Course backdrop
Parfect
Sign in

Privacy Policy

Effective date: June 14, 2026

This Privacy Policy explains how Parfect collects, uses, stores, and shares personal information when you use the Parfect web, mobile, and related golf services.

Parfect is intended for users in Norway. However, Parfect does not collect or verify citizenship or national identity as part of account registration.

Privacy is a core principle for Parfect. We aim to collect and use only the information that is necessary to deliver the service, keep it secure, and comply with the law. We do not use personal information for advertising, and we will not use personal information for materially different purposes without updating this policy and, where required, asking for consent.

Controller
todo as
Address
Sofies Gate 56A, 0168 Oslo
Contact
aksel@todo-as.no

1. Scope

This policy applies to the Parfect app and related services, including:

  • account sign-in and profile features;
  • club administration, course maps, and tee time management;
  • bookings, live rounds, scorecards, and round history;
  • GolfBox account linking, booking sync, and payment handoff features;
  • social features such as follows, in-app and push notifications, round posts, likes, and comments;
  • image uploads for profiles, clubs, and round posts;
  • app infrastructure such as realtime updates, logs, metrics, search, and storage.

It does not apply to websites, apps, payment pages, or services that we do not operate, such as Google, Apple, GolfBox, external payment providers, or map/3D tile providers. Their own privacy policies apply to their services.

2. Information We Collect

Sources of Information

We collect information from:

  • you, when you create content, upload images, link GolfBox, or use booking and scorecard features;
  • your device, only when you allow a permission and use a related feature, such as submitting a stroke location or choosing a photo to upload;
  • other Parfect users, when they invite you, include you in a booking, follow you, comment, like, or use shared social features;
  • club administrators, when they manage clubs, courses, tee times, bookings, and player records;
  • Google, when you sign in with Google or when selected profile and round-post images are checked for automated image moderation;
  • Apple, when you sign in with Apple or allow iOS push notifications through Apple Push Notification service;
  • GolfBox, when you choose to link a GolfBox account or use GolfBox-powered booking features.

Permission-based device information, such as precise location and photo library access, stays on your device unless you choose a feature that submits or uploads it to Parfect.

Account and Authentication Information

When you sign in, we collect and store information needed to create and secure your account, including:

  • your name;
  • email address;
  • your Google or Apple account ID and whether the provider reports your email as verified;
  • your Parfect player ID;
  • your selected rating category, used to choose relevant tee ratings and scoring defaults;
  • profile image, if you upload one;
  • account roles, such as whether you are a club administrator or app administrator;
  • invitation records, such as invited email address, invitation code, inviter, expiration, acceptance, and revocation status.

Parfect uses Google and Apple for sign-in. These providers may share your name, email address, account ID, email verification status, and, where available, a gender claim with Parfect so we can create or authenticate your account. If you use Apple's Hide My Email, Apple may provide a private relay email address instead of your personal email address.

Sign-In and Service Operation Information

We use a small amount of technical information to keep you signed in, keep live features working, and operate the service securely, including:

  • sign-in records, such as whether you use the web or mobile app, when the session was created, when it expires, and whether it has been revoked;
  • essential cookies that keep you signed in on the web;
  • a short-lived setup cookie or mobile setup token used to complete required account setup after sign-in;
  • mobile sign-in tokens stored securely on your device;
  • iOS push notification device tokens and server-issued push device IDs when you allow push notifications;
  • short-lived operational logs used for reliability, security, and debugging. These logs do not contain sensitive information or other personal information;
  • aggregate service metrics used for reliability and performance, such as request counts per endpoint. These metrics are not broken down by user and do not contain personal information;
  • connection information needed to show live booking and scorecard updates.

Web sessions may last up to 10 years unless you sign out, the session is revoked, or the token expires. Short-lived mobile sign-in handoff tokens and account setup tokens expire after a short period.

GolfBox Information

Linking a GolfBox account is optional. If you link a GolfBox account, we collect:

  • minimal GolfBox credentials necessary to perform actions on your behalf, stored encrypted at rest;
  • your GolfBox player ID;
  • validation status and timestamps;
  • booking, tee time, course, player, score submission, score attestation, payment, and related sync data returned by GolfBox as needed to provide linked features.

