Privacy
Duff works without an account. What you score stays on your phone unless you choose to share it.
On your phone
Your rounds, scores and stats, the courses you add and the players you save (names and Handicap Indexes) are stored only on your device. Deleting the app deletes them.
If you share a round
You only need an account to share rounds with friends. Sharing or joining a round makes a guest account for you unless you already have one, and you can add Sign in with Apple to it on the Account screen. Duff stores, with our backend provider Supabase (database in London):
- an account ID;
- for each shared round: the course, the players' names, Handicap Indexes and which ratings they play off, the games and any stakes, every score entered with who entered it, when, and a random ID for the phone or browser it came from, the standings and settle-up, and earlier versions of the round's setup, plus the name each person gave when sharing or joining;
- if you use Sign in with Apple: the identifier Apple gives Duff (Duff doesn't ask Apple for your name or email address), and a token used only to sign you out of Duff with Apple when you delete your account.
A shared round is visible to the people in it. Anyone with its join code or link can join it, and friends you invite see the course's name and who invited them before they join.
Friends
If you choose a handle (which needs Sign in with Apple), Duff stores it with the name you give. Other people with a handle can find you by searching for the start of your handle, and see your name with it. People you've shared rounds with see you as a suggestion. Duff also stores your friends and friend requests, the people you've blocked, your personal invite code, and invitations to rounds between friends. Blocked people can't find, ask or invite you.
Finding courses
When you search for a course, Duff's server receives what you type, and signs you in with a guest account if you don't have one. If Duff's shared course catalogue doesn't have the course, the server asks GolfCourseAPI (a course data provider) for it, sending only the words you searched for. Courses found are kept in the catalogue for everyone. The words searched online are kept for a month, without your account, so the same search isn't sent twice. Duff counts how many online lookups each account makes a day, to share the provider's limit fairly, and forgets the count the next day.
Courses near me uses your location on your phone to search Apple Maps, under Apple's privacy policy. Your location isn't sent to Duff's server or stored. The server receives Apple's IDs for the golf courses found, to tell you which are in the catalogue, and doesn't keep them. When you choose a course from a place on the map, Duff stores Apple's ID for that place with the course and your account ID, so the next person finds it straight away.
The join page
Friends without the app can join a round on this website. It makes a guest account the same way. Your browser's storage keeps that account, a random ID for your browser, the name you last joined with, the rounds you've joined and any scores not yet sent. It uses no cookies for tracking and no analytics.
Reports
If you report a problem with a round, someone in it, an account or a course's scorecard, Duff stores the report, the round or course it's about, your account ID, the account you reported and the name or handle they had. Only Duff's developer reads reports.
Crash reports
iOS can give Duff reports about crashes and hangs. Duff keeps them on your phone, under Profile → Settings → Diagnostics, and never sends them anywhere itself. You can choose to share one, for example by email, to help fix a problem.
Who handles your data
Supabase stores Duff's database in London and runs its server code, which may run elsewhere. Cloudflare hosts this website and the join page. Both keep short-lived logs of requests, including IP addresses, to run and protect their services. GolfCourseAPI receives only the words searched for and the courses looked up, never anything about you. Apple handles Sign in with Apple and Apple Maps under its own privacy policy.
What Duff doesn't do
No advertising, no tracking across apps or websites, no selling or sharing of your data, and no analytics services.
How long things are kept
Your account and what's stored with it are kept until you delete the account. Shared rounds are kept for the people in them. Online searches are kept for a month, lookup counts for a day, and wrong join codes for an hour.
Deleting your account
In the app, go to Profile → Account → Delete account. This deletes your account, handle, invite code, friends, requests, blocks and invitations from our servers, takes you out of every shared round and revokes Duff's Sign in with Apple token. Your phone then uses a new random ID for any scores it sends.
Some things stay, without your account: shared rounds, including your name, Handicap Index and scores as the other players see them; rounds you started, for the people still in them; reports you sent or that were about you; and places you linked to courses. Rounds on your phone stay there until you delete them or the app.
To delete a guest account made on the join page, email us the round's join code and the name you joined with, and we'll delete it.
Contact
Questions about your data: support@mattniblock.com.