Privacy Policy

1. Who we are

CIAGA is operated by James Ware, a private individual in the United Kingdom who runs it on a non-commercial basis (“we”, “us”, “our”). We are the data controller for the personal data described in this policy.

You can contact us about privacy or this policy at privacy@ciagagolf.com (a postal address for service is available on request).

2. Scope

This policy covers the CIAGA web app and marketing website, including every feature described below — whether it's live for everyone, or only switched on when you choose to use it. We process personal data in accordance with the UK GDPR and the Data Protection Act 2018.

3. The personal data we collect

Account & profile

• Your email address and a password (managed by our authentication provider — we never see your password in plain text).
• Your display name and, optionally, a profile photo (avatar).
• Your gender, where you provide it — used only to apply the correct World Handicap System allowance.

Public and private accounts

Accounts are public by default. On a public account, anyone signed in can see your round history, posts and stories. You can switch your account to private at any time from Privacy settings on your profile — once private, only followers you've approved can see your round history, posts and stories, and following you requires your approval ("follow requests") rather than happening instantly.

Some things stay visible regardless of your account type, because they exist as part of shared play or golf convention: your name, avatar and current handicap index; the scores and results of rounds you shared with other members (a shared round is shared content, visible to everyone who could see any participant's rounds — privacy governs your own profile history, not a round seen through another player); and your standings in any Majors group, which follow that group's own privacy rather than your account's (see "Groups, Majors and group posts" below). A mention also reaches the person mentioned: if someone tags you in a post or comment, you can see it even if you don't follow them and their account is private.

If you post publicly, we may also suggest your posts to members who don't follow you, as part of the feed (see "Your feed: ranking and suggestions"). You can turn this off at any time with the "Suggest my posts" setting, and it is unavailable (your posts are never suggested) once your account is private.

Follows and follow requests

• Who you follow, and who follows you.
• If you or someone you've asked to follow has a private account, the pending follow request until it's accepted or declined.
• Blocks and mutes you set: blocking hides each of you from the other everywhere (feed, comments, mentions, profile) and removes any follow between you; muting quietly hides someone's posts from your own feed without them being told.

Golf & competition data

• Your rounds, hole-by-hole scores and statistics, the courses you've played, and any personal bests or course records you hold.
• Your handicap index and its history over time, including the score-acceptability checks used to calculate it.
• Your membership of groups/societies, competition entries, standings and results.

Groups, Majors and group posts

A group (society or "Majors" group) has its own privacy setting — public, request-to-join, or invite-only — which controls who can see its roster, standings, leaderboards, tee times and results, independently of your own account's privacy. A public group's standings are visible to any signed-in member; a request or invite-only group's are visible only to its active members.

Group owners and admins can also post as the group — these appear in the feed with a "posted by" credit naming the admin who posted it, and reach the group's members and (for public groups only) anyone who follows the group.

Any active member can also share their own post or story to a group they belong to, or tag one of that group's events. A shared post reaches the group's active members (in their feed and on the group's page) even if they don't follow you and your account is private; a post tagged to an event appears on that event's page for the group's members. It is not shown to people who merely browse a public group, and it never reaches the group's followers. A shared story is visible to the group's active members for its usual 24 hours. Group owners and admins can remove a shared post from their group or event page.

Social content — posts, comments, mentions and reactions

• Posts, comments, replies, reactions, @mentions and any photos you upload to the feed.
• Photos you take or edit in the app. The in-app camera (which asks for camera access only, never your microphone) and the photo editor work entirely on your device — nothing is uploaded until you post. Drawings, text and stickers (such as a date, time, course, event, group or person) become part of the posted image; a sticker that tags a course, event, group or person also stores where it sits on the photo so others can tap through to it, and tagging a person notifies them. Saving a photo to your device happens on your device; we don't keep a copy of anything you save but don't post. Photo location data (EXIF/GPS) is stripped before upload. When you set a profile photo or a group picture, you frame and crop it on your device; only the cropped picture is uploaded, never the original photo.
• Reports you submit about content, and the reason you give.
• View counts. We show how many people viewed a post as a number only. For a story, its author can also see who viewed it, and any emoji reaction each viewer left, while the story is live — nobody else sees that list. We keep the underlying record of who viewed what for 90 days and then delete it; the total count itself is kept for as long as the post or story exists, since it's a running counter rather than a list of names.

Stories

A story is a photo (which you can draw, write or place stickers on) visible to your followers for 24 hours, after which it's automatically deleted — plus anyone you tag in it, the active members of a group you share it to, and (if your account is public) anyone viewing your profile while it's active. Blocking is mutual and immediate for stories, the same as for posts; muting only affects whose stories appear in your own story tray.

• Viewers can react to a story with an emoji. Only the story's author sees who reacted and with what (alongside who viewed it); a reaction is deleted with the story, and you can remove your own at any time while the story is live.
• A story is deleted within 48 hours of expiring, unless it's been reported or is the subject of an open appeal.
• If a story is reported and we act on it, we keep it until 30 days after that decision, so we can review it properly and keep a record of what we did. A dismissed report doesn't hold the story.
• The record of who viewed a story (not the image) is kept for 90 days, then deleted, the same as post view records above.
• Deleting your account deletes your stories, and the photo files behind them, immediately — along with your view history of other people's stories and posts, and the reactions you left on their stories. A story that has been reported, or is under appeal, is kept until that's resolved; if we act on the report, it's kept for 30 days after that decision, the same as above. Then it's deleted.

