Privacy Policy

Mapraow Labs Pte. Ltd. · Effective: on acceptance in the Cardie app · Last updated: 1 November 2026

This document is in English, which is the version that applies.

This policy explains how Mapraow Labs Pte. Ltd. ("Cardie," "we," "us," or "our") collects, uses, shares and protects your personal data when you use Cardie: the iPhone and Android apps, the Apple Watch and Wear OS apps, the web app at app.cardie.golf, the Cardie connector for AI apps, and our website at cardie.golf (together, "the Service").

This policy is written in English as the authoritative version. Translations are provided for convenience; in case of any conflict, this English version governs. If you're in China or Thailand, an addendum also applies to you (Section 18).

This policy replaces the previous version (what's changing). If you've accepted an earlier version, it keeps applying to you until the App asks you to accept this one.

1. The Short Version

Your data, always yours. Everything you add is yours: use it over the Cardie connector, download it, or delete it at any time.
Never sold to third parties. We don't sell your data or pass it to outside advertising platforms.
Stored in Singapore. Your account and rounds are stored and processed in Singapore. Some of the service providers we use are elsewhere, mostly in the United States (Section 10).
Optional means optional. Usage analytics, club offers and location are off unless you turn them on, and you can turn them off again at any time.

The rest of this policy is the detail.

2. Who We Are

Mapraow Labs Pte. Ltd. is a company incorporated in Singapore. It operates Cardie and is the controller of your personal data.

Contact: privacy@cardie.golf

3. What We Collect

We collect what you give us, what your devices send us when you use the Service, and what we receive from the providers you sign in or pay with. Depending on the features you use, that may include the following.

3.1 Account information

When you sign in with Apple or Google, we receive your name and email address. If you chose Apple's "Hide my email", that's a private relay address. We also store your profile: display name, handle, photo, home course, rating basis (men's or women's course ratings, a calculation setting) and language. We don't receive or store passwords.

3.2 Scorecard and round photos

Photos you take of scorecards, and any photos you add to a round or submit for a course. We use scorecard photos to read your scores, and keep them as the record behind your round history and handicap.

3.3 Golf data

Hole-by-hole scores, putts, fairways, greens, penalties, game ratings, round summaries, your handicap and its full history, profile tiers, and event and competition results. It comes from your scans, live rounds, watch, and the edits you make.

3.4 Pace of play

Tee time, round duration and the size of your playing group. Live rounds fill these in automatically.

3.5 Location

During a live round: with your permission, the App uses your device's precise location continuously while the round runs, including in the background when the App isn't on screen (on iPhone, the "Always" permission). It uses it to show distances to the green and to layups, detect the hole you're on, record shots, and keep the lock-screen Live Activity current. Location use stops when the round ends.
On the watch: the Apple Watch and Wear OS apps use the watch's own GPS during the round, and sync your hole, scores and shots with your phone.
When you look for courses: with your permission, the App uses your location in the Courses tab, course search, course select and when adding a course, to show courses near you, and to fetch weather for a round or course.
What we store: we don't keep a continuous trail of where you've been. We store what the round needs: shot start and end points (Section 3.6), the course and holes played, and round timings.

You control location in your device settings. The App asks only when a feature needs it, never during sign-up. Without location you can still scan scorecards, choose your course by hand and enter scores.

3.6 Shots and clubs

When you record a shot, on your phone or watch, we store its GPS start and end points, the distance, the hole and the club you chose. Your shots are visible to you. Anyone who can see a round also sees its longest recorded shot, as a distance and club. Other users never see your GPS tracks, your other shots or your shot positions; positions are used only in anonymous course statistics (Section 6).

3.7 Your bag

Your club set-up: which clubs you carry, and details such as brand, model or loft if you add them. You can type it in or take a photo of your clubs, and an AI provider reads the photo to fill in your bag (Section 9.1). Any signed-in golfer can see which clubs you carry on your profile, and golfers who share a private group with you can also see lofts and set distances. None of this shows if your account is hidden or deleted.

3.8 Watch workouts and health data

If you turn on Save Workout in the watch app, the watch records your round as a golf workout, including heart rate, active energy and walking or running distance. It writes the workout to your own Apple Health (Apple Watch) or Health Connect (Wear OS, through Health Services). That health data goes from the watch to your Health app. Cardie doesn't receive it on its servers, and we don't use it for anything else. If we ever wanted to receive health data, we would ask for your explicit consent first.

