Privacy Notice

What we collectIn force · effective 16 August 2026

This section is in force now. It is a complete list of the personal data we collect, and we collect nothing on it that the service does not need:

• Your email address, and the sign-in behind it. If you sign in with Google or Facebook, that provider gives us your email address and an account identifier for you — nothing else, and never a password.
• The watches you create: which course, the dates and times you want, the settings on the watch, and the record of what we alerted you about on it.
• If you turn on text alerts: your mobile number, your mobile carrier, the record of your consent, which delivery channel your account is set to, and — if the channel offers it — whether you opted in to that channel separately. That is described in full in “Phone numbers and text messages” below.
• If you set a Home Course: the postal code and country you enter, and the place name we resolve them to.
• Nothing from a military or veteran verification, because verification is not available yet and nobody can complete one. If it becomes available and you choose to use it, the verification provider would tell us whether you are verified, what the affiliation is, and when the verification expires, and we would store those three facts. We would never receive or store your identity documents: they go to that provider, and the verification happens on their system rather than here.
• Operational records needed to run and secure the service, and anonymous counts of page events. The session identifier on those event counts is hashed before it is stored, so they carry nothing that identifies you.

What we never collectIn force · effective 16 August 2026

This section is in force now. We never receive or store your card details. If paid plans start, the payment will happen at a payment processor and the card number will not reach us; how the money itself flows depends on which processor is chosen, which has not been decided, and the Refund Policy is where that will be stated.

What does not depend on any of that, and is in force now: we never complete a booking or a payment for a tee time. The reservation is completed by you, on the course or booking platform’s own site, with your own account and your own payment method. We are never the merchant of record for a green fee.

We hold no password for any course or booking account, and we never ask you for one; the service reads publicly published tee sheets and does not sign in as you anywhere. We do not track your device location — the only location data we hold is the postal code you type in yourself.

Why we collect itIn force · effective 16 August 2026

This section is in force now. Each item above has one stated purpose and is used for that purpose:

• Email address — to sign you in, to send the alerts you asked for, and to reach you about your own account.
• Watches — to run the checks you set up and to know what to alert you about.
• Mobile number and carrier — to deliver the text alerts you switched on, through your carrier’s own gateway. Nothing else is sent to that number.
• Home Course postal code — to work out which courses are near you and to label them sensibly.
• Veteran verification — there is none to use today, because verification is not available. Were it available, the only purpose would be to record that your account is verified, so that we could apply veteran terms wherever we offer them. We do not offer any today.
• We do not use any of it for advertising, we do not build a profile on you to sell or rent, and we do not sell personal data.

Phone numbers and text messagesIn force · effective 16 August 2026

This section is in force now. If you turn on text alerts we collect and store the mobile number you enter, your mobile carrier (we send through the carrier’s own gateway, so we have to know which one it is), the fact that you gave consent and when, and whether you have since withdrawn it. If you reply STOP we also store that, so the number stays unsubscribed.

We use that number for one thing: sending you the tee-time alerts you asked for, and service messages about those alerts. Nothing else is sent to it.

The messages are recurring and the frequency varies — one goes out when a watch of yours finds a match. Message and data rates may apply. Reply STOP to cancel, HELP for help. Consenting is not a condition of buying or using the service; email alerts never need a phone number. The programme is described in full in our Terms of Service and on our public text alerts page.

Consent to texts from Birdie Recon is consent to texts from Birdie Recon and nothing else. Global Partners, LLC operates other brands, and ticking the box here does not opt you in to messages from any of them — nor does a box ticked on one of theirs opt you in to ours. Each brand collects its own consent on its own screen, and a STOP applies to the brand whose message it answers.

• No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. All other categories of sharing described in this notice exclude text messaging originator opt-in data and consent; that information will not be shared with any third parties.
• We do not sell your mobile number, your mobile opt-in data or your consent, to anyone, for any purpose.
• The only parties who see your number are the messaging aggregators and carriers who have to carry the message to your handset, and they may use it only to deliver it — never for their own marketing.
• We do not use your number for anything you did not switch on, and we do not add it to any other list.

Withdrawing consent and deleting your numberIn force · effective 16 August 2026

You are in control of this and you do not have to ask us for permission. Reply STOP to any message, or untick the text-alert consent box on your account screen, or clear the number from that screen, or email support@birdierecon.com from the address on your account. Any one of those withdraws your consent.

If you replied STOP and want the texts back, text START to us from that same mobile number. A STOP is recorded against the number rather than the account, so re-ticking the consent box on your account screen will not lift it — mobile numbers get reassigned, and the person holding the handset is the one who gets to make that call. We put no expiry on a STOP.

