Privacy Policy

Foreteam ("we," "our," or "us") operates a golf partner matching service available as a mobile app (a web version may follow). This Privacy Policy explains how we collect, use, store, and protect your personal information when you use the app and our website.

By using Foreteam, you confirm you have read and agreed to this Privacy Policy. If you have any questions, email us at hello@fore.team — we're happy to help.

1. Data We Collect

Information You Provide

When you sign up and build your profile, we collect:

• Email address: Used to sign you in — we send a 6-digit one-time code to your email. There are no passwords.
• Golf profile: Your first name, skill level (beginner / intermediate / advanced / scratch), preferred playing days and time slots, the golf courses you choose and, optionally, your handicap
• Matching preferences (optional): your sex and whether you prefer same-sex partners, whether you are open to group rounds or mixed skill levels, and whether other golfers may find you in Explore. Your sex is used only to apply these preferences and is never shown to other users
• Profile photo (optional): Only if you choose to upload one. We may review photos and remove any that violate our rules (see Section 4)
• Messages: The messages (including any attached photos, short videos and voice messages) you send to other users through the in-app chat, and the short note you can attach to an invite in Explore
• Camera, microphone and photo library: used only when you take a photo, record a voice message or a video, or pick something from your library to send. Nothing is recorded in the background, and only what you send leaves your phone
• Ratings: After playing a round, you may rate a partner (one rating per person), optionally with a reason and a short comment. Ratings feed a reputation score shown to other users; the comment is seen only by us
• Reports: Anything you report to us from the app, so we can act on it
• Consent record: A record that you agreed to this Privacy Policy and the Terms

Data Generated by Your Use

We also record data derived from your use of the service:

• Session data: A session token (kept in the app's secure storage) that keeps you signed in after you enter your one-time code
• Push notification token: If you allow notifications, the device token Apple or Google issues so we can deliver them. It is deleted when you delete your account or when Apple or Google report the device as no longer registered. Signing out alone does not remove it: to stop notifications on a device you no longer use, delete your account or turn Foreteam's notifications off in that device's settings
• Usage events: Basic events about how the app is used — app opened, onboarding steps, a partner card seen or skipped, a message received — tied to your account and used only to run and improve the service. There is no third-party analytics SDK in the app
• Error and crash reports: When the app hits an error, we record what went wrong (the error text and a short technical trace, plus device model, OS version and app version). These reports are used only to fix bugs
• App version: Which version of the app you run and on which platform (iOS, Android or web), so we can keep older versions working and decide when one can be retired
• Feedback you send us: If you use "Report a problem" or "Suggest something" in the app, we keep what you wrote, the screen you sent it from and your app version, so we can fix the problem and reply. Feedback is kept for 400 days; when you delete your account it stays, with your name removed
• IP address and security logs: Your IP address is used to rate-limit sign-in and other requests and appears in server logs for about 30 days (see Section 4). If you join the waitlist, we keep the country your request came from
• One-off location lookup: Only if you tap "Find courses near me" and allow location access, the app sends your current coordinates once to list nearby courses. The coordinates are not stored
• Waitlist: If you join the waitlist on our website, we collect your email address and, optionally, your home course — used solely to notify you about the launch

What We Do NOT Collect

• Passwords — sign-in uses one-time email codes only
• Your location history — we never store your location (see the one-off course lookup above)
• Advertising or third-party analytics cookies or SDKs — the app sets no cookies; our website's page statistics run on self-hosted, cookieless Umami
• Payment information — Foreteam is free

2. How We Use Your Data

We use your data solely to operate and improve the golf partner matching service:

1. Sign-in — to send you a 6-digit one-time code by email and keep you signed in with a session token
2. Matching — to propose compatible golf partners at your chosen courses, based on skill level, availability, and course preference
3. Chat — to deliver the messages you exchange with other users in the app when arranging rounds
4. Ratings & reputation — to show other users a reputation based on the ratings players give each other after playing
5. Notifications — to send push notifications (e.g. about new matches or messages), transactional emails (sign-in codes) and occasional product emails about your matches, courses and check-ins. You can disable push notifications in your device settings at any time; every non-essential email carries an unsubscribe link
6. Safety — to handle reports, blocks and poor ratings, and to keep abusive accounts out
7. Photo moderation — to review reported or flagged profile photos and remove those that violate our rules (see Section 4)
8. Support — to respond to your questions and resolve technical issues
9. Legal compliance — to meet applicable legal obligations

