Privacy Policy

Last updated: 7 October 2026 · Applies to the Hooked2Golf app and hooked2golf.com

[PLACEHOLDER — review before launch] This policy was drafted from how the app actually works today. The bracketed items need the legal entity, contact details and a solicitor's read before it goes live.

1. Who we are

Hooked2Golf ("Hooked", "we") is the data controller for the personal data described here.

[PLACEHOLDER] Legal name and address of the controller (currently: Eoin Sullivan trading as Hooked2Golf, Ireland — confirm once the company is incorporated). Contact email for privacy requests: [email protected] — confirm the mailbox exists.

2. What we collect

Data	Where it comes from
Account: name, email address, password (hashed), optional profile photo	You, at sign-up
Onboarding answers: handicap band, experience, goals, practice days and places, self-ratings for driving, irons, short game, putting and mental focus	You, during onboarding
Practice sessions: drills done, scores against targets, minutes, and your three reflections after each session	You, in the Practice tab
Rounds: course, round type, Tiger 5 and Head 5 counts, mental ratings, best moment and your three reflections	You, when you log a round
Mental assessment answers and the resulting profile	You, in the Mental tab
Mental Coach conversations (your messages and the coach's replies) and a small structured summary of each reply	You, in the Coach tab
Consent records: what you agreed to, when, and when you withdrew it	Created when you sign up or change a setting
Usage and crash data: which screens and features you use, app errors, device type and OS version — tied to a random user id, never to your name or email	Collected automatically, unless you opt out in Profile

We do not collect precise location, contacts, or payment details. The app is free at launch.

3. What we use it for

To run the service: build your weekly practice plan, track your sessions and rounds, show your trends, and remember your reflections.
Mental Coach: to answer you, your message, the conversation so far, and a summary of your rounds, practice and mental profile are sent to our AI provider (section 5). The coach is an automated AI system, not a person, and it is not medical or psychological advice.
Safety: every coach message is screened first. If it suggests distress beyond golf, the coach does not reply with coaching and instead points you to support services. We record that a safety response was given, not what you wrote.
Improving the app: anonymous usage and crash data tell us what breaks and what gets used. You can switch this off in Profile → Privacy & data at any time.
Email: account emails (confirmation, password reset) always; tips and news only if you ticked the box at sign-up or joined the waiting list, and you can unsubscribe from every one.

4. Legal bases (GDPR)

Contract — account, plans, sessions, rounds, reflections: we need them to provide the app you asked for.
Consent — the Mental Coach (you accept the AI notice before the first chat), analytics, and marketing email. Each can be withdrawn in Profile or by unsubscribing; withdrawing does not affect what happened before.
Legitimate interests — keeping the service secure, preventing abuse, and the safety screening of coach messages.

5. Who processes your data for us

Processor	What for	Where
Supabase	Database, authentication, file storage, server functions	EU (Frankfurt)
Anthropic	The Mental Coach's replies and the safety screening of messages	United States
PostHog	Usage analytics and crash reporting (opt-out available)	EU
Kit (ConvertKit)	Waiting list and news emails you opted into	United States
Apple and Google	App distribution and push notifications	Global
Cloudflare	Hosting this website	Global

[PLACEHOLDER] Confirm the transfer mechanism for each US processor (EU–US Data Privacy Framework certification, or Standard Contractual Clauses) and link each processor's DPA. Confirm the Supabase region shown in the dashboard.

We do not sell your data and we do not share it with advertisers.

6. How long we keep it

For as long as you have an account. When you delete your account (Profile → Delete account) your account, plans, sessions, rounds, reflections, mental profile, coach conversations, consent records and stored files are deleted straight away, and your analytics person is deleted from PostHog. Backups roll off within [PLACEHOLDER — confirm Supabase backup retention, typically 7 days].

7. Your rights

You can access, correct, export or erase your data, object to or restrict processing, and withdraw consent at any time. Most of this you can do yourself in the app; for anything else email us (section 1) and we will answer within a month. You can also complain to the Data Protection Commission (Ireland) or your local supervisory authority.

8. Children

[PLACEHOLDER] Hooked2Golf is not directed at children under 16 and we do not knowingly collect their data. Confirm the age threshold (16 in Ireland for information-society services) and how it is enforced at sign-up.

9. Security

Data is encrypted in transit and at rest. Access to your rows is restricted to your own account at the database level (row-level security); the Mental Coach's server functions use a separate service credential that never ships in the app.

10. Changes

If this policy changes in a way that matters, we will tell you in the app before it takes effect. The date at the top always shows the current version.