Golf Handicap — Privacy Policy
Golf Handicap runs entirely in your browser. This page sets out exactly what data exists, where it goes, and who can see it.
What the App Stores
Only what you type in: golfer names, course names with their tee ratings, and for each round its date, score, course, tees, whether it was nine holes or eighteen, conditions adjustment and note — plus your settings (the league rule, which figure is shown first, the theme, which tab you had open and which competition format the course-handicap tables are set to). There is no account, no profile, and no usage tracking of any kind. Nothing is required to use the app.
Where That Data Lives
In your browser (always). Everything is stored in your browser's local storage on your own device. If you never sign in, this is the only copy that exists — none of your data is ever transmitted anywhere. (Signed in, the browser also keeps the copy it last synced, beside your rounds, so changes made on two devices can be combined rather than one replacing the other. It is never sent anywhere new, and "Delete all data" deletes it too.) Clearing the site's browser data deletes it, which is why the app offers a JSON backup you can keep yourself.
A copy of the app itself, so it opens offline. The page, its stylesheet and its icon are kept on your device — the same public files anyone can read on GitHub, and nothing else. Your rounds are never put there, nor is anything that arrives from sync. Clearing the site's browser data removes it along with everything else.
Google sign-in / Firestore (optional, off until you choose it). If you tap “Sign In to Sync”, your rounds are stored in a Firebase/Firestore database operated by the developer so the same data appears on your other devices, and Firebase Authentication records your Google account's email address and display name. Security rules confine every account to its own document — no other signed-in user can read yours. This only ever happens if you sign in; the app never does it on its own.
Backups you download. “Download backup” writes a JSON file straight to your device. It is never uploaded, and where it goes afterwards is entirely up to you. Note that it contains everything the app holds, in plain readable text.
Read-only links you create (optional). “Share” builds a link
containing the golfers you pick, their rounds, the courses those rounds were played on,
and the league rule they were worked out with. That data is packed into the link
itself, after the # — the part of a web address a browser never sends to
any server. Nothing is uploaded, and nobody but the person you send it to can see it.
Nothing identifying travels: no email address, no account, not even your theme. A link is
a frozen snapshot and cannot be withdrawn once sent, so treat it like
emailing a spreadsheet. Opening someone else's link never alters the data saved in your
own browser.
What Is Never Collected
- No analytics, no advertising, no third-party trackers, no cookies for tracking.
- No location data — a course is just a name and some numbers you typed.
- No contacts, no photos, no device identifiers.
- Nothing is sold or shared with anyone, in any circumstances.
Third Parties
Your rounds reach Google Firebase (Authentication and Firestore) if, and only if, you sign in. Their handling of that data is covered by Firebase's privacy documentation.
Google's code is fetched only when you ask for it. Nothing of
Google's loads on an ordinary visit: open the app, log a round, close it, and your browser
never speaks to Google at all. The Firebase and sign-in scripts come from
www.gstatic.com and accounts.google.com the moment you reach for
the "Sign In to Sync" button — pointer, keyboard or press — and not before.
There is one exception, and it is the only way this can work: if you are already signed in on this device, the app loads Firebase as the page opens, because asking Firebase whether your session is still good is the only way to find out. It knows to do that from a note kept in your own browser and rewritten every time your sign-in state changes — so signing out stops the requests too, not just the syncing. A browser that has signed in at some point but has no such note yet gets one page load that asks, once, and then settles.
When those requests do happen they tell Google your IP address, your browser's user-agent and which page asked — the ordinary information any request to any server carries. None of your rounds goes with them. Until August 22, 2026 this code loaded on every visit and this page said otherwise, which was wrong; the app was changed rather than the sentence softened.
The page itself is served by GitHub Pages, which — like any web host — sees the same ordinary request information involved in serving a page.
Deleting Your Data
Signed out: clear this site's data in your browser, and it is gone. Signed in: sign in, remove the golfers you want removed, and the change is pushed to the stored copy. To have the whole stored document deleted, email eagleadams86@gmail.com from the Google account you signed in with, and it will be removed.
Children
The app is not directed at children under 13 and collects nothing that would identify one. Google sign-in is subject to Google's own age requirements.
Changes
If what the app stores or where it sends it ever changes, this page and its effective date change in the same release.