We use linked GolfBox credentials to sign in to GolfBox on your behalf for actions you request or authorize, such as validating your account, syncing supported bookings, reserving tee times, submitting scorecards, and reviewing score attestations. You can unlink your GolfBox account, which deletes the stored GolfBox credentials from Parfect.

When a booking requires payment, Parfect may open an external GolfBox or payment-provider page. That page is controlled by GolfBox or the payment provider, not Parfect. Parfect cannot view, inspect, receive, or store payment card numbers, security codes, bank login details, or other payment credentials you enter on that page. Parfect may receive limited booking/payment information needed to complete the booking, such as payment status, amount, currency, order details, or a receipt reference.

Booking, Club, Course, and Scorecard Information

We collect information needed for golf operations, including:

  • clubs, courses, tee boxes, holes, local rules, addresses, homepages, and course map data;
  • tee times, capacity, booking status, booking participants, temporary booking holds, and the number of externally booked slots;
  • scorecards, tee selections, rating category used for tee selection, round status, hole-by-hole scores, completion status, and live round status;
  • administrative actions by club administrators and app administrators.

Location Information

Parfect uses precise location features for course guide and live round functionality.

On supported mobile devices, and only when allowed by your device permissions, Parfect may use your location while you use course guide or live round features to:

  • show your position on a course map;
  • calculate distances during an active round;
  • update a Live Activity during an active round;
  • attach a location to a marked stroke.

Precise location stays on your device by default. During an active round, the mobile app may use background location so distance and Live Activity features keep working. The app uses the latest available location on your device for course position, distances, and Live Activity updates. It stores local location for live round actions and clears the round-specific cache when the round stops. A last-known location used for nearby club distances may remain on your device until it is replaced, you sign out, or local app data is cleared.

Parfect does not continuously upload every location update to the server. Parfect receives precise location only when you take a supported action that shares it with us, such as marking a stroke. Stored stroke location may include latitude, longitude, horizontal accuracy, hole number, stroke number, and capture time.

Images and User Content

If you upload images or create content, we may collect:

  • profile images;
  • club landing and logo images;
  • round post images;
  • round post titles and descriptions;
  • comments, likes, and follow relationships;
  • notification records and read status;
  • push notification delivery state, such as whether a stored push device token has been disabled after logout, denied notification permission, or an invalid-token response.

Uploaded images are processed into application-ready versions. Raw upload objects are stored temporarily for processing and are deleted after processing completes. Processed images may be stored in a public static object bucket or static file host. This means an image may be accessible to other users through the app and, in some cases, to anyone who has the direct static image URL.

Profile images and round-post images may be sent to Google Cloud Vision for automated safety moderation before they become visible. Parfect does not store the moderation provider response body.

Photo Library

If you allow photo library access, Parfect uses that access so you can select profile, club, or round post images. The app does not receive photos you do not choose to upload.

Search and Caches

To make the app fast and searchable, some data is copied within Parfect systems used for search and caching. For example, player search data may include name, email address, player ID, and administrator status. These copies are treated as part of the Parfect service.

Sensitive Information

Some information Parfect processes may be considered sensitive under privacy laws, including precise location submitted with supported live round actions and linked GolfBox login credentials stored in encrypted form. We use this information to provide the requested app features, secure the service, and meet legal or operational requirements. We do not use sensitive information for advertising.

3. How We Use Information

We use personal information to:

  • create, authenticate, and maintain accounts;
  • verify email-based invitations and limit access to invited users;
  • provide profile, booking, club administration, tee rating selection, and scorecard features;
  • operate GolfBox linking, booking sync, tee time reservation, score submission, score attestation, and payment handoff workflows;
  • use precise location on your device to calculate distances and show course position during active rounds;
  • record stroke locations when you mark a stroke and the app submits its latest available location with that action;
  • display live round state and realtime booking or scorecard updates;
  • process, moderate, and serve selected uploaded images;
  • support social features, follows, notifications, posts, likes, and comments;
  • send requested push notifications for supported notification types;
  • provide player and club search;
  • detect, prevent, and investigate security issues, abuse, fraud, and service errors;
  • maintain short-lived operational logs, aggregate metrics, backups, and operational reliability;
  • comply with legal obligations and enforce our agreements or policies.

