Privacy Policy

This Privacy Policy describes how Tyler Cutshall ("Scorven", "we", "us", or "our") collects, uses, shares, and protects personal information when you use the Scorven mobile application, the website at scorven.com, and the related services we provide (together, the "Service").

It applies to players who create an account, people who register for a club tournament without an account, and visitors to our website. It does not apply to golf clubs' own separate handling of your information, or to third-party services we link to, which are governed by their own privacy policies.

By using the Service, you agree to the collection and use of information as described in this policy.

Information you provide to us

• Account information — your email address, a username, a display name, and a password (which we store only as a one-way cryptographic hash, never in readable form).
• Profile information — optionally, a handicap index, a home ZIP code (used only to show tournaments near you), and an avatar selection from our built-in presets (we do not host uploaded profile photos).
• Gameplay information — the rounds you create or join, hole-by-hole scores, game formats, and side-game and wager-ledger entries. Wager and side-game figures are informational only, as explained in our Terms.
• Tournament registration information — when you register for a club tournament, the name and email you provide, and optionally an age; if you register teammates, the names you enter for them. You can register for a tournament without a Scorven account.
• Content you post — Social Board posts, tournament fliers or images you upload as a club, comments, votes, and reports.
• Communications — messages you send us, including support requests and rights requests.

Information we collect automatically

• Device and connection data — your IP address and basic device/browser information, which we record in security and audit logs to protect the Service.
• Push notification token — if you enable notifications, a device token that lets us deliver them (via Apple's push service).
• Session data — information needed to keep you signed in securely, including a session identifier and the browser or app version associated with a session.

Information we receive from others

• Payment confirmations — when you pay a tournament entry fee, our payment processor (Stripe) tells us whether the payment succeeded and gives us transaction identifiers. We do not receive your full card number.
• Club and organizer input — a club administrator may enter or correct information about your tournament entry (such as your scores or payment status) as part of running an event.

We do not use third-party advertising networks or third-party analytics SDKs in the app, and we do not build advertising profiles about you.

We use personal information to:

• Provide, operate, and maintain the Service — scoring, statistics, friends, and the Social Board.
• Create, run, score, flight, and publish results for club tournaments.
• Process tournament entry-fee payments through our payment processor.
• Send you transactional messages you would expect, such as email verification, password resets, and tournament confirmations.
• Send push notifications you have opted into, such as round invites and your-turn nudges.
• Keep the Service secure — detecting, investigating, and preventing fraud, abuse, and unauthorized access, including through security and audit logging and rate limiting.
• Respond to your requests and provide support.
• Comply with legal obligations and enforce our Terms.

If you are in the European Economic Area or the United Kingdom, we process your personal information on the following legal bases:

• Performance of a contract — to provide the Service you have signed up for (for example, running your rounds and tournaments).
• Legitimate interests — to secure the Service, prevent abuse, and improve and maintain the product, where those interests are not overridden by your rights.
• Consent — for optional features such as push notifications; you can withdraw consent at any time.
• Legal obligation — where we must process information to comply with the law.

We do not sell your personal information, and we do not share it for cross-context behavioral advertising. We share information only in the following ways:

Visible to others by design

Scorven is a social and competitive product. Your display name, username, avatar, and scores are shown to people you play with. Tournament standings — including entrant names and scores — appear on results pages that are accessible with a shareable results code, and clubs' tournament posts appear on the Social Board. Please keep this in mind when choosing a display name and when entering information.

Service providers (subprocessors)

These providers process information on our behalf, only to provide their service to us:

• Stripe — payment processing for tournament entry fees.
• Apple — delivery of push notifications and distribution of the app.
• Cloudflare — content delivery, network security, and storage of images you or clubs upload.
• Our email delivery provider — sending transactional email.
• Our encrypted-backup provider — off-site storage of encrypted database backups.

Legal, safety, and business transfers

• To comply with applicable law, regulation, legal process, or an enforceable governmental request.
• To protect the rights, property, safety, and security of Scorven, our users, or the public, and to enforce our Terms.
• In connection with a merger, acquisition, financing, or sale of assets, in which case we will require the recipient to honor this policy or notify you of any material change.

Aggregated or de-identified information

We may create and use information that has been aggregated or de-identified so that it does not reasonably identify you. We do not attempt to re-identify it.

On our website we use strictly necessary cookies to keep you signed in securely (an authentication session cookie and related security cookies). These are essential to the operation of the site.

