Last updated: 2026-08-05 · Applies to the KITE Golf Leader Board web app and its iOS and Android applications.
This policy explains what personal data we process when you use KITE Golf Leader Board, why we process it, how long we keep it and what rights you have under the EU General Data Protection Regulation (GDPR) and the Swedish Data Protection Act. It also covers the disclosures required by Apple's App Store Review Guidelines and Google Play's User Data policy.
The data controller is Kitecreation AB ([Company registration number]), [Street address, postal code, city, Sweden], Sweden.
Privacy contact: privacy@kitegolfleaderboard.com. We respond to data subject requests within one month.
We have not appointed a Data Protection Officer because we do not carry out large-scale monitoring or large-scale processing of special category data.
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| Account identity: user ID, email address, and name/profile ID if you sign in with Google or Apple | Create and secure your account, sign you in | Art. 6(1)(b) contract | Until you delete your account |
| Plan data: subscription or beta status, family group membership, seat count, tier price | Provide the plan you bought and enforce seat limits | Art. 6(1)(b) contract | Until account deletion; billing records as required by law |
| Device and session data: device identifier you register, session token reference, active flag, last active time, last login time | Enforce the device and single-active-session limit, detect account sharing and abuse | Art. 6(1)(b) contract and Art. 6(1)(f) legitimate interest in preventing abuse | Sessions cleared on sign-out; device records until removed or account deletion |
| App state: language, open tournament tabs, followed players | Keep the app the way you left it across devices | Art. 6(1)(b) contract | Until you remove them or delete your account |
| Family invitations: invitee email or contact, invite token, acceptance and consent records | Run family accounts and keep an auditable record of consent | Art. 6(1)(b) contract and Art. 6(1)(c) legal obligation (accountability) | Tokens expire after 7 days; consent records kept for the life of the group |
| Consent choices for optional storage | Honour your cookie/local storage preferences | Art. 6(1)(a) consent | Until you change them |
| Technical logs: IP address, timestamp, error traces | Security, abuse prevention and debugging | Art. 6(1)(f) legitimate interest | Short-lived, typically up to 30 days |
We do not collect precise location, contacts, photos, health data, biometric data, or any special category data under Art. 9 GDPR.
We do not use advertising SDKs, we do not build advertising or behavioural profiles, we do not track you across other companies' apps or websites, and we do not use the iOS App Tracking Transparency identifier (IDFA). We do not sell or "share" personal data as those terms are defined under the CCPA/CPRA, and we do not carry out automated decision-making or profiling that produces legal effects.
Paid plans on iOS and Android are purchased through Apple's In-App Purchase or Google Play Billing. Apple and Google act as sellers of record and independent controllers for that transaction. We never see or store your card details — we only receive a purchase/entitlement confirmation linked to your account so we can unlock the plan.
Refunds and cancellations for store purchases are handled by Apple or Google under their own terms.
The app fetches and displays publicly published golf results from third-party sources: Min Golf (SGF), Golfdata / SGF Ranking, GolfBox / Nordic Golf League, Golf Genius, Clippd Scoreboard, The R&A.
This content — player names, clubs, scores, rankings — is already published publicly by the tournament organisers. We cache it briefly (typically minutes) to speed up the app and reduce load on the source sites. We do not enrich it, cross-reference it with other profiles, or use it for any purpose other than showing you the leaderboard you asked for. Our legal basis is legitimate interest (Art. 6(1)(f)) in providing a results viewer.
If you appear in these results and want your data removed from our cache and from search within the app, email privacy@kitegolfleaderboard.com and we will suppress it. Note that we cannot remove it from the source site — contact the organiser for that.
We do not send any of your personal data to these sources; requests are made by our servers, not from your device.
| Provider | Purpose | Location |
|---|---|---|
| Supabase (via Lovable Cloud) | Database, authentication, hosting of account and session data | EU |
| Google Sign-In | Optional authentication provider (email, name, profile ID) | EU / USA (SCCs, EU-US Data Privacy Framework) |
| Apple App Store / Google Play | In-app purchases, subscription billing and receipts | EU / USA |
Where a provider processes data outside the EEA, the transfer relies on the European Commission's Standard Contractual Clauses and, where applicable, the EU-US Data Privacy Framework. We do not disclose your data to anyone else except where required by law.
KITE Golf Leader Board is not directed at children under 16. You must be at least 16 to create your own account.
A family group organiser may invite a child under 16 to a seat. In that case the organiser must be the child's parent or legal guardian and confirms consent on the child's behalf when sending the invitation (Art. 8 GDPR). We record that confirmation, who gave it and when, in our consent audit log.
Child seats have the same minimal data footprint as any other account, receive no marketing, no ads and no behavioural tracking, and cannot access billing. A parent or guardian can review, export or delete a child's data at any time from the Family screen or by contacting us. Junior tournament results shown in the app come from publicly published organiser standings and are not collected by us from the players.
Under the GDPR you have the right to access, rectify, erase, restrict and object to the processing of your data, the right to data portability, and the right to withdraw consent at any time without affecting prior processing.
You can exercise the main rights yourself in the app: Account → Privacy & Data lets you download all of your data as JSON and permanently delete your account, plan history, devices, sessions and followed players. Account deletion is also available without contacting support, as required by Apple and Google.
For anything else, email privacy@kitegolfleaderboard.com. You also have the right to lodge a complaint with your supervisory authority — in Sweden, Integritetsskyddsmyndigheten (IMY), Sweden — imy.se.
Data is encrypted in transit (TLS) and at rest by our hosting provider. Database access is restricted by row-level security policies so an account can only read its own records, privileged functions are locked to explicitly authorised roles, and the single active session limit reduces the impact of a stolen credential. Access to production data is limited to the app owner.
If a personal data breach is likely to result in a risk to your rights, we will notify the supervisory authority within 72 hours and inform affected users without undue delay.
We will update this page when our processing changes and revise the "last updated" date. For material changes affecting your rights we will notify you in the app before the change takes effect.
Kitecreation AB · [Street address, postal code, city, Sweden] · privacy@kitegolfleaderboard.com
This page is maintained by the app owner to describe how KITE Golf Leader Board actually handles data. It is general information, not legal advice, and it is not an independent certification of compliance.
© 2026 Kitecreation AB. All rights reserved.