Privacy policy

Who operates WORM

WORM is operated by WORM GOLF LLC, doing business as Worm Golf. In this policy, “we”, “us” and “our” refer to WORM GOLF LLC as WORM’s operator. Contact support@playwormgolf.com for privacy questions or requests.

What we save

WORM saves your account email, profile, scores, courses, handicaps, Groups, game balances and logged conditions. Hosts can record guest names and scores without creating guest accounts. Signed-in data is backed up online, including private round details.

We also save sharing settings, connections, posts, repost references, selected photos, comments, reactions, Group requests, your default Group, seasons, challenges, feedback and support requests. Account and security records help operate and protect the service.

When you accept the terms, we record your account identifier, the terms version, the time of acceptance and your adult and legal-age acknowledgement. This is a self-declaration, not identity or age verification; we do not collect your date of birth for this step.

Who can see it

Onboarding shows recommended name/handle discovery and automatic score and achievement highlights for Friends, and lets you change those choices before confirming. Friends means your approved followers, not everyone using WORM. Public sharing remains a separate choice. Existing restrictions and unknown older choices are not permission to expand sharing or publish older private results. You can change personal audiences, discovery and automatic highlights in Sharing & privacy. Detailed conditions stay out of stories unless you include them; WORM achievements can reveal that you used adjustments.

Linked players can see their shared scorecard, logged adjustments and game standings, and enter scores and adjustments during live play. The host controls setup and completion. Shared edits are recorded to prevent conflicting changes and repeated saves. Guest links give access to anyone who receives them, subject to link settings and expiry. Feedback suggestions are visible to signed-in users; Contact WORM requests are private to you and WORM’s authorized administrators, including any administrator appointed by the owner to help with support.

A guest can use a completed scorecard link to request that their result be saved to their verified account. The scorer sees the requested guest name and the requesting account’s name and handle, and must confirm the match. The golfer then reviews the score before saving it. Claim requests and confirmations are retained with the round; a viewing link alone does not establish player identity or grant scoring access. Joining after play does not give the claimed result historical Group challenge credit.

Groups, records and recorded winnings

Eligible approved scores, records and recorded net winnings are shared automatically with your Group’s current and future accepted members by default. Creating or joining a Group shows this scope and lets you change the choices as part of the normal create or join step. Public Groups allow eligible accounts to join, so they are not confidential invitation-only spaces. Before acceptance, Group discovery shows only permitted identity information such as name, description and member count, not the roster, rules, rounds or results.

My sharing in this group lets you share less without leaving the Group or losing ordinary golf. Existing explicit restrictions, including a saved choice to hide recorded winnings, are preserved. Members without a saved Group sharing choice receive the automatic defaults for new eligible Group rounds. Personal-feed settings and each Group’s choices are separate. Automatic defaults do not publish past private results; sharing retained earlier private Group results requires a separate confirmation of that history. Already shared history retains its permitted audience unless you restrict it. We record sharing scope and preference versions, distinguishing automatic defaults from choices you confirm. Applying a default does not create a confirmation receipt.

Seasons organize Group standings and records. Members participate automatically in their Group’s seasonal challenges without a separate join step. The owner chooses whether each challenge counts all eligible personal results or only rounds assigned to that Group. An eligible personal result can count in challenges for more than one Group, subject to each Group’s score-sharing choice, accepted membership before play, required score approval and challenge rules. This personal-result sharing applies prospectively; starting a challenge does not backfill older private rounds. Turning off score sharing in a Group also hides your challenge results there.

Your first accepted Group becomes your default for round setup. You can change your default or select a different Group, or no Group, before play. The selection stays visible during setup. A round still belongs to at most one Group for ordinary standings, records and recorded winnings; seasonal challenge credit does not copy game balances into other Groups.

Money displays recorded net winnings from the original games, not verified payments. Guest and nonmember opponents can affect settlements without receiving Group rows. Hidden winnings are not zero, and visible totals may not balance. Extra exports of money or logged circumstances still require their own permitted scope.