We do not use advertising cookies or third-party tracking cookies. The mobile app stores your authentication tokens securely on your device (in the device keychain) rather than in cookies.

We use industry-standard measures designed to protect your information, including:

• Encrypting email addresses at rest (AES-256-GCM).
• Hashing passwords with a strong, modern algorithm (Argon2id) — we never store passwords in readable form.
• Storing authentication tokens only as hashes, with session rotation and revocation.
• Encrypting database backups.
• Serving all traffic over HTTPS.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If we become aware of a security incident affecting your personal information, we will notify you and the appropriate authorities as required by law.

We keep personal information for as long as your account is active or as needed to provide the Service, and then only as long as necessary for the purposes described in this policy. In practice:

• Account and gameplay data is retained while your account is active; when you delete your account, your personal identifiers are removed as described below.
• Security and audit logs are retained for a limited period to detect and investigate abuse.
• Encrypted backups are kept on a short rolling schedule and then deleted.
• Tournament entry records may be retained by the hosting club and by us as needed for the integrity of the event and to meet legal or financial obligations.

Depending on where you live, you may have some or all of the following rights:

• Access and portability — to know what personal information we hold about you and to receive a copy.
• Correction — to correct inaccurate information. You can edit much of your profile directly in the app (Me → profile) or on the web.
• Deletion — to delete your account and personal information. You can do this yourself in the app (Me → Delete Account) or by contacting us. Deletion anonymizes your account and removes your personal identifiers; some records may be retained where necessary for competition integrity, security, or legal reasons.
• Opt-out of communications — you can turn off push notifications in your device settings and opt out of non-essential email.
• Objection and restriction — where applicable, to object to or restrict certain processing.
• Withdraw consent — where we rely on consent, at any time.

To exercise a right, contact us at [email protected]. We will verify your request and respond within the time required by applicable law. We will not discriminate against you for exercising your rights.

If you are a California resident, the California Consumer Privacy Act, as amended, gives you specific rights. In the preceding 12 months, we collect the categories of personal information described in "Information we collect" above, which map to these statutory categories: identifiers (such as name, username, email, and IP address); customer records (such as email and, for tournament entrants, name); commercial information (such as tournament transactions); internet or network activity (limited security/log data); coarse geolocation (a home ZIP code, if you provide one); and financial information related to payments (processed by Stripe; we store transaction identifiers, not card numbers). We collect it for the business purposes described above and share it only with the service providers and for the reasons listed in "How we share your information."

We do not sell your personal information, and we do not "share" it for cross-context behavioral advertising, as those terms are defined under the CCPA/CPRA. Because we do not sell or share, we do not offer a "Do Not Sell or Share My Personal Information" opt-out, but you may still exercise the rights below.

As a California resident you have the right to:

• Know the categories and specific pieces of personal information we have collected about you.
• Delete personal information we have collected from you, subject to legal exceptions.
• Correct inaccurate personal information.
• Limit the use of sensitive personal information (we do not use sensitive personal information beyond what is necessary to provide the Service).
• Not receive discriminatory treatment for exercising your rights.

You may exercise these rights by emailing [email protected]. You may use an authorized agent to submit a request; we may require the agent to demonstrate authority and may ask you to verify your identity directly.

If you are in the European Economic Area, the United Kingdom, or another region with data-protection laws, you have the rights described in "Your privacy rights and choices," exercisable on the legal bases set out in "Legal bases for processing." You also have the right to lodge a complaint with your local supervisory authority. We act as the controller of your personal information for the purposes described in this policy.

Scorven is intended for players aged 13 and older and is not directed to children under 13. We do not knowingly collect personal information from children under 13. If you are a parent or guardian and believe a child under 13 has provided us with personal information, contact us at [email protected] and we will delete it.

Scorven is operated from, and stores data in, the United States. If you access the Service from outside the United States, you understand that your information will be transferred to, stored, and processed in the United States, where data-protection laws may differ from those in your country. Where required, we rely on appropriate safeguards for such transfers.

We may update this policy from time to time. When we make material changes, we will update the "Last updated" date above and, where appropriate, notify you in the app or by email. Your continued use of the Service after an update means you accept the revised policy.

If you have questions about this policy or want to exercise a privacy right, contact us at [email protected].

The entity responsible for your information under this policy is Tyler Cutshall.