3. Data Storage & Security

Where Your Data Lives

• Application and database: hosted on UpCloud infrastructure in the EU (Frankfurt, Germany), with a live standby copy of the database on a second UpCloud server in the EU (Amsterdam, Netherlands)
• Profile photos: stored on DigitalOcean Spaces in the EU (Frankfurt region)
• Chat photos, videos and voice messages: stored privately on DigitalOcean Spaces in the EU (Frankfurt region) and served through short-lived signed links
• Backups: encrypted database backups stored with DigitalOcean in the EU — a copy every 10 minutes kept for 3 days, daily copies kept for 30 days. A copy of the daily backups is also kept on our standby server in Amsterdam for 30 days
• Server logs: shipped to Axiom (EU region) and kept for about 30 days; log lines never carry your name, email or message text

How We Protect It

• All data in transit is encrypted via HTTPS / TLS
• Chat messages are stored encrypted at rest on our servers (not end-to-end encrypted — we can decrypt them to run the service and to act on reports)
• Access to production systems is restricted to authorised personnel only
• We regularly review and update our security practices

Data Retention

• Active accounts: retained for as long as you use the service
• Chat messages: retained for up to 365 days from when they were sent, then automatically and permanently purged — including attached media. If you delete a message of your own, it disappears for everyone in the chat, but the encrypted copy stays on our servers as possible evidence for a report until that purge
• Sign-in codes: deleted after 7 days; sessions expire after 180 days without use
• Email delivery log: which emails we sent to which address, kept for 90 days
• Usage events and invites: the record of what happened in your account (a match made, an invite sent, a badge earned) is kept for up to 400 days; Explore invites and their notes for up to 365 days. Both are purged automatically
• Do-not-contact list: if an email to you bounces, you mark it as spam or you unsubscribe, we keep your address on a small suppression list so we never email it again. It exists only to honour that, and it survives account deletion — removing it would let future emails through
• Backups: kept for at most 30 days, then deleted
• Waitlist: your email (and optional home course) is used solely to notify you about the launch
• Account deletion: delete your account anytime in the app (Settings → Delete account). Deletion is immediate: your name, email, golf profile, matching preferences, availability, courses, profile photo, sessions, push tokens and the notes on invites you sent are removed and your account is anonymised. Messages you sent stay visible to the people you chatted with, under the name "Deleted", until the 365-day purge removes them. Ratings you gave or received remain as anonymous reputation data, and any written rating comment is kept with your name removed. Reports you filed are kept with your name removed, and blocks stay in place, so that safety decisions stick. Usage events and the 90-day email delivery log keep only your numeric account id — no name, no address. Copies in backups expire within 30 days.

Data Breach Notification

In the unlikely event of a breach affecting your personal data, we will report it to the relevant data protection authority within 72 hours where required by law and notify affected users without undue delay.

4. How We Share Your Data

With Other Golfers

When the service proposes you as a partner, or shows you in Explore, other users can see:

• Your first name
• Your skill level and, if you entered one, your handicap
• Your profile photo, if you upload one
• Your reputation, based on ratings from players you've played with, your badges, rounds played and how long you have been a member
• Your home course (its name and town) and, in Explore, the distance between your home course and theirs — never your own location
• Your availability (the days and times you like to play)

Your email address, your sex and your matching preferences are never shared with other users.

Moderation, Reports and Blocks

We may review profile photos and remove any that violate our rules. Every user can be reported or blocked in the app, and anyone can report content they consider illegal by email. When you file a report or give a poor rating, we (the people running Foreteam) read it, including your first name and what you wrote, and act on it. If automated screening is enabled in the future, this policy will be updated to describe it before it applies.

Third-Party Service Providers

We rely on the following services to operate Foreteam. Each processes your data only as necessary to provide their service:

