Privacy Policy

Last updated: July 11, 2026

1. Scope

This Privacy Policy describes how Grassy ("Grassy," "we," "our," or "us") collects, uses, discloses, and protects information when you use our iOS mobile application and our website (collectively, the "Services").

2. Information We Collect

We collect information in the following categories:

  • Account and profile information: phone number, email address (including Apple private relay emails), display name, username, profile photo, and other profile details you choose to provide.
  • User content: golf course ratings, reviews, lists, comments, likes, follows, chat messages, and any text, photos, or videos you upload.
  • Golf performance data: scores and rounds you log or import, hole-by-hole and aggregate statistics, handicap-related information, club, equipment, and shaft configurations you enter, and launch-monitor metrics — including screenshots and PDF reports you upload for scanning.
  • Voice input (optional): if you use in-app dictation features (for example, speaking notes about a hole), your speech is transcribed on your device using Apple speech services. We store the resulting text (such as hole notes and extracted stats), not the audio recording.
  • AI feature content: messages you send to Grassy AI and images or PDF documents you upload for scanning or analysis (see Section 6).
  • Referral and attribution data: invite codes, invite links, and QR codes you generate or use; who invited whom; and attribution timestamps. If you open an invite landing page, it may copy the invite code to your clipboard when you take an action (such as tapping the download button) so that signup attribution can be completed in the app. QR codes encode the same invite link.
  • Contacts (optional): if you opt in to "find friends," we access your device contacts and may upload contact identifiers (such as phone numbers) to our servers to help you discover people you know on Grassy and to enable invitations. Uploaded contact identifiers are stored on our servers and you can request their deletion at any time. We do not need (and do not request) access to the full contents of your communications. Contact access is optional and can be turned off in your device settings.
  • Location information (optional): if you grant location permissions, we may collect precise location when the app is in use and, if you grant "Always" access, in the background to support golf course proximity features (for example, nearby course discovery, on-course GPS, and arrival reminders). You can control this in iOS Settings.
  • Photos (optional): if you choose to upload images or set a profile photo, we access photos you select. If you choose to save generated images to your camera roll, we request permission to add photos to your library.
  • Purchase information: if you subscribe to a paid tier, subscription status is managed by Apple and RevenueCat; we receive entitlement and transaction status, not your payment card details. Merchandise purchases occur on our Shopify-powered store, and we never receive your payment card data.
  • Device and usage information: device model, operating system and version, app version, language, time zone, IP address, and diagnostic/usage events generated when you use the Services.
  • Push notification information: a device token (such as an FCM token) and notification interaction data to deliver and manage push notifications.
  • Third-party data you choose to connect: if you use features that integrate with external services (for example, providing a GHIN number to sync handicap and score history), we process the identifiers and results needed to provide that feature, with your authorization.
  • Support communications: information you provide when you contact us (for example, emails, messages, and attachments).
  • Creator Program information: if you participate in the Creator Program, we collect additional information including your legal name, address, date of birth, tax identification number (SSN/ITIN), bank account information (processed by Stripe), identity verification documents, and earnings and engagement data — including invite and referral activity used to calculate Invite & Earn credits. This information is required for payment processing, tax reporting, and fraud prevention.

If you do not provide certain optional information (like location or contacts), some features may be unavailable or limited.

3. How We Use Information

We use information for purposes such as:

  • Providing, operating, maintaining, and improving the Services (including search, recommendations, statistics, and personalization)
  • Creating and managing accounts, authentication, and user settings
  • Enabling social features (following, feeds, chat, notifications, and other community features)
  • Powering AI features, including Grassy AI conversations, scorecard and launch-monitor scanning, and performance insights (see Section 6)
  • Administering referral, invite, and creator earnings programs, including attribution, qualification, crediting, and payout processing
  • Delivering push notifications and other communications you request or opt in to receive
  • Moderation, safety, and integrity (including detecting fraud, abuse, spam, referral manipulation, and prohibited content, and performing automated content safety checks for uploaded media)
  • Analytics and measurement to understand usage and improve performance
  • Complying with legal obligations and enforcing our Terms

4. How We Share Information

We may share information in these ways:

  • With other users: depending on your settings and how the Services work, your profile and user content (such as posts, ratings, reviews, and scores you choose to share) may be visible to other users or the public.
  • With service providers: we use vendors to host and operate the Services, including providers for authentication, databases, file storage, analytics, AI processing, chat, search, payments, and infrastructure (see Section 5).
  • With third-party platforms you choose: if you share content to third-party apps or platforms (for example, Instagram or TikTok), those services receive the information you share and their policies apply.
  • For legal, safety, and enforcement reasons: to comply with law, respond to lawful requests, protect rights and safety, investigate violations, or prevent fraud.
  • Business transfers: in connection with a merger, acquisition, financing, or sale of assets (information may be transferred as part of that transaction).

We do not sell your personal information in the traditional sense.

