Privacy Policy
Last updated: July 17, 2026. This is a draft. It has not been reviewed by counsel and is not yet in force.
1. Who we are
caddidaddy.com ("CaddiDaddy," "we," "us") operates the CaddiDaddy golf app, watch apps, and website. Contact: privacy@caddidaddy.com.
2. The data we collect and why
We only collect what the product needs to work. Here is every category, in plain terms.
| What | Why we collect it |
|---|---|
| Account data — email address | To identify your account and contact you about it. We never store your password; see Section 3. |
| Precise location / GPS traces, including background location while a round is active | To detect which hole and shot you're on, measure distances, and auto-assemble your scorecard. Background access is required because shots happen while your phone is in your bag. Detail in our Location Policy. |
| Motion sensor data (accelerometer/gyroscope) from an Apple Watch or Wear OS watch | To detect swings and distinguish a real shot from walking, a cart bump, or a ball pickup. |
| Heart rate from your watch | Wellness context only — composure and effort trends. This is health data; it has its own policy, retention, and consent. See our Health Data Policy. CaddiDaddy is not a medical device and makes no diagnostic claims. |
| Round scores, shots, club data, and derived statistics | The core product — your scorecard, strokes gained, club distances, and trends over time. |
| Voice audio, when you use the AI caddie | To answer your spoken questions during a round. Detail in Section 5. |
| Course corrections and pin reports you submit | To improve our proprietary course database (tee/green/hazard geometry). See Section 6. |
3. Authentication — we never see your password
Sign-in is handled entirely by CapchaID, our authentication provider. CapchaID stores and verifies your password; we never receive, store, or have access to it. At signup, CapchaID mints a consent certificate that we mirror into our own consent log so we can show you, on request, exactly what you agreed to and when.
4. Location data in detail
We collect precise GPS location, including in the background during an active round, so automatic shot detection and scoring can work without you touching your phone. We do not collect background location outside an active round. Full detail — precision, retention, what breaks if you turn it off — is in our Location Policy.
5. The AI caddie and Google Gemini
When you talk to the AI caddie, your voice audio is sent for processing to Google Gemini, routed through Cloudflare AI Gateway. Here is exactly what Gemini receives and does not receive:
- Gemini receives your spoken audio (or its transcript) for that session, and the specific numbers our deterministic scoring engine hands it to narrate — distance, target, recommended shot, risk, confidence. Gemini explains those numbers; it never invents them.
- Gemini does not receive your account email, password, payment information, or your full round history beyond what a given tool call passes it.
- Free tier: you supply your own Gemini API key. It is stored encrypted, on your device only, and is never transmitted to or stored on our servers. Your usage on the free tier is billed directly by Google to you.
- Paid tier: your voice session is routed through our pooled Gemini key via Cloudflare AI Gateway, and the audio/transcript is processed by Google under Google's own data-handling terms for the Gemini API.
6. Course corrections and pin reports
Pin reports and course corrections you submit become part of our proprietary course database (never mixed with OpenStreetMap data — see our attribution page for OSM sourcing). We may show an aggregated, non-identifying version of this data (e.g., "3 golfers confirmed this pin position today") to other golfers on the same course.
7. Third parties we share data with
| Party | What they get | Why |
|---|---|---|
| CapchaID | Email, password (they store it, we don't), consent certificate | Authentication |
| EdgeMailAPI | Email address, transactional email content | Account emails (verification, receipts, password reset) |
| Cloudflare | All application data in transit and at rest (D1, R2, Durable Objects, Workers) | Our hosting and data infrastructure |
| Google Gemini (via Cloudflare AI Gateway) | Voice audio/transcript and in-session numeric data, per Section 5 | The AI caddie |
| Stripe | Payment card details, billing email | Subscription billing (paid tier). We never see or store your card number. |
We do not sell your data. We share it only with the processors above, only as needed to run the service.
8. International data transfer
Our infrastructure runs on Cloudflare's global network, and our AI processing runs on Google's infrastructure. Depending on where you are and which edge locations handle your request, your data may be processed in a country other than the one you're in. We rely on each processor's own cross-border transfer safeguards (e.g., standard contractual clauses where applicable) rather than operating our own international transfer program.
9. Your rights: access, export, deletion
You can request a full export of every row of data tied to your account, or request permanent deletion of your account and all associated data (D1 rows, R2 objects, and Durable Object state), by emailing privacy@caddidaddy.com or using the in-app account tools once available (roadmap P1-T09). Deletion is permanent: once processed, a re-export of a deleted account returns nothing.
10. Retention
We keep your data while your account is active. Voice audio sent to the AI caddie is retained only as long as needed to complete and briefly debug that session, then deleted or handled per Google's own retention terms for API traffic. Heart rate and motion data retention is described specifically in our Health Data Policy. Location trace retention is described in our Location Policy. On account deletion, all categories are removed as described in Section 9.
11. Children
Our policy on accounts for golfers under 18, including why we do not currently permit under-13 signups, is in our Junior Golfer Policy.
12. Cookies
We use essential cookies for sessions and security. See the cookie banner for choices.
13. Changes
We will post updates here and adjust the "last updated" date. Material changes to how we handle health or location data will be called out clearly, not buried in a version bump.