Privacy Policy for ZenCaddie

Introduction

ZenCaddie - Software Secrets LLC ("we," "our," "us," or "Company") operates ZenCaddie, a golf mental-game product. This Privacy Policy explains what information we collect, how we use it, how we share it, and the rights you have regarding your data.

ZenCaddie exists on two separate surfaces, and they handle data very differently:

• The iOS app (iPhone, plus the Apple Watch companion), downloaded from the Apple App Store. This app has no accounts and no cloud sync. Everything you create in it stays on your device.
• The web app and website at zencaddie.com, including the signed-in web app. This surface does use accounts and does store your data on our servers.

Throughout this policy, we say "the iOS app" or "the web app" whenever a practice applies to only one of them. Where we say "the Service," we mean both.

This policy applies to all users of ZenCaddie, regardless of location. We are committed to transparency and compliance with applicable privacy laws in the jurisdictions where our users reside, including the General Data Protection Regulation (GDPR) in the European Union and European Economic Area, the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA) in California, the UK General Data Protection Regulation (UK GDPR) in the United Kingdom, the Personal Information Protection and Electronic Documents Act (PIPEDA) in Canada, the Lei Geral de Proteção de Dados (LGPD) in Brazil, and the Privacy Act in Australia.

Effective Date: April 14, 2026
Last Updated: August 5, 2026

The Short Version

• The iOS app keeps your golf data on your phone. Your profile, favorites, habits, rounds, streaks, settings, and any affirmations you record in your own voice are stored only on that device. There are no accounts, no sign-in, and no cloud sync. Deleting the app deletes that data.
• The web app stores your data on our servers because it needs an account to sign you in on more than one device.
• We do not sell your personal information, and we do not share it for cross-context behavioral advertising.
• The iOS app contains no ads, no advertising identifiers, and no cross-app or cross-site tracking. It does not use Apple's Identifier for Advertisers (IDFA) and never presents an App Tracking Transparency prompt.
• We do advertise ZenCaddie on third-party platforms to reach new golfers. That advertising activity is described under "Advertising and Marketing" below, and it involves the website only.

Information We Collect

What the iOS App Collects

The iOS app is designed to work without an account. We do not receive your name, your email address, or the contents of anything you write or record in it. Specifically:

• Your Golf Data Stays on the Device: Your profile, favorite affirmations, habit streaks, logged rounds, routine preferences, and settings are stored in local storage on your iPhone or Apple Watch. They are not transmitted to us.
• Voice Recordings Stay on the Device: If you record an affirmation in your own voice, the app asks for microphone permission and saves the audio file locally on your iPhone. Recordings are never uploaded to us or to any third party.
• Reminders Are Local: The daily reminder is a local notification scheduled by iOS on your device. We do not operate a push-notification server for the iOS app and we do not collect device push tokens.
• Purchases: Subscriptions and the lifetime purchase are processed by Apple and verified through RevenueCat, Inc. using an anonymous identifier. We receive confirmation of your entitlement and purchase history. We never see your name, email address, or payment card details.
• Crash and Performance Diagnostics: If the app crashes, hangs, or hits an unhandled error, a diagnostic event is sent to Sentry. See "Crash and Performance Monitoring" below for exactly what that contains.

The iOS app's Apple privacy manifest declares the data types it collects — crash data, performance data, and purchase history — all of it not linked to your identity and none of it used for tracking.

What the Web App and Website Collect

Information You Provide Directly

• Account Registration: When you create a web account, we collect your email address and a password, or, if you choose "Continue with Google," the name, email address, and profile image that Google shares with us. Accounts are managed with Firebase Authentication.
• Mental-Game Email Course: When you sign up for our mental-game habits email course, we ask for your email address. We use it to send you the course and a short series of follow-up emails about your mental game and ZenCaddie. This is separate from account registration, and you do not need an account to sign up. Every one of these emails includes a one-click unsubscribe link, and unsubscribing stops them immediately. If you later create an account or purchase, we stop this series automatically.
• Mental-Game Content You Create: If you write your own affirmations, record affirmations in your own voice, log rounds, or save routine preferences in the web app, we store that content so the Service can deliver it back to you on your next sign-in. Voice recordings made in the web app are uploaded to Firebase Cloud Storage under a folder that only your account can read.
• Payment Information: When you purchase through zencaddie.com, payment information (card details, billing address, and transaction history) is collected and processed by Stripe, Inc., our payment processor. We never see or store your card number. Stripe returns a customer identifier, which is the only billing value we associate with your account.
• Customer Support: When you contact us for support, we collect what you put in your message, including your name, email address, and the details of your inquiry.
• Forms and Surveys: If you fill out forms on our website, we collect the information you voluntarily provide.