3.9 Groups, events and social activity

Groups you're in and your role; events you join, create or organise, and the rounds you submit to them.
Team rounds a playing partner records with you, and the invite links and QR codes you use or share.
Reactions you give and get, and the rounds you view.
Course data and photos you contribute.
Your notification preferences.

3.10 Subscription information

If you buy Cardie Pro, we receive your subscription status (for example trial, active, expired or cancelled), the product, renewal and expiry dates, and the Store's purchase identifiers, through our subscription-management provider. We don't receive your card or bank details or your billing address; Apple and Google handle payment. We also keep how many of your free rounds you've used.

3.11 AI connections

If you connect an AI app to Cardie (Section 8), we store the connection: which app, when you approved it, its scope, and the tokens that let it in. We also keep an audit record of each tool call it makes: which tool, when, whether it worked, how long it took, which app made it, and for changes, which events it touched. The audit record doesn't include the content sent back to the AI app.

3.12 Club offers

If you turn on Club offers (Section 7), we use your most recent round and your location to pick which clubs' offers you see, and we record which offers you were shown and what you did with them.

3.13 Downloads and requests

When you download your data or ask us to exercise a right, we keep a record of the request and when we handled it.

3.14 Device and service reliability information

Device information: device model, operating system, app version and language. We use it to make the App work on your device and to fix bugs.
Push token: the token Apple or Google gives your device so we can send you notifications.
Reliability events: crashes (app version, OS, device model and a technical summary of the error), scorecard-processing outcomes (success or failure, processing time, which provider), and upload outcomes. These carry no user, device or session identifier. They're collected whether or not you turn on analytics.

3.15 Usage analytics (optional)

Only if you turn on Analytics. With it off, no usage events are sent. With it on, we collect:

screens you visit and how you move through the App;
app sessions, using a session identifier that resets after 30 minutes of inactivity;
product actions, such as reacting to a round, joining a group, creating an event or searching for a course (for searches, the length of the query, never the text);
a random identifier stored on your device to connect these events across sessions. It isn't derived from any hardware identifier or your Apple or Google account, and it's sent only while analytics is on.

3.16 Support and communications

Emails and messages you send us, and our replies.

3.17 Website

When you visit cardie.golf or app.cardie.golf, see Section 16 and our Cookie Notice.

3.18 Moving from another golf app

If you send us an export from another golf app, we use it to add your own rounds to your account. If you ask us to request it for you, you sign a short authorization, and we send it, with your name and email, to that app, only to make that one request. That app may contact you to confirm it. We never ask for your password there.

4. Why We Use It, and on What Legal Basis

Where data protection law asks for a legal basis (for example in the EU, the UK and Thailand), we rely on these:

What	Why	Legal basis
Account, photos, golf data, pace of play, shots, bag, subscription, AI connections you set up	To provide Cardie: your rounds, history, handicap, live rounds, watch apps, Pro, and the connections you ask for	Contract: you asked for the Service
Location during live rounds and course search	To give distances, hole detection, shot recording, nearby courses and weather when you use those features	Contract, plus the permission you give on your device. In China, your separate consent (China Addendum)
Groups, events, social activity	To run the community features you choose to use	Contract
Anonymous course statistics, including what we share with clubs	To show course insights to golfers, Cardie's AI tools and golf clubs (Section 6)	Legitimate interests in useful course information, with strong anonymity floors
Club offers	To show you offers from clubs, picked using your last round and location	Consent: off unless you turn it on
Usage analytics	To understand how the App is used and improve it	Consent: off unless you turn it on
Device information, push tokens, reliability events, security logs, AI audit records	To keep the Service working, secure and free of abuse	Legitimate interests
Support, legal requests, accounting records	To answer you, meet legal duties and defend legal claims	Legal obligation and legitimate interests

Where we rely on legitimate interests, we've weighed them against your rights and kept the data to what's needed. You can object at any time (Section 12).

