Privacy Policy

Caddie Fun Inc. ("us", "we", "our", or "Caddie Fun") operates the caddie.fun website and mobile application (the "Service").

This Privacy Policy informs you of our policies regarding the collection, use, and disclosure of Personal Information when you use our Service.

We will not use or share your information with anyone except as described in this Privacy Policy.

By using the Service, you agree to the collection and use of information in accordance with this policy. Unless otherwise defined in this Privacy Policy, terms used have the same meanings as in our Terms of Service.

Effective Date: July 2026

1. Information Collection and Use

Money rails: On-chain stakes use cfUSD, play money with no cash value. Separately, players may optionally settle a friendly skill-based game via Venmo; those settlements move real money directly between players off-platform. caddie.fun does not initiate, process, hold, or custody Venmo transfers. Data associated with cfUSD play money may be modified or deleted. We may reset or adjust cfUSD balances without notice. See our Terms of Service for cfUSD terms and payment rails.

To provide and improve our Service, we collect several types of information:

Personal Information

When you create an account, we may ask you to provide certain personally identifiable information that can be used to contact or identify you, including but not limited to:

• Account Information: Email address, name, username, phone number (optional), and profile picture
• Date of Birth: Collected during account creation to verify you meet our minimum age requirement (see "Children's Privacy" below)
• Authentication Data: Password (stored securely hashed) or passkey credentials via our authentication provider
• Profile Information: Bio, location (city/state), timezone, and golf-related preferences
• Payment Information: Venmo username (for optional off-platform peer-to-peer settlement links) and cryptocurrency wallet addresses (for cfUSD play-money escrow on Base Sepolia)

Golf Performance Information

While you use our Service, your gameplay generates certain data ("Golf Information"), including:

• Score Data: Round scores, hole-by-hole statistics, handicap index, and (when enabled) Stats+ or full strokes-gained capture
• Performance Metrics: Fairways hit, greens in regulation, putts, birdies, eagles, skill rating inputs, and other playing statistics
• Shot Data: GPS coordinates of shots, club selection, distances, and shot results (including rangefinder yardages during live rounds)
• Equipment Data: Golf club brands and specifications in your bag
• Practice Data: Practice plans, drill completions, session notes, and optional swing-analysis media you submit
• Gamification Data: XP, quests, achievements, streaks, and friend-only Markets prediction picks (XP stakes, not cash)

AI Caddie Information

Our AI-powered caddie feature collects information to provide personalized coaching:

• Profile Data: Stock yardages, self-reported strengths and weaknesses, playing style, miss patterns, and golf goals
• Conversation History: Your messages to the AI caddie and its responses are stored and associated with your account to provide conversation continuity and improve your coaching over time. These messages are sent to Anthropic (Claude) for processing. You can export or delete your conversation history at any time.
• Feedback: Thumbs up/down ratings on AI responses for quality improvement
• Voice Input: If you use voice input with the AI caddie, audio is processed for speech recognition and is not stored after transcription

We use AI-generated insights to personalize your experience. We do not sell or license your data to third parties for AI model training. You may opt out of AI-powered features at any time by disabling the AI caddie in your account settings.

Location Information

We collect and store information about your location depending on the permissions you have set on your device:

• Course Check-ins: GPS coordinates when checking in at golf courses
• Round Tracking: Location data during active rounds for shot recording and course detection
• Course Discovery: Location for finding nearby courses
• Fair Play Verification: Where GPS fair-play verification is enabled for a round, we may collect GPS checkpoint data (at round start, mid-round, and score submission) to verify you are physically present at the course. This data includes GPS coordinates, accuracy measurements, and timestamps. When collected, it is retained for up to 90 days to support dispute resolution and then deleted.
• Stakes / Paid-Feature Eligibility: When paid or stakes features are geo-restricted, we collect approximate device GPS coordinates at the time you attempt a paid action (for example creating or joining a paid round, accepting a paid side bet, or paying a competition entry fee). We reverse-geocode those coordinates on our servers to determine country/region eligibility. We may also receive an OS-reported mock-location flag (where available, such as on Android) to detect simulated GPS. This use is for App Functionality and Fraud Prevention. Coordinates used only for eligibility checks are processed to derive jurisdiction and are not retained as a long-term location history beyond ordinary security/ops logs.

You can enable or disable location services at any time through your device settings. Some features of our Service require location access to function properly. Disabling location services will prevent participation in rounds that require GPS verification and will block paid/stakes entry when geo restrictions are active (free scorekeeping remains available).