Clear the number from your account screen and we delete it. What we keep after that is the record that a consent was given and withdrawn — that record is how we can prove we had permission and how we make sure a number that said STOP is never messaged again, so deleting it would defeat both. We have not fixed a retention period for it yet and we are not going to print an invented one; when it is set with counsel it will be stated here.

Who we share it withIn force · effective 16 August 2026

This section is in force now. We do not sell your personal data. We have not sold it and we do not share it with data brokers, advertisers or ad networks, for any purpose.

Text messaging carries a stricter rule than the rest of this section, and that rule is in force. No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. All other categories of sharing described in this notice exclude text messaging originator opt-in data and consent; that information will not be shared with any third parties. That applies to every category listed below without exception — see “Phone numbers and text messages” above.

We add a provider to the list below when we start using one. We may also have to disclose information where the law genuinely requires it of us — and if we are ever asked to, we will not volunteer more than what is actually demanded.

Otherwise, the only outside parties who get any of it are the service providers we need in order to run the service. Each gets only the part of it their job requires, and may use it only to do that job for us:

• Our sign-in provider (Supabase), which performs the sign-in and holds the identity record behind your account. That record is stored in Canada — see “Where your data is stored” below.
• Google or Facebook, if you choose to sign in with one of them. The sign-in happens on their screen and they tell us your email address and an account identifier. What they do on their side is governed by their own policies, not ours. That consent screen is branded to our parent company, Global Partners, LLC — one sign-in identity is shared across its products, so their screen shows the parent’s name rather than Birdie Recon. It is the same company.
• An identity verification provider, if and when military and veteran verification starts, and only if you choose to use it. Verification is not available today and nothing has been sent to anyone for it, so none is named here; when one is carrying it out, it will be named here before you are asked to use it. Your identity documents would go to them directly and we would not see them.
• Telnyx, our messaging provider, and the mobile carriers who have to carry a text to your handset, if you turn text alerts on. They may use your number to deliver the message and for nothing else.
• Hostinger, which provides the servers the application runs on — see “Where your data is stored” below.
• Cloudflare, which provides DNS for birdierecon.com — it resolves the address your browser looks up, and sees the request that reaches us.
• Paddle, which processes subscription payments as our Merchant of Record — billing, sales tax, receipts and refunds. Your card details go to Paddle directly and never reach us. Paddle does not receive anything about which courses you watch.

Where your data is storedIn force · effective 16 August 2026

This section is in force now. Your account data — the sign-in identity and the records behind your account, held by Supabase — is stored in Canada, specifically in the ca-central-1 region. Other parts of the service, including the application itself and its operational records, run on infrastructure in the United States. So the honest answer to “where is my data?” is: the account record is in Canada, and some of the running of the service happens in the US.

Birdie Recon is aimed at golfers in the United States, so for most people reading this, their personal data is held outside the country they live in and crosses a border to get there. We would rather say that plainly than leave you to work it out from a provider’s name.

It is a deliberate choice of where to run the service, made knowing where that is — not a default we did not look at. Data stored in Canada is subject to Canada’s laws, in the same way data stored in the United States is subject to United States law.

We have not put a formal cross-border transfer agreement in place, and we are not going to print the name of one here that we have not signed — an assurance you could rely on and we could not stand behind is worse than saying nothing. Whether one is required of us is with counsel, and it will be stated here when it is settled. What binds us in the meantime is the rest of this notice, and it binds us wherever the data sits: we do not sell it, and the list of who receives it is immediately above.

Cookies, analytics, and what sits on your deviceIn force · effective 16 August 2026

This section is in force now. We set no advertising cookies and no tracking cookies, and we run no third-party analytics tracker. Our funnel analytics are server-side and count events with no personal data in them; the session identifier attached to a count is hashed before it is stored.

Your own browser does keep a couple of things on your device: the sign-in session that keeps you logged in, and small preferences such as whether you dismissed the “add to home screen” prompt. Clearing your browser storage removes them and signs you out.

How we protect itIn force · effective 16 August 2026

This section is in force now. We use reasonable technical and organisational measures to protect what we hold: data in transit is encrypted, access to the production data is limited to the people who need it to run the service, and we hold no card details and no course passwords at all — the safest record is the one that was never collected, which is why “What we never collect” above is written the way it is.

No method of transmission or storage is completely secure, and we are not going to claim otherwise. If we ever have a breach that affects your personal data we will tell you and the relevant regulator as the law requires, and we will tell you what we actually know rather than what sounds best.

