Privacy Policy

AlignIQ Golf ("AlignIQ", "we") is a training platform for competitive golfers, operated by [COUNSEL: legal entity name and state of formation]. This policy explains what we collect, why, who can see it, and the controls you have.

Contact for anything in this policy: [CONTACT EMAIL].

Everything below is data you or your coach enter on purpose. We do not track you across other apps or sites, we do not use advertising identifiers, and we do not buy data about you.

• Account: name, email, username, and a password we store only as a salted hash (we cannot read it).
• Golf performance: rounds, hole-by-hole scores, shot detail (lie, distance, position), strokes gained, practice sessions, drills, equipment (your bag), and goals.
• Mental game and journal: played-freely ratings, reflections, journal entries, mental game cards, and notes. We treat this category as the most sensitive data in the product; see "What your coach can see."
• Photos you upload (for example scorecard photos), used to extract the round data you confirm.
• Messages you send to the app's AI features (the coach chat and Stevie, the logging companion).
• Technical records: session tokens (stored hashed), rate-limit counters (stored hashed), and product usage events used for reliability and product metrics.

To run the product: build your weekly plan, compute your stats, show your trends, and let you log with less friction. Recommendation priorities come from deterministic rules over your structured data; AI models are used for extraction (reading a scorecard photo), retrieval, and phrasing, not for deciding what matters.

We do not sell your data. We do not use it for advertising. We do not use your data to train AI models.

Some features send the data you provide to Anthropic (the maker of Claude) to power extraction, chat, and summaries. Under the API terms we use, Anthropic does not train models on this data. AI outputs in the product carry provenance: mental-game insights are attributed to the framework of Dr. Raymond Prior, and recommendations cite the data that produced them.

AI features never silently change your records. Anything an AI feature drafts (for example, a round Stevie transcribed from your description) requires your explicit confirmation before it is saved, and you can edit or discard it.

If you join a coach's roster, that coach can see your golf performance data: rounds, scores, shots, strokes gained, and practice.

Your mental-game and journal content is different. It is private by default, per coach. A coach on your roster sees a uniform "Private" placeholder unless you explicitly grant that specific coach access, and you can revoke that grant at any time. The placeholder is identical whether or not you have logged anything sensitive, so its presence reveals nothing.

Every coach read of your data is recorded in an access log.

[COUNSEL + PRODUCT: whether the played-freely percentage is classified as performance or mental-game data is an open product decision (D1). This section must be updated when it is made.]

We use a small set of providers to run the service. Each receives only what its function requires:

• Vercel: application hosting.
• Turso: the database where your data lives.
• Anthropic: AI processing described above.
• Resend: transactional email (password resets, coach snapshot emails you request).
• GitHub: encrypted-at-rest storage of database backups in a private repository, retained 90 days.
• Sentry: error monitoring. Error reports are scrubbed before sending: no cookies, no request bodies, no emails, no IP addresses.

Your data stays until you delete it. You can export everything as a machine-readable file and you can delete your account yourself, from your profile, without asking us. Deletion removes your rows from the live database immediately.

Backups age out on a 90-day cycle, so deleted data leaves backups within 90 days.

Regardless of where you live, we give everyone the same controls: export your data (self-serve), delete your account (self-serve), correct anything by editing it, and withdraw a coach's mental-game access at any time. For anything you cannot do in the product, email [CONTACT EMAIL].

[COUNSEL: add jurisdiction-specific language as required (e.g., GDPR lawful bases and EU representative if EU users are in scope; CCPA notice if California thresholds ever apply).]

[DECISION REQUIRED (D4) — Raymond + counsel must choose one of the two variants below. There is deliberately no default.]

VARIANT A (guardian consent): AlignIQ is designed for competitive golfers, including juniors. Players under 18 may use AlignIQ only with verifiable consent from a parent or legal guardian, collected at signup. The guardian may review the minor's data, withdraw consent, and delete the account at any time by contacting [CONTACT EMAIL]. We collect no more data from a minor than the product functions described above require. [COUNSEL: COPPA applies under 13; specify the verifiable-consent mechanism and whether under-13 is blocked outright.]

VARIANT B (18+ only): AlignIQ is for users 18 and older. We do not knowingly allow accounts for anyone under 18, and we delete any such account when we learn of it. [Note for decision: this variant conflicts with the junior-golfer pilot cohort; choosing it changes who the product can onboard.]

Passwords are stored as salted scrypt hashes. Session tokens and password-reset tokens are stored only as SHA-256 hashes; the raw values exist only in your browser cookie or your email. Auth endpoints are rate-limited. Coach access to player data is enforced server-side through a single tenancy boundary and logged.

No system is perfectly secure. If we learn of a breach affecting your data we will notify you [COUNSEL: notification window and mechanism].

If this policy changes materially we will tell you in the product before the change takes effect. The current version always lives at this address.