Log Data

When you access the Service, we automatically collect certain information, including:

• The type of device you use and its unique identifier
• Your device's IP address and operating system
• Browser type and version
• Pages and features accessed within the Service
• Time and date of your visit
• Time spent on pages and other diagnostic data

Media Content

When you upload media to our Service:

• Swing Videos and Photos: Media files you record or upload for sharing moments or AI swing analysis
• Device Information: Camera and device metadata associated with uploads
• AI Analysis Results: Insights generated from swing analysis (if you opt into this feature)
• Scorecard Photos: Images of physical scorecards uploaded for OCR score extraction

We process photos and videos for the specific features you use (sharing, AI analysis, OCR). We do not use facial recognition technology. Visual data from swing analysis is used solely to generate your coaching insights and is not used to train third-party AI models.

Health and Fitness Data

If you connect Apple Health (HealthKit), we import golf workout data including activity duration and calories. We do not access or store any health data beyond golf-specific workout records. HealthKit data is never shared with third parties or used for advertising purposes, in accordance with Apple's HealthKit guidelines.

2. How We Use Your Information

We use the information we collect for the following purposes:

• To Provide the Service: Operating and maintaining golf round management, live scoring, spectating, groups/crews, seasons, tournaments, trips, practice, passport, and social features
• To Personalize Your Experience: Delivering AI caddie recommendations, Scout intel, course suggestions, practice plans, and content tailored to your skill level and preferences
• To Facilitate Peer-to-Peer Payments: Connecting players with third-party payment services and processing on-chain settlements between players for golf games and competitions
• To Measure Marketing Effectiveness: Attributing signups and key conversions to our own advertising campaigns (first-party click IDs and consented conversion measurement; see Cookies and Tracking)
• To Improve the Service: Analyzing usage patterns to enhance features, fix issues, and develop new functionality
• To Communicate With You: Sending notifications about rounds, friend requests, achievements, quests, spectator alerts, and Service updates
• To Ensure Fair Play: Detecting and preventing fraud in competitive rounds through our trust and verification systems
• To Comply With Legal Obligations: Meeting applicable legal requirements

Automated Decision-Making

Our Service uses automated systems in the following ways:

• Trust Scoring: We assign trust tiers based on verified round history, GPS verification, and peer attestation. Trust tiers affect which features require additional verification (e.g., photo proof for certain competitions). You can view your trust tier in your profile.
• AI Caddie Recommendations: Personalized coaching and strategy suggestions based on your playing data. These are advisory only and do not affect your account standing or access to features.
• Fraud Detection: Automated flagging of suspicious scoring patterns for human review. No account action is taken without human review.

You have the right to request human review of any automated decision that significantly affects your account.

3. Information Sharing

We do not sell your Personal Information. We do not share your data with advertisers or data brokers. We may share your information in the following circumstances:

With Other Players

• Your profile information, username, and Golf Information may be visible to other players you compete with, friends you connect with, and members of groups you join
• Leaderboard and competition data is shared with participants and may be displayed publicly within the Service
• Spectators may view limited round information if you enable spectating for your rounds

With Service Providers

We employ third-party companies and services to facilitate our Service. These providers have access to your information only to perform specific tasks on our behalf and are obligated not to disclose or use it for other purposes:

• Privy - Authentication and identity verification
• Anthropic (Claude) - AI-powered caddie features and coaching
• PostHog - Product analytics; receives identified usage and event data to help us understand how the Service is used and improve it
• Google Ads - Conversion measurement for our own advertising (gtag / Consent Mode v2 on the web; Enhanced Conversions uploads on the server when you complete a tracked action such as signup). Used only to measure our campaigns, not to sell your data to advertisers.
• Meta (Facebook/Instagram) - Server-side Conversions API uploads for our own advertising measurement when a campaign click ID (e.g. fbclid) is present and conversion upload is configured. We do not sell your data to Meta for their advertising use.
• Mapbox - Course mapping and location services on the web
• Apple Maps / Google Maps - Map rendering and location services in our mobile app (Apple Maps on iOS, Google Maps on Android)
• Amazon Web Services (AWS) - Media storage and cloud infrastructure
• Twilio - SMS notifications
• Resend - Email delivery
• Sentry - Error monitoring and diagnostics (with privacy masking enabled)

Blockchain Services

For cryptocurrency-related features:

• Wallet addresses and on-chain transactions are recorded on the Base network blockchain and are publicly visible by nature of blockchain technology. Once recorded on-chain, this data cannot be deleted or modified.
• Smart contract interactions for peer-to-peer settlements are processed on-chain. The MatchVault smart contract holds entry fees in escrow and distributes payouts directly to participants - Caddie Fun does not custody user funds.
• Your blockchain wallet address is pseudonymous but may be linked to your account by anyone who observes both your wallet address and your Caddie Fun profile.

