Privacy Policy

1. Scope

This Privacy Policy describes how Grassy ("Grassy," "we," "our," or "us") collects, uses, discloses, and protects information when you use our iOS mobile application and our website (collectively, the "Services").

2. Information We Collect

We collect information in the following categories:

• Account and profile information: phone number, email address (including Apple private relay emails), display name, username, profile photo, and other profile details you choose to provide.
• User content: golf course ratings, reviews, lists, comments, likes, follows, and any text, photos, or videos you upload.
• Contacts (optional): if you opt in to "find friends," we access your device contacts and may upload contact identifiers (such as phone numbers) to our servers to help you discover people you know on Grassy and to enable invitations. We do not need (and do not request) access to the full contents of your communications. Contact access is optional and can be turned off in your device settings.
• Location information (optional): if you grant location permissions, we may collect precise location when the app is in use and, if you grant "Always" access, in the background to support golf course proximity features (for example, nearby course discovery and arrival reminders). You can control this in iOS Settings.
• Photos (optional): if you choose to upload images or set a profile photo, we access photos you select. If you choose to save generated images to your camera roll, we request permission to add photos to your library.
• Device and usage information: device model, operating system and version, app version, language, time zone, IP address, and diagnostic/usage events generated when you use the Services.
• Push notification information: a device token (such as an FCM token) and notification interaction data to deliver and manage push notifications.
• Third-party data you choose to connect: if you use features that integrate with external services (for example, providing a GHIN number to sync score history), we process the identifiers and results needed to provide that feature.
• Support communications: information you provide when you contact us (for example, emails, messages, and attachments).
• Creator Program information: if you participate in the Creator Program, we collect additional information including your legal name, address, date of birth, tax identification number (SSN/ITIN), bank account information (processed by Stripe), identity verification documents, and earnings and engagement data. This information is required for payment processing, tax reporting, and fraud prevention.

If you do not provide certain optional information (like location or contacts), some features may be unavailable or limited.

3. How We Use Information

We use information for purposes such as:

• Providing, operating, maintaining, and improving the Services (including search, recommendations, and personalization)
• Creating and managing accounts, authentication, and user settings
• Enabling social features (following, feeds, notifications, and other community features)
• Delivering push notifications and other communications you request or opt in to receive
• Moderation, safety, and integrity (including detecting fraud, abuse, spam, and prohibited content, and performing automated content safety checks for uploaded media)
• Analytics and measurement to understand usage and improve performance
• Complying with legal obligations and enforcing our Terms

4. How We Share Information

We may share information in these ways:

• With other users: depending on your settings and how the Services work, your profile and user content (such as posts, ratings, and reviews) may be visible to other users or the public.
• With service providers: we use vendors to host and operate the Services, including providers for authentication, databases, file storage, analytics, and infrastructure.
• With third-party platforms you choose: if you share content to third-party apps or platforms (for example, Instagram or TikTok), those services receive the information you share and their policies apply.
• For legal, safety, and enforcement reasons: to comply with law, respond to lawful requests, protect rights and safety, investigate violations, or prevent fraud.
• Business transfers: in connection with a merger, acquisition, financing, or sale of assets (information may be transferred as part of that transaction).

We do not sell your personal information in the traditional sense.

5. Third-Party Services We Use

The Services may rely on third-party providers such as:

• Google/Firebase: authentication, databases, cloud functions, analytics, file storage, and push notifications
• Algolia: search functionality (for example, course and member search)
• Cloudflare: video processing/streaming and content delivery (when you upload or view videos)
• PostHog and other analytics/measurement tools: product analytics and measurement on web and/or app
• Fraud prevention and verification: phone authentication may involve automated verification mechanisms (such as reCAPTCHA) as part of third-party authentication providers

These providers process information on our behalf subject to contractual obligations and their own policies.

6. Creator Program Data

If you participate in the Grassy Creator Program, we collect and process additional information to facilitate payments and comply with legal requirements:

• Identity and Tax Information: Legal name, address, date of birth, and tax identification number (SSN or ITIN) are collected to comply with IRS reporting requirements. If you earn $600 or more in a calendar year, we (or our payment processor) will issue a Form 1099.
• Payment Information: Bank account details and related financial information are collected and processed by our payment processor, Stripe. We do not store complete bank account numbers on our servers.
• Identity Verification: We may collect identity documents (such as a driver's license or passport) through Stripe for verification purposes required by financial regulations.
• Engagement and Earnings Data: We track views, engaged views, watch time, and other engagement metrics to calculate your earnings. This data is associated with your account and content.
• Fraud Prevention Data: We collect and analyze data to detect fraudulent activity, including IP addresses, device fingerprints, viewing patterns, and behavioral signals.

Sharing of Creator Data:

• Stripe: We share your identity, tax, and payment information with Stripe to process payments and comply with their Connected Account requirements.
• Tax Authorities: We report earnings to the IRS and other tax authorities as required by law.
• Fraud Prevention: We may share information with fraud prevention services and law enforcement if we detect fraudulent activity.

Creator Program data is retained for as long as you participate in the program, plus an additional period as required for tax, legal, and fraud prevention purposes (typically 7 years for tax records).

7. Tracking, Cookies, and Advertising Choices

• App Tracking Transparency (ATT): on iOS, if we ask to track you across apps and websites owned by other companies, we will request permission. You can change your choice in iOS Settings.
• Cookies and similar technologies: our website may use cookies/local storage and similar technologies for functionality, analytics, and marketing measurement. You can control cookies through your browser settings.
• Device identifiers: we may use device identifiers (and, if permitted, an advertising identifier) for analytics, security, and measurement.

8. Your Choices and Rights

Depending on your location, you may have rights to access, correct, delete, or object to certain processing of your information. You can also:

• Adjust location permissions in iOS Settings
• Turn contacts access on/off in iOS Settings
• Manage push notifications in iOS Settings
• Request account deletion by contacting us

To exercise privacy rights or request deletion, contact us using the details below.

9. Data Retention

We retain information for as long as needed to provide the Services, comply with legal obligations, resolve disputes, and enforce our agreements. If you request deletion, we will take steps to delete or de-identify information, subject to technical and legal limitations.

10. Security

We use administrative, technical, and physical safeguards designed to protect information. No method of transmission or storage is 100% secure, so we cannot guarantee absolute security.

11. International Transfers

The Services may be operated from the United States and other countries. If you access the Services from outside the United States, your information may be transferred to, stored, and processed in the United States or other jurisdictions that may have different data protection laws.

12. Children's Privacy

The Services are not intended for children under 13, and we do not knowingly collect personal information from children under 13. If you believe a child has provided us personal information, contact us and we will take appropriate steps.

13. Changes to This Policy

We may update this Privacy Policy from time to time. We will post the updated policy on this page and update the "Last updated" date. If changes are material, we may provide additional notice in the app or via other communications.

14. Contact Us

If you have questions or requests related to privacy, contact us at:

Email: [email protected]