Privacy Policy

Who we are

The Scramble Cup is run by Kane Stapler for a group of friends. It isn't a company. When this policy says "we" or "us", it means Kane and the tournament's admins, the handful of people who help run the event. Questions go to kane@scramblecup.com.

Your account

You don't need an account to look around. You need one to enter scores, set lineups, vote for awards or add photos.

• Ways to sign in. Email and password, or Google, on the website and in the app. The iPhone app also offers Sign in with Apple. If you choose Apple's "Hide My Email", we only get an Apple relay address.
• What we store. Your email address, your name (the one you give us, or the one Google or Apple shares), your role (viewer, player or admin), the player or staff profile your account is linked to, and when you signed up. We also store settings you choose: whether location sharing is on and your phone's location permission (see Location sharing), uploaders or photos you've hidden for yourself, and when you last looked at photos of you. If an admin turns off photo uploads for your account, that's stored too.
• Passwords. Google Firebase Authentication handles them. We never see or store your password. Password reset emails come from Firebase.
• Guests in the iPhone app. If you use the app without signing in, it creates an anonymous guest ID behind the scenes. It has no name or email attached. It lets your phone receive general notifications and lets you report a photo.
• Face ID and Touch ID. In the app you can turn on quick sign-in. Your password is then kept in your iPhone's Keychain, on that device only, and unlocked with Face ID or Touch ID. Apple handles the biometrics on your phone; we never receive any face or fingerprint data.
• Linking to your player profile. An admin links your account to your player profile. That's what lets you score your matches, vote and share your location. In the app you can tap "Request link", which emails the admins your name, email address, sign-in methods and the player you say you are.
• What admins see. Admins can see your name, email, sign-in methods, role and linked player so they can link and manage accounts.

Player profiles

Every Scramble Cup player has a public profile that the admins create and edit: name, nickname, bio, headshot and signature images, tournament handicaps, and match history and stats worked out from results. Staff have a short public listing too. Signed-in players can also see a map of how players know each other (school, work, family and similar groups), which the admins maintain.

Some player headshots are stylized images the organizers make from photos players give them, using Google's Gemini image tools. If you'd like anything on your profile changed or removed, email us.

Scores, lineups and match data

Players enter hole-by-hole results during their matches, and captains submit lineups and draft picks. With each score we store which account entered it and when, so mistakes can be sorted out, and admins can see a history of score changes. Scores, mulligans, lineups, results and standings are public on the website and in the app, and stay as part of the Cup's history.

Award voting

Players on a tournament's roster can vote for the end-of-trip awards. Each vote is saved with your account ID and player profile so everyone gets one vote per award.

Votes are anonymous to everyone, admins included. The website and app only show totals and winners. No screen shows who voted for whom. To be completely honest: the raw votes sit in our database, so an admin could technically look them up there. Our promise is that we don't, and the admin tools don't show them. Admins can delete a vote (for example if a nominee is removed) but can't cast or change a vote for anyone.

Votes are kept after voting closes, and if you delete your account.

Photos and videos

• Who can add them. Admins, and players on that year's roster, from the website or the app.
• What happens to the file. It goes straight to our Google Cloud storage, and our server makes the copies people see. For photos, all embedded metadata is removed, including GPS location, camera details and other EXIF data. Before removing it, we read the time the photo was taken so the gallery can show photos in order. For videos, we remove location and other file-level metadata and keep the time it was recorded. The file you uploaded is deleted once the copies are made. We keep a fingerprint (a hash) of each file to catch duplicates.
• Who sees them. The gallery is public. Anyone can view and download photos and videos on the website and in the app. Each one shows "Added by" with the uploader's name, and any caption.
• Your control. You can edit the caption on, or delete, anything you uploaded, any time.
• Reporting and hiding. Anyone can report a photo or video (on the website you sign in first; guests in the app can report too). A report stores who sent it, the reason and any note, and the admins see it, so reports aren't anonymous. A report from a signed-in person hides the item for everyone until an admin reviews it. Admins can hide, restore or delete anything, and can turn off uploads for an account. You can also hide everything from one uploader just for yourself; for app guests that list stays on the phone.

