Privacy & Security

Members

Name, member ID, phone number, and email address. This is used solely to manage caddie requests and send round-related communications (e.g. chit links, reminders).

Caddies

Name, phone number, email address, and tax identification information (SSN/EIN) required for 1099 reporting. Rank, schedule, and loop history are stored for caddie management purposes.

Rounds & Payments

Loop dates, caddie assignments, base fees, and tip amounts are stored to generate earnings summaries and payroll reports. We do not store any credit or debit card numbers — payment processing is handled externally.

Usage Data

We do not use tracking pixels, behavioral analytics, or third-party advertising tools. Server logs may capture IP addresses and request timestamps for debugging purposes only.

Operations only

Your data is used exclusively to operate the caddie management platform — scheduling, loop assignment, chit delivery, tip processing, and earnings reporting.

No selling or sharing

We do not sell, rent, or share your personal information with any third parties for marketing or advertising purposes.

Service providers

We may share limited data with service providers who help us operate the platform (e.g. SMS delivery via Twilio, email via Resend, database hosting via Neon). These providers are contractually bound to protect your information.

Data in transit

All communication between your browser and our servers is encrypted via HTTPS/TLS. This includes chit links, member portals, and admin dashboards.

Data at rest

Your data is stored in a managed PostgreSQL database with encryption at rest. Database credentials are never exposed to the client and are stored as server-side environment variables.

Authentication

Admin, caddie, and member portals use separate, isolated authentication flows. Caddie and admin passwords are hashed using Argon2 — industry-standard, memory-hard hashing. Session tokens are short-lived and invalidated on logout.

Sensitive identifiers

SSN/Tax IDs are stored in the database and visible only to authorized club administrators. They are never transmitted to the client-side browser. QR codes and short codes are one-way mapped to caddie identities and do not expose personal data.

Chit links

Chit URLs use randomly generated tokens (not sequential IDs) and expire once the tip is completed. They do not require login and are designed to be shareable only with the intended member.

Transactional only

We only send messages that are directly related to your round — chit links, tip reminders, and loop confirmations. We do not send marketing emails or SMS messages.

Opt-out

If you no longer wish to receive chit notifications, please contact your club's caddie master or club administrator to update your preferences.

Access & correction

Members and caddies may request access to their personal data or ask for corrections by contacting their club administrator.

Deletion

You may request that your personal data be removed from the platform. Certain records (e.g. historical earnings for tax purposes) may be retained as required by law.

Data portability

Club administrators can export member and caddie data via the Reports section. Individual data requests can be accommodated by contacting your club.