Tacada Privacy Policy

Version 1.1.0 — 9 August 2026

Tacada is in testing. This policy explains what data of yours we collect, what we use it for, who else sees it, and what you can demand from us. It is written to be understood in one read. If anything is unclear, write to privacy@tacadagolf.com.

1. Who is responsible for your data

Data controller:

Alejandro Gómez de la Cruz Alcañiz
Spanish tax ID 44599568S
Calle General Pardiñas 57, 4.º A — 28006 Madrid, Spain
privacy@tacadagolf.com

Tacada is a personal project, not a company. We have not appointed a Data Protection Officer because none of the circumstances in Article 37 GDPR apply.

2. What Tacada is, and where it stands

Tacada is a social golf app: it lets you organise rounds, keep score hole by hole, calculate your playing level, compete in tournaments and follow other players.

Important notice: this is a beta. The app is under active development and is distributed to a closed group of people to test it. That means:

• There may be bugs, and some data could be lost through an error or a technical change.
• Do not use Tacada as your official record of results. Keep your scorecards wherever you normally keep them.
• If the project were not to continue, we would email you with reasonable notice before deleting anything.

3. What data we collect

3.1 Account and identity

• Email address. Required. It is your login identifier and how we reach you.
• Password. Only if you sign up with email. We never see it: it is stored encrypted by our authentication provider (Supabase).
• Sign in with Apple or Google. If you choose this route, we receive a user identifier and your email from Apple or Google. If you use Apple's "Hide My Email", we receive the relay address Apple generates, not your real one.
• Username (@handle). Public. You choose it.
• Display name, bio and profile picture. Optional. Other players see them.
• App language.

3.2 Record of your consent

When you create your account we store which version of this policy and of the terms you accepted, the date, your IP address and your browser or device identifier. It is the proof that consent happened, and the GDPR itself requires it. The IP address is deleted automatically after one year.

3.3 Your golf

• Scorecards and strokes hole by hole, with putts, penalties and bunker shots if you record them.
• Your Tacada Score, our own calculation of your level, and its history.
• Playing handicap, tees, courses and clubs where you play.
• Rounds you take part in, who you play with and who signs your cards.
• Tournaments, communities and standings.

3.4 Official handicap (WHS)

If you give it to us, we store your federation licence number and query your official handicap from the Spanish Golf Federation (RFEG) or the Portuguese Golf Federation (FPG) so we can display it in the app. It is optional: the app works without it.

Tacada does not issue official handicaps. It only reads them from your federation. Our own calculation is called Score and is a different thing.

3.5 Social activity

Communities you belong to, who you follow and who follows you, posts and photos you upload to the feed, messages in community chats and direct messages, and your reactions.

About messages: direct messages are not end-to-end encrypted. They are encrypted in transit and at rest, but they are technically readable on the server. We do not read them, except where strictly necessary to investigate reported abuse or to comply with a legal order.

3.6 Location

Only while the app is open, and only if you grant permission. We use it to show you courses, rounds and tournaments near you, and the distance to the green while you play.

• Never in the background.
• We do not keep a history of where you have been. We use your position at that moment and discard it.
• If you decline, the app still works: it shows you every course instead of the nearby ones.

3.7 Your course notebook (Tacaddie)

The notes, drawings and distances you record for each hole. They are private unless you choose to share a notebook.

3.8 Map contributions

The app improves course maps through two different routes, and they do not store the same thing:

• Marks you deliberately make (tapping "mark tee", or pinning the centre of a green) are stored with your player identifier. We need it so that your own mark takes priority over everyone else's in your view of the hole, and so we can withdraw a mistaken or malicious contribution.
• Automatic samples the app takes of where players tee off, while you play, are stored without any identifier of yours. They only serve to compute the average position of each tee and cannot be linked back to you.

Once a mark is approved and becomes part of the course map, the coordinate stops being data about you, but the record of who contributed it is kept for as long as the mark stands.

3.9 Notifications

If you enable them, we store your device's notification identifier (push token), provided by Apple or Google. It identifies the installation, not the person.

3.10 Diagnostics and usage

• Errors (Sentry, EU servers): when something breaks, the error is sent along with your internal user identifier. It is configured not to send your email, your name or your location.
• Usage (PostHog, EU servers): events such as "created a round" or "signed a card", tied to your internal user identifier. No names, no emails.

That internal identifier is a random code, but since we can link it back to you, the law treats it as personal data — which is why we are telling you about it here.

