Privacy Policy

1. Overview

Lowman is a social app for golfers to post rounds, tag playing partners, find a foursome, and share courses played. This policy explains what we collect, how we use it, and your choices.

We try to collect only what we need to run the product. We don't sell your data and we don't share it with advertisers.

2. Information We Collect

Information you give us when you sign up and use the app:

• Account info: email address, password (stored hashed by our auth provider), display name, and handle.
• Profile info: optional avatar image, handicap range, and self-reported GHIN number if you choose to provide it.
• Posts and content: course played, score, par, putts, playing partners you tag, captions, and any photos you upload.
• Social interactions: likes, comments, follows, blocks, and reports you create.
• Support communications: if you email us, we keep your message and our reply.

Information collected automatically:

• Usage events: we log product events (for example, "post submitted" or "like tapped") through PostHog so we can understand how the app is used and fix bugs.
• Error reports: if the app crashes or errors, Sentry receives a report with a stack trace and basic device context.
• Approximate location (only if you allow it): when you create a post, the app may use your device's geolocation to suggest nearby courses. We do not store your coordinates; we use them only to perform a reverse-geocode lookup and show city/state.

3. How We Use Your Information

• To create and maintain your account and authenticate your sessions.
• To display your posts, profile, and activity to other Lowman users as part of the social feed.
• To power core features: course search, foursome matching, likes, comments, follows, blocks, and reports.
• To operate, secure, debug, and improve the product.
• To respond to support requests and safety reports.
• To comply with legal obligations.

4. How Your Content Is Shared

Lowman is a social product. By design:

• Your display name, handle, avatar, and posts are visible to other Lowman users.
• Post photos are stored in a publicly-readable image bucket. A user with the URL can view the image; assume any photo you upload may be viewed by people with that link.
• Likes and comments are visible to anyone who can view the post.
• Users you block will no longer see your content or be able to interact with you.

Your email address, password, and any private metadata (like a self-reported GHIN number) are not visible to other users.

5. Third-Party Service Providers

We use the following processors to run the product. Each has their own privacy practices. Clicking the name will take you to their privacy policy.

• Supabase — hosts our database, authentication, and image storage. Servers are in the United States.
• PostHog — product analytics (usage events only; no session replays).
• Sentry — error and crash reporting.
• Netlify — hosts our landing page and web app.
• Google Workspace — email (hello@lowman.golf).
• OpenStreetMap Nominatim — reverse geocoding for the "course near you" feature.
• Apple — App Store distribution and, in the future, push notifications via APNs.

These providers process your information on our behalf and are not permitted to use it for their own purposes.

6. Your Choices and Rights

• Edit your profile: you can update your display name, handle, avatar, and handicap range in Settings.
• Delete individual posts: open any post you created and tap the menu to delete it.
• Delete your account: Settings → Delete Account. This triggers our server-side delete_own_account routine that removes your profile, posts, likes, comments, follows, blocks, reports, and auth record. This is permanent and cannot be undone.
• Right of access, correction, and deletion: depending on where you live (including California under CCPA and EU/UK under GDPR), you may have rights to request a copy of your data, correct it, or have it deleted. Email hello@lowman.golf and we'll respond within 30 days.
• Opt out of analytics: we do not currently offer a separate analytics opt-out beyond account deletion. If this is important to you, email us.

7. Data Retention

We keep your account data for as long as your account is active. When you delete your account, your profile, posts, and interactions are deleted from our database. Backups may persist for up to 30 days before being overwritten.

Error reports in Sentry and usage events in PostHog are retained per each provider's default policy (typically 30–90 days for errors, and longer for aggregated analytics).

8. Security

We use TLS everywhere, row-level security on our database so one user can't read another user's private data, and store passwords hashed via our auth provider. No system is perfectly secure; if we learn of a breach that affects you, we will notify you by email.

9. Children's Privacy

Lowman is not directed to children under 13 and we do not knowingly collect information from them. If you believe a child under 13 has created an account, email us and we will remove it.

10. International Users

Lowman is operated from the United States and our servers are located in the United States. If you use the app from outside the US, your information is transferred to and processed in the US. By using Lowman, you consent to this transfer.

11. Changes to This Policy

We may update this policy as the product evolves. We will update the effective date above and, if the changes are material, notify you in-app or by email. Continued use of Lowman after a change means you accept the updated policy.