Your feed: ranking and suggestions

We don't show your feed in strict chronological order. Instead we rank what's shown using signals including: how recent something is; how much engagement it has (reactions, comments, views); your relationships (people you follow, groups you're in, mentions); and the courses and groups you follow.

We also suggest items you haven't been directly targeted with, drawn from: courses you follow, public groups you follow, courses you've played, and posts reacted to by people you follow. Only discoverable items can be suggested — your own posts and achievements only count as discoverable if your account is public and you haven't turned off "Suggest my posts"; a group's posts only count if that group is public. Your privacy settings are re-checked each time the feed is generated, so going private or turning suggestions off immediately stops your existing items from being suggested to anyone new — it doesn't just affect posts from that point on. Turning suggestions back on later does not retroactively re-expose items that were already suppressed.

A suggested item is labelled as such, and a "Why am I seeing this?" explanation is shown for each one — for example that it's from a course or group you follow, or that people you follow reacted to it.

If you tell us you're not interested in something — a particular person, group, course or type of content — we record that as a negative signal and use it to demote or hide similar suggestions. We keep each negative signal for up to 90 days, after which it's automatically deleted and no longer has any effect.

None of this produces a decision with a legal or similarly significant effect on you — it only changes what order you see content in, and what gets suggested to you. Because ranking and suggestions run on our legitimate interest in showing you relevant content, you have the right to object to them — see "Your rights" below — and you can exercise that directly by going private or turning off "Suggest my posts".

Because accounts default to public, we show existing members a one-time in-app notice explaining that their account is public and suggestible, with a direct link to Privacy settings and this policy.

Course follows

You can follow a golf course from its course page. Following one is used the same way as following a group — as a signal for your feed and suggestions (for example, to show you posts from a course you follow). You can unfollow a course at any time.

Share images

When you create a share image (for example a scorecard or profile card) to post elsewhere, we generate a static picture from your data at that moment. Once you've downloaded or shared it, it's a copy you control like any other image — it doesn't update if the underlying data changes later, and we have no way to recall it from wherever you shared it.

Notifications and push

• If you enable push notifications, a push subscription for your device (a browser-issued endpoint and keys) and your browser's user-agent string.
• Your notification preferences (which kinds of activity you want to be notified about).

You can turn notifications off at any time, in the app or in your browser/device settings.

Location

• Approximate device location — only at the moment you use the "nearby courses" search, to find courses near you. We do not store your personal location.
• If you open the map to pick a location (for example setting up a course or an event), your browser loads map images directly from OpenStreetMap's servers — see "Who we share it with" below.

Analytics

If — and only if — you turn on optional analytics, we (via our analytics provider) record which pages and features you use and basic technical details such as browser type and approximate country. Until you turn it on, nothing is stored on your device, and we only ever see anonymous, daily-rotating counts that cannot be traced back to you or linked across days. Pages that could carry a sign-in or invite link (which can contain a one-time token) have that part of the address removed before it's ever recorded, however you've set your analytics preference.

Cookies and local storage

Essential cookies and local storage needed to keep you signed in and run the app. See our Cookie Policy for the full list, including what optional analytics cookies are set if you turn that feature on.

Device & technical data

• Your IP address, which we use to prevent abuse, for example by limiting repeated attempts to use an invite link. Where we record it for that purpose, we delete it after 2 days. Our hosting provider also processes it to deliver the service, under its own standard logging.

4. Where your data comes from

Most data comes directly from you or is generated as you use CIAGA. In some cases another member may add you to the app before you join — for example by adding you to a round or inviting you — creating a "managed profile" that holds your name and, if provided, your email address so we can invite you and attribute your golf results.

5. How and why we use your data (and our lawful bases)

Where we rely on legitimate interests, you have the right to object (see section 12). Where we rely on consent, you can withdraw it at any time without affecting earlier processing.

6. Fantasy picks and money records

• Fantasy predictions and the associated virtual points ledger. These points have no monetary value and cannot be exchanged for money or prizes.
• Society bookkeeping entries — amounts you are recorded as owing or being owed within a group (for example green fees or prize-pot entries). CIAGA is a record-keeping tool only: it does not take payments, hold funds, or move money between members. See our Terms of Use.

7. Moderation, reports and appeals

If you report a post, comment, story, automatic card (such as a round or a result), someone’s profile photo or a group’s picture, we record the report, the reason you gave, and who reported it. Who reported something is never shown to the person reported.

Reported content is hidden straight away. While we build out moderation, anything that's reported is hidden from everyone until an admin has reviewed it. The only exception is content an admin has already reviewed and cleared. If it's your content, we tell you it's under review. You can see it, and appeal, under Settings → Safety → Reported content in the app. You can't delete content while it's under review, because the review needs it.

