What we keep, and why.
What we collect, why, who else sees it, and how to have it removed. Written to describe what the software actually does, not what sounds reassuring.
Who holds your data
TourneyHQ is used by golf clubs, leagues, golf groups and event organizers to run competitions. When a club enters you into a tournament, the club decides what to collect and why. We store and process it on their behalf and act on their instructions.
In data-protection terms the club is the controller and TourneyHQ is the processor. In practice that means: if you want your details corrected or removed, your club can do it directly, and that is usually the fastest route. If they cannot, write to us at support@tourneyhq.club and we will act on it.
You may be in here without ever having signed up. That is normal for club golf — an organizer enters the field from the club’s own membership records. It does not reduce your rights below, and it is why this page is readable without an account.
What is collected
About players in a tournament, from the club:
- Name
- Email address and phone number, where the club provides them
- Handicap index, and whether it is a 9 or 18-hole index
- Scores, results and any note attached to a card
- Weekly availability, in leagues that ask
About people who sign in to run an event:
- Email address and name
- A password, stored only as a hash — we cannot read it
About the club itself: its name, town or region, colors and logo.
If an organizer opens self-service registration, whatever a person types into that form — typically the same name, contact details and handicap.
If you register your interest
Before TourneyHQ opens, the register your interest form asks for your name, email address, club or golf group, which best describes you, and, if you choose, a phone number, how many members it has and a note. We hold this ourselves, not on any club’s behalf: it is copied to our inquiries mailbox and kept in our records so we can tell you when TourneyHQ opens, send the discount code you were promised, answer any question you asked, and call you if you left a number.
If you arrived by one of our links or advertisements, the link’s campaign label (which post or advertisement you followed) and the name of the site that sent you are kept with your registration, so we can tell which ones work. They are read from the web address you arrived at; nothing is stored on your device and nothing is shared.
If you register through a form inside Facebook, Instagram or LinkedIn instead, that platform passes us what you typed in it, and we keep it in the same way; the platform’s own privacy policy covers what it keeps.
It is used for nothing else and never sold. Write to us and we will delete it, whenever you ask.
What is not collected
No payment card details. When a club pays for a plan it pays on Stripe’s own page, and the card goes to Stripe, never to us. Money in a tournament — entry fees, skins, payouts — is worked out and recorded, never taken. No location tracking. No advertising identifiers, no advertising trackers, and no analytics cookies.
Sign-in and abuse limits are counted against a hashed identifier. The code that stores those counts never receives the original value.
Cookies
One cookie signs you in and keeps you signed in. It holds a signed reference to your account and nothing else. A second, similar cookie is used when a player joins a round with a code instead of an account.
They are not used to track you between sites or to build a profile.
Who else sees it
Only what is needed to run the service:
- Vercel — hosting. Serves the app and keeps standard server logs. Where page counts are switched on, Vercel also counts visits to each page — the page’s address, the referring site, the country, and the kind of browser and device. It uses no cookies and does not recognise anyone from one day to the next. Any link token in an address is removed before it is counted.
- Our database provider — stores the tournament data described above.
- Stripe — only when a club pays for a plan. Stripe receives the club’s name and the email address of the person who buys, and takes the payment. No player’s details are sent.
- Sentry — error reports, where they are switched on. When a page fails on our server, a report of the fault is sent: the address of the page, with any link token and email address removed, and the technical details of the error. No cookies and no IP address are included.
- Anthropic — only for the features your club switches on, and only when someone uses them:
- Reading a scorecard from a photo. The photograph is sent, along with the name of the player whose scores are being read. A photograph of a card may also show other players’ names and scores, and handwriting.
- AI-written commentary. Current standings, which include player names, are sent to generate a line of text.
- Describing a tournament in words. Only the sentence the organizer types is sent. No player data is included.
- Drafting an announcement. A summary of the event is sent: its name, the size of the field, the rounds, the leading players by name with their scores or points, and, where a league runs skins, who is up or down on the season and by how much. Contact details are never included.
We do not sell personal data, and we do not share it for advertising.
Public leaderboards
An organizer can publish a leaderboard on a link anyone can open, for a clubhouse screen or to share with a field. It shows what a leaderboard shows: names, scores and standings. It does not show email addresses or phone numbers.
Whether to publish one is the organizer’s decision, and they can stop sharing it at any time.
How long it is kept
On Par, the free plan, a tournament is deleted for good — its entries, cards, results and money — when its organizer marks it Completed, or 14 days after its first round is played, whichever comes first. This applies to clubs that joined after the free plan’s terms were introduced on 29 September 2026; a free club that joined before then keeps its tournaments as the paid plans do.
On Birdie, Eagle and Albatross, tournament data is kept until the club deletes it or asks us to. When a paid plan ends, every tournament the club has is kept read-only for 12 more months and then deleted for good, unless the club chooses a plan again first — see the terms.
A casual round is deleted 24 hours after it is set up unless its organizer keeps it. On Par, for clubs that joined after those terms were introduced, it cannot be kept.
An organizer can remove a player, or a member from the club roster, at any time. A club’s owner can delete the whole club from Club settings, and everything it holds goes at once — including the record of any texts sent and emails that failed.
Your rights
Depending on where you live you may have the right to see the personal data held about you, have it corrected, have it deleted, or object to how it is used.
If you have a TourneyHQ account, you can delete it yourself from Your account. Your sign-in and all your access go at once. What a club holds about you — entries, scores, roster details, money records and messages — stays with that club, which can remove it; ask them as below.
Ask your club first — they hold the relationship and can act immediately. If that does not resolve it, write to support@tourneyhq.club and we will action it, and tell the club we have.
Children
Junior competitions are part of club golf, and a club may enter players under 18. Where it does, the club is responsible for having the right permission from a parent or guardian. TourneyHQ collects nothing extra from a junior player, and no account is needed to appear in a field or on a leaderboard.
Security
Traffic is encrypted in transit. Passwords are stored only as hashes. Access to a tournament is scoped to the organization that owns it, and checked on the server rather than only hidden in the interface.
No system is perfect; if you believe you have found a problem, please tell us.
Changes
If this policy changes in a way that affects what is collected or who it is shared with, the date below changes and the change is described here rather than made quietly.
21 October 2026: the register-your-interest form is described: what it asks, that we hold it ourselves, and that it is deleted on request. And a paid plan that ends keeps its tournaments read-only for 12 months, then deletes them, in place of 30 days followed by the free plan’s terms.
3 October 2026: Vercel’s cookie-free page counts are described, for when they are switched on; “no third-party analytics” becomes “no analytics cookies”, which is what stays true either way. A club’s owner can delete the club, and all it holds, from Club settings; and anybody with an account can delete it from Your account.
2 October 2026: Stripe is listed, for clubs that pay for a plan, and Sentry, for error reports; a paid plan that ends keeps its tournaments for 30 days.
30 September 2026: “How long it is kept” now describes the deletion on the free plan, which is built and running; the icon stylesheet on a public CDN is no longer listed, because the icons are now part of the page and nothing is fetched from it.
Last updated 21 October 2026.