Tagging people in photos

Linked players and admins can tag people who have a player or staff profile in a photo or video. A tag says who is in it, not where they are in the picture. Tags are public: they show on the photo, in a "Photos" section on player profiles and in the gallery's "Photos of" filter. We store who added each tag; only that person and the admins can see that.

The person who added a tag and the admins can remove it. If you'd rather not be tagged in something, email us and we'll take it off. Being tagged doesn't send a notification; the website and app show a "New photos of you" badge instead.

We don't use face recognition. Nothing on the website or in the app scans faces or creates face data. If we ever add it, we'll update this policy and tell players before it's turned on.

Location sharing (iPhone app)

Location sharing is part of the iPhone app only. The website never asks for your location.

• Off unless you turn it on. Only players linked to a player profile can share, and only after turning it on in the app and giving it permission to use location.
• Only during your round. Sharing can only run during your own tournament round. It opens when the first match of your round on your course starts, and stops when your own match is finished, with a backstop that stops it 9 hours after the round opened. During that window the app records where your phone is, on the course or off it.
• What's recorded. For each point: latitude and longitude, the time, and how accurate the reading was. Your current position also includes the direction and speed you're moving, whether you're inside the course boundary, whether the app is in its battery-saving mode, and an ID for the app install sending it. Readings that aren't accurate enough to show are kept, but never drawn on the map. On your account we store whether sharing is on and your phone's location permission (for example "Always" or "While Using", and whether precise location is on), so the admins can see who's set up before a round.
• It's public. Anyone can watch the live map and round replays on the website or in the app, without signing in.
• It's kept. Each player's trail for each match is kept as a permanent round replay.
• Your control. Pause any time in Settings › Location in the app; signing out stops sharing too. You can delete your own trail for a match, which also stops sharing for the rest of that match. Admins can stop anyone's sharing and delete any trail. Email us and we'll delete any of your trails.

Push notifications (iPhone app)

If you allow notifications, the app keeps a device record so we can send them. It holds a random ID for this install of the app, your account ID (or guest ID), the push token Apple gives your phone, whether notifications are allowed, which kinds of notification you've turned on, the app and iOS versions, the kind of device (iPhone, iPad or Mac), your language and region setting, your time zone, and when the app last checked in. For each notification we keep a short delivery record (which device, and whether it went through).

Notifications go directly through Apple's Push Notification service. Guests only get general notifications; personal ones, like alerts about your own matches, need an account. Turn any kind on or off in Settings › Notifications in the app, or turn them all off in iOS Settings. A device record is deleted when you delete your account, or after about 120 days without the app checking in.

Crash reports (iPhone app)

App Store and TestFlight builds of the iPhone app send crash reports, and reports of some errors the app recovered from, to Google Firebase Crashlytics. A report has technical details such as the device model, iOS and app versions, and what the app was doing when it happened. If you're signed in it also carries your account ID, so we can follow up on a bug. Reports never include your email, your name or a password. Development builds send nothing. Google keeps crash reports for 90 days.

Emails

We don't send newsletters or marketing email. The emails that exist are:

• Password reset emails, sent by Firebase Authentication when you ask for one.
• Admin alerts, sent through Resend from alerts@scramblecup.com to the admins only, when something needs a person to look at it: a request to be linked to a player (with the requester's name, email, sign-in methods and the player they named), a duplicate account, someone reporting a lot of photos, or the gallery filling up.

Analytics, cookies and browser storage

• Vercel Web Analytics counts page views on the website. It doesn't use cookies. It records things like the page, the site that sent you, your country and your type of device and browser.
• Google Analytics (through Firebase) also measures visits to the website. It sets its own cookies (such as _ga) to tell visits apart, and Google receives your IP address and basic device and browser details. We use it to see how much the site is used, not for advertising.
• The iPhone app has no analytics.
• Staying signed in. The website keeps you signed in using your browser's storage (Firebase Authentication uses local storage and IndexedDB). The app uses the iPhone Keychain.
• Small conveniences. The website remembers banners you've dismissed for the current browser tab (session storage).
• Offline cache. The website installs a service worker that caches the site's own files (code, logos, fonts and the like) so it loads quickly on a weak signal. It doesn't cache your personal data.
• Content from other services. Some pages load things from other services, which then receive your IP address and browser details: Google Fonts (fonts, on every page), Open-Meteo (course weather and time zones; only the course's coordinates are sent), Apple MapKit JS (the live map and replays) and Twitch (the live-stream player when we're streaming, which may set Twitch's own cookies).

