Privacy

Data inventory

Version 1 · Last reviewed: 2026-08-31

Source-observed production data handling in the monorepo. Retention statements marked uncertain require portal or legal review before store submission.

account-profile

Account identity and profile: email, username, names, date of birth, avatar URL, handicap, preferences, onboarding and membership flags

Purposes: account management, personalization, social
Processors: PostgreSQL, Supabase
Identity and tracking: Linked to identity · Not marked as tracking
Collection: Required · Leaves the device
Retention: Until account deletion; Source-review qualification: The users row is persistent and deletion cascades are source-observed, but no retention schedule is defined in the repository.
Deletion path: Authenticated DELETE /user deletes the PostgreSQL users row; configured foreign-key cascades remove dependent records, and the route then calls the Supabase admin auth-user delete.
Source references: packages/database/src/schema/users.ts · apps/api/src/routes/user.ts · apps/mobile/context/supabase-provider.tsx

authentication-credentials

Supabase authentication credentials and access/refresh session tokens

Purposes: authentication, security
Processors: SecureStore, Supabase
Identity and tracking: Linked to identity · Not marked as tracking
Collection: Required · Leaves the device
Retention: Until sign-out, token expiry, or account deletion; Source-review qualification: The app stores sessions through SecureStore and the server deletes the auth user, but token and provider retention schedules are not defined in source.
Deletion path: The mobile Supabase provider signs out and removes the SecureStore-backed session; account deletion uses DELETE /user, which removes the Supabase auth user.
Source references: apps/mobile/config/supabase.ts · apps/mobile/context/supabase-provider.tsx · apps/api/src/middleware/auth.middleware.ts · apps/api/src/routes/user.ts

shot-session-telemetry

Gameplay and shot/session telemetry: launch measurements, simulated results, scores, course/session context, and AI analysis payloads

Purposes: gameplay, coaching, analytics, product improvement
Processors: Cloudflare Queues, PostgreSQL
Identity and tracking: Linked to identity · Not marked as tracking
Collection: Optional · Leaves the device
Retention: Until account deletion; Source-review qualification: Shot and analytics rows reference users with delete cascades, but queue and any derived-data retention schedule are not defined in source.
Deletion path: DELETE /user removes the user and source-observed user-referencing rows through configured PostgreSQL cascades; queued events have no separate user-facing deletion route in the repository.
Source references: packages/database/src/schema/shots.ts · packages/database/src/schema/games.ts · apps/api/src/routes/bag.ts · apps/mobile/services/statsEvents.ts · apps/api/src/routes/events.ts · apps/api/src/stats/consumer.ts

r10-device-data

Garmin R10 and watch-linked device data: device identifiers, app/build versions, connection state, launch-monitor measurements, and hashed enrollment credentials

Purposes: device linking, gameplay, diagnostics, analytics
Processors: Cloudflare Queues, PostgreSQL, SecureStore
Identity and tracking: Linked to identity · Not marked as tracking
Collection: Optional · Leaves the device
Retention: Until device revocation, account deletion, or local credential removal; Source-review qualification: Revocation and account-cascade paths are source-observed, but expiration cleanup and queue retention are not fully specified in the repository.
Deletion path: The app revokes watch devices through POST /v1/watch/devices/revoke-for-phone and removes local pending-revocation markers on repair; DELETE /user removes user-linked device rows through PostgreSQL cascades.
Source references: apps/mobile/context/r10-provider.tsx · apps/mobile/services/api.ts · packages/database/src/schema/watch.ts · packages/watch-contracts/src/watch.ts · apps/api/src/services/watchTelemetry.ts · apps/api/src/routes/watch.ts

swing-videos

User-uploaded swing videos and sidecar shot context used for coaching analysis

Purposes: coaching, customer support, product improvement
Processors: Cloudflare R2, Coach API
Identity and tracking: Linked to identity · Not marked as tracking
Collection: Optional · Leaves the device
Retention: Until account deletion; no in-repository time-based expiry schedule; Source-review qualification: DELETE /user deletes the authenticated user's R2 swing-media prefix, but the repository defines no time-based expiry, per-video deletion flow, or Coach API retention schedule. Confirm processor retention in portal/legal review.
Deletion path: Authenticated DELETE /user lists and deletes all R2 objects under swings/<authenticated user id>/ before deleting the PostgreSQL user record and Supabase auth user. The user starts this in the app from Profile → Account actions → Delete account forever → Delete Forever.
Source references: apps/api/src/routes/coach.ts · apps/api/src/schemas/coach.ts · apps/api/src/routes/user.ts · apps/mobile/services/api.ts · apps/mobile/services/coachCaptureFlow.ts

purchase-entitlement-status

Purchase and entitlement status: RevenueCat customer identity, tour-card entitlement state, purchase timestamps, and subscription membership flags

