it is what stops one scorer’s unsent holes being sent up under somebody else’s sign-in. It is cleared when the card goes through or when you discard it. It never leaves your device except as the score you were entering anyway, and we cannot read it.

How long it is kept

Nothing in the database expires on its own. There is no table that empties itself after a year, and no automatic deletion of old seasons, scores or handicap history. Your records stay until you delete your account or an administrator removes them. The windows below are about logs and scorecard photos, and only those — do not read them as how long your golf is kept.

Logs expire in two different ways:

Where logs are copied off the server into our log service, they are set to expire there: application logs after 30 days, database logs after 14.
On the server itself, logs rotate by size rather than by age. The web server’s request log — the one carrying IP addresses — keeps five files of about 10 MB each before the oldest is overwritten. How far back that reaches depends on how busy the site has been, not on a number of days, and the honest statement is that it is bounded by volume.

A copy of the database is kept for 14 days, so a deletion is not fully complete until the last copy taken before it has expired. That period was last checked against the live storage rule on 2026-09-11.

A scorecard photo is kept so that an administrator can check the scores read from it before approving them, and it is deleted once they are approved. If your league does not ask administrators to approve cards, or no row of the photo was matched to a golfer, it is deleted as soon as the person entering the card finishes. Both depend on that person finishing: if they never do — they leave part-way, or delete their account — approving the scores does not delete the photo, and it is kept until the limits below. Anyone who can see it may also delete it. Whatever happens, it is no longer shown to anyone 7 days after it was taken, and our storage deletes every photo 8 days after it was taken. That storage counts to the next midnight and removes expired files in the background, so a photo is never kept more than about 9 days. When we last watched that rule remove a stored photo: 2026-10-09.

Deleting your account

If you have signed in, you can delete your account yourself, from /leagues/account inside the app. It acts on the account you are signed in as — there is nothing to fill in, and no way to aim it at somebody else.

Destroyed immediately: your account record — your name, email address and profile picture address — and every sign-in token we held. Every session you have open ends at the same moment, on every device.

Anonymised everywhere at once: in every league you belong to, your display name is replaced with a placeholder and your GHIN number is removed. That includes leagues you have stopped playing in and leagues that are no longer running — you do not have to visit them, and you cannot miss one.

Kept, deliberately: your scores, your handicap history, which rounds you played, and what each round settled at. These stay attached to the anonymous placeholder. The reason is other people: your scores are part of what decided what everyone else in those rounds won or owed, and removing them would rewrite other golfers’ results and money after the fact. So we remove who you are and keep what was played.

Fees are kept the same way. If a league charged you a fee — a season buy-in, say — the charge and each payment recorded against it, with its amount, method and date, are kept under the placeholder, so the league’s record of the money it collected still adds up after you leave.

Nothing links the placeholder back to you. There is no table mapping it to your old name or email. Our internal change log records that a display name was changed, and stores neither the old value nor the new one.

Your leagues: a league you were the only member of is deleted along with your account. A league where other people play, but where you were the only administrator, is kept intact for them — we keep an internal note that it has been left without an administrator, so it can be sorted out rather than silently stranded.

That last part covers leagues that are switched on, and memberships that are still active — which in ordinary use is all of them. If a league has been switched off, or an administrator had already deactivated your membership, it is not picked up: your name is still replaced there, because that happens everywhere without exception, but the league itself is left as it is. Write to us if that matters in your case.

Notes administrators wrote about you are erased too. When an administrator sends your card back, corrects a round’s money, or reverses a recorded payment, they type a reason, and it can name you. Deleting your account erases the reason on your own returned cards, and every correction and payment reason on the rounds you played in or paid into — in every league, including ones you have left or that are no longer running. Where a reversal has to keep a reason, the text is replaced with “[redacted]”. The same goes for the reasons support records: a support change made to you, to a round you played in or paid into, or to any card on such a round — yours or another golfer’s — has its reason, and any repair script, replaced with “[redacted]”.

There are three kinds of written record a deletion does not reach, and we would rather tell you than let the paragraphs above read as covering everything. First, a reason an administrator gave for sending back another golfer’s card belongs to that golfer’s card, so it stays even if it names you — including on a round you played in. Second, a correction or payment note about you on a round you neither played in nor paid into is not tied to you anywhere we can see, so it stays too. Third, a support note or repair script that names you but was about neither you nor a round you were part of stays, and so does a repair script support ran that was not recorded against you. A support note or repair script that reached you only through something you were joined to after it was written — a place on a roster later linked to your account, or a round you joined later — stays as well, but only if that league is erased before you delete your account. We can remove any of these on request — email support@standingtee.com and say which league and round, or just ask us to look.

A scorecard photo is not deleted early. Deleting your account, or a league being deleted, does not remove a scorecard photo that has already been taken, whether you took it or appear on it. It expires on the same schedule as any other photo. After an account is deleted, the league’s administrators and scorers can still see the photo for up to 7 days after it was taken. Approving its scores ends that sooner only if the person who took it had finished entering the card; if they had not, and a deleted account never can, it stays visible to them for the whole of that time unless one of them deletes it. After a league is deleted, nobody can see the photo any more, but the stored file is not removed early either. In both cases our storage deletes it 8 days after it was taken, and it is never kept more than about 9 days.

What a fee is for is the league’s own text. An administrator writes it when they set up a fee. It describes what the league charges for, not any one golfer, so no account removal erases it. It is not copied into our internal change log: the fee itself is the only place it is kept, and a league administrator can reword it at any time. If one names you, ask an administrator of that league to change it, or email support@standingtee.com with the league and the fee and we will remove it.

If you never signed in, or you have already uninstalled the app, there is nothing for you to sign in to and the route above is not open to you. How to request deletion covers that case and gives you the address to write to. We answer deletion requests within 30 days.

Where this service is offered

Standing Tee is offered in the United States and is not directed to people outside it. We do not claim compliance with the GDPR or the UK equivalent, and we are not offering rights under laws we do not operate a process for — saying otherwise would be easy and false. What we do offer is on this page: you can see what we hold, you can delete your account yourself, and you can write to us.

This service is for adults: you must be 18 or older to hold an account. Our Terms of Service also set limits on the records an administrator may create about other people — never about a child under 13, and nobody under 18 in a league that plays for stakes.

Contacting us, and changes to this page

Standing Tee is run by Richard Hayn, an individual operating as a sole proprietor. Questions about any of this, and deletion requests, go to support@standingtee.com.

If this policy changes, the date at the foot of this page changes with it. There is no archive of previous versions yet; if that becomes something you have relied on, it will be.