Who can see what

Anyone, no sign-in needed

Player and staff profiles, tournaments, teams, lineups, scores and results, award winners and vote totals, the photo and video gallery (with uploader names, captions and tags), and the live map and round replays.

Signed-in players

The map of how players know each other.

You and the admins

Your account details and settings, and the tags you added.

Admins only

Score-change history, photo reports, link requests and other admin alerts, who has location sharing set up, the record of deleted accounts, and individual award votes (which, as above, the admin tools don't show).

Services that handle data for us

We use a few services to run the Cup. Each only gets what it needs to do its job, and each handles data under its own privacy policy. Data is processed in the United States.

• Google Firebase and Google Cloud: sign-in (Firebase Authentication), the database (Cloud Firestore), photo and video storage (Cloud Storage), our server code (Cloud Functions), server logs, Crashlytics and Google Analytics.
• Google Sign-In: if you sign in with Google.
• Vercel: hosts the website, keeps short-lived server logs (which include IP addresses) and runs Web Analytics.
• Apple: Sign in with Apple, the Apple Push Notification service, MapKit JS maps, and the App Store and TestFlight.
• Resend: delivers admin alert emails.
• Twitch: the live-stream player. Our server also asks Twitch whether we're live; that sends nothing about you.
• Open-Meteo and Google Fonts: weather and fonts, as described above.
• Google Gemini: used by the organizers to make stylized player headshots.

What we don't do

• We don't sell or rent your data, and never will.
• No advertising, no ad networks and no data brokers.
• We don't track you across other companies' apps or websites, which is why the iPhone app never asks for permission to track you.
• We don't use your data for anything except running the Cup.

How long we keep things

• Your account: until you delete it.
• Tournament history (player profiles, scores, results, lineups, award votes, photos and videos, tags and location trails): kept indefinitely as the record of the Cup, unless you ask us to remove something or an admin deletes it.
• Photo and video uploads: the file you send is deleted as soon as it's processed; unfinished uploads are cleaned up automatically.
• Notification device records: until you delete your account, or about 120 days without the app checking in.
• Crash reports: 90 days.
• Deleted accounts: we keep a short note (the account ID, the linked player, the sign-in methods and the date) so the admins know the account was closed on purpose.

Deleting your account

On the website, open the account menu and choose Delete account. In the iPhone app, go to Settings › Account › Delete account. You'll confirm it's you first.

If you'd like any of what stays removed as well, email us at kane@scramblecup.com.

Your choices and rights

Wherever you live, you can ask us to:

• send you a copy of the data we hold about you,
• correct something that's wrong,
• delete your account, or something specific: a photo, a tag, a location trail or a profile detail.

You can also stop location sharing and notifications yourself in the app at any time. Email kane@scramblecup.com with any request. We'll reply within 30 days, usually much sooner, and may ask you to confirm it's really you. If there's a reason we can't do something (say, a match result everyone else relies on), we'll explain why.

Children

The Scramble Cup is for adults and isn't directed at children under 13. We don't knowingly collect personal information from children under 13. If you think a child has given us information, email us and we'll delete it.

Security

Everything travels over encrypted connections (HTTPS). Database and storage rules limit who can read and change what, and the admin tools only work for admins. No system is perfectly secure, but we take care, and we'll tell anyone affected if something goes wrong.

Changes to this policy

If we change how we handle data, we'll update this page and the effective date at the top. For big changes, we'll tell players directly before they take effect.

Contact us

Kane Stapler, The Scramble Cup
kane@scramblecup.com