We do not use your personal information for third-party behavioral advertising. We do not sell personal information.

4. Legal Bases for Processing

Under Norwegian privacy law and the GDPR, we rely on the following legal bases:

  • Contract: to provide the app features you request, including sign-in, bookings, scorecards, GolfBox integration, live rounds, and social features.
  • Consent: for device permissions such as precise location and photo library access, and where another consent is required by law.
  • Legitimate interests: to secure the service, prevent abuse, maintain short-lived operational logs and aggregate metrics, improve reliability, operate necessary infrastructure, and support club administration.
  • Legal obligation: where we must retain, disclose, or process information to comply with applicable law.

You can withdraw device-level consent for location or photo library access in your device settings. Withdrawing a permission may limit related features.

5. How Information Is Shared

We share information only as needed to operate the service, provide requested features, or comply with law.

Other Users and Club Administrators

Depending on the feature, other people may see some of your information:

  • other authenticated users may find your player profile in player search, including your name, and profile image;
  • booking participants may see names, booking details, scorecard status, and live round updates for the booking or round they are part of;
  • club administrators may see booking, player, tee time, course, scorecard, and operational information for clubs they administer;
  • social content you create, such as round posts, images, comments, likes, follow requests, and follow status, will be visible to selective users after your explicit consent (your followers).

Some uploaded or generated images may also be accessible to anyone who has the direct static image URL.

Service Providers and Integrations

We use service providers and integrations that may process personal information for us or receive information when you use their features, including:

  • Google, for sign-in and Google Cloud Vision automated image moderation;
  • Apple, for sign-in, private email relay when you choose Hide My Email, and Apple Push Notification service delivery when you allow iOS push notifications;
  • GolfBox, for linked account validation, tee time lookup, booking sync, reservation, score submission, score attestation, and payment handoff;
  • external payment providers used through GolfBox payment pages;
  • Resend, for transactional invitation emails;
  • Hetzner, which provides the hosting environment for Parfect's first-party infrastructure, including application hosting, object storage, databases, search, cache, background workers, logs, and metrics;
  • Google 3D Tiles, accessed through Cesium Ion, when course mapping or course guide views load 3D map assets.

These providers may process data in the countries where they operate.

Parfect operates its databases, search, cache, storage, background jobs, logs, and metrics as first-party systems in Hetzner's hosting environment. Internal copies used for search, caching, and operations are part of Parfect and are not separate consumer-facing services.

Legal, Safety, and Business Transfers

We may disclose information if required by law, legal process, or a valid government request; to protect the rights, safety, and security of users, clubs, Parfect, or others; or as part of a merger, acquisition, financing, restructuring, or transfer of all or part of the service.

6. Cookies and Local Storage

Parfect uses essential authentication cookies for the web app, including a session cookie and a short-lived sign-in state cookie. These cookies are used for sign-in, session security, and provider sign-in flow protection.

The mobile app stores authentication tokens in the iOS keychain. If you allow push notifications, it also stores the server-issued push device ID in the iOS keychain so the app can best-effort disable that device on logout or when iOS notification permission is denied. It may also store a short-lived live round action token, live round location data, a last-known location for nearby club distances, and cached live activity map assets on the device or in an app group container so location-backed features can work reliably.

Parfect does not use cookies for advertising nor tracking.

7. Retention

We keep personal information for as long as needed to provide the service, protect the service, comply with legal obligations, resolve disputes, and maintain accurate golf, booking, and club records.

