Privacy

• MyGolfHoles is designed to collect only the information needed to run the service.
• Golfers don’t create a username and password. Instead, we verify your email address with a one-time link, so you can come back to and manage your golf selections.
• We do not sell personal information, and we don’t use advertising or cross-site tracking.
• Golf-hole rankings are produced from the combined selections of verified golfers. Your email address is never shown publicly.
• Privacy and security are built into the technical design: for example, we store one-way hashes of device credentials and of your network address rather than the originals.
• The main MyGolfHoles application and database are hosted in the United Kingdom.
• Some specialist service providers process limited information outside the UK. We explain exactly who, what and where below.

MyGolfHoles (mygolfholes.com) is operated by Nicholas Schutz, trading as MyGolfHoles. MyGolfHoles is run by Nicholas personally; it is not a limited company.

Nicholas Schutz is the “data controller” for the personal information described in this policy. That means he decides how and why it is used and is responsible for protecting it. In this policy, “we”, “us” and “our” mean Nicholas Schutz trading as MyGolfHoles.

Questions or requests about privacy: hello@mygolfholes.com

MyGolfHoles is built and hosted on Base44, an application platform that provides our web hosting, database, backend functions and related infrastructure. Base44 acts as our data processor: it processes information on our behalf and under our instructions, under its Data Processing Agreement.

The MyGolfHoles application has been set up to use Base44’s UK data-residency environment. This means the primary application data, including the database records described in this policy, is stored in the United Kingdom.

UK data residency is precise but limited in scope. It does not mean that every supplier, or every supporting operation across the whole service, happens only in the UK. For example, Base44 itself is a US-based business, its own account and billing systems are US-based, and the specialist providers described later (Resend and OpenAI in particular) process certain information in the United States.

Base44 states that it encrypts data in transit using TLS 1.2 or higher and at rest using AES-256, that it is independently certified to ISO 27001 and audited for SOC 2 Type II, that it is penetration-tested, and that it provides built-in security scanning for apps. You can read more on Base44’s Security page, its Privacy Policy and its Data Processing Agreement, and in its privacy and security documentation.

This is the complete list of personal information MyGolfHoles handles. There are no public usernames, profiles, photos or passwords for golfers, and we don’t use browser fingerprinting.

Golf venues, courses, holes, pars and course locations are public golf information, not information about you.

If you email us (for example to send photos or a video link), we receive your email address and whatever you include in the message. We use it to reply and to consider the media for publication. If we publish media, we show the credit you asked for.

Site administrators sign in with a separate Base44 account. That covers only the people who run MyGolfHoles, not golfers.

MyGolfHoles doesn’t use a normal username-and-password account for golfers. Instead:

• When you save holes, or want to view My Holes on a new device, you enter your email address.
• We email you a one-time verification link. We keep only a hash of the secret part of the link. It works once and expires after 30 minutes.
• When you open the link, your holes are published to the community totals and the device is remembered as a trusted device for your golfer identity.
• On another device, verifying the same email lets you see and manage the same selections. Because we recognise the same email, you still count as one golfer per course.

Your email address is needed because it is the one thing that lets you prove who you are and come back to your selections without a password. Temporary verification records are deleted automatically around 24 hours after they were last used.

To prevent abuse, verification emails, failed attempts and other requests are rate-limited, and a pending verification can be locked after repeated failures. We don’t publish the exact limits, because that would make them easier to get around.

• Near Me is optional. You only use it if you choose the Near Me filter.
• Your browser or device asks your permission first. If you say no, Near Me simply doesn’t work and nothing else is affected.
• When allowed, your browser gives us an approximate position, which we round to about 100 metres before it leaves the page.
• That rounded position is sent securely to the MyGolfHoles backend (hosted in the UK) with your request, so the server can work out which courses are within your chosen distance, using the stored coordinates of each golf course.
• The position is used for that request only. It is not written to our database, not added to logs by our code, not saved in your browser’s storage or in the page address, and not attached to your golfer identity or selections. The page holds it in memory for up to 5 minutes, so you aren’t asked repeatedly, and forgets it when you close or reload the page.
• Your location is not sent to Geoapify or any other third party.

