Heckler Golf · Legal

Privacy Policy

Effective: September 9, 2026 · Operator/controller: Regulr AI, Inc. · Mailing address: 1476 Yates St., Denver, CO 80204 · Privacy contact: hello@heckler.golf · Support: hello@heckler.golf

Current availability: the browser game is free. Member accounts, verification texts and Apple Wallet provisions apply when those features are available and you use them. Paid-entry identity, location and payment collection is not active.

1. What this notice covers

This notice explains how Heckler Golf handles personal information when you visit heckler.golf, play browser golf, create a member account, interact with friends, contact us or add an optional Apple Wallet member pass. Available features may vary. A separate notice and event rules will explain any additional information needed before you enter an enabled paid or prize competition.

2. Information we collect and why

Account and contact information. We collect your display name and email address to create an account and send a requested sign-in code. We keep your sign-in session in browser storage so you can return without requesting a code each visit. Phone verification, if offered separately, has its own notice and choices. We assign account/member identifiers and record preferences, verification and consent events. Support messages include information you choose to provide and our response history.

Game and social records. We process game settings, shots, scores, saved rounds, match records, invitations, friend requests, friendships, blocks and event preferences to provide play, resume progress and operate requested social features. We may associate these records with a guest session or member account. We distinguish device-imported solo progress from server-scored match history where the feature supports that distinction.

Technical and security information. Our service and infrastructure providers process IP addresses, request times, browser/device information, session identifiers, authentication and security events to deliver, protect and troubleshoot the service. Some abuse-control records use keyed hashes of phone numbers and IP addresses. Hashing reduces direct exposure but does not make linkable information anonymous. Configured security challenges may process browser and interaction information through the challenge provider.

Service measurement. We record a limited set of membership steps, such as verification, return to play and opening the Wallet offer, along with a broad device category. These records may be associated internally with an authenticated account or guest identity. We use aggregated reports to find where signup or features fail. We do not need the contents of a verification code, private invite URL or custom message for these measurements.

Sponsor measurement. We use a short-lived browser identifier and placement events, such as an exposure, card opening or outbound click, to measure on-course sponsorship. The underlying records are pseudonymous, not necessarily anonymous. Sponsor reports are aggregated; we do not provide sponsors with player phone numbers, verification codes, friend lists or account-level enrollment records through these reports.

3. Cookies and browser storage

We use browser storage and authentication technologies to maintain sessions, remember settings, preserve saves and continue signup. Some information remains on your device until removed, overwritten or cleared by your browser. Removing storage can sign you out or remove unsynchronized progress.

The golf_sponsor_session cookie is a first-party reporting identifier with a 24-hour lifetime. It is limited to the sponsor API path. We also use short-lived session storage for pending verification and queued measurement events, and local storage for saves, trial progress and member-pass offer preferences. A preference's functional expiry does not necessarily erase its stored value at that exact moment.

Our sponsor-reporting flow suppresses new reporting when it receives supported Do Not Track or Global Privacy Control signals. This does not turn off security processing, requested account functions or all internal service measurement. Browser controls can limit or clear storage. We do not use our sponsor-reporting flow to build cross-site advertising profiles.

Third-party security services, when loaded, process information necessary for their challenge functions and may use their own technologies across services. External sponsor sites receive connection information if you visit them and apply their own policies. We do not embed a sponsor's advertising pixel merely by showing an on-course placement. Any later tracking or advertising integration requires an updated assessment and applicable choices before activation.

Google Analytics. We use Google Analytics 4 to understand visits and use of our website. Google processes browser/device information, page activity and analytics identifiers, and may set first-party analytics cookies. We disable Google advertising signals and ad personalization for this integration. Our page configuration removes query strings and URL fragments from reported page locations and referrers so sign-in codes and private invite links are not included in those fields. We do not intentionally send your email address, phone number or account ID to Google Analytics. Google describes its processing at How Google uses information from sites that use its services.

Our own analytics. We also keep our own measurement of how the site and game are used. It is stored with our database provider and is not shared with advertisers or other third parties. When you first visit, your browser receives a random analytics identifier kept in local storage. We record page views; which platform or site referred the visit (for example a social network, a search engine or a link another player shared); campaign tags in our own links; your device type, operating system and browser family; the country derived from your connection; and game events such as starting a course, finishing a hole and each step of signup. We do not store your IP address, full referring addresses, query strings, names, email addresses or messages in these records. If you create a guest or member account, we link that browser's identifier to the account so we can understand how people find and join Heckler. We keep individual records for up to 13 months.

Neither Google Analytics nor our own analytics runs when your browser sends supported Do Not Track or Global Privacy Control signals, or when you turn analytics off below. Your choice applies to this browser; clearing site storage resets it. Turning analytics off removes this site's Google Analytics cookies and our analytics identifier without removing your account session or game saves.

Manage analytics

4. Who receives information

Other players. Your display name, member code, relevant match activity and event ranking may be visible where needed for a feature you use. Holders of a private invite link can see limited lobby information and request to join. Your phone number is not searchable by players. We do not upload your phone's address book. Avoid putting private contact details in your display name or broadly sharing invite links.

Service providers. We use Vercel for hosting/server functions and Supabase for authentication, database and live-match services. When phone verification is enabled, Telnyx delivers requested authentication texts. Apple processes member-pass functions when you add a pass. A configured challenge can use Cloudflare Turnstile or hCaptcha. These providers receive information needed for their roles and may have independent legal obligations. An enabled security challenge identifies its provider when presented. Email communications are also processed by the mail services used by you and us.