A separate Group achievement post can show a leaderboard, record or challenge milestone attributed to the golfer who earned it. Personal-feed audiences and automatic-highlight choices still apply. The golfer’s name, achievement, own result, date, Group name and season may appear to that permitted personal audience even when the Group is private. These posts do not expose other members’ identities or results, full standings, or restricted source scorecards. Opening the Group from a post shows members their Group and nonmembers the permitted join page; private Group requests, invitations and acceptance are still required as applicable. Corrections and changes to access or sharing can remove a milestone. Participating in a challenge does not turn on personal-feed sharing. You can separately preview and export your own permitted milestone image, including your name, own achievement, Group name and season. An exported image can be seen or saved outside your WORM audience and cannot be withdrawn from copies held by others.

Owners and the appointed co-organizer can manage Group participation, requests and competitive exclusions. Authorized administrators can review private ownership-recovery requests and reassign ownership with a recorded decision. Group start evidence, rule versions, sharing settings and confirmations, ownership changes and exclusions are retained as needed to operate the Group, explain authorized changes and prevent repeated actions. These records do not create a public second scorebook or override account deletion and privacy choices.

Leaving a Group removes access but does not itself disqualify a completed tournament winner. If privacy or deletion means a final result cannot safely be shown, it may be marked unavailable instead of promoting another golfer. Score corrections and explicit exclusions can produce a visible result revision. Group requests and relevant in-app activity do not require phone notification permission; optional push and Group mute settings are separate.

Connections and reposts

Suggested golfers use permitted social connections and accepted Group relationships, subject to discovery, blocks, restrictions and existing requests. WORM does not use your address book, precise location or course activity for these suggestions. Someone you already follow may send a follow request back even if you turn discovery off; this does not make you searchable to unrelated users or bypass your approval and block controls.

A repost points to an existing round or Group achievement post with its original author. It does not give its recipients broader access than the original permits. Removing or hiding the source, blocking, or losing access stops the repost from showing that source. Reposting is separate from exporting an image to another app.

Internal course activity reports

Only WORM’s owner can inspect aggregate WORM-recorded play at catalog courses over 30- and 90-day windows, including today. Reports use minimal retained course and completed participation information, including private or hidden saved rounds and rounds shared with Friends, Groups or the public. Social audiences and Group sharing choices do not exclude retained activity from these internal totals. Duplicate cards, guests, explicitly excluded test accounts and unresolved course identities are handled separately. Counts show their refresh time and incomplete coverage; they are not verified tee-sheet visits.

The internal course projection excludes wager amounts, game details, logged WORM circumstances, alcohol inputs and private notes. Merely playing a course does not publish your presence, join a community or challenge, subscribe you to marketing, or give a course operator access to you. Course staff have no report, contact-export or messaging access through this feature. No background GPS tracks are collected.

Services that help WORM work

Supabase hosts accounts, data and photos. WORM currently offers email sign-in. If you previously linked an Apple or Google identity, the account may retain the provider identifier and supplied name or email, not your provider password; deleting that account also handles the linked identity. GolfCourseAPI receives course searches or identifiers through our server, not your profile, scores or condition logs.

Expo delivers app updates and processes an installation identifier and technical update and crash-related information for update delivery and reliability. Expo update delivery is separate from the optional Share app activity setting. WORM does not use an advertising identifier for these features.

The photo picker gives access to selected images only. Uploaded story photos have original metadata removed. If you enable phone notifications and delivery is available, Apple and Expo process delivery tokens and notification content. WORM stores the installation and delivery identifiers, account/session association, notification settings, time zone and delivery status needed to send notifications and prevent delivery to the wrong account. Apps you choose for sharing have their own privacy practices.

Group hosting purchases

Apple processes App Store subscription payments. WORM sends Apple your WORM account identifier as an app-account token so a purchase can be linked to the correct WORM account. We receive and store purchase identifiers, product and environment, subscription status, paid-through and grace dates, renewal status, and verification times. Apple-signed purchase and renewal information is checked with Apple to grant access, restore purchases, handle expiry or refunds and prevent a purchase from being reassigned to a different WORM account. WORM does not receive your payment-card number or Apple Account password.

