Mini Golf Scoring ("we", "us") provides digital scorecards for mini golf venues: a management dashboard for venue operators at manage.minigolfscoring.com, a player-facing scoring app at play.minigolfscoring.com, and this website. This policy explains what personal information we collect through those services, why, and the choices you have. We handle personal information in line with the Australian Privacy Act 1988 and, where they apply to you, the UK and EU General Data Protection Regulations.
Who this covers
We deal with two kinds of people:
- Venue operators — people who create an account to run one or more venues, and the team members they invite.
- Players — people who scan a venue's QR code and keep score. Players do not create accounts.
What we collect
From venue operators and team members
- Account details: your email address, a hashed password (we never store the password itself), and an optional name.
- Venue data: venue and course names, hole pars, and the settings you configure.
- Billing details: your subscription status, invoices and a reference to your Stripe customer record. Card details are entered directly with Stripe and never reach our servers.
- Session details: when you sign in we record the time, your IP address and browser type so you can see where your account is signed in and sign out other devices.
- Support messages you send us by email.
From players
- Round data: the player names typed into the scorecard, the strokes recorded on each hole, and when the round was played. Names are whatever the group chooses to type — a first name or nickname is all that is needed.
- An anonymous session: a cookie that ties the phone to the round in progress so a refresh does not lose the scorecard. It contains no personal information.
We do not knowingly collect personal information from children under 13 beyond the name a group types onto a scorecard; a parent or guardian who would like a name removed can contact us at the address below and we will remove it.
Automatically
- Server logs record requests to our services, including IP address, browser type and the pages requested, kept for troubleshooting and security.
- Error reports: when something breaks we receive a technical report (via Sentry) describing the error and the page it occurred on. These may include your IP address and browser details.
- Analytics on this website: minigolfscoring.com uses Google Analytics and Google Ads conversion tracking to understand how visitors find us. The manage and player apps use Google Ads conversion tracking only. You can opt out with the Google Analytics opt-out add-on or by blocking third-party scripts.
How we use it
- To provide the service: run scorecards and leaderboards, show operators their rounds and dashboards, and bill subscriptions.
- To communicate with operators: account emails (welcome, email confirmation, password resets, team invites), billing emails (trial reminders, failed payments, cancellations), and a monthly summary of activity at their venues.
- To keep the service secure: detecting abuse, rate-limiting sign-in attempts, and investigating errors.
- To improve the product, using aggregated usage statistics.
We do not sell personal information, and we do not use players' names or scores for advertising.
Our legal bases (UK/EU)
Where the GDPR applies, we process account and billing data to perform our contract with you; round data on behalf of the venue operator, who is the controller of their players' data (we are their processor); security, error reporting and analytics under our legitimate interest in running a reliable service; and marketing emails only with your consent, which you can withdraw at any time.
Who we share it with
We use a small number of providers to run the service. Each only receives what it needs to do its job:
| Provider | Purpose | What they receive |
|---|---|---|
| Stripe | Payments and subscriptions | Operator email, billing address, card details (entered directly with Stripe) |
| Resend | Sending email | Recipient email address and the message content |
| Cloudflare | Hosting the web apps and network security | Request data, IP addresses |
| Railway | Hosting the API and database | All service data, encrypted at rest |
| Sentry | Error reporting | Technical error details, IP address, browser |
| Google (Analytics, Ads) | Website analytics and ad conversion tracking | Usage data, cookies |
We also share information when the law requires it, to protect our rights or the safety of others, or with a successor if the business is sold — in which case this policy continues to apply.
Venue operators can see the names and scores of players who play at their venues, and team members they invite can see the same venue data they can.
Where it is stored
Our database and API run in Singapore; our web apps are served from Cloudflare's global network; email, payments and error reporting providers operate in the United States and Europe. When information leaves your country we rely on our providers' standard contractual protections.
How long we keep it
- Account and venue data: while your account exists, then deleted when you delete your account.
- Round data: kept with the venue so operators have their history; deleted with the venue or the operator's account. Operators can ask us to remove a particular player's name.
- Billing records: kept for seven years as required by Australian tax law, even after account deletion.
- Sessions: expire after 30 days and are then removed.
- Logs and error reports: up to 90 days.
Your choices and rights
Operators can, from the Account page of the manage app:
- Download everything we hold about the account as a JSON file, and each course's rounds as CSV.
- Correct their email address and profile.
- Delete the account, which removes the operator's venues, courses and rounds and cancels any subscription.
Everyone — including players — can ask us to access, correct or delete personal information about them, object to or restrict processing, or complain, by emailing [email protected]. We respond within 30 days. If you are in Australia you may also complain to the Office of the Australian Information Commissioner; in the UK, the Information Commissioner's Office; in the EU, your local supervisory authority.
Cookies
We use a small number of cookies:
| Cookie | Where | Purpose | Lasts |
|---|---|---|---|
mgs_session | manage and player apps | Keeps you signed in / ties a phone to its round (essential) | 30 days |
Google Analytics / Ads (_ga, _gcl_*) | this website; Ads tag on the apps | Analytics and conversion measurement | Up to 2 years |
The session cookie is required for the service to work. You can block the others in your browser settings without affecting scoring.
Security
Passwords are hashed with bcrypt, all traffic is encrypted in transit, data is encrypted at rest by our hosting providers, sign-in attempts are rate-limited, and one-off links (password resets, email confirmation, invites) are single-use and expire. No system is perfectly secure; if we become aware of a breach affecting your information we will notify you and the relevant regulator as the law requires.
Changes
We will post any changes here and update the date at the top. For significant changes we will email operators before they take effect.
Contact
Mini Golf Scoring — [email protected]