5. Third-Party Services We Use

The Services rely on third-party providers, including:

  • Google/Firebase: authentication, databases, cloud functions, analytics, file storage, and push notifications
  • Anthropic (Claude API): AI processing for Grassy AI features (see Section 6)
  • Stripe (Stripe Connect): creator payouts, including Invite & Earn credits. Stripe collects banking and identity information directly under its own privacy policy; we store payout amounts and status, not complete bank account numbers.
  • Shopify: our merchandise store at shop.grassy.golf. Shopify and its payment providers process orders and payments; we never receive your payment card data.
  • RevenueCat and Apple: in-app subscription management and purchase processing
  • Stream: in-app chat and messaging infrastructure
  • GIPHY: GIF search and display in comments and messaging. When you search for GIFs, your search terms are sent to GIPHY.
  • Algolia: search functionality (for example, course and member search)
  • GHIN: handicap and score history data, accessed with your authorization when you connect your GHIN number
  • Apple Maps (MapKit) and map data providers: course maps, GPS, and location features
  • Cloudflare: video processing/streaming and content delivery (when you upload or view videos)
  • PostHog and other analytics/measurement tools: product analytics and measurement on web and/or app
  • Fraud prevention and verification: phone authentication may involve automated verification mechanisms (such as reCAPTCHA) as part of third-party authentication providers

These providers process information on our behalf subject to contractual obligations and their own policies.

7. Creator Program Data

If you participate in the Grassy Creator Program (including the Invite & Earn Program), we collect and process additional information to facilitate payments and comply with legal requirements:

  • Identity and Tax Information: Legal name, address, date of birth, and tax identification number (SSN or ITIN) are collected to comply with IRS reporting requirements. If you earn $600 or more in a calendar year, we (or our payment processor) will issue a Form 1099.
  • Payment Information: Bank account details and related financial information are collected and processed by our payment processor, Stripe. We do not store complete bank account numbers on our servers.
  • Identity Verification: We may collect identity documents (such as a driver's license or passport) through Stripe for verification purposes required by financial regulations.
  • Engagement and Earnings Data: We track views, engaged views, watch time, and other engagement metrics to calculate your earnings. For the Invite & Earn Program, we also track invite link and code usage, qualifying invites, attribution timestamps, and monthly credit totals. This data is associated with your account and content.
  • Fraud Prevention Data: We collect and analyze data to detect fraudulent activity, including IP addresses, device fingerprints, viewing patterns, referral and signup patterns, and behavioral signals.

Sharing of Creator Data:

  • Stripe: We share your identity, tax, and payment information with Stripe to process payments and comply with their Connected Account requirements.
  • Tax Authorities: We report earnings to the IRS and other tax authorities as required by law.
  • Fraud Prevention: We may share information with fraud prevention services and law enforcement if we detect fraudulent activity.

Creator Program data is retained for as long as you participate in the program, plus an additional period as required for tax, legal, and fraud prevention purposes (typically 7 years for tax records).

8. Tracking, Cookies, and Advertising Choices

  • App Tracking Transparency (ATT): on iOS, if we ask to track you across apps and websites owned by other companies, we will request permission. You can change your choice in iOS Settings.
  • Cookies and similar technologies: our website may use cookies/local storage and similar technologies for functionality, analytics, and marketing measurement. You can control cookies through your browser settings.
  • Device identifiers: we may use device identifiers (and, if permitted, an advertising identifier) for analytics, security, and measurement.

9. Your Choices and Rights

Depending on your location, you may have rights to access, correct, delete, or receive a copy of your personal information, or to object to or restrict certain processing. California residents may have rights under the California Consumer Privacy Act (CCPA/CPRA), including the rights to know, correct, and delete personal information and the right not to receive discriminatory treatment for exercising those rights. Residents of the European Economic Area, the United Kingdom, and other jurisdictions with comprehensive privacy laws may have similar rights under those laws (such as the GDPR), including the right to lodge a complaint with a supervisory authority.

You can also:

  • Adjust location permissions in iOS Settings
  • Turn contacts access on/off in iOS Settings (and request deletion of previously uploaded contact identifiers)
  • Manage push notifications in iOS Settings
  • Delete your account from within the app or by contacting us

To exercise privacy rights, contact us using the details below. We will verify your request and respond as required by applicable law. We do not charge a fee for exercising your rights, and authorized agents may submit requests where permitted by law.

10. Data Retention and Deletion

We retain information for as long as needed to provide the Services, comply with legal obligations, resolve disputes, and enforce our agreements.

When you delete your account, our deletion pipeline removes your personal data and social graph — including your profile, follows and followers, posts, ratings, comments, likes, and uploaded contact identifiers — subject to technical and legal limitations. Certain records may be retained where required (for example, tax and payout records for Creator Program participants, and records needed for fraud prevention, security, or legal compliance), and residual copies may persist in backups for a limited period before being purged.

11. Security

We use administrative, technical, and physical safeguards designed to protect information. No method of transmission or storage is 100% secure, so we cannot guarantee absolute security.

12. International Transfers

The Services may be operated from the United States and other countries. If you access the Services from outside the United States, your information may be transferred to, stored, and processed in the United States or other jurisdictions that may have different data protection laws.

13. Children's Privacy

The Services are not directed to children under 13, and we do not knowingly collect personal information from children under 13. If you believe a child has provided us personal information, contact us and we will take appropriate steps to delete it.

14. Changes to This Policy

We may update this Privacy Policy from time to time. We will post the updated policy on this page and update the "Last updated" date. If changes are material, we may provide additional notice in the app or via other communications.

15. Contact Us

If you have questions or requests related to privacy, contact us at:

Email: [email protected]

Back to Home