Privacy Policy

PlayerTap LLC, a Wyoming limited liability company (“PlayerTap”, “we”, “us”), operates PlayerTap and is responsible for your personal information. This policy covers the playertap.app website, the profiles it hosts, PlayerTap cards and bag tags, the waitlist, and the emails we send. It is part of our Terms of Service.

Your account. Your name, email address and username. If you sign up with email, your password is stored only as a one-way hash, never in readable form. If you choose Google, Google gives us your verified name, email address and a durable account identifier so the same Google account returns to the same PlayerTap account; we do not store Google access or refresh tokens. We also record when you signed up and whether you signed up as a golfer or for an organization. New members provide their date of birth so we can enforce our membership and Settle Up age limits. Your date of birth is private and is never shown on your profile.

Your profile (public). Whatever you choose to add: profile photo, cover photo and bag photo; handicap and home course; a one-line description and bio; interests; answers to profile prompts (what’s in your bag, the 19th Hole); links to your social media, payment and golf apps and websites; your business or occupation and its website; and, only if you switch them on, your phone number and email address. All of it is optional.

How you use PlayerTap. Who you connect with and when; where you met, if you add it; who you add to your Play Again List; the messages you send and receive, when they were sent and whether they’ve been read; Settle Up entries (amount, note, who is paying whom, and whether settled); people you block and any reason you give; your notifications; and the cards and bag tags you activate and when.

Taps. When someone opens a profile from outside PlayerTap, we record whose profile it was, when, whether it came from a card or a shared link, and — if they have an account — who they are. If the visitor has no account, the tap is linked to a random identifier in a cookie instead (see section 3), so it can be credited to them if they sign up. If a tap fails to record, we log the profile, the kind of failure and, for network failures, the error message the browser reported. When someone taps a card that hasn’t been activated yet, we record that the card was tapped, against the same kind of random identifier.

The waitlist. Your name and email; what you’re interested in (card, bag tag or both); any club, team or outing enquiry (organisation name and rough quantities); whether you qualified for a promotional offer; and whether you’ve unsubscribed.

Pre-orders. If you pre-order a tag or card: your name and email; the name and home course to print on each one, and whether it’s a tag, a card or both; whether you’ll collect it or have it mailed, and your shipping address if mailed; what you paid and when; and whether the order was paid, cancelled or refunded. You enter your card details on Stripe’s checkout page, not ours — they never reach us, and Stripe tells us only whether the payment went through.

League orders. If you order for a league using an access code we sent you: the same as a pre-order — the name and home course to print for each golfer, what each gets, delivery and shipping address, and payment status — plus your phone number and title if you give them, and which league the order is for. We keep each league’s name, the name and email of its contact, and the prices agreed with it; the access code itself is stored only as a one-way hash.

Organizations. If you belong to or manage an organization on PlayerTap: the organization’s name, page details, logo and links; who belongs to it and in what role; invitations, including the email address each was sent to and who sent it; and how many times each of its links was opened — a count with a time, not who opened it.

Inquiries. If you contact an organization through an inquiry form on PlayerTap: your name, email address, your message if you write one, which form you used, and when you agreed to share them with that organization. You don’t need an account to send one.

Settings. Your theme, email notification preferences, whether Settle Up is on, and which profile tips you’ve dismissed.

Technical information. Like any website, our hosting provider receives your IP address, browser and device type, the page requested and the page you came from, and keeps them briefly in server logs. We use the page you came from to tell a card tap from a link. To prevent abuse we keep counters of recent sign-in, sign-up, password-reset, waitlist, inquiry, checkout and league access-code attempts, keyed to a one-way hash of your IP address or email — never the address itself — and delete them within about a day. Password-reset links are stored only as hashes and expire after an hour.

What we don’t collect. No precise location or GPS, no access to your contacts, camera roll or other apps, and no payment card details — a pre-order is paid on Stripe’s checkout page, and payments between players happen in apps like Venmo, neither of which we see inside. We don’t use analytics or advertising tools, third-party tracking cookies or fingerprinting.

We use only cookies the Service needs to work. There are no advertising, analytics or third-party cookies. The only thing kept in your browser’s local storage is an unfinished league order (below).