Information Collected Automatically

• Device and Browser Information: Browser type, operating system, screen size, referring page, and approximate region.
• Usage Data: Pages visited, features used, time spent, and actions taken in the web app.
• Diagnostic Data: Stack traces and browser metadata when the web app throws an unhandled error, sent to Sentry.
• Cookies and Similar Technologies: Used for sign-in sessions, saved preferences, and analytics. See "Cookies and Tracking Technologies" for when analytics run and how to turn them off.

How We Collect Information

• Forms: Account registration, email-course signup, contact, and feedback forms on the website and web app.
• Analytics Tools: PostHog, Google Analytics, and DataFast measure usage of the website and web app. None of them run in the iOS app. In the EU, EEA, and UK they stay off until you actively accept; elsewhere they load under implied consent until you decline. See "Managing Your Choices" for the full rules.
• Crash and Performance Monitoring: Sentry (Functional Software, Inc.) receives diagnostic events from both the iOS app and the web app.
• Payment Processors: Stripe, Inc. for purchases made at zencaddie.com. Apple Inc. for App Store purchases, with RevenueCat, Inc. verifying the resulting entitlement.
• Google Sign-In: If you use "Continue with Google," Google shares your name, email address, and profile image with us to create the account.
• Customer Support Channels: Email, where you voluntarily provide information.

How We Use Your Information

• Provide the Service: To deliver, maintain, and improve ZenCaddie, including authentication, account management, and technical support.
• Billing and Payments: To process payments, manage subscriptions, send receipts, and maintain billing records.
• Communication: To respond to your inquiries and send service messages such as password resets and trial reminders.
• Marketing Emails: If you opt in — by signing up for the mental-game email course or a marketing list — we send you that course and other emails about your mental game, new features, and offers. We only send these to people who asked for them, and every one carries a one-click unsubscribe link that takes effect immediately.
• Analytics and Research: To understand how people use ZenCaddie so we can improve it.
• Advertising: To promote ZenCaddie to prospective customers, and to measure whether those campaigns worked. See "Advertising and Marketing" below for the limits on this.
• Security and Fraud Prevention: To detect, prevent, and address fraud, abuse, and security incidents, and to protect the rights, property, and safety of ZenCaddie, our users, and the public.
• Legal Compliance: To comply with applicable laws, regulations, court orders, and government requests.

Advertising and Marketing

We buy advertising on third-party platforms — search engines, social networks, and similar channels — to introduce ZenCaddie to golfers who have not heard of it. This section explains exactly what that does and does not mean for your data.

• The iOS app is out of scope entirely. It shows no ads, contains no advertising SDKs, does not access the Identifier for Advertisers (IDFA), never presents an App Tracking Transparency prompt, and does not track you across other apps or websites. Its Apple privacy manifest declares tracking as disabled, and no data collected by the app is used for tracking.
• Advertising activity is limited to the website. Ads we buy point to zencaddie.com.
• We do not currently run advertising or retargeting pixels on zencaddie.com. The only third-party measurement on the site is the analytics named above, under the rules in "Managing Your Choices."
• If we add advertising measurement to the website — for example a conversion pixel that tells an ad platform a signup came from its campaign — it will load only on zencaddie.com, only after you accept non-essential cookies, and never inside the iOS app. We will update this policy and the "Last Updated" date before doing so.
• We do not build advertising profiles from the content you create. Your affirmations, recordings, rounds, and streaks are never used for advertising or shared with advertising platforms.

Lawful Bases for Processing (GDPR/UK GDPR)

For users in the EU, EEA, and UK, we process personal information on the following lawful bases:

• Contract: Processing necessary to provide the Service and fulfill our obligations to you.
• Legitimate Interests: Processing for security, fraud prevention, and service improvement, balanced against your privacy rights.
• Consent: For marketing emails, non-essential cookies, and analytics.
• Legal Obligation: Processing required to comply with applicable law.

Information Sharing and Disclosure

We Do Not Sell Your Data

ZenCaddie does not sell, rent, or trade your personal information. We do not share your personal information for cross-context behavioral advertising as those terms are defined under the CCPA and CPRA.