4. What we use each thing for, and on what legal basis

Where the basis is consent, you can withdraw it at any time from your system or app settings, without affecting what was processed beforehand.

Where the basis is legitimate interest, we have assessed that the benefit (that scorecards mean something, that the app works) does not override your rights, because the data is minimal and is not used to profile you commercially. You can object by writing to us.

5. What we do NOT do

• We do not sell your data. To anyone, ever.
• There is no advertising in the app, no ad networks, no tracking pixels.
• We do not track you across other apps or websites. That is why Tacada never shows you the iOS tracking prompt.
• We do not make automated decisions with legal effects about you (Art. 22 GDPR). Match recommendations are just that: you join if you want to.
• We do not collect special categories of data: no health, political opinions, religion, ethnic origin, biometrics or sexual orientation. A handicap is a measure of sporting skill, not health data.
• We do not track your location in the background.

6. Who else sees your data

6.1 Other players

Tacada is a social app, so some of what is yours is visible. Specifically:

• Always public inside the app: your @username, display name, picture and bio.
• Depending on your privacy settings: your scorecards, your Score, your courses and your posts.
• Whoever plays with you sees, for that round, your playing handicap and your strokes. That is unavoidable: it is the round you are both playing.

You can review and change all of this in Profile → Settings → Privacy.

6.2 Providers that process data on our behalf

All of them process data on our instructions, under a data processing agreement (Art. 28 GDPR).

We also query the RFEG and the FPG to read your official handicap, if you give us your licence. There, the federations act as independent controllers of their own data.

6.3 Transfers outside the European Union

Your account, your scorecards and your photos live in Ireland. The only data that leaves the EU is what is technically necessary to deliver the app to your phone and to send notifications (Expo, Apple, Google), plus these legal pages (Vercel) and the forwarding of our contact mailbox (ImprovMX). Those transfers rely on the European Commission's Standard Contractual Clauses and, where applicable, on the EU-US Data Privacy Framework.

6.4 Authorities

We would only hand data to an authority under a valid legal order. If the law lets us tell you, we will.

7. How long we keep things

If your account goes inactive for a long time, we would write to you before doing anything with it.

8. How we protect them

• Everything travels encrypted (HTTPS/TLS) and is stored encrypted at rest.
• The database enforces row-level access rules: on every query the server checks that you may see what you are asking for — it is not enough for the app to ask nicely.
• Passwords are stored using key derivation functions; not even we can read them.
• Technical logs contain no email, no name and no precise location.

If a security breach posing a risk to you did occur, we would notify the Spanish Data Protection Agency within 72 hours and tell you directly if the risk is high.

9. Your rights

You can exercise all of these by writing to privacy@tacadagolf.com. We reply within one month at most, free of charge.

• Access. To be told what we hold about you and given a copy.
• Rectification. To correct anything wrong. Much of it you can change yourself under "Edit profile".
• Erasure. To delete your account. You can do it yourself in Profile → Settings → Account → Delete account: deletion is scheduled and you have 30 days to change your mind before it becomes final.
• Portability. To take your data in a machine-readable format.
• Restriction and objection to processing.
• Withdrawal of consent for location, notifications or the federation handicap, at any time.

One thing to bear in mind when you delete your account: your scorecards are deleted with it, including those from rounds you played with other people. What does survive are any of your marks that had already become part of the course map — where a tee is, where the centre of a green is: there, the link to you is erased and the coordinate stays, because other players depend on it.

Complaints. If you think we are getting it wrong, write to us first — but you may complain directly to the Spanish Data Protection Agency (www.aepd.es, C/ Jorge Juan 6, 28001 Madrid). If you live in another EU country, you may go to your own national authority — for example the CNPD in Portugal (www.cnpd.pt).

10. Minors

Tacada is for people aged 16 and over. We do not knowingly collect data from anyone younger. If we learn that an account belongs to someone under 16, we will delete it. If you are a parent or guardian and believe this has happened, write to privacy@tacadagolf.com and we will sort it out.

11. If we change this policy

We will publish the new version here with its date. If the change is significant, we will tell you inside the app and, if needed, ask you to accept it again. Previous versions are kept so we know what each person accepted and when.

12. How to contact us

privacy@tacadagolf.com

Alejandro Gómez de la Cruz Alcañiz — Calle General Pardiñas 57, 4.º A, 28006 Madrid, Spain