Profile photos and group pictures. A reported photo is taken down everywhere it appears, including older feed cards, and moved to private storage. While it’s there, only the admins reviewing it and its owner can see it. For a profile photo the owner is you. For a group picture it’s the group’s owners and admins. If it’s put back, it reappears everywhere. If it’s removed, we keep the private copy for 30 days after that decision, or longer while an appeal is open, and then delete it. You can choose a new photo at any time, including while the old one is under review.

An admin then either removes it or puts it back. We tell you what we decided and why, unless doing so would be unlawful or put someone at risk. If you think we got it wrong, you can appeal in the app, or as described in our Acceptable Use Policy. We keep the appeal, what you wrote in it, and the outcome. We also keep a record of every moderation decision, so there's an audit trail if a decision is questioned later.

8. Who we share it with

Your golf and social activity is, by design, visible to other members according to your account's and your groups' privacy settings described above (for example on leaderboards, the feed and points-based standings). We do not sell your personal data or use it for advertising.

We use the following organisations to help us run the service. Most act as our processor, handling data only on our instructions; a few (noted below) receive limited data directly from your browser rather than from us:

Map images. When you open the map to pick a location, your browser loads the map images directly from the OpenStreetMap Foundation's servers, not from us. They receive your IP address and handle it under their own privacy policy. Map data © OpenStreetMap contributors.

We may also disclose data where required by law, or to establish, exercise or defend legal claims.

9. International transfers

Some of our providers are based in, or transfer data to, countries outside the UK (including the United States). Where that happens we rely on appropriate safeguards recognised under UK law — such as the UK International Data Transfer Agreement or Addendum, or a UK adequacy decision — to protect your data.

10. How long we keep it

We keep most personal data for as long as you have an account, and afterwards only as long as needed for the purposes described here or to meet legal obligations. Because CIAGA records shared competitions, some data is retained after you leave — see section 11. Some data has a shorter, fixed retention period regardless of your account status:

11. What happens when you delete your account

You can delete your account at any time from your profile screen, or by emailing us. Our approach is to store the minimum information possible while keeping shared records intact for the other members who rely on them. When you delete your account:

• We permanently delete your sign-in account and email address, your profile photo (except one that’s under review or appeal when you delete your account: we keep that privately until the review and any appeal are finished, and for at least 30 days after it was hidden, then delete it, and it is never put back on your profile), your device push subscriptions, your calendar/availability data, your follows and follow requests, the courses you follow, any blocks or mutes you set, any "not interested" signals you've given, invitations you sent, your notifications, your own stories (including the photo files, except a story under review or appeal, which is deleted once that's resolved), and your view history of other people's posts and stories. Reports you filed are kept, but with your name removed, so that moderation decisions stay explainable.
• We keep the records that are shared with other members — your scores, handicap history, group standings, society bookkeeping entries, fantasy predictions, and the posts, comments and reactions you shared in a group — because deleting them would damage other people's rounds, leaderboards and shared history.
• On those retained records we shorten your name to an abbreviated form (for example, "James Ware" becomes "J.Ware") and detach the records from your account. Deleting whole rounds, removing you from other members' scorecards, or erasing shared feed cards would break those shared records, so we do not do that automatically.

Because a shortened form of your name is retained, this is data minimisation rather than complete anonymisation. We retain these records on the basis of our and other members' legitimate interests in the integrity of shared rounds, leaderboards, seasons and who-owed-what records. If you would like us to go further in a particular case, contact us at privacy@ciagagolf.com and we will consider your request.

12. Your rights

Under UK data protection law you have the right to:

• be informed about how we use your data (this policy);
• access a copy of your data;
• rectify inaccurate or incomplete data;
• erase your data (subject to section 11);
• restrict or object to certain processing — including objecting to feed ranking or suggestions, which run on legitimate interests (you can also achieve this directly, without contacting us, via a private account and the "Suggest my posts" setting);
• data portability — receive your data in a machine-readable format;
• withdraw consent at any time, for anything we rely on consent for (such as analytics or push notifications), without affecting processing already carried out.

You can exercise the main rights yourself in the app: use Download my data and Delete account on your profile screen. For anything else, email privacy@ciagagolf.com. We will respond within one month. There is normally no charge.

13. Children

CIAGA is not intended for children. You must be at least 18 years old to hold an account. If you believe a child has provided us with personal data, contact us and we will remove it.

14. Security

We use appropriate technical and organisational measures to protect your data, including encrypted transport, access controls and a managed authentication provider. No online service can be completely secure, but we work to protect your data and will notify you and the ICO of a serious breach where the law requires.

15. Changes to this policy

We may update this policy from time to time, including to describe a new feature or a new service provider. We will always update the "last updated" date above, and for significant changes — for example a change to who can see your data by default, or a new use of your data — we use in-app notices to tell existing members directly, as we did when accounts defaulted to public and feed suggestions were introduced.

16. Complaints

If you have a concern about how we handle your personal data, please contact us first at privacy@ciagagolf.com. We will acknowledge your complaint within 30 days, look into it, and tell you the outcome without undue delay. You also have the right to complain to the Information Commissioner's Office (ICO), the UK supervisory authority, at https://ico.org.uk or on 0303 123 1113.