5. How We Use Your Data

Reading scores from scorecard photos with automated image recognition.
Keeping your round history, stats, trends, pace of play and handicap, using the rating basis you chose.
Running live rounds: distances, hole detection, shot recording, and the Live Activity.
Syncing rounds, scores and shots between your phone and watch.
Setting up your bag, including from a photo of your clubs.
Writing AI round recaps and explaining your handicap (Section 9).
Running groups, events, leaderboards, team rounds, reactions, views and invites.
Generating the handicap certificate.
Building anonymous course statistics (Section 6).
Showing you club offers, if you turned them on (Section 7).
Sending data to an AI app you connected, when it asks (Section 8).
Sending push notifications about group activity, events, leaderboards, reactions, views and personal bests, as your settings allow.
Sending service emails, such as account, security, subscription and policy notices.
Managing your subscription and free rounds.
Fetching weather, maps, hole imagery and course information.
Improving the App from usage patterns, if analytics is on.
Monitoring reliability, preventing abuse, and keeping the Service secure.
Answering you, and meeting our legal obligations.

Automated processing. Score extraction, handicap calculation, hole detection, AI recaps and bag reading are automated. They don't make decisions with legal or similarly significant effects on you. You can always review and correct scores before they're saved, and correct your bag at any time.

What we don't do. We don't sell your data or pass it to outside advertising platforms. We don't profile you for marketing, except to pick club offers if you've turned Club offers on (Section 7).

6. Anonymous Course Statistics

Your rounds contribute, anonymously, to statistics about the courses you play. These include scoring by handicap band, hole difficulty, pace of play, playing conditions, and where shots typically finish on each hole, built from rounds and shot positions. These statistics are part of using Cardie (see the Terms of Service). They're shown to other golfers, through Cardie's AI tools and the Cardie connector, and to golf clubs.

To keep them anonymous, our servers enforce floors: a course figure appears only once it has at least 20 rounds from at least 5 different golfers, and never from one golfer's rounds alone. Nobody, clubs included, can see your individual rounds, shot positions or identity through these statistics. Once a figure is aggregated this way it's no longer personal data, so it can stay after you delete your account.

7. Club Offers (Optional)

If you turn on Club offers in the consent screen or Settings, golf clubs can show you offers inside Cardie, and we pick which offers you see using your most recent round and your location. We don't give clubs your name, contact details, rounds or location. They see only how many golfers an offer reached and how many responded. If you contact or book with a club through an offer, what you share with it is between you and the club.

Club offers are off unless you turn them on. You can turn them off at any time in Settings, and we then stop using your data for them.

8. Connecting an AI App (the Cardie Connector)

You can connect an AI app, such as Claude or ChatGPT, to your Cardie account. You sign in with Cardie at app.cardie.golf and approve the connection on our consent page, which names the app and what it can do.

What it can reach: only the connector's own tools. It can read your rounds, scores, handicap, stats, the groups, feeds and leaderboards you're a member of, events, and course statistics. It can create, edit and publish events for you (publishing asks you to confirm, and notifies the group). It can't reach anything else in your account.
A transfer you direct: when the AI app asks for data through the connector, we send it at your instruction. Once received, the data is handled by the company behind that app (for example Anthropic or OpenAI, usually in the United States) under its own terms and privacy policy. It's not our service provider, and we don't control what it does with the data, how long it keeps it, or whether it uses it to train models. Check your settings with that company.
Other members' rounds: group feeds and leaderboards include other members' rounds. A member who connects an AI app can use it to read what they can already see in Cardie. If you're in mainland China, members' AI apps see your rounds only if you've allowed it (China Addendum).
What we keep: the connection record and an audit log of tool calls, without the content (Section 3.11).
Disconnecting: you can disconnect at any time in the web app under Profile → Connected apps, or by asking us. That revokes the connection's access straight away. It can't recall data the AI app already received; ask its company to delete that.

9. AI Inside Cardie

9.1 What we send to AI providers

We use AI providers as our service providers for:

scorecard recognition: the scorecard photo;
round recaps and handicap explanations: your round statistics and handicap figures, without your name or contact details;
reading your bag: the photo of your clubs.

9.2 How they're bound

We use these providers through their business APIs, under terms that don't allow them to use your content to train their models, and that limit how long they keep it to what's needed to provide and secure the service. We may change providers. Section 10.1 lists the current ones.