Purposes: purchases, account management
Processors: RevenueCat, Supabase, PostgreSQL
Identity and tracking: Linked to identity · Not marked as tracking
Collection: Optional · Leaves the device
Retention: Until account deletion or provider-defined purchase-record expiry; Source-review qualification: The webhook updates a persistent user membership flag, while RevenueCat and app-store purchase retention is outside the repository. Confirm provider retention in portal/legal review.
Deletion path: DELETE /user removes the PostgreSQL user and cascades dependent records; no in-repository RevenueCat customer deletion call is present.
Source references: apps/mobile/services/purchases.ts · apps/mobile/context/purchases-provider.tsx · apps/api/src/routes/revenuecat-webhook.ts · packages/database/src/schema/users.ts

push-notification-tokens

Expo push notification token and notification preference flags

Purposes: communications, account management
Processors: Expo Push Service, PostgreSQL
Identity and tracking: Linked to identity · Not marked as tracking
Collection: Optional · Leaves the device
Retention: Until token replacement, account deletion, or notification opt-out; Source-review qualification: The source provides token replacement and user-row deletion, but does not define automatic invalid-token cleanup or Expo retention.
Deletion path: The authenticated PUT /user/push-notification-token replaces the token; DELETE /user removes the users row and its token through the database deletion path.
Source references: packages/database/src/schema/users.ts · packages/database/src/schema/notificationPreferences.ts · apps/api/src/routes/user.ts · apps/api/src/services/notifications.ts

party-voice-metadata

Party, presence, and live voice/video metadata: room/session IDs, membership, participant identity, camera/microphone publication state, and short-lived connection tokens

Purposes: gameplay, communications, moderation
Processors: Centrifugo, LiveKit Cloud, PostgreSQL
Identity and tracking: Linked to identity · Not marked as tracking
Collection: Optional · Leaves the device
Retention: Live session duration for tokens; persistent party records until account deletion; Source-review qualification: Token TTLs and the no-recording camera consent copy are source-observed, but processor logs and persistent party cleanup schedules are not defined.
Deletion path: Session destroy and party-end flows stop the live room; DELETE /user removes user-linked PostgreSQL party records through configured cascades. No separate LiveKit or Centrifugo account deletion path is in source.
Source references: packages/database/src/schema/social.ts · packages/database/src/schema/games.ts · apps/game-session-api/src/routes/session.ts · apps/game-session-api/src/services/livekit.ts · apps/game-session-api/src/services/centrifugo.ts · apps/mobile/context/party-voice-provider.tsx · apps/mobile/components/party/CameraConsentSheet.tsx

diagnostics-and-crash-reports

Application diagnostics and crash/error reports, including normalized error details and selected request metadata

Purposes: diagnostics, security, product improvement
Processors: PostHog, Sentry
Identity and tracking: Not linked to identity · Not marked as tracking
Collection: Optional · Leaves the device
Retention: Provider-defined diagnostics retention; Source-review qualification: The source configures Sentry/PostHog reporting and scrubbing but specifies no provider retention period. Confirm retention and deletion controls in portal/legal review.
Deletion path: No in-repository user-facing diagnostic deletion route is present; reports require processor-console deletion or provider support review.
Source references: apps/api/src/sentry.ts · apps/api/src/index.ts · apps/api/src/middleware/error-handler.ts · apps/mobile/lib/errors/installGlobalErrorHandler.ts · apps/mobile/components/global-error-handler.tsx

product-analytics

Product analytics events and screen views, including authenticated PostHog identify/capture properties and gameplay event payloads

Purposes: analytics, product improvement
Processors: Cloudflare Queues, PostHog, PostgreSQL
Identity and tracking: Linked to identity · Not marked as tracking
Collection: Optional · Leaves the device
Retention: Provider-defined analytics retention; PostgreSQL event rows until account deletion; Source-review qualification: The repository defines append-only event storage and user cascades but no PostHog retention schedule or queue purge policy. Confirm in portal/legal review.
Deletion path: DELETE /user removes PostgreSQL analytics rows through the user foreign-key cascade; no in-repository PostHog profile/event deletion call is present.
Source references: apps/mobile/context/analytics-provider.tsx · apps/mobile/services/statsEvents.ts · apps/api/src/routes/events.ts · packages/database/src/schema/analytics.ts · apps/api/src/stats/consumer.ts

support-requests

User and party moderation reports: reason, notes, reporter/reported IDs, party context, and optional voice-snippet identifier

Purposes: customer support, moderation, security
Processors: Discord, PostgreSQL, Slack
Identity and tracking: Linked to identity · Not marked as tracking
Collection: Optional · Leaves the device
Retention: Until account deletion for database rows; provider-defined webhook retention; Source-review qualification: Report rows have user foreign keys and cascades, but Slack/Discord webhook retention and moderation-preservation requirements are not defined in source.
Deletion path: DELETE /user removes user-linked report rows through PostgreSQL cascades; webhook copies in Slack or Discord have no in-repository deletion route.
Source references: apps/api/src/routes/reports.ts · packages/database/src/schema/userReports.ts · apps/mobile/services/api.ts

marketing-waitlist-submissions

Marketing waitlist submission: name and email address

Purposes: marketing, communications
Processors: Formspree
Identity and tracking: Linked to identity · Not marked as tracking
Collection: Optional · Leaves the device
Retention: Provider-defined Formspree retention; Source-review qualification: The source posts the form to the configured Formspree endpoint but contains no provider retention or deletion controls. Confirm in portal/legal review.
Deletion path: No in-repository waitlist deletion flow is present; deletion requires the configured Formspree account or processor support.
Source references: apps/web/app/components/WaitlistForm.tsx · apps/web/next.config.ts