Sponsors and fulfilment. Current sponsorship reporting provides aggregate placement measurements. If you later win a prize, an event-specific notice will identify information needed by an identified fulfilment provider. Entering an event does not automatically subscribe you to a sponsor's marketing or permit us to give it your phone number for promotions.

Legal, safety and business purposes. We may disclose information where reasonably necessary to meet law or valid legal process, protect people and systems, investigate abuse, establish or defend legal claims, or complete a business transaction under appropriate confidentiality and privacy protections. We also disclose information when you direct us to do so. These descriptions do not authorize unrelated sale or reuse.

We do not sell personal information or share it for cross-context behavioral advertising in the service described here. We do not sell or share mobile numbers, SMS opt-in information or authentication consent with third parties or affiliates for their marketing/promotional use. Delivery providers may process that information to provide the requested messaging service. If practices change, we will update this notice and provide choices or consent required before the new processing begins.

5. Verification texts and communications

Email preferences. The optional Heckler news, courses and offers checkbox starts selected during signup. You can clear it before continuing or change it in Account → Member card & email preferences. We record the submitted choice, wording, date and whether the box was selected by default. Authentication emails are separate from marketing preferences. Any marketing emails we send will include an unsubscribe option.

Authentication texts, if enabled, are sent following your request and separate SMS choice. Message frequency depends on your requests; message and data rates may apply. Reply STOP to opt out or HELP for assistance. Opting out can prevent further SMS-based sign-in until delivery is restored. Authentication consent does not enroll you in promotional messaging. See the SMS Terms for the program contact and details.

6. Apple Wallet member pass

Adding a pass is optional and requires your action. The pass can contain your name, member code, match record and event information. It does not contain your phone number or an account sign-in credential. We process pass identifiers, device registration identifiers and push tokens to issue, update and revoke the pass. A device registration is not universal proof that a pass is currently installed or that a notification was displayed.

Public record/event updates are silent by default. A separately disclosed internal pilot may allow limited featured-event alerts for selected test members who opt in and can turn the pilot off. Manage the pass and available update settings in Wallet. Removing the pass does not delete your Heckler account; deleting your account initiates pass revocation. Apple applies its own privacy practices to its services.

7. How long information is kept

We retain information for the purpose for which it was collected, including providing an active account, resolving a specific dispute, maintaining security and meeting legal obligations. We restrict access to records retained for a legal hold and delete or de-identify them when the justification ends. We do not keep every category indefinitely simply because an account once existed.

Sponsor measurement uses a limited reporting window. Operational records may remain until their scheduled cleanup completes. Account, support and security retention depends on the active relationship, the type of record, a specific dispute or legal requirement, and provider retention arrangements. Provider logs and backups may have separate periods. Before additional member or paid-entry collection begins, we will update this notice with the applicable retention details. You can ask us about the retention of a particular category at the privacy contact above.

Deleting an account removes or dissociates profile and social records and initiates removal of the authentication account. Some completed match information may remain to preserve opponents' records and integrity, with reduced identifying information where supported. A redacted pass record may remain to communicate revocation. Technical/security records, necessary consent evidence, support records and provider backups may persist for their documented purposes. Ask us about a particular record through the privacy contact.

8. Your choices and requests

Available Account settings let you edit a display name, manage friends and blocks, remove saves, manage the member pass, sign out and request deletion. You may also contact hello@heckler.golf for access, correction, deletion or a portable copy, or to exercise other applicable rights. We will review requests regardless of whether a particular state statute applies and explain any lawful limitation. We may need reasonable information to verify ownership; do not send passwords, codes or government documents by ordinary email. We do not require a new paid account to make a request.

Depending on applicable law, you may have additional rights concerning sale, targeted advertising, significant profiling or sensitive information, and to use an authorized agent or appeal a denial. We do not use the described service to make automated decisions with legal or similarly significant effects about credit, housing or employment. Future anti-fraud eligibility decisions will require their own assessment and review path.

We will respond within the applicable deadline, explain an allowed extension and give reasons for a refusal where required. You can ask for reconsideration at hello@heckler.golf with “Privacy appeal” in the subject. If an applicable law provides an appeal or regulator-complaint right, we will explain that process. We will not unlawfully discriminate against you for exercising privacy rights. Essential account deletion or declining necessary processing may make the related feature unavailable.

9. Age and location of the service

Our account service is intended for adults; paid/prize entry, if offered, has additional age and location requirements. We do not knowingly allow under-13 children to create accounts. If you believe a child has provided personal information, contact hello@heckler.golf so we can investigate and take appropriate action. An adult-use statement does not replace our obligation to respond to what we know about a user's age.

Our providers may process information in the United States and other locations where they operate. We apply legally required safeguards to transfers covered by applicable law. Contact us for information about a transfer involving your data. Use from another country does not itself supply any legally required consent to an international transfer.

10. Security

We use administrative, technical and organizational measures appropriate to the information and risk. No internet service can guarantee perfect security. Report suspected account compromise or security issues to hello@heckler.golf. Do not disclose authentication codes or full payment/identity documents in a report. We will handle qualifying incidents and notices under applicable law.

11. Changes and contact

We will post changes with a revised effective date and give notice of material changes through an appropriate website/account channel. We will obtain consent where a new use requires it. For privacy questions or an accessible alternative format, contact the operator at the email or mailing address above.

12. Future paid/prize features

Paid entry and payouts are not currently offered. If we introduce them, the additional data categories below may be necessary. We will explain the actual collection, named providers, recipients, retention and required choices before asking you to provide that information. This section does not authorize collection before that notice.

Any identity process involving biometric information will require a separate applicable notice, consent and retention review before it is offered. We will not treat a general agreement to the Terms as permission for every sensitive-data use.