Privacy

Privacy Policy

Last updated: 7 May 2026

Grooves complies with the EU General Data Protection Regulation (GDPR) and the French Data Protection Act. This policy describes the data we collect, why we collect it and the rights you have over it.

1. Data controller

The data controller is Grooves, reachable at [email protected].

2. Data we collect

2.1 Account data

• Email address
• Name and profile picture (if provided via Google)
• Unique authentication identifier

2.2 Usage data

• Golf profile (handicap, estimated level, goals)
• Rounds played and recorded scores
• Game statistics (Strokes Gained, fairways, greens, putts)
• Practice sessions and drill results
• Training preferences (available days, duration, facilities)

2.3 Technical data

• IP address, browser type, operating system
• Login logs and error reports

3. Purposes and legal bases

4. Recipients and sub-processors

Your data is accessible to Grooves staff strictly within their duties. We rely on sub-processors bound by contractual confidentiality and GDPR-compliance commitments:

• Google (OAuth authentication) - United States (Standard Contractual Clauses)
• Resend (transactional email delivery) - United States (Standard Contractual Clauses)
• Railway (application and database hosting) - European Union
• Anthropic (AI-generated educational content) - United States (Standard Contractual Clauses)

No data is sold to third parties for commercial or advertising purposes.

5. Data retention

• Active account data: as long as the account remains active
• Data after account deletion: erased within 30 days
• Technical logs: 12 months maximum
• Backups: 30 days after deletion
• Data subject to legal retention obligations (billing, accounting): 10 years

6. Your rights

Under the GDPR you have the following rights at any time:

• Right of access: obtain a copy of the data we hold about you
• Right to rectification: correct inaccurate data
• Right to erasure: delete your account and your data
• Right to portability: receive your data in a structured format
• Right to object: refuse processing based on legitimate interest
• Right to restriction: temporarily suspend a processing activity
• Right to withdraw consent at any time, without retroactive effect

To exercise these rights, write to [email protected]. We respond within 30 days. If you disagree with the outcome, you may lodge a complaint with the French data protection authority CNIL or with your local supervisory authority.

7. Cookies and local storage

Grooves uses a minimal set of cookies, strictly necessary for the Service to function:

• Session cookie: authentication (30-day lifetime, HttpOnly, SameSite=Lax)
• Attribution cookie: acquisition channel of your first visit (campaign source, referring site), 90-day lifetime, first-party only
• localStorage: stores your preferences and onboarding drafts

Audience statistics are measured with Umami, a self-hosted tool that sets no cookies and collects no personally identifiable data. No advertising or third-party tracking cookies are set.

8. Security

Grooves implements technical and organizational measures suited to protect your data: encrypted communications (HTTPS), encrypted sessions (JWE), secure database storage, restricted access for authorized staff, and regular backups.

In the event of a data breach likely to result in a risk to your rights, we will notify the CNIL within 72 hours and, where required, the affected Users as soon as possible.

9. Minors

The Service is restricted to adults (18 and over). If we become aware that an account has been created by a minor, we will delete it.

10. Changes to this policy

We may update this policy. Material changes will be communicated by email or in-app at least 15 days before they take effect. The date of the last update appears at the top of this document.

11. Contact

For any question about this policy or your personal data, please write to [email protected].