Compliance With Laws

We will disclose your Personal Information where required by law, subpoena, or if we believe such action is necessary to:

• Comply with legal obligations
• Protect and defend our rights or property
• Prevent fraud or abuse of the Service
• Protect the safety of users or the public

Business Transactions

If Caddie Fun Inc. is involved in a merger, acquisition, or asset sale, your Personal Information may be transferred as a business asset. We will provide notice before your information becomes subject to a different Privacy Policy.

4. Data Retention

We retain your Personal Information for as long as your account is active or as needed to provide you the Service. You may request deletion of your account and associated data at any time by contacting us.

Specific retention periods:

• GPS verification data: Where collected, up to 90 days after round completion (for dispute resolution)
• AI caddie session metadata: Duration of your account plus 30 days
• Audit logs (IP, device): 12 months
• Blockchain data: Permanent and immutable (on-chain transactions cannot be deleted by any party, including Caddie Fun)

Certain data may be retained longer as required for:

• Legal compliance
• Dispute resolution
• Fraud prevention
• Enforcing our agreements

Aggregate, anonymized data that cannot identify you may be retained indefinitely for analytics and Service improvement.

5. Data Security

The security of your Personal Information is important to us. We implement reasonable, commercially acceptable security procedures and practices, including:

• Encryption of data in transit (TLS/SSL)
• Secure password hashing (bcrypt)
• Passkey/WebAuthn support for passwordless authentication
• Session management with token versioning
• Rate limiting and CSRF protection
• Row-level security in our database

However, no method of transmission over the Internet or electronic storage is 100% secure. We cannot guarantee absolute security of your information.

Data Breach Notification

In the event of a data breach that affects your Personal Information, we will notify affected users via email within 72 hours of becoming aware of the breach, consistent with GDPR requirements and applicable state breach notification laws. Notifications will include the nature of the breach, the data affected, steps we are taking, and recommended actions for you.

6. Cookies and Tracking

We use cookies and similar technologies to operate and improve our Service. For detailed information about the cookies we use, their purposes, and how to manage them, please see our Cookie Policy.

In summary, we use:

• Essential cookies for session management, authentication, and security
• Functional cookies to remember your preferences and settings
• Analytics cookies to understand how our Service is used and identify improvements (PostHog product analytics may associate events with your account when you are signed in)
• Advertising measurement cookies / scripts for our own paid acquisition: Google Ads gtag (with Consent Mode v2) and a first-party attribution cookie that stores click IDs (such as gclid, gbraid, wbraid, fbclid) and UTM parameters from ads that land on caddie.fun so we can credit a later signup. These tools measure our campaigns; we do not sell your Personal Information or share it with data brokers for their advertising.

We do not operate a third-party ad network on the Service, and we do not sell Personal Information for cross-context behavioral advertising.

Do Not Track and Global Privacy Control

On the web, we honor Do Not Track (DNT) browser signals and Global Privacy Control (GPC) signals. When we detect a DNT or GPC signal, we do not load our product analytics for that session, we suppress non-essential analytics events, and we do not capture first-party ad-click attribution for that session. Cookie consent choices also gate Google Ads Consent Mode (ad storage and related signals default to denied until you Accept All).

If you would like to opt out of product analytics on any platform, you can also contact us at hello@caddie.fun and we will disable non-essential analytics for your account.

7. Third-Party Links and Services

Our Service may contain links to third-party websites and integrate with external services not operated by us, including:

• USGA GHIN handicap services
• Course websites and tee time booking
• Social media platforms for sharing
• Payment platforms (Venmo)

We have no control over and assume no responsibility for the content, privacy policies, or practices of third-party sites or services. We encourage you to review the privacy policy of every site you visit.

