Privacy Policy

Effective date: September 17, 2026

This policy explains what data the Golf Caddie+ app for iPhone and Apple Watch collects, why we collect it, who we share it with, and the choices you have. We've written it to be read, not skimmed past.

1. Who we are

Golf Caddie+ is published by Lazarus Labs (“we”, “us”, “our”). We are responsible for the personal data described in this policy.

Questions about this policy: info@thelazaruslabs.com.

2. What we collect, and why

Account

What: your email address. If you use Sign in with Apple or Google Sign-In, the name and email address they provide. Apple's private relay email addresses are supported.

Why: to create your account and keep it secure.

Profile

What: display name, profile photo (optional), date of birth, height, weight, handicap index, skill level, handedness, playing frequency, golf goals, home course, the year you started playing, preferred tee and measurement units.

Why: to personalise distances, statistics and coaching.

Golf data

What: your clubs and club distances, rounds, scores and shots, including where each shot was taken on the course.

Why: for your scorecards and statistics, and to learn how far you hit each club.

Location (precise)

• On iPhone, we use your location only while the app is in use. We never use it in the background, and the app has no background location mode. We use it to show distances, find courses near you, get the local weather and record where your shots were taken.
• On Apple Watch, we use your location during a round you have started, so distances keep updating when your wrist is down.
• Your location is not sold and is not used for advertising.

Camera and photos

• Swing analysis runs entirely on your device. Swing videos are never uploaded.
• Profile photo: if you choose one, it is uploaded to our storage.
• Scorecard photos are used only when you scan a scorecard. See AI features and OpenAI.

Health data (Apple Watch, via Apple HealthKit)

• During a round, the watch reads your heart rate and active calories to show them on your wrist, and saves the round to Apple Health as a golf workout.
• This data stays on your watch and in Apple Health. It is not sent to our servers or to any third party, and it is never used for advertising or marketing.

Purchases

What: your subscription status, the product you bought, purchase and renewal dates, and store transaction details.

Why: to unlock the plan you paid for. Your payment card details are handled by Apple (or Google) and never reach us.

AI usage counts

What: how many AI requests you have made each day and each month.

Why: to apply your plan's limits. Daily counts expire automatically.

Diagnostics

What: crash and error reports, including device model, operating system version, app version and technical logs. They contain no name, email address or user ID.

Why: to find and fix bugs.

App integrity

What: Apple App Attest and Firebase App Check confirm that requests come from the genuine Golf Caddie+ app.

Why: to prevent abuse of our services.

3. AI features and OpenAI

What OpenAI receives, with your permission

Only what each feature needs:

• your questions and your coaching conversation
• your golf profile: handicap, skill level, goals, handedness and playing frequency
• your club distances
• round statistics, such as average score, fairways and greens in regulation, and putts
• swing measurements, such as angles and tempo (never the video)
• photos of a scorecard, when you scan one

What OpenAI never receives

OpenAI never receives your name, email address or location. Requests go through our server and carry a one-way hashed identifier instead of your account, so we can detect misuse without identifying you to OpenAI.

How OpenAI uses it

OpenAI processes this data to generate responses, under its API terms. Data sent through the OpenAI API is not used to train OpenAI's models. OpenAI keeps abuse-monitoring logs of API requests for up to 30 days and then deletes them, unless it needs to keep them longer to comply with the law or to protect its services from harm.

4. Service providers we share data with

These providers process data on our behalf to run Golf Caddie+. We don't sell personal data.

• Google Firebase (Authentication, Cloud Firestore, Cloud Storage, Cloud Functions, Crashlytics, App Check): your account, profile, golf data, profile photo, subscription status, AI usage counts and crash reports. Data region: United States.
• RevenueCat: manages subscriptions. It receives an app user ID (not your email address) and purchase and transaction information.
• Apple: Sign in with Apple, App Store payments, and HealthKit (on your device only).
• Google: Google Sign-In, and Google Maps Platform (maps, geocoding and place search), which receives map requests, including coordinates.
• OpenAI: as described in AI features and OpenAI, and only with your permission.
• OpenWeather: receives coordinates, to return the weather at the course.
• GolfCourseAPI and OpenStreetMap (Overpass API): receive course search terms and course map areas, not personal data.
• ESPN: golf news is fetched from ESPN. No personal data is sent.