Specific retention practices include:

  • authentication sessions may remain valid for up to 10 years unless you sign out, the session is revoked, or the token expires;
  • short-lived mobile handoff tokens expire after a few minutes;
  • short-lived account setup tokens expire after about 15 minutes and are not stored as completed account records until setup is finished;
  • push notification device tokens are retained while needed for delivery and may be disabled when you sign out, deny notification permission, or Apple reports the token as inactive or invalid;
  • invitation links expire according to the configured invitation period, commonly 14 days;
  • raw image uploads are deleted after image processing completes, including when an upload is rejected by automated moderation;
  • processed images are retained until replaced, deleted, or no longer needed;
  • local live round location cache is cleared when the active round stops, while the last-known location used for nearby club distances remains until it is replaced, you sign out, or local app data is cleared;
  • server-side stroke locations, scorecards, bookings, posts, comments, and related records may be retained as part of round history and club operations;
  • when you delete your account in the app, your account record and user-owned data are deleted, including profile, authentication, GolfBox link, WHS history, scorecards, stroke locations, social content, notifications, profile image, and post images;
  • shared booking records may remain for other players or club operations only after your account reference has been removed;
  • media cleanup for account deletion may be processed asynchronously without undue delay;
  • operational logs do not contain sensitive information or other personal information and are short-lived. They are kept only for the lifetime of the running server instance that created them and are deleted when that server instance is replaced or stopped;
  • aggregate metrics do not contain personal information and are retained for 30 days;
  • backup copies may remain for a limited time after data is deleted from active systems.

If you delete your account or ask us to delete information, we will delete it where required and where it is not still needed for legitimate business, security, legal, or operational reasons.

8. Security

We use technical and organizational safeguards designed to protect personal information, including:

  • HTTPS for service traffic;
  • secure, HTTP-only web session cookies where supported;
  • hashed session tokens in the server database;
  • encrypted storage of linked GolfBox credentials and booking session secrets;
  • encrypted storage of iOS push notification device tokens;
  • iOS keychain storage for mobile authentication tokens and server-issued push device IDs;
  • access controls for club administration, bookings, scorecards, and live round actions;
  • temporary internal storage for raw image uploads and deletion after processing;
  • separation between internal object storage and public static assets.

No method of transmission or storage is completely secure. If you believe your account or data has been compromised, contact us at aksel@todo-as.no.

9. Your Choices and Rights

Under Norwegian privacy law and the GDPR, you have rights to access, correct, delete, restrict, object to, or receive a portable copy of your personal information. You also have the right to withdraw consent where processing is based on consent.

You can exercise some choices directly:

  • update account details available in the app;
  • delete your account from the account area in the app;
  • sign out to revoke a session;
  • unlink your GolfBox account;
  • change location and photo library permissions in device settings;
  • change notification permission in iOS Settings;
  • delete or edit content where the app provides those controls.

For requests that are not available in the app, contact us at aksel@todo-as.no. We may need to verify your identity before completing a request.

We will respond to privacy requests within the time required by applicable law. If you use an authorized agent or representative, we may ask for proof of authority and may still need to verify your identity.

Norway and EEA Privacy Rights

You have rights to:

  • be informed about processing;
  • access your personal information;
  • correct inaccurate or incomplete information;
  • request deletion;
  • restrict processing;
  • receive data portability;
  • object to certain processing;
  • withdraw consent;
  • complain to a data protection authority.

The relevant supervisory authority in Norway is Datatilsynet. You may also contact another EEA supervisory authority if applicable.

Parfect does not use personal information to make decisions based solely on automated processing that produce legal or similarly significant effects.

10. International Transfers

Parfect and its service providers may process information outside Norway or the EEA, including countries that may have different data protection laws. Where required, we use appropriate safeguards for international transfers.

11. Children

Parfect is not directed to children under 13. If you believe a child has provided personal information to Parfect without appropriate consent, contact us at aksel@todo-as.no.

12. Changes to This Policy

We may update this Privacy Policy from time to time. If changes are material, we will take reasonable steps to notify users, such as updating the effective date, posting a notice in the app, or sending a service message where appropriate.

13. Contact

For privacy questions or requests, contact:

Email
aksel@todo-as.no
Controller
todo as
Address
Sofies Gate 56A, 0168 Oslo