8. Your Rights and Choices

Depending on your location, you may have rights regarding your Personal Information:

• Access: Request a copy of the Personal Information we hold about you
• Correction: Request correction of inaccurate information
• Deletion: Request deletion of your Personal Information (note: on-chain blockchain data cannot be deleted)
• Portability: Request transfer of your data in a machine-readable format
• Opt-Out: Opt out of marketing communications at any time
• Restrict Processing: Request that we limit how we use your data
• Object: Object to processing of your data based on legitimate interests
• Withdraw Consent: Where processing is based on consent, withdraw consent at any time without affecting the lawfulness of prior processing

Notification Preferences

You can control notification preferences within the Service, including:

• Push notification settings
• Email notification preferences
• SMS opt-in/opt-out
• Quiet hours configuration
• Per-friend and per-group notification overrides

To exercise your data rights, please contact us at hello@caddie.fun. We will respond to verifiable requests within 30 days (or 45 days if we notify you of an extension).

9. Children's Privacy

Our Service is not intended for anyone under the age of 18. We do not knowingly collect personally identifiable information from anyone under 18.

If you are a parent or guardian and learn that your child has provided us with Personal Information, please contact us. If we become aware that we have collected Personal Information from a person under 18, we will take steps to remove that information and terminate the associated account.

10. California Privacy Rights (CCPA/CPRA)

If you are a California resident, you have specific rights under the California Consumer Privacy Act and California Privacy Rights Act:

• Right to Know: You may request the categories and specific pieces of Personal Information we have collected, the sources, our business purposes for collecting it, and the categories of third parties with whom we share it
• Right to Delete: You may request deletion of your Personal Information, subject to certain exceptions
• Right to Correct: You may request correction of inaccurate Personal Information
• Right to Opt-Out of Sale/Sharing: We do not sell or share your Personal Information for cross-context behavioral advertising
• Right to Limit Use of Sensitive Personal Information: You may request that we limit our use of sensitive information to what is necessary to provide the Service
• Right to Non-Discrimination: We will not discriminate against you for exercising your privacy rights

Categories of Information Collected: Identifiers (name, email, username), internet activity (log data, usage), geolocation (course check-ins, GPS verification), audio (voice input to AI caddie), professional information (golf performance data), advertising measurement identifiers (first-party click IDs / UTMs when present).

Information Sold or Shared: None. We do not sell Personal Information or share it for cross-context behavioral advertising.

To exercise these rights, contact us at hello@caddie.fun or use the in-app data request feature. We will verify your identity before processing requests.

11. European Economic Area, UK, and Swiss Users (GDPR)

If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, the following additional provisions apply:

Legal Bases for Processing

We process your Personal Information on the following legal bases:

• Contract Performance: Processing necessary to provide the Service you requested (account management, scoring, AI caddie features, payment facilitation)
• Legitimate Interests: Fraud prevention, service improvement, security, and analytics, where these interests are not overridden by your rights
• Consent: Where you have given explicit consent (e.g., marketing communications, optional AI features, HealthKit integration). You may withdraw consent at any time.
• Legal Obligation: Processing required to comply with applicable laws

International Data Transfers

Your information is transferred to and processed in the United States. We protect these transfers through:

• Standard Contractual Clauses (SCCs) approved by the European Commission
• Data processing agreements with all service providers that require equivalent protections

Your Additional Rights

In addition to the rights listed in Section 8, you have the right to:

• Lodge a Complaint: File a complaint with your local data protection supervisory authority
• Data Protection Officer: Contact our data protection team at hello@caddie.fun

Data Protection Contact

For GDPR-specific inquiries:

Email: hello@caddie.fun

12. Biometric and Sensitive Data

We do not use facial recognition, fingerprint scanning, or voiceprint analysis.

Media you upload (swing videos, photos) is processed for the specific feature you are using (sharing, AI swing analysis, scorecard OCR). We do not extract or store biometric identifiers from your media.

Voice input to the AI caddie is processed for speech-to-text transcription only. Audio is processed in real-time and is not retained after transcription is complete.

If you are an Illinois resident: we do not collect biometric identifiers or biometric information as defined under the Illinois Biometric Information Privacy Act (BIPA).

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of any changes by:

• Posting the new Privacy Policy on this page
• Updating the "Effective Date" at the top
• Sending you an email notification for material changes

Your continued use of the Service after changes constitutes acceptance of the modified Privacy Policy.

14. Contact Us

If you have any questions about this Privacy Policy, please contact us:

Caddie Fun Inc.

Email: hello@caddie.fun Privacy inquiries: hello@caddie.fun Website: https://caddie.fun

This Privacy Policy was last updated in July 2026.