Privacy Policy

Last updated: June 2026

1. Controller

applico
Heiko Sudar
Pfarrer-Aigner-Str. 33
85567 Grafing b. München, Germany
Email: info@tournament-caddie.com

2. Overview

Tournament Caddie is a web application for managing golf tournaments. This privacy policy applies to www.tournament-caddie.com (marketing) and app.tournament-caddie.com (application).

3. Hosting

3.1 Vercel

Our websites are hosted by Vercel Inc., 340 S Lemon Ave #4133, Walnut, CA 91789, USA. Each page request transmits technically necessary data (IP address, timestamp, requested URL, browser type) to Vercel servers. Vercel processes this data based on legitimate interests (Art. 6(1)(f) GDPR).

Vercel is certified under the EU-U.S. Data Privacy Framework.

More: https://vercel.com/legal/privacy-policy

3.2 Neon (Database)

Our database is operated by Neon Inc. in the EU region (Frankfurt). Stored data does not leave the European Economic Area.

More: https://neon.tech/privacy

4. Web Analytics

4.1 Plausible Analytics

We use Plausible Analytics to analyze usage of our websites. Plausible is a privacy-friendly analytics tool that:

Sets no cookies
Stores no personal data
Does not process or store IP addresses
Is fully operated on EU servers (Hetzner, Germany)

Processing is based on legitimate interests (Art. 6(1)(f) GDPR). No consent is required as no cookies or personal data are processed.

More: https://plausible.io/data-policy

5. User Account

5.1 Registration

During registration we collect:

Name
Email address
Password (stored only as hash, bcrypt)

Processing is necessary for contract performance (Art. 6(1)(b) GDPR).

5.2 Email Verification

After registration, we send a confirmation email with a verification link. The account is activated only after confirmation.

5.3 Password Reset

When resetting a password, a time-limited token (1 hour) is generated and sent by email.

5.4 Account Deletion

You can delete your account at any time under Profile → Delete Account. All tournaments, players and scorecards are permanently deleted. Payment records are anonymized and retained for legal reasons (§ 147 AO, 10 years).

6. Tournament Data

6.1 Player Data

Tournament organizers enter the following data when adding players:

First name, last name
Email address
Handicap index
Gender (for mixed tournaments)

This data is processed for tournament execution (Art. 6(1)(b) GDPR). The tournament organizer is responsible for obtaining consent from their participants.

6.2 Score Data

Players enter their scores (strokes, putts) via a personal QR code link. Scores are linked to the player profile and displayed on the leaderboard.

6.3 Public Leaderboards

Leaderboards are publicly accessible via a direct link. They display player names, handicap and tournament results.

7. Email

7.1 Resend

We use Resend (Resend Inc., USA) for email delivery. The following emails are sent:

Registration confirmation (verification link)
Password reset
QR code links to tournament participants (on behalf of the organizer)

QR code emails are sent in the name of the tournament organizer (sender: "[Name] via Tournament Caddie"), with reply-to set to the organizer's email address.

Resend is certified under the EU-U.S. Data Privacy Framework.

More: https://resend.com/legal/privacy-policy

8. Push Notifications

Tournament organizers can enable push notifications for their tournament. Players decide for themselves whether to receive notifications (opt-in via browser).

When activated, a Web Push subscription (endpoint URL + encryption keys) is stored in our database. No personal data is transmitted to third parties — delivery uses the standard Web Push protocol of the respective browser vendor (Google, Apple, Mozilla).

Players can disable notifications at any time.

9. Offline Storage & PWA

9.1 Service Worker

Our app uses a service worker for offline functionality. Visited pages and static assets are stored in the browser cache (Cache Storage API). This data does not leave the device.

9.2 IndexedDB

If there is no internet connection when submitting a score, the score is stored locally in IndexedDB and automatically synchronized when connectivity is restored. The data is deleted after successful synchronization.

10. Payments

10.1 Lemon Squeezy

Payments are processed through Lemon Squeezy (Lemon Squeezy LLC, USA) as Merchant of Record. Lemon Squeezy independently processes payment data (credit card, PayPal, etc.) — we do not store any payment data. We only receive confirmations of completed payments (order number, amount, status).

More: https://www.lemonsqueezy.com/privacy

10.2 Retention

Payment records are retained in accordance with statutory retention periods (§ 147 AO) for 10 years. When a user account is deleted, records are anonymized (name and email removed) while payment information is retained.

11. Cookies

Our application uses only:

Session cookie (admin_token): JWT token for tournament organizer authentication. Expires after 7 days. Technically necessary (Art. 6(1)(f) GDPR).

We do not use marketing or tracking cookies. Plausible Analytics operates entirely without cookies.

12. Your Rights

You have the right to:

Access your stored data (Art. 15 GDPR)
Rectification of inaccurate data (Art. 16 GDPR)
Erasure of your data (Art. 17 GDPR)
Restriction of processing (Art. 18 GDPR)
Data portability (Art. 20 GDPR)
Object to processing (Art. 21 GDPR)

Please direct requests to: info@tournament-caddie.com

13. Right to Complain

You have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for us is:

Bayerisches Landesamt für Datenschutzaufsicht (BayLDA) Promenade 18, 91522 Ansbach, Germany https://www.lda.bayern.de

14. Changes

We reserve the right to update this privacy policy as needed. The current version is always available at www.tournament-caddie.com/privacy.