Privacy Policy
This policy explains how the USA Golf Events public MVP handles adult-account and optional parent-managed child-profile information. It applies to the USA Golf Events website and its account features.
Notice at collection
We collect the adult account and optional parent-managed child-profile fields listed below to provide sign-in, private event discovery, security, and account and parent controls. We do not sell this information. Payments, subscriptions, marketing sends, and profiles for children under 13 are disabled.
1. Information we collect
An adult account holder directly enters an email address, an optional mobile phone number, display name, state, age and legal-capacity confirmation, policy acceptance records, an account password, and an optional marketing preference. The password is stored only as a one-way salted hash, not as readable text. The phone number is used for account service and family support. Providing it does not authorize promotional text messages; SMS marketing requires separate express consent. Each active email address and normalized mobile number may be linked to only one account. The service offers email verification using a random, expiring, single-use link. A verified email may be used to request a password-reset link. Registration does not require a ChatGPT or Google account, and email verification is not required to finish registration or browse protected events.
A parent or legal guardian may optionally create a profile for a child age 13–17 containing only current age, a generated age band, state, optional gender, and an optional display nickname. Do not enter a child’s real name. We do not request a child’s birth date, email, phone number, school, street address, government identifier, photograph, or social-media account.
2. Children under 13
This MVP does not save profiles for children under 13. If a parent enters an age below 13, the server rejects the request before creating a child record. USA Golf Events will not enable under-13 profiles unless a separately reviewed verifiable parental-consent process is implemented.
3. How information is used
- Provide and secure the adult account.
- Unlock the protected event directory after profile completion.
- Filter events for the adult account holder and, when a parent chooses, rank family events using a child’s state, current age, and optional gender.
- Maintain consent, export, deletion, and security records.
- Record an optional marketing preference. Marketing consent is not required to use the service.
The current MVP does not use child-profile information for behavioral advertising and does not send marketing directly to children.
The allowlisted USA Golf Events owner may view adult-account display names and email addresses in a protected owner dashboard for account support and administration. Phone numbers and child nicknames remain masked there. Owner changes and account deletion require confirmation, are checked again on the server, and create an internal audit record. Bulk export remains disabled.
4. Sharing and service providers
Information may be processed by providers that support hosting, database storage, security, and site operation. They may process information only as needed to provide those services. USA Golf Events does not sell adult-account or child-profile information and does not provide child-profile information to advertising networks.
When outbound email is enabled, the email-delivery provider receives the account email address and the verification or password-reset message only as needed to deliver that message. Child-profile information is never included in those messages.
5. Public and protected event information
Anonymous visitors receive approximate event totals and non-identifying preview cards. Complete event records are returned only after the adult account information and required confirmations are submitted. Adult account and child profiles are not public.
6. Security
Protected records are stored in a server-side database. The account holder’s password is processed with a salted one-way password hash. After account creation or successful sign-in, the site creates a random access token in an HTTP-only, secure cookie. The cookie controls the signed-in session, while the password permits the account holder to sign in from another device or network. Repeated failed sign-in attempts are temporarily limited. Verification links expire after 48 hours; password-reset links expire after 30 minutes. Only hashes of the one-time tokens are stored, and a successful password reset revokes earlier signed-in sessions. Protected responses are marked private and are not intended for public indexing. No internet service can promise absolute security.
7. Retention and deletion
Active profile information is kept while the adult account remains active. Deleting a child profile removes that profile and withdraws its active consent record. Deleting the adult account removes all child profiles, disables marketing, and anonymizes the account holder’s email, display name, phone number, and state. Self-service deletion revokes active sessions. Final retention periods for consent, deletion, security, and backup records will be set after legal and operational review; until then, the service does not promise a specific deletion-from-backup period.
8. Account-holder and parent choices
An adult account holder with an active session can view or change profile information, export active account data, or delete the account. A parent or legal guardian may also delete a child profile and withdraw child-profile consent. Turning off optional marketing does not affect access to the service.
9. Cookies and device access
The site uses an essential access cookie for up to 30 days on the signed-in device. Signing out of that device or deleting the account revokes that cookie. An account holder may sign in on another device using the email address or mobile number linked to the account and the account password. The MVP does not add third-party behavioral-advertising trackers.
10. Contact and policy changes
For privacy actions, use the Export my data, Withdraw consent & delete, or Delete my account controls while device access is active. If device access is unavailable, use the USA Golf Events support channel through which access to the service was provided. A dedicated public privacy email will be added before email marketing, payments, or under-13 profiles are enabled.
This page is a lawyer-review draft, not legal advice.
Material changes will be published with a new version and effective date. When required, account holders will be asked to review the updated policy before continuing.
中文摘要
本MVP允许年满18岁的成年球员、家长或法定监护人创建账户，填写邮箱、选填手机号、显示名称、所在州、账户密码、年龄与法律行为能力确认、政策同意记录和选填营销偏好；不需要ChatGPT或Google账号。密码仅以加盐单向哈希保存。每个有效邮箱和规范化手机号只能绑定一个账户。只有家长或法定监护人可以选填13至17岁孩子资料，且只保存年龄、年龄段、州、选填性别和选填昵称；孩子资料始终私密。系统不收孩子真实姓名、生日、邮箱、电话、学校、住址、照片或社交账号，13岁以下资料会在服务端拒绝保存。成人账户使用者可以查看、修改、导出和删除账户资料；删除账户会同时删除其管理的孩子资料并匿名化身份字段。本摘要便于阅读，英文正式版本为准。
Resumen en español
Este MVP permite que jugadores adultos, padres y tutores legales mayores de 18 años creen una cuenta con correo, teléfono móvil opcional, nombre visible, estado, confirmación de edad y capacidad legal, contraseña, registros de aceptación y preferencia promocional opcional, sin cuenta de ChatGPT o Google. La contraseña solo se conserva como un hash unidireccional con sal. Cada correo y teléfono normalizado solo puede vincularse a una cuenta activa, y permite volver al mismo perfil desde otro dispositivo. El registro permite acceso inmediato; la verificación por correo no bloquea el directorio. Un correo verificado permite solicitar un enlace de restablecimiento de contraseña de un solo uso. El teléfono se usa para el servicio de cuenta y no autoriza marketing por SMS, que requiere un consentimiento expreso separado. Administradores autorizados pueden ver registros activos en un panel protegido para operar el servicio. El acceso se mantiene mediante una cookie segura por un máximo de 30 días en el dispositivo. Solo un padre o tutor legal puede guardar perfiles de menores de 13 a 17 años con edad actual y rango generado, estado, género opcional y apodo opcional. No se solicita nombre real, fecha de nacimiento, correo, teléfono, escuela, dirección, foto ni redes sociales del menor. El servidor rechaza perfiles de menores de 13 años. El titular de la cuenta puede consultar, modificar, exportar y eliminar datos. Este resumen es informativo; prevalece la versión completa en inglés.