10. Who We Share Data With

10.1 Service providers

We use service providers ("processors") who handle data on our behalf, under contracts that require them to protect it and use it only for us. They fall into these groups:

Type of provider	What for	What it may receive	Where
Cloud hosting and storage	Database, sign-in, server functions, storage of photos (including training images for scorecard recognition), and hosting of our website, the web app and the Cardie connector	All account and Service data, photos, IP address	Singapore servers; some of these providers are US companies
AI providers	Scorecard recognition, round recaps, handicap explanations, reading your bag	Scorecard and bag photos, round statistics	United States and other locations they use
Subscription management	Managing subscriptions	Your Cardie user ID, subscription status and Store purchase details	United States
Apple and Google	Sign-in; Store purchases; push notifications	Sign-in details; purchase details; push token and notification text	United States and other locations they use
Email delivery	Sending service emails	Your email address and the email's content	United States
Map providers	Maps, and hole and course imagery on phone and watch	Your IP address, the map area shown, and course and hole coordinates	United States and other locations they use
Weather provider	Weather for rounds and courses	Coordinates of the course or round	United Kingdom and other locations it uses
Golf course data provider	Course search and course import	Search terms and course identifiers	Outside Singapore
Internal team tools	Internal operational alerts (for example a new course added, or a blocked bot sign-up)	Event types and short internal identifiers. Not your name, email or user-chosen handle, except the email of a blocked bot sign-up	United States
Google Analytics	Website analytics, only after you accept (Section 16)	Website usage, approximate location, device and browser	United States and other locations it uses

We run the App's analytics ourselves: usage and reliability events are stored in our own database in Singapore. We don't use a third-party analytics company for the App.

We may add or replace providers. When that changes what this table says, we'll update it. You can ask for the names of our current providers at privacy@cardie.golf.

10.2 People you choose to share with

Other Cardie users: what members of your groups, event participants and partners on team rounds can see is set out in the Terms of Service (Section 6.3). In short:
- Group members see your rounds (unless excluded), scores, stats, handicap, rating basis badge, profile tier and Pro badge.
- Event participants see your name, scores, handicap, rating basis and scorecard image.
- Reactions: the round owner sees who reacted, and other members see the count.
- Views: owners see how many views; Pro owners see who viewed.
- Your bag: any signed-in golfer sees which clubs you carry; golfers who share a private group with you also see lofts and set distances.
- Longest shot: anyone who can see a round sees its longest recorded shot, as a distance and club.
Everyone: course data and course photos you contribute, and anonymous course statistics.
AI apps you connect (Section 8), and summaries you share outside Cardie.

10.3 Golf clubs

Clubs receive anonymous, aggregated course statistics (Section 6) and reach counts for their offers (Section 7). They don't receive your identity, rounds or location.

10.4 Legal reasons and business changes

We disclose data when the law requires it, such as under a valid court order, or when it's needed to protect the rights, safety or property of our users or others. If Cardie is merged, acquired or sells its assets, your data may transfer to the new owner under this policy, and we'll tell you.

11. Where Your Data Is Stored, and Transfers

Your account and Service data are stored and processed in Singapore. Some providers process data outside Singapore, mainly in the United States (Section 10.1).

When data goes outside Singapore, or from your country to Singapore, we protect it with safeguards:

data-processing agreements with our providers that require protection comparable to the law that applies to you;
the European Commission's Standard Contractual Clauses (with the UK Addendum for UK data), where you're in the EEA or the UK, since Singapore and most of our providers' countries aren't covered by an adequacy decision;
the EU–US Data Privacy Framework (and its UK and Swiss extensions), for US providers certified under it;
encryption in transit, and access controls.

For China and Thailand, see the addendum for your country. You can ask for a copy of the relevant safeguards at privacy@cardie.golf.

Data you send to an AI app through the connector goes to that app's company at your direction (Section 8). It isn't a transfer to our service provider.

12. How Long We Keep Your Data

Data	How long
Account, profile, golf data, handicap history, pace of play, shots, bag, groups, events and social activity	While your account is active. Deleted when your account is purged (below)
Scorecard, round and course photos, including training copies	While your account is active. Deleted when your account is purged. Course photos you've submitted may stay attached to the course without your name
Bag photos	Kept only as long as needed to read your bag, and no longer than 30 days. The bag it produced stays with your account
Live-round location	Not stored as a trail. Shot points and round details are kept as above
Watch health data	Not received by Cardie. It's kept in your Health app under Apple's or Google's control
AI connections	Until you disconnect, or your account is purged. Access tokens are revoked immediately on disconnect; a record that the connection existed may be kept for up to 12 months for security
AI audit records	Up to 12 months, then deleted. Deleted or de-identified when your account is purged
Club-offer data	While Club offers is on. Your offer history is deleted within 12 months of you turning it off, or at account purge
Subscription status	While your account is active. Purchase records needed for accounting or legal claims are kept as long as the law requires
Push tokens	Until you sign out, the token stops working, or your account is purged
Usage analytics	Up to 24 months, then deleted or aggregated
Reliability events (no identifier)	Up to 24 months
Support emails	Up to 2 years after your request is resolved
Records of privacy requests	Up to 3 years, to show we handled them
Service emails (at our email provider)	As long as that provider keeps delivery logs under its terms, typically 30 days
Exports and authorizations for moving from another golf app	Deleted within 30 days of the import finishing or the request failing. The rounds stay in your account. We keep a short record of the request (date, app and result) with our records of privacy requests
Website data	See the Cookie Notice
Anonymous course statistics and other anonymised aggregates	Indefinitely; they can't be linked to you
Course data you contributed	Kept in the shared course database; it's not personal data

