score70 home

Privacy

What score70 keeps,
and who can see it

score70 stores names, handicaps and scores so a group can keep score properly. This page says exactly what that means, in plain words, including the part most people would rather not say: a trip that is shared by link can be read by anyone holding the link.

Effective

Who we are

The company behind the name

score70 is a trading name of CBI Digital Limited, a company registered in England and Wales, company number 16146193. CBI Digital Limited is the data controller: it decides what is collected and why, and it is who you write to about it.

Registered office: 1 Textile Drive, Brockworth, Gloucester, GL3 4WD.

For anything about your data, email privacy@score70.com.

score70 is for adults organising golf trips. It is not aimed at children and does not knowingly hold data about anyone under 18. Accounts are for people aged 18 or over, and an organiser should not add anyone under 13 to a roster without a parent or guardian knowing.

What we keep, and why

Four kinds of thing, and the reason for each

The law asks us to name the basis we rely on for each. Where it is the group’s legitimate interest rather than something you agreed to, it says so.

  • If you make an organiser account

    Basis: Providing the service you signed up for

    • Your email address, and whether you have confirmed it.
    • A display name, if you give one.
    • Your password, stored as a salted hash. We cannot read it.
    • When you signed up and when you last signed in.
    • Which groups you organise or play in, and which player on a roster is you, if you claim one.
    • Whether you have chosen to appear in course records, when you chose it, and the golf club you say you belong to, if you give one (see “Course records” below). These are in “Download my data”.

  • If somebody puts you on a trip

    Basis: The legitimate interest of the group in scoring its own golf

    • Your name, as the organiser typed it.
    • Your handicap index, and any trip-only adjustment the organiser sets.
    • If a club organiser loads its members file: your club membership number and your CDH / WHS handicap number. Only the organisers of that group can see them; they are used to recognise you in the next month’s file, are deleted if you are removed, and are in “Download my data”. Email addresses in the file are not kept.
    • Which ratings your handicap uses — “Men’s” or “Women’s”, the set of a tee’s course rating, slope and par your handicap index is kept under. The organiser sets it, or you do once you have claimed your name. It is used only to work out your course handicap, is shown only where it explains a handicap (Players, the handicap breakdown, Set up the day) and never on results or anything shared, goes back to the default if you are removed, and is in “Download my data”.
    • Whether you are a man or a woman, if the organiser says: optional, never guessed from your name, and the organiser can change it. It is used only to put a woman on the women’s tee and ratings when a round is set up. Only the group’s organisers see it; it is never on results or anything shared, is deleted if you are removed, and is in “Download my data”.
    • Which team you are on.
    • You do not need an account for any of this, and you may never have visited score70. The organiser entered it, and the organiser is responsible for telling you they did.

  • When a round is scored

    Basis: The legitimate interest of the group in a scorecard nobody can argue with

    • Your gross score on every hole, and the time each score was entered.
    • The course handicap you played off that day.
    • If the person entering the score was signed in, which account it was. Anonymous entries are recorded as anonymous.

  • On the phone you use

    Basis: Necessary for the app to work with no signal

    • A random id for the phone, so two phones scoring the same group can be told apart. It goes with each request so that forty phones on one clubhouse wifi are not mistaken for one very busy caller; the server keeps it for a minute at most, and never links it to you or to the name you picked.
    • Which player you said you were, per trip.
    • The invite key from any private trip link you opened, per trip, so the trip keeps opening for you. It identifies the trip, not you; the organiser can reset it, after which it stops working.
    • The names and addresses of the last few trips you opened, so you can switch between them. You can remove any of them from the Switch trip sheet.
    • A copy of the trips you have opened — names, handicaps and scores — so the scorecard still works on the course. It is deleted after 30 days.
    • Scores you entered with no signal, queued until they can be sent.

  • If you send us feedback

    Basis: Our legitimate interest in fixing and improving score70

    • What you write, which kind of feedback it is, and your email address if you give one so we can reply.
    • Added automatically, as the form says before you send: the kind of page you were on (such as “a trip’s scorecard” — never the trip’s address, its name or a round), the app version, and your browser and phone type. If you are signed in, which account sent it.
    • Never your trip’s scores or anyone else’s details. Only score70 reads it, to fix problems and decide what to build next.

