How FootWedge uses personal data

Who is responsible for your data

FootWedge is the controller for the personal data described in this notice for the FootWedge website and app at footwedge.co.uk.

Contact: privacy@footwedge.co.uk

What we collect

• Account information such as username, display name, email address, password hash, email-verification state, handicap estimate, home club, and account settings.
• Golf activity such as rounds, hole-by-hole scoring, statistics, handicap estimate entries, achievements, friendships, rivalry-related data, private manually marked course check-offs, live-round sharing records, and related in-app notification records.
• Range and replay data such as saved range-session details, saved key-shot metadata, replay-export references, and related practice notes where those features are available.
• RoundCast data, including tee, shot, putt and GPS points. Live tracking records are temporary; RoundCast paths saved with a round remain part of your golf record.
• Location data from your browser or device when you choose to use location-based features such as nearby course search, Range positioning, RoundCast, or similar map-led features.
• Public-content submissions such as blog comments, comment moderation records, course edit requests, and related contact details.
• Technical and security data such as sign-in session data, consent preferences, admin audit information, anti-abuse records, and server-side error logs.
• If you enable device notifications, push-subscription data such as the browser endpoint, cryptographic subscription keys, device label, user agent, and delivery status metadata for that device.
• Operational email records such as verification emails, password-reset emails, friend-request emails, and related delivery or failure logs.
• Support correspondence sent to FootWedge, including sender and recipient details, message content, safe attachments, delivery state, and any exact association with a course record.
• If you choose to receive them, direct-marketing records for account holders and email-only mailing-list subscribers, including your email address, consent source and timestamps, confirmation state, and hashed confirmation or unsubscribe tokens.
• If you register interest in Android beta testing, the Google account email you submit and the time of your request. The address is encrypted at rest, available only through authenticated administration, omitted from alert emails and application logs, kept separate from marketing consent, and used only to arrange and support testing.
• Aggregate daily site-visit totals, counted once per active browsing session without storing the visitor's IP address, user agent, page history, or a visitor profile.
• If you allow analytics cookies, aggregate FootWedge engagement counters and limited Google Analytics 4 measurement for page use and key product journeys such as scroll completion, course discovery, account access, completed rounds and campaign-level returns from FootWedge email links.
• If you submit an advertising enquiry, the selected placement, contact name, organisation, email address, optional telephone number, message, status and timestamps.
• If you allow analytics, limited first-party advertising measurement such as advert, placement and page identifiers with pseudonymous hashed session or user-agent values. Contextual adverts themselves do not require advertising cookies.
• Device-side storage used by the app, described in the Cookie Notice.

Why we use it

Where we rely on legitimate interests, those interests are generally keeping the service secure, preventing misuse, running the app effectively, handling support, and maintaining a usable social golf record for the features you choose to use.

Who we share data with

• Accepted friends inside FootWedge can see social activity, live-round sharing you choose to enable, RoundCast information shared during a live round, and round details made available through the friends features.
• Accepted friends may trigger in-app alerts for you, such as friend requests, accepted requests, or live-round alerts, if you leave those notifications enabled in settings.
• Public visitors and search engines can see public course pages, public blog posts, and any approved blog comments you choose to publish. Approved comments can show your display-name snapshot, comment text, and comment date publicly.
• Hosting, infrastructure, and database providers acting on our instructions.
• Email providers used to send operational messages, friend-request emails, admin-approved user communications, optional marketing emails you have agreed to receive, and course edit request notifications.
• The mailbox and email-delivery providers used to receive and send support correspondence.
• Browser push services operated by the browser or platform vendor when you enable device notifications.
• Map, geolocation, or tile providers used to render map-based features when you choose to use them, such as Mapbox, OpenStreetMap-linked tile services, ArcGIS, or your browser/device geolocation provider.
• WeatherAPI receives rounded course or requested coordinates when FootWedge retrieves weather. Requests are made by our server, and the WeatherAPI key is never sent to your browser.
• YouTube may receive technical request information when you load an embedded video in a FootWedge blog article. Embeds use YouTube's privacy-enhanced no-cookie domain.
• Google, if you allow optional analytics measurement through the cookie controls.
• An advertiser receives the normal technical request made by your browser only if you choose to follow its clearly labelled external link. FootWedge does not load third-party ad-technology scripts.
• Professional advisers, regulators, law enforcement, or courts where disclosure is legally required or reasonably necessary.

FootWedge does not sell your personal data. If the service model changes in future, this notice would need to be updated before that change takes effect.

Where the data comes from

• Most account and golf-record data comes directly from you when you register, edit your profile, log rounds, update settings, or submit requests.
• Location data comes from your device or browser only if you grant that permission for a feature that needs it.
• Social data such as friendships and live activity is created when you or another FootWedge user interacts with the social features.
• Public comment display names are taken from your account details at the time the comment is posted and stored as a snapshot with that comment.
• Technical and security data comes from your browser, device, and web requests when you use the site.
• Marketing-preference data comes from the choices you make at registration or later in account settings.
• Support correspondence and attachments come from people who email FootWedge or reply to a support conversation. A conversation is associated with a course automatically only where its validated contact address exactly matches the course contact email, or when an administrator links it manually.

