Privacy Policy

Golfle is operated by Antlr Creatives (“Antlr Creatives,” “we,” “our,” or “us”). For the purposes of the EU and UK GDPR, Antlr Creatives is the data controller of your personal data. You can contact us at any time at antlrcreatives@gmail.com.

We collect only the data necessary to run the game and prevent abuse. Specifically:

• Account data (only if you sign in): your email address; your display name (from your Google account, your email prefix, or whatever you set in your profile); and your avatar URL (the public profile picture that your Google account exposes when you sign in with Google). We do not receive or store your Google password.
• Game data:your guesses, the games you’ve played, whether you won, how many guesses it took, your current and best streaks, and your follow relationships with other signed-in players.
• Technical data: standard request metadata from your browser (IP address, user agent, referer, timestamp). IP addresses are processed temporarily for rate-limiting and abuse prevention and are not retained with your account record.
• Cookies: a small number of strictly necessary cookies, primarily for keeping you signed in. See our Cookie Policy for details.
• Local storage:while you play as a guest (without signing in), your guesses, stats, and preferences are stored in your browser’s localStorage. This data never leaves your device unless you sign in.

What we don’t collect: we do not collect or process precise geolocation, payment information, biometric data, contacts, microphone or camera input, or browsing history outside of Golfle.

We use your data only for the following purposes:

• To provide and maintain the game (matching guesses, computing streaks, generating leaderboards);
• To authenticate you when you sign in (via Supabase Auth and, if you choose, Google);
• To display your name and avatar to other users on the leaderboard, as your follower, or in search results within the “Find friends” feature;
• To prevent abuse, including rate limiting and detecting attempts to manipulate the leaderboard;
• To send transactional messages (for example, your magic-link sign-in email);
• To comply with our legal obligations and protect our rights or those of others.

We do not use your data for advertising, profiling for marketing purposes, or any form of automated decision-making that produces legal or similarly significant effects on you.

If you are in the EU, the UK, or another GDPR-equivalent jurisdiction, we rely on the following legal bases:

• Performance of a contract— to provide the game and run your account once you accept our Terms of Service.
• Legitimate interests— to operate, secure, and improve the Service, prevent abuse, and display public leaderboards. We have weighed these interests against your privacy rights and believe they do not override your rights.
• Consent— for any optional features that we add later that require it. You can withdraw consent at any time.
• Compliance with a legal obligation— where we are required by law to retain or disclose certain data.

We do not sell your personal data and we do not share it with advertisers. We share your data only with the following categories of recipients:

• Other playerssee your display name and avatar when (a) you appear on a public leaderboard, (b) they follow you, or (c) they search for you in the “Find friends” dialog. Your email address is never shown to other players.
• Sub-processors / vendors that help us operate the Service. These companies process your data only on our behalf and under contractual obligations of confidentiality and security.
• Authorities or third parties when required by valid legal process, to protect our rights or those of others, or in connection with a corporate transaction (for example, a merger or acquisition).

Current sub-processors:

• Supabase, Inc. — Authentication, database, and session storage. Privacy policy
• Vercel Inc. — Web hosting and edge delivery. Privacy policy
• Google LLC — Google OAuth (when you sign in with Google). Privacy policy

Our sub-processors are based in the United States. If you access the Service from outside the United States, your data will be transferred to and processed in the United States and other countries where our sub-processors operate. Where required by law (for example, transfers from the EEA, the UK, or Switzerland), we rely on the European Commission’s Standard Contractual Clauses or equivalent safeguards.

We retain your account data (email, display name, avatar URL) for as long as your account is active. Your game history (guesses, wins, streaks) and leaderboard entries are retained while you have an account so the leaderboard remains accurate.

When you delete your account, we delete your personal data and all associated game records within 30 days, except where we are required by law to retain certain information (for example, fraud-prevention logs may be retained longer in aggregated and anonymized form).

Local-storage data on your device persists until you sign in (which migrates the relevant pieces to your account) or until you clear your browser storage.

Depending on where you live, you may have some or all of the rights below. To exercise any of them, email us at antlrcreatives@gmail.com from the address associated with your account, or use the in-app controls noted in each item.

• Access— request a copy of the personal data we hold about you.
• Correction— ask us to fix inaccurate data. You can edit your display name in-app from the account menu.
• Deletion (“right to be forgotten”)— ask us to delete your data. You can delete your account in-app from the account menu, or follow the steps on our Account & Data Deletion page.
• Portability— request a machine-readable copy of the data you provided to us.
• Restriction or objection— ask us to limit or stop certain processing.
• Withdraw consent— where we relied on your consent, you may withdraw it at any time without affecting the lawfulness of processing before the withdrawal.
• Lodge a complaint— with your local supervisory authority. EEA residents can find their authority at edpb.europa.eu.

We respond to verifiable requests within 30 days (or as required by applicable law). We may need to verify your identity before fulfilling a request.

If you are a California resident, you have additional rights under the California Consumer Privacy Act, as amended by the California Privacy Rights Act:

• The right to know what categories of personal information we collect, use, and disclose;
• The right to access the specific pieces of personal information we have about you;
• The right to delete the personal information we hold about you;
• The right to correct inaccurate personal information;
• The right to non-discrimination for exercising your CCPA rights;
• The right to limit the use of sensitive personal information (we do not collect any “sensitive personal information” as defined by the CCPA);
• The right to opt out of the sale or sharing of personal information — we do not sell or share your personal information as those terms are defined under the CCPA, and we have not done so in the preceding 12 months.

To exercise any of these rights, contact us at antlrcreatives@gmail.com. You may also designate an authorized agent to make a request on your behalf, subject to our verification of their authority.

Residents of states with comprehensive consumer-privacy laws — including Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), Utah (UCPA), Texas (TDPSA), Oregon, Montana, Iowa, Tennessee, Indiana, New Jersey, Delaware, and others as they take effect — may have rights similar to those listed in Sections 8 and 9. We honor those rights to the same extent. Contact us at antlrcreatives@gmail.com to exercise them.

Golfle is not directed to children under 13 (or the higher minimum age in your jurisdiction), and we do not knowingly collect personal information from children. See our Children’s Privacy Notice for what we do if we discover otherwise.

We use commercially reasonable technical and organizational measures to protect your data, including encrypted connections (HTTPS) for all web traffic, access controls on our database, and managed authentication via industry-standard providers. No method of transmission or storage is 100% secure. If we become aware of a security breach affecting your personal data, we will notify you and the appropriate authorities as required by law.

Some browsers send a “Do Not Track” signal. Because we do not track you across other websites or build advertising profiles, our processing is unaffected by this signal. We honor the spirit of the signal by default.

We may update this Privacy Policy from time to time. If we make a material change we will provide reasonable notice (for example, by posting a notice on the Service or sending an email to the address associated with your account) before the change takes effect. The “Updated” date at the top of this page reflects the most recent revision.

For privacy questions, requests, or complaints, contact us at antlrcreatives@gmail.com.