5. What we don't do

• No advertising and no ad networks.
• No selling or renting of personal data.
• No tracking across other companies' apps or websites.
• No third-party analytics SDKs.

6. Retention and deletion

• We keep your account data for as long as your account exists.
• You can delete your account in the app: Settings → Account → Delete account. This permanently deletes your profile, golf data, uploaded files, subscription record, your subscription customer record at RevenueCat, and your login itself.
• Data stored only on your device is removed when you uninstall the app.
• Daily AI usage counts expire automatically.
• Crash reports are kept by Google Crashlytics for 90 days, after which Google begins deleting them from its live and backup systems.

7. Your rights

You can access, correct, export or delete your data, or withdraw your consent, by:

• using the in-app controls described above (your profile, Settings → Privacy → Share with OpenAI, and Settings → Account → Delete account), including your device's permission settings for location, camera and Health; or
• emailing support@thelazaruslabs.com.

We may need to confirm your identity before acting on a request. The sections below describe the additional rights you have if you live in the European Economic Area, the United Kingdom or California.

8. EEA and UK residents (GDPR)

If you are in the European Economic Area or the United Kingdom, Lazarus Labs is the controller of your personal data.

Our legal bases for using your data:

• Contract: to provide the app and the plan you signed up for: your account, profile, golf data, location while you use distance features, and purchases.
• Consent: sharing data with OpenAI for AI features, and the device permissions you grant (location, camera, Apple Health). You can withdraw consent at any time; this doesn't affect processing that happened before.
• Legitimate interests: crash diagnostics to fix bugs, and app integrity checks and AI usage limits to prevent abuse.

Your rights: you have the right to access your data, correct it, delete it, restrict or object to how we use it, receive it in a portable format, and withdraw consent. To use these rights, use the in-app controls or email support@thelazaruslabs.com. You also have the right to complain to your local data protection authority.

International transfers: our service providers may process your data outside the EEA and UK, including in the United States. Where this happens, we rely on appropriate safeguards, such as the European Commission's Standard Contractual Clauses.

9. California residents (CCPA/CPRA)

If you live in California, you have the following rights under the California Consumer Privacy Act, as amended by the California Privacy Rights Act.

Categories of personal information we collect (described in section 2):

• Identifiers: email address, name, and app user ID
• Personal characteristics: date of birth, height, weight and handedness
• Commercial information: subscription and purchase records
• Precise geolocation
• Photos: profile photo and scanned scorecards
• Other information you provide: golf data, goals and AI coaching conversations

Heart rate and active calories stay on your Apple Watch and in Apple Health, and are not collected by us.

Sale and sharing: we do not sell your personal information, and we do not share it for cross-context behavioural advertising. We use sensitive personal information, such as precise geolocation, only to provide the features you use.

Your rights:

• to know what personal information we collect, use and disclose
• to delete your personal information
• to correct inaccurate personal information
• to limit the use of sensitive personal information (we already use it only to provide the service)
• not to be discriminated against for using any of these rights

To make a request, use the in-app controls or email support@thelazaruslabs.com. You can also ask an authorised agent to make a request for you.

10. Children

Golf Caddie+ is not directed to children under 13, or under the minimum age required in your country if it is higher (in some parts of the EEA, that is 16). We don't knowingly collect personal data from them. If you believe a child has given us personal data, contact support@thelazaruslabs.com and we will remove it.

11. Security

• Data is encrypted in transit using HTTPS.
• Our database uses per-user access rules, so each account can reach only its own data.
• Login credentials are stored in your device's keychain.

No system is perfectly secure, but we work to protect your data.

12. Changes to this policy

When we change this policy, we'll update this page and the effective date at the top. If a change is material, we'll also tell you in the app.

13. Contact us

General and privacy questions: info@thelazaruslabs.com
Data requests and support: support@thelazaruslabs.com