Your scorecard, your information

Privacy policy

Last updated October 7, 2026

Card & Flag stores your scorecards on your device. Online course lookup uses a separate service; it does not upload your saved players or rounds.

This policy covers the Card & Flag Android app and this website, operated under the Card & Flag developer name. For privacy questions, contact cardandflag.dev@gmail.com.

What stays on your device

The app stores the player names and handicaps you enter, favorite-player choices, downloaded course scorecards, round settings, scores, active rounds, and round history in its local database. These records are not sent to our course service. You do not need a Card & Flag account.

The app does not request access to your contacts or precise device location. An optional round notification shows that a round is in progress; you can control notifications in Android settings.

When you look up a course

Your search text or requested course identifier is sent over HTTPS to our course gateway, hosted by Cloudflare. The gateway requests course data from GolfCourseAPI when it cannot serve a cached result. GolfCourseAPI receives the course query or identifier, not your saved player list, handicaps, or scores.

Network services necessarily process technical information such as an IP address and request timing. Our gateway uses a keyed digest of the connecting IP address to limit abuse. It stores those temporary rate-limit identifiers for up to about two minutes and caches course information for up to 24 hours. Our application diagnostics record request outcomes, status codes, duration, and limited failure categories, rather than raw search queries, IP addresses, verification tokens, or player information. Hosting providers may separately process network and security data under their own policies and retention settings.

Optional nearby courses

In versions that support nearby courses, you can choose to grant approximate location access while using the app. We explain this before requesting Android permission. If you allow it, the app can look up nearby courses when you open the app or choose a new round. It does not request precise or background location, continuously track you, or track your movement during scoring.

For a nearby lookup, the app rounds latitude and longitude to two decimal places and sends this approximate area over HTTPS to our Cloudflare-hosted gateway. When an area is not already cached, the gateway sends it to GolfCourseAPI with the search radius. Nearby course results and their approximate area may be cached at the gateway for up to 24 hours; they are not linked to saved players or rounds. The app holds nearby results and location in memory rather than saving them in round history, its database, or backups.

Our application diagnostics and alert emails do not include location coordinates or request URLs. Hosting and location-service providers may process technical information under their own policies. You can decline location access or revoke it in Android settings at any time. Saved courses, manual course search, and scoring remain available without location permission.

Google Play verification

Online lookup in release builds uses Google Play Integrity to help check that a request comes from a recognized app on a device meeting Google’s integrity requirements. Google processes app, device, and Play licensing signals to provide this verification. Our server receives a verification result, including app identity, version, signing-certificate information, licensing status, and integrity verdicts. It does not receive your Google account email through this verification.

A hash binds verification to the course request. The request’s raw search text or approximate coordinates are not included in that hash as readable text. Verification tokens and the app’s token provider are held in memory, not saved with your rounds. A failed online check does not block access to locally saved courses or scoring.

Learn more about Google Play Integrity and Google’s privacy policy.

Backups and sharing

Android may back up or transfer the app’s local database, including saved players and rounds, depending on your device, Google account, and system backup settings. These system-managed backups are separate from our course service. You can review or change backup settings in Android.

Sharing a scorecard or results is your choice. The content you choose to share is passed to the app or recipient you select using Android’s sharing tools. That service’s privacy practices apply to its copy. Consider other players’ privacy before sharing their names or scores.

Support and this website

If you email us, we receive your email address, message, and any attachments you choose to send. We use them to respond and investigate the issue, and retain the correspondence in our support mailbox for follow-up. Contact us to request deletion of that correspondence, subject to any applicable recordkeeping obligations.

This website has no newsletter signup, advertising trackers, or analytics scripts added by Card & Flag. Its hosting provider may process technical information and use necessary authentication or security cookies to deliver and protect the site. A private preview may require a hosting-provider sign-in.

Relevant service policies include Cloudflare, Google, and OpenAI for Sites-hosted previews. Course data is supplied by GolfCourseAPI.

Retention and your choices

Locally saved information remains on your device until you delete it using available app controls or clear the app’s storage. You can delete unwanted rounds from history. Clearing storage removes all locally saved app data, so share anything you want to keep first. System backups and previously shared copies must be managed separately with the relevant service or recipient.

We do not have a server-side copy of your local round history to retrieve or delete. To ask about information handled through online services or support, email us. We will consider access, correction, and deletion requests as required by applicable law.

Card & Flag does not sell personal information or use it for targeted advertising. We use service providers to operate course lookup, security, website hosting, and email support. Information may also be disclosed when required by law or necessary to protect the service and its users.

Security and changes

We use HTTPS for online course requests and keep provider credentials on the server rather than in release builds of the app. No storage or transmission method can be guaranteed completely secure. We will update this page when our practices change and revise the date above; material changes may also be communicated in the app or release information.

Questions? Contact Card & Flag.