• Sign-in cookies — keep you logged in (up to 30 days) and protect sign-in forms from forgery.
• playertap_anon — a random identifier set when someone without an account opens a profile or taps a card, so the tap can be credited if they sign up. It lasts 30 days and is cleared when you sign in.
• playertap-last-workspace — for members who also manage an organization, remembers whether you last used your personal dashboard or an organization’s, so you return to the same place. It lasts a year and holds only that choice.
• pt_league — set when you enter a league access code, so the league order form stays open in that browser. It holds which league it is and a signature, lasts a year, and stops working if the code is changed or the league is turned off.
• Unfinished league order (local storage, not a cookie) — while you fill in a league order, the roster and your contact details are kept in your browser so a closed tab doesn’t lose them. It never leaves your device until you choose to pay. It is removed when you reach the order confirmation page after paying, or choose “Start over”; if you leave before then — for example by closing the tab on the payment page — it stays in your browser until you start over or clear your browser’s site data.
• playertap_founders_offer — marked a visitor as eligible for a promotional offer, which has ended. It is no longer set.

You can block or delete cookies in your browser, but signing in won’t work without them.

• To provide the Service: showing your profile to people who tap your card or open your link, connecting you with people, delivering messages, keeping your cards pointed at your profile, and your tap and activity history.
• To communicate with you: password resets and account notices; notifications you’ve left on, such as a new message or a Play Again match (message emails say a message arrived, never what it says); an invitation to an organization, if one of its admins asked us to send you one; and, if you joined the waitlist, news about the drop, with an unsubscribe link in every one.
• To fill pre-orders: having the names printed, sending your receipt and delivery news, and arranging pickup or mailing.
• To run organization features: showing an organization’s page, sending invitations its admins request, counting link opens, and passing an inquiry to the organization you sent it to.
• To keep PlayerTap safe: preventing spam, abuse and fraud, rate limiting, enforcing our terms, and investigating reports.
• To run and improve the Service: fixing problems and understanding, in aggregate, how cards and profiles are used — for example, how many taps lead to connections.
• To meet legal obligations and to establish or defend legal claims.

If you are in a place whose law requires a legal basis for processing, we rely on performing our contract with you, our legitimate interests in running and protecting the Service, your consent where we ask for it (you can withdraw it at any time), and legal obligations.

Public to anyone with your card or link, no login needed: your name, username, photos, handicap, home course, one-liner, bio, interests, profile prompt answers, links, work details, and your number of connections. Your phone and email appear only if you switch them on. Who you are connected with is never shown on your public profile.

Shared with specific people: your messages, with the person you’re messaging; Settle Up entries, with the other player; the fact you’re connected, with that connection; a Play Again match, with both of you once it’s mutual; your membership of an organization, with that organization’s admins, who see your name, photo, role and number of connections; and an inquiry, with the organization you sent it to.

Organization pages — the organization’s name, logo, description and links — are public.

Private to you: your Play Again marks until they’re mutual, where you noted meeting someone, your tap history, who you’ve blocked, your settings, and your email address unless you choose to show it. A person you block is not told.

We don’t sell your personal information, and we don’t share it for cross-context behavioural advertising. We disclose it only as follows:

• Service providers that process it on our behalf, under contract and only for us: Vercel (hosting and server logs), Neon (database), Amazon Web Services (photo storage), Resend (email delivery) and Stripe (payments for pre-orders).
• Google, if you choose Google sign-in. Your browser goes to Google so it can authenticate you, and Google returns your verified name, email and account identifier to us. Google handles that interaction under its own privacy policy. PlayerTap asks only for basic identity and does not request access to Gmail, Drive, contacts, YouTube or any other Google service.
• Filling a pre-order. The manufacturer that makes the tags and cards receives the names and home courses to print, and nothing else. If you mail-order, the postal carrier receives your name and shipping address. If you choose pickup at a golf club, that club receives your name and what’s printed on your order so it can hand it over.
• Other users and the public, as described in section 5.
• Organizations you contact. When you send an inquiry and tick the box agreeing to share your details, we give your name, email and message to that organization so it can reply. From then on the organization decides how to use and keep them, under its own privacy practices, and we aren’t responsible for what it does with them.
• Apps you choose to open from a profile, such as Venmo or Instagram — what happens there is governed by their own policies.
• Legal and safety — when we believe in good faith that the law requires it, or to protect the rights, property or safety of PlayerTap, our users or the public.
• Business transfers — if PlayerTap is involved in a merger, acquisition, financing or sale of assets, information may be transferred as part of it, subject to this policy.
• With your consent or at your direction.