International transfers

If a service provider used by FootWedge processes data outside the UK, transfers should only take place with an appropriate lawful safeguard, such as adequacy regulations or approved contractual protections. Depending on the feature you use, this can include providers involved in analytics, weather, embedded video, map delivery, push services, or email delivery.

How long we keep data

• Account data is normally kept while the account remains active and for a reasonable period afterward where needed for security, fraud prevention, or legal obligations.
• Rounds, scoring records, profile history, and saved range-session records are kept as part of the service until removed, corrected, or the account is deleted, subject to any lawful retention needs. Saved Range sessions and shot metadata are included in your data export. Account deletion removes saved replay files; unreferenced temporary replay files older than 24 hours are removed by the next successful retention cleanup. Hosting backups follow the backup operator's retention process.
• Temporary live RoundCast tracking is normally deleted when a round is submitted, abandoned, or expires after 24 hours. RoundCast paths saved with a round are retained with your golf record, included in your data export, and removed when your account is deleted. Contact us if you want a saved path removed separately.
• In-app notification records are deleted when you open them, can be cleared manually, and are otherwise normally kept for up to 180 days before automated removal.
• Push-device registrations are normally kept until you disable the device, remove the subscription, or the device has been inactive for up to 12 months.
• Ad impression and click logs are normally kept for up to 90 days in pseudonymous form unless a longer period is needed for fraud, abuse, or reporting integrity.
• Admin audit logs, operational logs, and request records are normally kept for up to 90 days, unless a longer period is needed for a live incident, abuse investigation, or legal obligation.
• Approved blog comments are normally kept while the related article remains live, unless they are edited, moderated, removed, or the site has another lawful reason to retain a minimal record.
• Confirmed marketing-contact records are kept until you unsubscribe or withdraw consent. Pending confirmation tokens expire after 48 hours; a minimal unsubscribed record may be retained to honour the opt-out.
• Android beta interest records are kept for up to 12 months after the latest activity, or removed sooner if you ask us to delete your application.
• Open advertising enquiries are retained while the enquiry is active. Closed and spam enquiries are automatically deleted 24 months after their last update.
• Active support conversations are retained while support is ongoing. Resolved and spam conversations, including stored attachments, are automatically deleted 24 months after their last activity. Privacy-safe mailbox synchronisation summaries are kept for 90 days.

Public pages and search engines

Public course pages, blogs, and other public website content can be indexed by search engines. A golfer profile set to Public remains visible to anyone with its link and can show the account's display name, username, home club, member-since date, handicap snapshot, golf record, recent completed rounds, achievement count, friend count, and In the Bag. Email addresses and account-security details are never part of the public profile.

All golfer profile pages are marked noindex and excluded from FootWedge's sitemap, including profiles whose visibility is Public. You can still share your profile link directly. Public, Friends only, and Private continue to control who can view the page; search engines may retain an older copy from before this policy changed while they recrawl it.

When you must provide data

Basic account details such as username, display name, email address, and password are needed to create and secure your account. If you do not provide them, FootWedge cannot create the service you are asking for. Optional profile and golf-history fields can be left blank unless a page marks them as required for that specific action.

How we protect data

• Passwords are stored using secure password hashing rather than plain text.
• Sessions and form submissions use security controls such as CSRF protection, HTTP-only cookies, and server-side access checks.
• Access to admin tools and protected user pages is restricted through server-side permissions and authentication checks.
• Admin actions are logged for accountability, and sensitive configuration should be kept outside public files.

No online system is risk-free, but FootWedge is intended to use proportionate technical and organisational measures appropriate to the current service.

Your rights

• Access the personal data we hold about you.
• Ask for incorrect data to be corrected.
• Ask for deletion in appropriate circumstances.
• Ask us to restrict processing in appropriate circumstances.
• Object where we rely on legitimate interests.
• Receive portable data where the law gives that right.
• Withdraw consent for optional cookies, similar technologies, and optional marketing emails at any time.
• Opt out of direct marketing at any time. If you object to direct marketing, FootWedge must stop using your personal data for that purpose.

You can contact privacy@footwedge.co.uk to exercise your rights. You also have the right to complain to the UK Information Commissioner's Office.

Automated decision-making

FootWedge is not intended to use solely automated decision-making or profiling that produces legal or similarly significant effects on users in this build. Some automated rules may still be used for spam filtering, rate limiting, abuse prevention, analytics controls, or ad-serving controls, but not for decisions of that significance.

Children's data

FootWedge supports junior golfers with age-group privacy controls. Under-13 requests collect a nickname and parent contact first; email confirmation alone does not activate an account. Activation requires parental verification and completion of the junior-release assessments. We store age categories, the source of the age classification, linked-parent approvals, friendship permissions, safety reports and reviewed age corrections. Existing accounts were classified as adults on the operator's personal attestation, not independent age verification. See our Junior and parent privacy information for controls, parental access and retention.

Cookies and similar technologies

FootWedge uses cookies and related browser storage for secure sessions, consent management, optional settings, PWA functionality and optional analytics measurement. Contextual first-party adverts do not require advertising cookies. Read the full Cookie Notice for the detailed list and control options.

Changes to this notice

We may update this notice from time to time when the service, legal requirements, or data uses change. The latest version will always be published on this page, and material changes should be brought to users' attention in an appropriate way.