Service Providers

We share personal information with third parties only when necessary to operate the Service or comply with the law:

• Apple Inc. and RevenueCat, Inc.: App Store purchases are processed by Apple. RevenueCat verifies the resulting subscription entitlement using an anonymous identifier. This is the only routine data flow out of the iOS app besides crash diagnostics.
• Stripe, Inc.: Processes payments made directly at zencaddie.com.
• Google LLC (Firebase): We use Firebase Authentication, Cloud Firestore, Cloud Storage, Cloud Functions, and Firebase Hosting to authenticate web accounts, store web-app data and voice recordings, run server-side code, and serve the Service.
• PostHog, Inc., Google LLC (Google Analytics), and DataFast: Receive website and web-app usage data collected in your browser, subject to the consent rules in "Managing Your Choices."
• PostHog, Inc. (server-side events): Separately from the browser analytics above, our servers send PostHog a small set of account events that only the backend can see — a subscription being granted or cancelled, a trial converting, a trial reminder going out, and an email-course opt-in. These carry your ZenCaddie account identifier and the event name, never your name, email address, or any content you created. Because they are generated on our servers rather than in your browser, they are not governed by the cookie banner. They are processed to operate and account for your subscription, and you can object to that processing using the rights described below.
• Functional Software, Inc. (Sentry): Receives crash and error diagnostics from both surfaces.
• Resend, Inc.: Delivers transactional and course emails.
• Legal and Compliance: We may disclose information when required by law, court order, or government request, or to protect the security, rights, and safety of our users and the public.

All third-party service providers are contractually obligated to use your information only as necessary to provide their services to us, and to maintain the confidentiality and security of your data. We do not share your personal information with third parties for their own marketing purposes.

Crash and Performance Monitoring

We use Sentry, operated by Functional Software, Inc., to find and fix crashes in ZenCaddie. When the app or web app crashes, hangs, or hits an unhandled error, Sentry receives a diagnostic event.

That event contains:

• A Stack Trace: the technical record of what code was running when the problem occurred.
• Device and Environment Metadata: app version, operating system version, and device or browser model.

Sentry is configured with personally identifying information disabled on both surfaces. We do not send your name or email address to Sentry, we do not attach a user identifier to iOS events, and Session Replay is switched off, so we never record your screen. On the website and web app, Sentry runs in production builds only; in the iOS app it runs in every build, including any beta you install through TestFlight.

Diagnostic data is retained by Sentry according to the retention settings on our project. For Sentry's own privacy practices, see https://sentry.io/privacy/.

Data Retention

We retain personal information for as long as necessary to provide ZenCaddie, fulfill the purposes described in this policy, and comply with applicable legal and tax regulations.

• iOS App Data: Held on your device, not by us, for as long as the app is installed.
• Web Account Information: Retained for the life of your account, and briefly afterward where legal or tax obligations require it.
• Payment Records: Retained as long as tax, accounting, and audit regulations require.
• Usage and Analytics Data: Retained for a limited period to improve the Service; older data is aggregated or deleted.
• Customer Support Records: Retained for a reasonable period to resolve disputes and answer follow-up questions.
• Marketing Suppression List: If you unsubscribe, we keep your email address on a suppression list specifically so we can honor your opt-out.

Deleting Your Data

iOS App

The iOS app stores your data only on your device and has no account to delete. Deleting the app from your iPhone deletes your ZenCaddie data, including any voice recordings you made. If you also want your App Store subscription cancelled, manage it in Settings on your iPhone under your Apple Account, since subscriptions are billed by Apple rather than by us.

Web App

To delete your ZenCaddie web account and everything stored under it — profile, rounds, custom affirmations, voice recordings, and preferences — email support@zencaddie.com from the address on the account. The web app's Settings screen has a Privacy section with a one-tap link that opens that request for you. We complete deletion requests within 30 days. Records we are legally required to keep, such as payment and tax records, are retained for the period the law requires and are not used for any other purpose.

Your Privacy Rights

The rights available to you depend on your location. Below is a summary of your privacy rights under applicable laws.

Rights for EU/EEA and UK Residents (GDPR/UK GDPR)

• Right of Access: You may request a copy of the personal information we hold about you.
• Right to Rectification: You may request correction of inaccurate or incomplete personal information.
• Right to Erasure ("Right to be Forgotten"): You may request deletion of your personal information, subject to legal and contractual exceptions.
• Right to Restrict Processing: You may request that we limit how we process your information for certain purposes.
• Right to Data Portability: You may request a copy of your personal information in a structured, machine-readable format.
• Right to Object: You may object to processing based on legitimate interests, or to marketing communications.
• Right to Withdraw Consent: Where processing is based on your consent, you may withdraw it at any time.
• Right to Lodge a Complaint: You may file a complaint with the European Data Protection Board (https://edpb.europa.eu/) or your local supervisory authority.