Geoapify is used for something else entirely: turning golf venues’ addresses and names into map coordinates (see “Service providers”).

• Private: your email, its hash, your golfer identity, your devices, your individual list of selections and Reasons, and security records. Only you (on a verified device) and the operator of MyGolfHoles can see these.
• Community totals: rankings, percentages, Top 18 and course and hole statistics are calculated from the combined selections of verified golfers. They never show email addresses or which golfer chose what.
• Shared My 18 links: if you share your My 18, anyone who has the link can see the holes in your My 18 as they were when you shared it, together with the current public community statistics for those holes. The page does not show your email address, device or identity. Anyone who gets hold of the link, including people it is forwarded to, may be able to view it. Shared pages are hidden from search engines.
• Public golf information: course and hole names, pars, locations and official website links are public information.

Bear in mind that on a course with very few golfers, a person who knows you have taken part could sometimes infer something from the totals. We reduce this by showing broader rankings only once enough golfers have contributed.

We use appropriate technical and organisational measures designed to reduce risk and protect personal information. No online service can be made completely secure, but these are the safeguards built into MyGolfHoles:

• UK hosting of the primary application and database with Base44.
• Encryption: HTTPS/TLS for all traffic, and encryption at rest provided by Base44.
• Hashing: device identifiers and credentials, verification and share-link tokens are stored only as one-way hashes; IP addresses are stored only as keyed hashes made with a server-side secret.
• Separation: public pages only ever receive combined totals and public golf information, never identity data.
• One-time, expiring links for verification.
• Trusted-device credentials held on your device, so verified devices can be recognised without a password.
• Rate limiting and automated abuse controls on verification, emails, searches and submissions.
• Restricted access: the database tables holding personal information can only be read through our own server-side code or by the site administrator.
• Secrets kept server-side: API keys and signing secrets are never sent to your browser.
• Security scanning tools provided by Base44.
• Data minimisation and automatic clean-up: we collect little, and an hourly job deletes expired temporary records.

If something did go wrong, we would act promptly and, where the law requires, tell the Information Commissioner’s Office and affected golfers.

We don’t sell personal information or share it with advertisers. These are the only providers that handle information for MyGolfHoles:

Course websites linked from MyGolfHoles are run by others; we don’t share your information with them.

Although the main MyGolfHoles application and database are in the UK, some information goes outside the UK:

• United States: Resend. Your email address and verification email. Resend relies on the Standard Contractual Clauses with the UK Addendum in its DPA, and also on the UK Extension to the EU-US Data Privacy Framework.
• United States: OpenAI. Course search text and course details. OpenAI’s DPA includes standard contractual transfer terms for UK data.
• United States: Base44. Any support or administrative access to our data from outside the UK is covered by Base44’s DPA.
• European Union: Geoapify. Only public venue addresses and names. The UK recognises the EU as giving adequate protection.

In simple terms, these contract terms legally commit each provider to protect UK personal information to UK standards, and give you rights you can enforce.

MyGolfHoles uses AI in two places, and only for golf course information:

• Course lookup (OpenAI): when someone searches for a course that isn’t already listed, the search text is sent to OpenAI, which uses web search to identify matching real courses and their details. A second check may send a found course’s name, address and hole count to confirm its layout. Please don’t type personal information into the course search.
• Hole pars (Base44’s AI tool): an occasional background job researches the par of holes using public web sources. It receives only course and hole details.

OpenAI states that it does not use data from its API platform to train its models by default. OpenAI says API data may be kept for up to 30 days to monitor for abuse, then deleted unless the law requires otherwise.

No AI makes any decision about you. Rankings, percentages, Top 18, My 18 and Near Me are ordinary calculations, not AI.

UK data protection law requires a legal reason for each use of personal information:

• Providing the service you ask for (performing our agreement with you): verifying your email, saving and showing your selections and Reasons, remembering trusted devices, creating Shared My 18 links you request and sending verification emails.
• Legitimate interests: keeping MyGolfHoles secure and free from spam, automated abuse and ranking manipulation (rate limits, hashed network addresses, counting each golfer once); producing fair community rankings from combined selections; and finding and adding real golf courses (course lookup logs and AI research). We have balanced these against your interests: the information is minimal, mostly hashed or short-lived, and never used for advertising.
• Consent: Near Me only works with location permission you give through your browser. You can withdraw it at any time in your browser or device settings.