These account-linked purchase and access records are private operational data, not social-feed content, and do not depend on the Share app activity choice. Apple processes its own payment and subscription records under its policies. Deleting your WORM account removes its associated WORM subscription records; Apple may retain its own transaction records. Deleting WORM, signing out or deleting your WORM account does not cancel an Apple subscription. Cancel it separately in your Apple Account subscription settings.

App failures and crash reports

WORM automatically records limited operational failures in Supabase to diagnose problems with saving, loading, sync, screens and server functions. First-party reports contain a report identifier, operation and failure category, response status when available, app version, runtime/update identifier, platform and time. Signed-in app reports are associated with a private account identifier for rate limits and affected-account counts. These records are account-linked, not anonymous; server-function reports are not assigned to a golfer account.

The first-party failure report does not include exception messages, stack traces, request or response bodies, URLs, passwords, sign-in tokens, GPS coordinates, scores, condition entries or photos. Authorized administrators see grouped reports and affected-account counts in App health, not a public error feed. Repeated failures are sampled and reporting may miss some failures. Up to 20 reports can be kept in an account-scoped device queue for retry after an interrupted connection or app restart. Unsent device reports expire after 30 days and are never sent as another account’s reports. Reports are scheduled for deletion after 30 days in the active server diagnostics store, and reports associated with your account are removed when that account is deleted.

This operational reporting is separate from Share app activity: turning that setting off stops optional app-use observations, not failure reporting, account/security processing or necessary update requests. The 30-day limit and field exclusions above apply to WORM’s first-party failure records, not to every record held by Apple, Expo or another service provider.

Native iPhone crashes are reviewed through Apple’s developer tools, separately from the Supabase App health view. Apple may provide WORM with crash logs, usage information and feedback. What Apple collects and shares depends on how you obtained the app and Apple’s applicable sharing controls and policies; some distribution methods automatically share crash logs and usage information. Reports and feedback may contain information that identifies you. This collection is not controlled by WORM’s Share app activity switch. For App Store installations, Apple diagnostics follow Apple’s applicable sharing controls and policies. We use Apple-provided reports to investigate bugs and improve WORM; Apple’s handling and retention are separate from WORM’s first-party reporting.

Owner notices and moderation alerts

WORM’s owner receives private in-app notices about confirmed new accounts and pending moderation. These records link to the relevant account or moderation item and include creation, read and delivery information. A new golfer’s display name may be shown inside the protected Owner inbox. Owner push notifications contain counts and an instruction to open WORM, not new users’ names, email addresses, reported text or photos. These operational notices are not sent by email.

Unread signup notices remain available while they are eligible for the Owner inbox. Owner notices are scheduled for removal once more than 90 days old if they have been read or are no longer eligible for that inbox, provided their underlying moderation item is not pending. Moderation notices remain while their underlying item is pending. Reading a notice or disabling pushes does not resolve or delete the underlying moderation record. Account-linked notices are removed with the associated account.

Authorized team access and access history

The owner may appoint additional administrators or moderators and revoke their access. Admin tools allow grouped app-failure information, support replies, feedback management and authorized Group administration. Usage and course analytics are available only to WORM’s owner, not delegated administrators or moderators. Moderation access allows review of pending or reported content, relevant profile information and social-restriction actions. The permissions are separate; a moderation-only teammate does not automatically receive App health or private support access.

Only the owner can manage team permissions or read the Owner inbox. Team management uses an existing account’s identifier, name, handle, eligibility and current permissions to identify the intended person. Permission changes are recorded with the acting and affected account identifiers, previous and new permissions and server time. The access-history table does not retain copies of names, email addresses or profile content.

Access-history records have no fixed age-based expiry and are retained to establish permission history while the affected account exists. Deleting the affected account removes its access-history records. Deleting an acting account clears its actor reference in records about other accounts. Revoking access prevents later protected requests; it cannot recall information already viewed or necessarily stop an action already in progress. App team permissions do not grant access to WORM’s hosting accounts or Apple’s separately controlled crash-report tools.

Location and maps

Find distance uses your precise location while its map is open and WORM is in the foreground. The distance to the spot you tap is calculated on your phone. WORM does not save or sync your GPS position or selected target to your account.