Rights for California Residents (CCPA/CPRA)

• Right to Know: You may request what personal information we collect, use, and share about you.
• Right to Delete: You may request deletion of personal information we collected from you, subject to legal exceptions.
• Right to Correct: You may request correction of inaccurate personal information.
• Right to Opt Out of Sale or Sharing: We do not sell your personal information and we do not share it for cross-context behavioral advertising, so there is nothing to opt out of. You may still submit a request, and we will confirm our practices in writing.
• Right to Limit Use of Sensitive Personal Information: We do not use or disclose sensitive personal information for purposes beyond providing the Service.
• Right to Non-Discrimination: We will not discriminate against you for exercising your privacy rights.
• Right to Appeal: If we deny your request, you may appeal our decision.

California residents may submit requests by emailing support@zencaddie.com. You may also designate an authorized agent to submit requests on your behalf.

Rights for UK Residents (UK GDPR)

UK residents have substantially the same rights as EU/EEA residents under the UK GDPR (see above). You may lodge complaints with the Information Commissioner's Office (https://ico.org.uk/).

Rights for Canadian Residents (PIPEDA)

• Right to Access: You may request access to personal information we hold about you.
• Right to Accuracy: You may request correction of inaccurate personal information.
• Right to Withdraw Consent: You may withdraw consent for processing, subject to legal obligations.
• Right to Complain: You may lodge a complaint with the Office of the Privacy Commissioner of Canada (https://www.priv.gc.ca/).

Rights for Australian Residents (Privacy Act)

• Right to Access: You may request access to personal information we hold about you.
• Right to Correction and Completion: You may request correction of inaccurate personal information.
• Right to Complain: You may lodge a complaint with the Office of the Australian Information Commissioner (https://www.oaic.gov.au/).

Rights for Brazilian Residents (LGPD)

• Right of Access: You may request access to your personal information.
• Right of Rectification: You may request correction of inaccurate data.
• Right of Deletion: You may request deletion of data, subject to LGPD exceptions.
• Right to Data Portability: You may request your data in a portable format.
• Right to Opt Out of Processing: You may object to processing for certain purposes.
• Right to Complain: You may file a complaint with the Autoridade Nacional de Proteção de Dados (ANPD) (https://www.gov.br/anpd/).

How to Exercise Your Rights

To exercise any of your privacy rights, email support@zencaddie.com. Please include enough detail for us to identify you and locate your information. We respond within the timeframes required by applicable law, typically within 30 days. In some cases we may ask for additional information to verify your identity. If we cannot fulfill your request, we will explain why and tell you how to appeal or complain.

Children's Privacy

ZenCaddie is not intended for children under the age of 13, and we do not knowingly collect personal information from children under 13. If we learn that we have collected personal information from a child under 13, we will delete it and terminate the account promptly.

For users between 13 and 18 years old, we collect minimal personal information and use it only to provide the Service. We do not use data from minors for targeted advertising or marketing.

If you are a parent or guardian and believe your child has provided personal information to ZenCaddie without your consent, contact us at support@zencaddie.com and we will take appropriate action.

International Data Transfers

Your personal information may be transferred to, stored in, and processed in countries other than your country of residence, which may have data protection laws that differ from your own.

• Standard Contractual Clauses (SCCs): For transfers from the EU/EEA to countries outside it, we rely on Standard Contractual Clauses approved by the European Commission.
• Adequacy Decisions: Where applicable, we rely on adequacy decisions by relevant authorities.
• Consent: We may obtain your explicit consent for transfers to countries without equivalent protections.

Web-app data is processed primarily in the United States. By using ZenCaddie, you consent to that transfer for the purposes described in this policy.

Security Measures

• Encryption in Transit: Traffic to and from ZenCaddie is encrypted with industry-standard TLS.
• Owner-Only Access Rules: Web-app data and voice recordings are stored behind server-enforced security rules that allow only the signed-in owner of an account to read or write them.
• Server-Enforced Billing Fields: Subscription and entitlement fields can be written only by our server-side code, never by a browser.
• On-Device Storage for iOS: The iOS app's data never leaves your device, which removes an entire class of server-side risk.
• Access Controls: We limit access to personal information to the people and service providers who need it, and require them to maintain confidentiality.
• Data Minimization: We collect and retain only what the Service needs.

No system is completely secure, and we cannot guarantee absolute security. If you believe your account has been compromised, contact us immediately at support@zencaddie.com.

Cookies and Tracking Technologies

Cookies and similar browser storage are used on zencaddie.com and in the web app. The iOS app does not use cookies, advertising identifiers, or any cross-app or cross-site tracking technology.