• UpCloud — cloud hosting for the application and database (EU) — Privacy Notice ↗
• Cloudflare — network security and TLS in front of our servers; sees your IP address as any connection reaches us — Privacy Policy ↗
• DigitalOcean — profile photo, chat media and backup storage (EU) — Privacy Policy ↗
• Expo, with Apple Push Notification service and Google Firebase Cloud Messaging — push notification delivery and app updates. A notification carries the sender's first name and a short preview of the message, so that text passes through Expo and Apple or Google on its way to your phone. On launch the app also asks Expo's update service (EAS Update) whether newer app code is available, sending the app version, runtime and platform, never account data — Privacy Policy ↗
• Axiom — server log storage (EU region, about 30 days) — Privacy Policy ↗
• Anthropic — an AI on-call agent (Claude) that, when a monitor fires, queries our server logs in Axiom to diagnose the outage and writes up what it found; it sees what those log lines contain (request paths, IP addresses, technical errors), never your name, email or messages — Privacy Policy ↗
• GitHub — runs our deployments and that on-call agent on GitHub Actions; sees deployment logs, the agent's log queries and their results, and its written incident reports — Privacy Statement ↗
• PagerDuty — alerting: receives the title of the monitor that fired and the on-call agent's short incident summary, nothing about you beyond what such a summary may contain — Privacy Policy ↗
• Resend — email delivery: sign-in codes and product emails — Privacy Policy ↗
• Proton Mail — hosting of our inbound mailbox, hello@fore.team (Switzerland) — Privacy Policy ↗
• Sentry — error and crash monitoring for our servers and the app (EU region, Frankfurt), configured not to send personally identifying information (no names, emails, message text or IP addresses) — Privacy Policy ↗

Legal Bases (GDPR)

• Performance of a contract (Art. 6(1)(b)) — your account, matching, chat, notifications about your matches
• Consent (Art. 6(1)(a)) — your profile photo, the one-off location lookup, optional matching preferences and product emails; you can withdraw each at any time
• Legitimate interests (Art. 6(1)(f)) — keeping the service secure and working: rate limiting, server logs, error reports, moderation and handling reports
• Legal obligation (Art. 6(1)(c)) — where the law requires us to keep or disclose data

Legal Requirements

We may disclose your information if required by law, court order, or government regulation. We will notify you where legally permitted to do so.

5. Your Rights

Under the GDPR you have the following rights over your personal data. In all cases, just contact us and we'll act on your request.

Right to Access

You can request a copy of the personal data we hold about you. Email us (see Section 8).

Right to Rectification

Update your profile — name, skill level, availability, courses, photo — at any time in the app.

Right to Erasure ("Right to be Forgotten")

Delete your account via Settings → Delete account in the app (or by emailing us). Deletion is immediate and cannot be undone; see "Account deletion" in Section 3 for exactly what is removed and what stays anonymised.

Right to Data Portability

Request a machine-readable copy of your data by contacting us (see Section 8).

Right to Object or Restrict Processing

You can object to or request temporary suspension of data processing by contacting us directly.

Right to Withdraw Consent

Stop using Foreteam at any time. Delete your account in the app (Settings → Delete account) to withdraw consent completely.

Complaints

If you're unsatisfied with how we handle your data, please contact us first — we'll do our best to resolve it directly. If that doesn't work, you can lodge a complaint with a supervisory authority — in Poland, the data protection authority is UODO ↗; you may also contact your local EU supervisory authority, the ICO ↗ in the United Kingdom, or the FDPIC ↗ in Switzerland.

If you live in the United States

Some US states give residents specific privacy rights. Whatever your state, here is what we do and do not do: we do not sell your personal information, we do not share it for cross-context behavioural advertising, we do not use it for targeted advertising, and we do not profile you in a way that produces legal or similarly significant effects. You can access, correct or delete your data and take a copy of it as described above, and we will never treat you differently for exercising these rights. Write to hello@fore.team; we answer within 30 days.

6. Children's Privacy

Foreteam is for adults: you must be 18 or older to create an account. We do not knowingly collect personal information from anyone under 18, and we close accounts we learn belong to minors.

If you believe we have inadvertently collected data from someone under 18, please contact us immediately and we will delete it without delay.

7. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, the "Last updated" date at the top of this page will change. We will notify users of significant changes in the app or by email.

Continued use of Foreteam after changes are posted constitutes acceptance of the updated policy. If you don't agree to the changes, please stop using the service and delete your account.

8. Contact

Questions, requests, or concerns about this Privacy Policy or your personal data? We're easy to reach:

• Email: hello@fore.team

Data Controller: Foreteam is operated by Paweł Kłeczek, a sole trader (jednoosobowa działalność gospodarcza) registered in the Polish Central Register of Business Activity (CEIDG), NIP 8641888325, ul. Fort Służew 3 m. 148, 02-787 Warszawa, Poland. Email: hello@fore.team. No data protection officer has been appointed; write to the address above.