ChildrenIn force · effective 16 August 2026

This section is in force now. The service is not directed to children under 18, we do not knowingly collect personal data from them, and an account requires you to be 18 or over (see the Terms of Service). If you believe a child has given us personal data, email support@birdierecon.com and we will delete it.

Changes to this noticeIn force · effective 16 August 2026

This section is in force now. We may change this document. When we do, the effective date printed on the sections it affects moves with it, and we will notify you of a material change — by email to the address on your account, or in the product — before it takes effect.

Notice is not enough for every change, and we would rather draw that line ourselves than leave it to be argued later. A change that widens what we do with your personal data, or that would start sending you a kind of message you did not ask for, requires fresh consent from you: until you give it, the version you agreed to is the one that binds us. For anything short of that, continuing to use the service after the change takes effect is acceptance of it.

How long we keep itIn force · effective 16 August 2026

This section is in force now. We do not set fixed retention periods, and that is a decision rather than a gap. This page used to say periods would be set with counsel and printed here. Counsel has now looked at it and advised against committing to fixed periods, so we are telling you that instead of leaving a sentence up that we were not going to honour.

What governs instead is simpler, and you control it: your data stays while your account does. There is no clock running in the background and no expiry date on your account, your watches or your alert history.

We do not automatically delete your account for being inactive, and we do not quietly delete your data on a schedule. If that ever changes we will say so here first — it would be a change of the kind “Changes to this notice” covers.

When you want it gone, you delete it yourself from the account screen and it goes immediately — see “Your choices, and deleting your data” above, which also names the one part we cannot reach and the three things that survive a deletion and why. Those three are the only exceptions to “your data stays while your account does, and goes when you end it.”

Your choices, and deleting your dataIn force · effective 16 August 2026

This section is in force now. Most of it you do yourself — the controls are in the product and none of them needs our permission.

Deleting your account is something you do yourself, on the account screen, and it takes effect immediately — there is no queue and nothing to wait for. It is irreversible: we have no undo, no grace period and no backup you can ask us to restore from. The screen says exactly what goes and what stays before you confirm, and it asks you to type a phrase rather than tap a button twice.

Deleting removes your Birdie Recon account and the data in it. If you also have an account with another Global Partners, LLC product, that one is separate and is not touched — you would delete it there. If Birdie Recon is the only one you have, your sign-in goes with it.

If you would rather we carried it out for you — or you want a copy of what we hold, or a correction — email support@birdierecon.com from the address on your account. We will acknowledge within 7 days and complete within 30, and in practice it is usually the same day. That address is a real route and a person reads it. Most people will not need it — the button on the account screen is immediate and waits on nobody.

One honest limit on that, which we would rather state than let you assume: your sign-in record itself is not deleted, because we cannot delete it. Your account and the data in it are ours to remove and we remove them; the identity held by the provider you sign in with lives at our sign-in provider, and this service holds no credential that can reach it. The login therefore still exists afterwards, and what it reaches is nothing — signing in again gives you a new empty account rather than the old one. Ask us at the address above if you want to know what that record is or what can be done about it.

Three things survive a deletion, and we would rather say so than surprise you. Two of them exist to protect a person rather than to protect us.

The first: if your mobile number has ever replied STOP, that STOP stays in force. It is recorded against the number and not against the account, because it is an instruction from whoever was holding that handset — and numbers get reassigned, so it protects whoever holds that number next. Deleting an account does not clear it and is not a way to clear it. See “Withdrawing consent and deleting your number” above.

The second: the record that a messaging consent was given and withdrawn stays, detached from you. What is left is the brand, the channel, the campaign, whether consent was granted or revoked, and when. No email address, no phone number, no account identifier — nothing that points back at a person, so it is no longer personal data about you. It is how we can show we had permission before we sent anything, and how a number that said STOP is never messaged again.

The third: anything we are actually required by law to keep.

The controls you have today, without asking anyone:

• Delete your whole account from the account screen. Watches, alert history, Home Course, mobile number and carrier, quiet hours, veteran verification status and the record of which sign-in methods reach the account all go with it.
• Delete any watch from the alerts screen at any time. The watch and its alert history go with it.
• Clear your mobile number from your account screen, or untick the consent box. Either stops the texts; clearing the number deletes it.
• Change or clear your Home Course postal code on your account screen.
• Unlink a sign-in provider on your account screen. The last remaining sign-in cannot be unlinked — an account with no way in is an account you could not get back into either.

ContactIn force · effective 16 August 2026

Email support@birdierecon.com. That reaches a person, not a ticket queue. The operator of record is Global Partners, LLC d/b/a Birdie Recon; ask at that address if you need a postal address.