Privacy Policy

What we collect

Everything the site can read without an account — every club, shaft and course page — collects nothing about you beyond the analytics and the Grow button named at the end of this list. The rest of the list is what an account can carry, and every entry in it is something you typed or switched on yourself.

• Email and a display name — when you create an account. The email is how you sign in, verify the account and reset a password; it is used for the newsletter only if you ticked the optional box, and either way there is no separate list.
• Your golf profile and statistics — handicap index, gender, handedness, age band, swing speed, a home course and tee, and how your stated distances were measured. If you file round statistics (greens in regulation, miss directions, fairways, the scoring mix, putting), each reading is stored under the date you gave it and the app or tracker you said it came from, as a timeline you can edit or delete entry by entry. Every field is optional and every one is stored exactly as you enter it. We store what you tell us; anything the site works out from it is calculated fresh each time and never written back as though you had said it.
• Your bag — the clubs you carry, their lofts, an optional link to the catalog entry, and how far you say you hit each one. A distance is recorded together with whether you measured it yourself or accepted a figure we suggested.
• Rounds and shots, if you track a round — this is location data: the GPS position of each shot and where the ball finished, plus the club, the lie, the result and the time. It is recorded only while you are tracking a round.
• Saved strategy plans — the course and tee, the plan as computed, and your own edits to it: per-hole club choices, aim points and pin positions you place on the map (both are map coordinates), lay-up distances and any notes you write. A plan also stores a snapshot of the profile and bag it was built from, so we can tell you when your own numbers have moved rather than quietly showing you stale advice.
• Saved courses — the courses you save, the tee you play there, and any note you write about the place. The note is shown only to you.
• Reports you send about a record — if you tell us a figure is wrong or missing on a club, shaft or course page, we keep what you typed: the value or the link, your note, and which page and field it was about. You do not need an account to send one; if you were signed in, the report is linked to your account so we can weigh it at review time. These reports are claims we check by hand — nothing you submit is ever published automatically.
• Support messages — a message sent through the support form is delivered to our mailbox as an email, with your account's address as the reply-to. It is not stored in any database of ours; the mailbox is the record.
• IP address and browser user agent — recorded with each sign-in session, which is how a session can be traced or revoked if an account is compromised. The IP is also used, briefly, to rate-limit sign-in attempts and record submissions.
• Analytics: two counters. Cloudflare Web Analytics counts pages without a cookie: nothing written to your device and no cross-site tracking. Google Analytics counts visits and the pages they read, using two cookies on this site (_ga and _ga_MY6N5MS0VK) to tell a returning browser from a new one, and Google receives the page address, your browser's details and your IP address with each visit. Its advertising features, Google signals and ad personalization, are switched off. You can switch Google Analytics off, or stop both counters in your browser, and the cookies page says how.
• The Grow button: a save and share button, with suggested pages, run by Mediavine, an advertising company. Mediavine receives the page address, your browser's details and your IP address, and records how readers use the button. It keeps a cookie and an entry in your browser's local storage, named on the cookies page, and more if you save a page or sign in to Grow, in which case your Grow account is held by Mediavine under its own terms. Grow can load advertising identity tools, and this site blocks them. You can switch Grow off.

How we use it

To run the service (sign-in, saving your data), to send transactional email (verification, sign-in codes and password resets), and — only if you asked for it — to send the weekly newsletter. The newsletter is an optional, unticked box on the sign-up form, separate from agreeing to these policies; creating an account does not subscribe you, and you can turn it on or off at any time without affecting the account. We store whether you consented and, if you did, the time you gave it; turning it off clears that timestamp, because there is then no consent to date.

Your golf profile, your statistics, your bag and your saved plans are also used to tailor what Zomma shows you — the gear, the data and any advertising or affiliate links we put in front of you. If you have added a Titleist driver, for example, we may surface Titleist specifications and offers rather than a brand you do not carry. This is us using your own data to decide what you see on your own screen; it is not us handing your data to anyone.

We also produce aggregate, de-identified statistics across all accounts — counts and trends such as how many players carry a given brand, or the distances golfers of a given handicap report — and we may quote those figures to advertisers and affiliate partners. They are numbers about the group, never about you: they carry nothing that names or identifies a person and cannot be traced back to your account. Those figures are the only thing a marketer ever receives. We do not sell or share the personal information in your account: your email, your profile, your bag, your rounds and your plans.