And what is not here

  • No analytics or tracking script of any kind.
  • No advertising, and nothing sold or shared for advertising.
  • No fonts or scripts loaded from anybody else’s servers.
  • No payment details, because there is nothing to pay.
  • No date of birth, phone number, address or photo.

If you add a friend

Both of you say yes, and either can stop

Friends are optional and only for people with an account. When one of you asks and the other accepts, you each see the other’s handicap, latest round and your record against each other on the rounds you played together. That is shown on your consent, and you can take it back at any time: remove the friend, block them, or switch off “Show my handicap and latest round to friends”.

  • A friend never sees your email, who else you are friends with, or the name of a trip they are not in. Nobody else can see your friends.
  • We only suggest people whose names are on the same scorecards as yours. We never read your contacts, and there is no search by name or email.
  • If you invite someone who has no account yet, their trip shows them your first name and that you asked. We store that you invited that name on the roster, nothing else, for up to 90 days.
  • We never email about friends and never tell anyone you looked at their record. Blocking someone is silent.
  • Your friends are in your data download, and deleting your account deletes them.

Course records

Only if you say yes, and you can stop at any time

A course record is the best round at a course by a member of that golf club. It can be seen by anyone, so nobody is in one unless they have a score70 account and have switched on “Show me in my club’s course records” on their account page. It is off for everyone until they do. Players an organiser typed in, who have no account, are never shown outside their own group.

  • What anyone can see about a record you hold: your name as it is on your account (or, if it has none, the name you claimed), your score and how it compares with par, the date, whether it was a society trip, a league round or a day out, how many others were in the round, whether a playing partner entered the scores, and whether your membership is verified.
  • Never shown: your group’s name, the trip, its address, who you played with, your handicap index or your email address.
  • Which rounds count: a finished, complete 18-hole round in an individual stroke format, with every hole scored, played with at least one other person, in any of the groups you have claimed your name in — private ones included, though nothing about the group is shown.
  • How membership is checked: you can say which club you belong to, and your score shows as “unverified”, beside the record and never as it. It becomes verified when the club’s members list has been loaded on score70 by an organiser, score70 itself has confirmed which club the list belongs to, and you have claimed your name on it.
  • Stopping: switch it off on your account page and you are out of every course record straight away. Deleting your account takes you out too. Records are worked out each time they are shown, so nothing is left behind.
  • The basis is your consent. Inside a trip or league, the group still sees its own best rounds at each course — the “group best” — because those are the scores it already shares.

How long we keep it

Until you or the organiser ask, with two exceptions

Scorecards are the record of a trip, and the whole point is being able to look back at them, so trips, rosters and scores are kept until the organiser removes them or you ask us to. When an organiser deletes a trip it disappears from the site straight away and is permanently removed from our database 12 months later; until then it can be restored on request. Accounts are kept while you have one.

  • The copy on your phone is deleted after 30 days, and sooner if you clear the site’s data.
  • A password-reset link stops working after three days. A signed-in session lasts two weeks, and expired sessions are cleared nightly.
  • If you create an account but never confirm your email address, never sign in and are never added to a group, the account is deleted after 90 days.
  • Feedback you send is deleted 24 months after you send it. If you delete your account first, the feedback stays but without your email address or any link to your account.
  • Deleting an account does not delete the scores it entered. They stay on the card, marked as entered by nobody in particular.
  • Nightly database backups are kept for 30 days, so something deleted can persist in a backup for up to 30 days after it is removed.

Where it is stored

Four companies touch it, and none of them for their own purposes

Each one processes data only on our instructions, under a written data-processing agreement. Where a provider is outside the UK, that agreement includes the standard contractual safeguards UK law requires for sending data abroad.