• Account and profile information: until you delete it or ask us to delete your account. Fields you clear are removed straight away; replaced photos are deleted from storage. Your date of birth stays with your account.
• Messages: until either of you removes the connection or blocks the other, which deletes the conversation for both of you, or your account is deleted.
• Settle Up entries: kept as a record for both players even if one blocks the other, until either player’s account is deleted.
• Taps by visitors without an account: 30 days unless they sign up.
• Rate-limit counters: about a day. Password-reset links: an hour.
• Inquiries, organization memberships and invitations: while the organization is on PlayerTap, or until you ask us to delete them. Copies an organization has already received are theirs to keep or delete.
• Pre-orders: as a record of the sale, for as long as tax and accounting law requires.
• Waitlist entries: until you ask us to remove you. If you unsubscribe we keep your address marked as unsubscribed, so we never email you again by mistake.
• Server logs: kept by our hosting provider for a short period, typically days.
• We may keep limited information longer where the law requires it, or to resolve disputes and enforce our terms. Backups expire on their normal schedule.

• Edit or clear any profile field at any time — empty fields simply don’t appear.
• Keep your phone number and email hidden (the default), switch off notification emails and Settle Up, and unsubscribe from waitlist email using the link in any message.
• Remove connections and block people.
• Email hello@playertap.app from your account’s address to request a copy of your information, a correction, or deletion of your account. We’ll confirm your request and respond within 30 days where we can, and always within the time the law allows.

Depending on where you live — including California, Colorado, Connecticut, Virginia, other U.S. states, and the EU and UK — you may have the right to know what personal information we hold and how we use it, to access and get a copy of it, to correct it, to delete it, to object to or restrict certain processing, and to opt out of its sale, sharing or use for targeted advertising (we do none of these). We will honour these rights whether or not your state’s law applies to us, and we won’t treat you differently for using them. You may use an authorised agent, who must show us your written permission. If we decline a request, you may appeal by replying to our decision, and if you’re unhappy with the outcome you may contact your state attorney general or data protection authority.

Because we don’t sell or share personal information, there is nothing to opt out of, but we treat Global Privacy Control signals as a valid opt-out anyway. We don’t respond differently to “Do Not Track” signals, since we don’t track you across sites.

In the past 12 months we have collected these categories of personal information, from you, from Google if you choose Google sign-in, from other users (for example, a connection or a Settle Up entry they record with you) and automatically, for the purposes in section 4: identifiers (name, email, username, Google account identifier, IP address, cookie identifiers); customer records (date of birth for new members; phone number, if you add it); commercial information (waitlist interest and enquiries, pre-orders and league orders, cards activated, inquiries you send to organizations); internet or other electronic network activity (taps, the page you came from, server logs); audio or visual information (photos you upload); professional information (business or occupation, if you add it); and sensitive personal information limited to your account login (username or email with password). We use sensitive personal information only to provide the Service and keep it secure. We disclose these categories only to the recipients in section 6 — an inquiry goes to an organization only at your direction — and have not sold or shared any of them.

Passwords are hashed and never stored readably; Google sign-in accounts are linked by Google’s durable account identifier without storing Google access or refresh tokens; password-reset links are stored only as hashes and expire in an hour; traffic is encrypted in transit; sign-in and sign-up are rate-limited; resetting your password signs out every other session; and access to production systems is restricted. No service can guarantee perfect security, and we won’t pretend otherwise. If a breach affects your personal information, we’ll notify you and the authorities as the law requires.

PlayerTap isn’t for children under 13, and we don’t knowingly collect personal information from them. If we learn we have, we’ll delete it. Users under 18 must have a parent or guardian’s permission, as our terms explain; we ask for date of birth at sign-up to enforce our age limits, but we don’t otherwise verify age. Settle Up is only for users 18 and over, and organizations may not use PlayerTap to collect information from anyone under 18. If you believe a child is using PlayerTap, tell us at hello@playertap.app.

PlayerTap is based in the United States, and your information is stored and processed there by us and our service providers. If you use PlayerTap from elsewhere, you understand it will be transferred to the United States, where privacy laws may differ from yours.

We’ll update this policy as PlayerTap changes, and the date at the top shows when it last did. If a change materially affects how we handle your information, we’ll tell account holders by email or on the Service before it takes effect.

Questions, requests or complaints: hello@playertap.app, or by post to PlayerTap LLC, Attn: Privacy, 30 N Gould St, Ste N, Sheridan, WY 82801, USA.