Deleting your account. When you ask to delete your account, it's deactivated for a 30-day grace period and other users can't see your data. Sign back in during that time and the deletion is cancelled. After 30 days, we permanently delete your personal data. That includes your rounds, photos, shots, bag, AI connections and their audit records, your consents, and your push tokens. Rounds you played in other people's events or team rounds stay with those events and rounds, without your identity where we can remove it. Backups may keep copies for up to 90 days more, after which they're purged automatically.

13. Your Rights

Wherever you are, you can:

Get a copy of all your data at any time: download it in the web app (Download my data), or ask us.
Correct your data: edit it in the App, or ask us.
Delete your data: delete your account in the App's settings, or ask us. A 30-day grace period applies (Section 12).
Take your data elsewhere, in a structured, machine-readable format, by download or by asking us.
Withdraw consent for anything that relies on it (usage analytics, Club offers, location), in Settings or your device settings, at any time. This doesn't affect what we did before.
Object to processing based on legitimate interests, and restrict processing in certain cases.
Disconnect any AI app, in Profile → Connected apps or by asking us.
Complain to your local data protection authority.

If a feature in the App or web app doesn't do what you need, email privacy@cardie.golf and we'll do it for you. We reply within 30 days, or sooner if your local law requires. We may need to check it's you before acting on a request.

14. Your Controls

Location: your device settings. The App asks when a feature needs it.
Apple Health / Health Connect: the watch app's Save Workout setting, and your Health app's permissions.
Analytics and Club offers: Settings → Privacy.
Notifications: Settings, per group and overall, and your device settings.
Who sees a round: each round's exclude toggle, and which groups you're in.
AI apps: Profile → Connected apps in the web app.
Website cookies: Cookie settings in the website footer.

15. Children

Cardie is for people aged 16 and older. We don't knowingly collect data from anyone under 16. If we learn that a user is under 16, we'll delete their account and data promptly.

16. Our Website and Cookies

Our website cardie.golf and the web app app.cardie.golf use cookies and similar storage. The web app uses necessary ones only:

Necessary: to keep you signed in, finish signing in, and remember your language. These are always on.
Analytics (optional): Google Analytics counts visits, pages, clicks and where visitors come from, only if you accept in the cookie banner. Until then, nothing is sent to Google Analytics. We don't send it your Cardie identity, and we don't link it to advertising.

You can change your choice at any time under Cookie settings in the website footer. Our Cookie Notice lists each cookie, what it does and how long it lasts. The mobile and watch apps don't use cookies.

17. Security

We protect your data with reasonable technical and organisational measures, including:

encryption in transit (TLS) and at rest;
sign-in through Apple and Google, with no passwords stored by us;
sessions kept in your device's secure storage (Keychain or Keystore);
database row-level security, so users reach only their own data and what's shared with them;
AI connections that are limited to the connector's tools and can be revoked;
access controls on our team and systems, and regular reviews of our providers.

No system is completely secure. If a breach is likely to put your rights at risk, we'll notify you and the relevant authorities as the law requires, and within 72 hours where that applies.

18. Regional Addenda

If you're in one of these places, additional terms apply and take priority for you:

China: China (PIPL) Addendum
Thailand: Thailand (PDPA) Addendum

19. Changes to This Policy

We may update this policy. If we make material changes, we'll tell you in the App, by email or both, before they take effect, and where the law or the change requires it, the App will ask you to review it before you continue. The "Last Updated" date above shows the latest version.

20. Contact Us

Email: privacy@cardie.golf

Entity: Mapraow Labs Pte. Ltd., Singapore

This document is the authoritative English version. Translations into other languages are provided for convenience only.