Vercel
Hosts the website and the server that answers it, and keeps the server logs.
The server runs in London. Vercel is a US company with a worldwide network, so the page is served from wherever you are and its logs may be held in the US, under an agreement with us that carries the UK’s standard safeguards for data handled abroad.
Neon
Stores everything in the “What we keep” section.
A managed Postgres database in London (AWS eu-west-2). The company running it is based outside the UK, under an agreement with us that carries the same safeguards.
Resend
Sends every email score70 sends: confirming your address, a welcome once it is confirmed, password resets, a note if someone asks for a reset on an address with no account, a trip recap you ask for, and — once per trip — a notice to a player an organiser has added, saying their name and handicap are here and how to be removed. Trip invitations are not sent by score70: organisers share the link from their own phone.
A US company, and it keeps a copy of each email for 30 days in the US, under an agreement with us that carries the same safeguards. The address a notice goes to is typed by the organiser for that one send and is not kept by score70. Nothing is emailed to anyone for marketing.
Anthropic
Only if an organiser imports a tee sheet from a photo: the photo, which shows players’ names and tee times, is sent to Anthropic’s Claude to read the names and times off it. score70 does not store the photo.
A US company, under an agreement with us that carries the same safeguards. It processes the photo only to answer that one request, not to train its models. Pasting the tee sheet as text instead sends nothing to Anthropic.

One more: score70’s code lives on GitHub, a US company, and two jobs run there that touch real data, under the same kind of agreement. When we release a change, the job that updates the database’s structure connects to the database to do it. And every night a backup copy of the whole database is taken and kept there for 30 days, so that a mistake or a failure can be undone; those copies are private to us and are deleted automatically after 30 days.

Nobody else. No analytics company, no advertising network, no payment processor, no customer-support tool. Signing in is handled by score70 itself, not by anyone else. If that list ever grows, this page changes first.

Cookies and your phone

No tracking, so no banner

score70 sets two cookies, both only when you sign in: one that keeps you signed in for two weeks, and one that stops another website submitting forms as you. A third, short-lived one may appear on the page that confirms your email. That is the whole list. Nothing is set by anybody else, because nothing on the site loads from anybody else.

The app also keeps a small amount in your browser’s storage so it works on a course with no signal: the copy of your trips described above, scores waiting to be sent, which player you said you were, which trip you last opened, an organiser’s half-finished set-up for the day, and a few preferences like your last leaderboard tab. All of it is there to make the thing you asked for work, none of it is read by anyone but your phone, and clearing the site’s data in your browser removes the lot.

Your location is used only if you tap “Show courses near me” when choosing a course, and only after your browser has asked you. The distance to each course is then worked out on your phone: your location is not sent to score70 or anyone else, and it is not stored — it is gone when you close the page. Course locations come from OpenStreetMap (© OpenStreetMap contributors).

Because every cookie and every stored item is strictly necessary for the service, UK law does not require your consent for them, which is why there is no banner asking for it.

Your rights

What you can ask for, and how

Email privacy@score70.com and say which of these you want. We may ask you to show the request really is from you. We answer within a month, for free. If you are on a roster and have no account, the quickest route is often the organiser who added you, but you can always come to us directly.

See what we hold about you
Ask, and you will get a copy of everything above that relates to you.
Correct it
Your email or name if you have an account; your name or handicap if you are on a roster, which the organiser can also change.
Have it deleted
If you have an account you can delete it yourself, and it goes straight away: open the menu (More) in the app, tap My account, then Delete account — or go straight to score70.com/account/delete. You will be asked for your password (or, if your account was made with Google or Apple and has no password, to confirm with that account). The account, its email address, your sign-in on every device and your place in every group are removed at once, and a confirmation is emailed to the address that was on the account. Scores you entered stay on the trips they were on, with no account attached. A name on a scorecard is replaced with an anonymous label rather than removed, because the other players’ results depend on the card staying whole. If you cannot sign in, email us at the address above and we will delete it for you.
Object, or ask us to stop
If you never agreed to be on a trip and want off it, tell us or the organiser. The organiser can also make a trip private, and reset its invite link, so only the people they have sent the link to and signed-in members of the group can open it.
Take it with you
Ask, and you will get your data in a machine-readable form.

If you are not happy with our answer

You have the right to complain to the Information Commissioner’s Office, the UK regulator for data protection, at ico.org.uk or on 0303 123 1113. We would rather hear from you first, but you do not have to.

Changes to this notice

When it changes, the date at the top changes with it

This notice was last changed on . If what score70 keeps, who it shares it with or why ever changes, this page is updated before the change goes live, and anyone with an account is told by email if the change affects them.

Wondering what the app actually does with all this? See how it works.