• Email and golfer identity: kept while you keep selections with us, with no fixed end date, until you ask us to delete them.
• Golf selections and Reasons: kept until you change or remove them, or ask for deletion. When you change a selection, it replaces the previous one.
• Trusted devices: kept with your identity until deletion; clearing your browser storage removes the credential from that device.
• Pending verifications: links expire after 30 minutes; pending records (including any unverified email and proposed holes) are deleted around 24 hours after they were last used.
• Verification-email logs: deleted after about 24 hours.
• Security and rate-limit records: deleted automatically, typically between 10 minutes and 24 hours. The pseudonymised network address on a new device record is removed after about an hour.
• Course search text: removed from our logs after 48 hours. Short-lived search result references are deleted once they expire.
• Shared My 18 snapshots: kept until you ask us to disable the link or delete your information.
• Near Me location: not stored.
• Providers: Resend says it keeps email and log data for 30 days; OpenAI says it may keep API data for up to 30 days for abuse monitoring.

Your email, golfer identity, trusted devices, selections and Shared My 18 snapshots have no arbitrary expiry date while they are still needed to provide the service. We review this identity-linked information at least once a year. We delete or anonymise anything that is no longer reasonably needed for the service, for security, for legal obligations, or for you to be able to return to your golf selections.

The temporary clean-ups listed above run automatically every hour. When you ask for deletion, we remove your email, golfer identity, selections, Reasons, trusted devices, pending verifications and Shared My 18 links, and recalculate the community totals without you. Copies may briefly remain in our providers’ routine backups until they are overwritten, and short-lived security records expire on the schedule above.

Under UK data protection law you have rights over your personal information. Some depend on the circumstances and the lawful basis we rely on, so not every right applies in every case:

• Access: get a copy of the information we hold about you.
• Correction: have inaccurate information corrected.
• Deletion: ask us to delete your information.
• Restriction: ask us to limit how we use it.
• Objection: object to uses based on legitimate interests.
• Portability: receive information you gave us, for services we provide under our agreement with you, in a commonly used format.
• Withdrawing consent: for Near Me, at any time via your browser settings.

Email hello@mygolfholes.com, ideally from the address you verified with, so we can confirm the request is yours. We will respond within one month, and usually much sooner.

You can also complain to the Information Commissioner’s Office (ICO), the UK regulator: ico.org.uk/make-a-complaint. We would appreciate the chance to help first.

MyGolfHoles does not set its own cookies. It uses your browser’s storage as follows:

• mgh_device_v1 (local storage, strictly necessary): your random device identifier and credential, so a verified device can be recognised and security limits applied. It stays until you clear your browser storage.
• Brand splash flag (session storage, functional): remembers that the opening logo animation has played, so it isn’t shown again in the same tab. It is cleared when you close the tab.
• base44_analytics_session_id (local storage, technical): despite its name, this is not used for statistics. MyGolfHoles has switched off Base44’s site statistics. Base44’s software creates this random identifier automatically and sends it with requests from visitors who aren’t signed in, so the platform can tell those requests apart. It isn’t linked to your email or selections. It stays until you clear your browser storage.
• Administrator sign-in: if you are a MyGolfHoles administrator, Base44 stores a sign-in token in local storage. Golfers never sign in this way.

MyGolfHoles does not use advertising cookies, cross-site tracking, behavioural advertising, third-party analytics services or marketing pixels.

MyGolfHoles is a general-audience golf service and is not designed for or aimed at children. That does not change the protections UK data protection law gives children: if a child does use MyGolfHoles, their information is handled with the same care and safeguards described in this policy, and the same rights apply. If you are a parent or carer and think a child has given us their email address, contact hello@mygolfholes.com and we will delete their information.

We may update this policy as MyGolfHoles develops. We will change the “Last updated” date when we do and, for significant changes, give additional notice on the site where appropriate. Last updated: 21 October 2026.

Nicholas Schutz trading as MyGolfHoles
hello@mygolfholes.com