Privacy Policy
Last updated October 23, 2026
Draft for counsel review. Not legal advice.
The short version
We collect what it takes to keep your score, map your round and show you to your friends, and nothing more. We don’t sell your data, we don’t run ads and we don’t track you across other apps. Health data stays out of marketing, always. You can see, download or delete everything from Settings.
This policy explains what Shot Lab LLC (“Shot Lab”, “we”) collects when you use the Shot Lab apps for iPhone, Apple Watch, Android and Wear OS, and the website at shotlab.app. It applies to everyone, wherever you live. Sections for specific places are at the end.
What we collect
| Data | What it’s for | When |
|---|---|---|
| Account: username, email, name and photo if you add them, sign-in from Apple or Google | Your profile, friends, posting rounds to the right accounts | When you sign up |
| Precise location | Distance to the basket, marking throws, finding the next tee, nearby courses, mapping a hole | Only while the app is open and you’ve allowed it; never in the background outside a round |
| Rounds and throws: scores, discs, lies, distances | Your card, stats, Caddie, badges | When you play |
| Health and fitness: steps, distance, calories, heart rate, workouts | Saving rounds as workouts, health badges. See the Consumer Health Data Privacy Policy | Only if you turn on workouts and allow access |
| Watch motion data | Detecting throws | Processed on the watch. Raw motion data never leaves your devices unless you opt in to share labeled throws to improve detection |
| Friends and cheers | Friend lists, live “playing now” status, the six cheers | When you use friends features |
| Map contributions and condition reports | Improving course maps for everyone | When you submit them |
| Purchases | Unlocking Pro and Pro+. Payment is handled by Apple or Google; we never see your card | When you subscribe |
| Device and diagnostics: app version, crash logs, coarse usage events | Fixing bugs and keeping the app fast | While you use the app |
| Feedback you send: your report, any screenshots you attach, diagnostics if you leave them on (app version, device model, system version and the screen you were on), and a reply email if you give one | Fixing what you report. Reports are kept as issues in our private GitHub repository, never in analytics | Only when you send feedback |
What we never do
- Sell or rent your personal data, to anyone.
- Show ads, or share data for cross-app or targeted advertising.
- Track you across other companies’ apps and websites.
- Use data from Apple Health, HealthKit or Health Connect for advertising or marketing, or store it in iCloud.
- Show your location on a map to other people.
Course traffic and walking paths
“How busy is it” counts and the walking routes between holes are built from location data that we aggregate and de-identify before use. Counts are only shown when enough players are present that no one can be singled out. We don’t try to re-identify anyone from this data and we don’t let others do it.
Friends and what they see
By default, friends see that you’re playing, the course and your score so far. They never see your position on a map. You can limit this to selected friends, hide your status, or go private in Settings › Privacy at any time.
Profiles, reviews, leaderboards and leagues
Your web profile shows your name, photo, home course and showcase badges, never your rounds or location, and you can turn it off in Settings › Privacy. Course reviews you write are public with your display name. Course leaderboards show your name and score only if you opt in. When you join a league, its players see your name and scores on its leaderboards; directors never see your email.
Rules Ask
Rules Ask answers rules questions from Shot Lab’s rule summaries. Answers made on your phone (Apple Foundation Models, Gemini Nano) never leave it. Questions sent to the cloud are processed by Cloudflare Workers AI (no training, no retention) and, as a fallback, Groq (no training, logs kept up to 30 days). Questions are not stored in readable form and are never used for analytics. Ask quotas use hashed IP addresses and a random Ask device id.
Who we share data with
Only service providers who help us run Shot Lab, under contracts that limit them to doing that work:
- Cloudflare: hosting, databases and storage, email delivery, Workers AI for Rules Ask, and cookieless, aggregate page counts on the website.
- RevenueCat: subscription status.
- Apple and Google: sign-in, billing and push notifications.
- PostHog, in the apps only: usage events and crash reports, with IP addresses discarded and not linked to your account.
- Groq: a fallback for Rules Ask questions.
- Apple WeatherKit: forecasts, which receives the course location, not your identity.
- GitHub: our private issue tracker, which holds the feedback you send from the app.
We may disclose data if the law requires it, to protect someone’s safety, or as part of a merger or sale, in which case this policy continues to apply.
How long we keep it
- Account, rounds and stats: until you delete them or your account.
- Raw location points from a round: 90 days, then reduced to the throws and totals on your card.
- Diagnostics: up to 12 months.
- Map contributions: kept in de-identified form after you delete your account, because they’re part of the shared map.
Your choices
- Turn location, health access, notifications and friends visibility on or off at any time in Settings or your phone’s settings.
- Download your data or delete your account in Settings › Account, or on the web at shotlab.app/delete.
- See Your Privacy Choices for access, correction, deletion and appeal requests.
Children
Shot Lab is for people 13 and older (16 in some countries). We don’t knowingly collect data from younger children. If you think a child under 13 has an account, email privacy@shotlab.app and we’ll delete it.
Security
Data is encrypted in transit and at rest, access is limited to staff who need it, and health data is stored separately from other account data.
United States
Depending on your state, you may have the right to know, access, correct, delete and port your data, to opt out of sale, targeted advertising and profiling (we do none of these), to consent before we process sensitive data such as precise location and health data, and to appeal a decision. We honor Global Privacy Control signals. California residents: the categories above are the categories we collected in the past 12 months; we have not sold or shared personal information as those terms are defined by California law. Washington, Nevada and Connecticut residents: see the Consumer Health Data Privacy Policy.
EU, UK and Switzerland
Shot Lab LLC is the controller. We rely on contract to provide the app, consent for health data, precise location and optional analytics, and legitimate interests for security and fixing bugs. You can access, correct, delete, restrict, object and port your data, withdraw consent at any time, and complain to your local data protection authority. Transfers to the US rely on the EU-US Data Privacy Framework and its UK and Swiss extensions, with Standard Contractual Clauses as a backup. Our EU and UK representatives will be listed here before Shot Lab launches in those regions.
Changes and contact
We’ll tell you in the app before a material change takes effect. Questions or requests: privacy@shotlab.app, or Shot Lab LLC, Wilmington, Delaware, USA.