Two optional tools on the site are a different case. Google Analytics and the Grow button from Mediavine run in your browser and send Google and Mediavine what they collect there: the page address, your browser's details and your IP address, never anything from your account. US state privacy laws can count that as sharing, so we treat it that way. Both are on unless you switch them off on the cookies page, and if your browser sends Global Privacy Control they stay off without you doing anything.

A tracked round is location data, and we treat it as the most sensitive thing here. It is used to compute your strategy — and only if you switch that on for the round, which is off by default and set one round at a time — and to improve our course maps. It is never used to choose your advertising, and it never enters the figures we quote to marketers.

A report you send about a record is used for one thing: checking the claim against its source and, if it holds up, correcting the database. Your support messages are used to answer you.

The AI Studio

When you ask the AI Studio for something, we send your request, together with the golf numbers it needs to answer, to Cloudflare, whose Workers AI service runs the AI model that writes the answer. Those numbers are your handicap index, or the range estimated from your typical score together with the course and tee it was estimated at, the clubs in your bag with the distances and widths you gave or accepted for them, statistics you filed such as your fairways rate, and the course, tee and hole plans the answer draws on.

We send no name, no email address and no account identifier with it. The only label on the request is a scrambled code that lets us count your usage without saying who you are. Your request itself is sent as you typed it, so leave out anything you would not want sent.

Cookies and similar technologies

This site sets first-party cookies to keep you signed in, to remember your cookie choice, and to carry the human check that lets you ask a question without an account. Two optional tools add their own: Google Analytics, which counts visits, and Grow from Mediavine, the save and share button. Both are on unless you switch them off, and switching either off stops it loading and deletes what it stored here. If you ask the site not to count your visits, your browser remembers that in its local storage, and neither counter nor Grow loads again. The other third-party scripts are Cloudflare's: the cookieless page counter, and the Turnstile human check, which loads on the pages where a check is needed and nowhere else. See the full list and the controls.

This site will carry advertising later, and we would rather say so here than surprise you with it. When it arrives, each advertising cookie is listed on that page with a switch that works, and you can turn it off without giving up your account. If your browser sends Global Privacy Control, we treat that as an instruction to opt you out of any sharing of your data, automatically, with nothing for you to click: Google Analytics and Grow both stay off.

Who processes it

• Cloudflare — hosting and delivery of the whole site, the accounts database (D1), storage for the course map files (R2), the Turnstile human check on sign-in, sign-up, record reports and questions asked of the AI, Workers AI, which runs the model behind the AI Studio, and the cookieless analytics named above.
• Google: Google Analytics, unless you switch it off.
• Mediavine: the Grow button, unless you switch it off.
• Resend — email delivery: verification links and sign-in codes, password resets, support-form messages, and the newsletter.

Those four are the whole list. Cloudflare and Resend process data on our instructions to run the service. Google and Mediavine receive what their tools collect, as described above, and nothing from your account: no email, no name, no golf profile and no rounds.

Your rights

You can unsubscribe from the newsletter at any time — the toggle in your account settings, or the link at the bottom of any issue. Unsubscribing stops the email and leaves your account and saved data alone. You can delete your account from the same page; deletion is permanent and removes the account and everything saved to it — profile, statistics, bag, rounds and shots, plans, saved courses, and the newsletter subscription with it. When you delete your account, we keep a one-way scrambled form of your email address and your usage counts only until your current usage limits reset, so a limit cannot be reset by deleting and re-creating an account.

One exception, stated rather than buried: a report you sent about a course or club is kept, but the link to your account is severed — what remains is a value, a URL and a timestamp attached to nobody. It stays because it may already be the recorded source of a published figure, and erasing where a figure came from is the one thing a research database must not do. Nothing about you survives with it.

To request a copy of your data, email us at the address below and we will action it by hand — there is no self-service export yet, and we would rather say so than point you at a button that does not exist.

Contact

Privacy questions, and requests for a copy of what we hold about you, go to help@zommagolf.com. If you are signed in, the support form sends to the same place and already knows which account is asking.