Apple Maps supplies the satellite imagery and processes the requests needed to display the map under Apple’s privacy practices. You can change WORM’s location permission in iPhone Settings.

Keeping shared content safe

Automatic checks screen shared text, including names, handles, comments, captions and Group information. Story photos wait for an authorized moderator to approve them before other golfers can see them. These checks are not perfect; use the report and block controls if something is inappropriate.

Authorized moderators can review pending photos, reported content and relevant public account information, remove content and restrict social access. We keep private reports, moderation decisions and records needed to prevent removed content from returning. These records are used to operate and protect the community, not shown in the feed. The moderation queue, decisions and removal-prevention records do not have the 30-day expiry used for diagnostic reports or the 90-day cleanup criteria for eligible old owner notices; they remain for review and abuse prevention, subject to associated account deletion and any applicable legal retention.

Usage data and tracking

Share app activity is optional and stays off until you make an explicit choice. You can choose when prompted or in Settings; deciding later leaves it off. Existing explicit choices, including opting out, are preserved. We record your choice, its version and time; we do not treat a previous default as consent. When on, WORM records your account and app-use dates to measure return visits. Only WORM’s owner sees aggregate activity statistics, but the underlying account/date observations are linked to your account. Visits that are not observed are not reconstructed or treated as measured inactivity.

The owner also sees internal aggregate operational totals from retained accounts, saved rounds, Groups and social activity, including private, hidden, Friends-only and public activity and real use by the owner or staff. Explicitly marked test accounts are excluded. These totals do not depend on social sharing settings or the optional Share app activity choice. The analytics reports show counts and trends, not individual scorecards, private notes, contact lists or wager exports. This internal processing does not expand who can see your content in the app, publish your course presence or give course operators access.

WORM does not sell personal data, use advertising trackers or track across other companies’ apps. Native device storage saves your golf data and sign-in; no advertising cookies are used.

Your choices and deletion

Edit or delete your content in the app. Export saved data in Settings copies this device’s golf data. Use Contact WORM for broader access, correction, deletion or review requests; we may verify account ownership. Notifications can be disabled in WORM or iPhone Settings.

Account data stays until deleted. Settings → Account → Delete account removes associated cloud data, terms-acceptance records and story photos. After the server confirms deletion, WORM removes that account’s local scorebook, recovery copies, queued edits, cached agreements, pending diagnostic reports and account-owned temporary files. If device cleanup is interrupted, WORM keeps a minimal account identifier and cleanup marker to resume it; minimal deletion markers also prevent delayed operations from recreating removed data. Ordinary sign-out keeps saved rounds. Copies exported to other apps, others’ saved records and system-managed caches or legacy temporary files whose account owner cannot be established may remain. Deleted comments can remain marked as deleted for moderation; security records and provider backups may remain for operational or legal retention periods. The specific diagnostics, owner-notice and team-access retention rules above apply to those active records; deletion from provider backups follows the provider’s backup lifecycle, not an immediate deletion guarantee.

Website and round links

WORM’s website and browser scorecards are hosted through OpenAI’s Sites service and Cloudflare. Those hosting services process requests, including network information such as IP addresses and browser details, to deliver and protect the site. The homepage does not include advertising or analytics scripts.

A shared-round invitation keeps its access token in the link fragment. The browser sends that token to WORM’s round service to request the shared scorecard. Anyone with the link can use its permitted access until it expires or the scorer stops sharing. Opening the homepage does not create a WORM account. Shared Group links open a joining page with only permitted identity information; they do not grant membership or bypass private Group approval. When you open a Group or guest-claim link in WORM, the app temporarily stores that destination securely on your device so it can continue after sign-in and onboarding. You may need to return to the original web page after installing the app.

Questions

Email support@playwormgolf.com or use Contact WORM in Settings for privacy questions, including if you cannot sign in. WORM is for an adult audience, not children. This page contains the current notice; material changes will be communicated when required.

Contact

Beta testers can reach WORM privately through Profile → Settings → Contact WORM in the app.

See Support for account deletion and help with shared content.