Types We Use

• Essential: Required for sign-in sessions, security, and basic functionality. These do not require consent.
• Preference: Remember your settings, including your cookie choice itself, so you are not asked again on every visit.
• Analytics: Set by PostHog, Google Analytics, and DataFast to measure how the site and web app are used. Whether these load before you make a choice depends on where you are — see "Managing Your Choices" directly below.

We do not currently set advertising or retargeting cookies, and we do not allow advertising networks to set third-party cookies through our site.

Managing Your Choices

• Do Not Track and Global Privacy Control: If your browser sends a Do Not Track or Global Privacy Control signal, we treat it as a refusal and never load analytics. No banner is shown and there are no exceptions. This check runs before every other rule below.
• EU, EEA, and UK Visitors: Analytics stay off until you actively accept. Nothing loads before you choose.
• Everywhere Else: On your first visit, analytics load under implied consent while the banner is shown, and stop when you decline. If you would rather nothing loaded at all, decline on the banner or turn on Global Privacy Control in your browser, which we honor before anything runs.
• Your Choice Is Remembered: Accepting or declining is stored in your browser, so we stop asking, and the choice carries between the website and the web app. Declining switches PostHog and Google Analytics off immediately; DataFast has no mid-page opt-out, so it stops on your next page load. Neither loads again on later visits.
• Browser Controls: Most browsers let you block or delete cookies. Blocking essential cookies will break sign-in.
• Google Analytics Opt-Out: https://tools.google.com/dlpage/gaoptout

Apple App Store and Platform Disclosures

The iOS app is distributed through the Apple App Store and complies with Apple's App Store Review Guidelines on privacy and data protection.

App Privacy Details: The practices described here match the App Privacy Details configured in App Store Connect and the privacy manifest bundled with the app. The app declares three collected data types — crash data, performance data, and purchase history — none of which are linked to your identity and none of which are used for tracking.

Tracking: The iOS app does not track you. It does not access the Identifier for Advertisers (IDFA), does not present an App Tracking Transparency prompt, contains no advertising SDKs, and does not derive identifiers from device characteristics to identify you across apps, websites, or services. Its privacy manifest declares tracking as disabled with no tracking domains.

Accounts: The iOS app does not offer account creation. There is no sign-in and no account to delete. Uninstalling the app removes your data from the device.

Microphone: The app requests microphone access only when you choose to record an affirmation in your own voice. Recordings are saved as audio files on your device and are never uploaded. You can revoke microphone access at any time in Settings on your iPhone.

Notifications: Daily reminders are local notifications scheduled on your device by iOS. We operate no push server for the iOS app and collect no device push tokens. You can turn reminders off in the app or in Settings on your iPhone.

Purchases and Subscriptions: Subscriptions and the lifetime purchase are billed by Apple and verified through RevenueCat using an anonymous identifier. Manage or cancel an App Store subscription in Settings on your iPhone under your Apple Account. We cannot cancel an Apple subscription on your behalf.

Apple Watch: The Apple Watch companion displays and records the same on-device data as the iPhone app and transmits nothing to us.

Age: ZenCaddie is not intended for children under 13. We do not use Apple's parental consent mechanisms because the app collects no personal information from users.

Data Deletion: Because the iOS app has no accounts, deleting the app deletes your data. For the web app, see "Deleting Your Data" above, or email support@zencaddie.com.

ZenCaddie is not currently distributed on Google Play. If that changes, we will update this policy with the corresponding disclosures before publishing.

Changes to This Policy

We may update this Privacy Policy to reflect changes in our practices, technology, or legal requirements. When we make material changes, we will:

• Post the updated policy here with a new "Last Updated" date, and
• Email account holders at the address on their account.

Your continued use of ZenCaddie after such notice constitutes acceptance of the updated policy. We encourage you to review it periodically.

Contact Information

Privacy Contact Email: support@zencaddie.com

Company / Legal Entity: ZenCaddie - Software Secrets LLC

Service / Product Name: ZenCaddie

Website: https://zencaddie.com/

Mailing Address:
155 31st Street
Ogden, UT 84401

Response Time: Privacy requests are answered within the timeframes described in the Your Privacy Rights section.

Supervisory Authority Links (for applicable jurisdictions):

• European Union / European Economic Area: https://edpb.europa.eu/
• United Kingdom: https://ico.org.uk/
• California: https://cppa.ca.gov/
• Canada: https://www.priv.gc.ca/
• Brazil: https://www.gov.br/anpd/
• Australia: https://www.oaic.gov.au/