Privacy Policy

This policy describes how Settle the Card LLC (“we,” “us”) handles information when you use Settle the Card (“the app,” served as a website and installable web app at settlethecard.golf). The app is a golf score and round-tracking tool for social use. We do not collect, hold, or transfer money between players for on-course games or settlements. Optional Pro purchases are processed separately by Stripe (see below).

Local-only use (default)

When you use the app in local-only mode (the default), player names, scores, course details, game settings, and related round data are stored in your browser (for example via local storage) so the app can work offline and remember your round. We do not send that local round data to our own servers.

Fairway Sync (optional cloud rounds)

If you turn on Fairway Sync (host, follow, or play along), the app stores shared round data in a Supabase database we operate so devices in the same game can stay in sync. You do not need a sign-in account for Fairway Sync; devices join with a game code.

Data we store for an active cloud game can include:

• A short game code and per-device slot assignment
• A random device identifier generated in your browser and used to prevent one phone from overwriting another’s row
• Player names, handicaps, tee selections, hole-by-hole scores, and related game markers (for example junk dots) for the players that device is scoring
• Game configuration from the host (course name, game types, amounts configured in the app, drink holes, and similar setup metadata)
• Technical timestamps and a revision counter for sync

Anyone who knows the game code can read rows for that game (the app is designed for a shared foursome, not private medical or financial records). Cloud game rows are automatically deleted when they have had no updates for about 12 hours. Supabase may also process standard request metadata (such as IP address) when your browser talks to their service. See the Supabase Privacy Policy.

Accounts, Pro, and payments

Signing in is optional and is used mainly to unlock and sync Pro across devices after purchase.

• Google sign-in (via Supabase Auth): If you choose Continue with Google on the Pro upgrade screen, Google authenticates you and Supabase creates or updates an account for you. We typically receive your Google account email address, a stable user id, and basic profile fields Google shares with the app (such as name and avatar URL, depending on your Google settings). Google’s Privacy Policy applies to that sign-in flow.
• Entitlements in Supabase: For signed-in users we store a row in stc_user_entitlements with your user id, whether your tier is free or Pro (plus in the database), an optional expiry for time-limited Pro, and optionally a Stripe customer id linked to your purchase. The browser can read your own row when you are signed in; it cannot change it directly.
• Stripe Checkout: Pro is sold through Stripe Checkout. When you pay, you are redirected to Stripe’s hosted payment page. Payment card and billing details are collected and processed by Stripe, not by us. We do not store full card numbers on our servers. Our backend (hosted on Vercel) creates a Checkout Session after verifying your Supabase sign-in token, and Stripe notifies us via signed webhooks (and an optional return-url claim step) when a purchase succeeds so we can update your Pro entitlement. Stripe receives purchase amounts, payment method details, and related fraud-prevention data under its own policies. See the Stripe Privacy Policy.
• Session tokens: After Google sign-in, Supabase issues access tokens stored in your browser (local storage) so the app can confirm who you are for Pro sync and checkout. Sign out clears that session from the device.

What we do not sell

We do not sell your personal information.

Other third-party services

• Golf course search: When you use optional course search, your browser sends the search text to a proxy API we run on Vercel. That proxy forwards the request to a third-party golf data provider using a server-side credential, so the API key is not embedded in the public app. The proxy and the upstream provider each receive standard technical data for that request (such as IP address and search terms). The upstream provider’s own terms and privacy notices govern their use of that data.
• Hosting and APIs: The static app is served from our web host; serverless routes on Vercel handle golf search proxying, Stripe checkout, entitlement claims, and Stripe webhooks. Vercel and similar infrastructure providers may log IP addresses, request paths, and error diagnostics.
• Supabase client library: The app loads the Supabase JavaScript client from jsDelivr (cdn.jsdelivr.net), which may receive standard CDN request metadata.
• Fonts and icons: The app may load assets (for example Google Fonts or Font Awesome from Cloudflare’s CDN) from third-party CDNs; those providers may receive standard technical data (such as IP address) typical of any web request.
• Google Tag Manager (GTM): We use GTM (container ID GTM-TQ2X79MQ) to load and manage measurement tags. Google’s terms and privacy notices apply to GTM and to any Google tags (such as Google Analytics) enabled in that container.

Advertising

We may display ads using Google AdSense and other Google advertising products. Google and its advertising partners may use cookies, mobile advertising IDs, and similar technologies to deliver and measure ads and, where allowed, to personalize content and ads based on your activity on this and other sites. Processing is subject to Google’s policies, including the Google Privacy Policy and How Google uses information from sites or apps that use our services.

Our AdSense publisher ID is ca-pub-7875512220906768. Depending on your location, you may see a consent message (for example for ads in the European Economic Area, the UK, or Switzerland) before certain cookies or personalized ads are used.

You can review or adjust some ad personalization choices through Google Ads Settings (when signed in to Google) and learn about industry opt-out tools at optout.aboutads.info where available.

Analytics

We use Google Tag Manager for usage analytics. The main app records anonymous click interactions (for example which tab and section you used and what control was tapped) as a custom stc_click event in the browser’s dataLayer for analysis in Google Analytics. What is ultimately stored depends on the tags enabled in our GTM container.

Your choices

• Stay in local-only mode if you do not want round data in Supabase.
• Sign out of Google / Supabase Auth in the app to remove the persisted auth session on that device.
• Use browser settings to clear local storage and site data (this removes local rounds, device ids, and sign-in tokens on that device).
• For Pro or account questions, or to request deletion of entitlement data tied to your sign-in, email us (see Contact).

Children

The app is not directed at children under 13. If you believe we have inadvertently collected information from a child, please email contact@settlethecard.golf and we will take appropriate steps.

Related policies

Our Terms of Service govern use of the app.

Changes

We may update this policy from time to time. The “Last updated” date will change when we do.

Contact

Settle the Card LLC
Email: contact@settlethecard.golf
Web: settlethecard.golf