Privacy Policy

How Grip collects, uses and protects your personal data.

Last updated · October 2026

This policy explains what personal data Grip collects, why we collect it, who we share it with and what rights you have. It applies to the Grip mobile application and this website. Grip operates in the United Kingdom and European Union, and this policy is written to meet UK GDPR and EU GDPR requirements.

Grip is the data controller for the personal data described here. For any question about this policy, or to exercise your rights, contact [email protected].

1. Data we collect

When you register for and use the Grip app, we collect:

• Account and profile data — name, email address, date of birth, gender, profile photograph, handicap, home course and playing preferences.
• Activity data — the general location region you set, your availability, messages and conversations, friend connections, saved calendar events, tee-time activity, favourite venues, the courses you have played and the course lists you track.
• Trips — the destinations and dates of trips you add, any note you attach, and whether you are open to meeting visiting golfers near your home area.
• Reciprocal golf data — the clubs you host at and your hosting preferences, games you request, host or play, whether each game took place, the star ratings and tags you give and receive, and any private note you add to a rating.
• Technical data — device type, operating system, app version and diagnostic information collected when an error occurs.
• Notification data — your notification settings, device push tokens and a record of the golf reminders we have sent you.
• App store age signal — whether your device's app store (Apple or Google) reports you as 18 or over, under 18, or gives no answer, and how that range was declared. We never receive your date of birth or any identity document from the app store.

Where you sign in with Apple or Google, we receive your name and email address from that provider. We do not receive your password.

2. Why we process it, and our lawful basis

Under UK and EU GDPR we must have a lawful basis for processing your data. Ours are as follows:

• To provide the service — creating your account, matching you with playing partners, messaging, courses, trips and notifications. Basis: performance of our contract with you.
• To keep the community safe — reviewing reports, moderating content, enforcing our Community Guidelines, calculating host trust levels and reviewing low ratings and membership reports. Basis: our legitimate interest in a safe service, and our legal obligations.
• Golf reminders — occasional push notifications built from your own activity, such as your rounds, streak and course challenges. They are paced to how often you play, stop if you ignore them, and can be turned off at any time in Notification settings. Basis: our legitimate interest in helping you get the most from Grip.
• To improve the app — analysing which features are used and where errors occur. Basis: our legitimate interest in improving the service.
• Location — showing you nearby golfers and venues. Basis: your consent, which you may withdraw at any time in your device settings.
• To meet legal obligations — responding to lawful requests and retaining records where required. Basis: legal obligation.

We do not sell your personal data. Some safety measures apply automatically: an account may be suspended pending review if the app store reports it belongs to someone under 18, or if a guest reports that a host is not a member of the club they host at (see section 4). A person reviews every such case before any permanent action is taken, and you can contest a decision by contacting [email protected].

3. The Grip website

Before launch, this website allows you to join a waitlist by submitting your email address. We use it to notify you when Grip becomes available and, if you later create a Grip account with the same email address, to give that account a Founding member badge, on the basis of your consent. You may ask us to remove it at any time at [email protected].

4. Who your data is shared with

Other Grip users see the profile fields you choose to display — typically your first name, handicap and general area. Your precise location is never shown to other users.

• Trips — the destination, dates and any note on a trip you add can be seen by other signed-in members. If you turn on "Open to meeting visiting golfers", members with a trip near you can find you; they see roughly how far away you are, never where you live.
• Hosting — if you host, members who match the audience you choose for your listing (such as a handicap or age range) can see the club you host at, your hosting preferences, your trust level and the number of games you have hosted.
• Courses played — any member can see how many courses you have played. Your progress on course lists is visible to your friends or only to you, as you choose in Settings.
• Ratings — after a reciprocal game, each player's rating of the other is hidden until both have rated or seven days have passed. Your average star rating as a host and as a guest is shown once you have received three ratings. Individual ratings show the stars, tags, club and month played, with the rater shown by first name and last initial only. Private notes are seen only by our moderators. Ratings between members who have blocked each other are not shown to either.
• Membership reports — if a guest reports that a host is not a member of their club, the host, and anyone who earlier confirmed that membership, may be suspended while we review the report. If the report is confirmed, those accounts are closed; if not, the suspensions are lifted.

We also use the following processors, each bound by contract to process data only on our instructions:

• Supabase — database, authentication and file storage (EU/US servers).
• Firebase Cloud Messaging — delivers push notifications.
• Expo — app builds and over-the-air updates.
• Sentry — crash and error reporting. Receives diagnostic data when something goes wrong, which may include your user ID, device model, OS version and the screen you were on.
• Mixpanel — product analytics. Receives usage events such as screens viewed, features used and searches performed, linked to your user ID, so we can see how Grip is used and improve it (EU servers).
• Resend — email delivery. When you report another member, the report is emailed to our safety team so we can act on it quickly. That email contains the report reason and the user IDs and display names of the member reported and the member reporting.

We do not sell your personal data, and no processor is permitted to use it for its own purposes. We may also disclose data where required by law, to protect the rights or safety of our users or the public, or in connection with a merger or acquisition, in which case we will notify you.

5. Your rights

Under UK and EU GDPR you have the right to:

• Access a copy of the personal data we hold about you
• Have inaccurate or incomplete data corrected
• Have your data erased, including by deleting your account
• Restrict how we process your data
• Receive your data in a portable, machine-readable format
• Object to processing carried out on the basis of our legitimate interests
• Withdraw consent at any time where our processing relies on it

To exercise any of these rights, contact [email protected]. We will respond within 30 days. You can delete your account directly in the app; see our account deletion page.

You also have the right to lodge a complaint with a supervisory authority. In the United Kingdom this is the Information Commissioner's Office (ico.org.uk). In the European Union it is the Data Protection Authority for your member state.

6. Retention

We retain your data for as long as your account remains active. When you delete your account, your personal data — including your profile, your photograph and any images you have uploaded — is deleted permanently and cannot be recovered. We retain only those limited records we are required to keep by law, such as safety reports where applicable. This includes messages you have sent, which are removed from your conversations. Waitlist email addresses are retained until launch, or until you ask us to remove them.

7. Where your data is stored

Your data is held on Supabase servers within the European Union. Certain processors, including Firebase Cloud Messaging and Expo, may process data outside the UK and EU. Where this occurs, the transfer is covered by an adequacy decision or by Standard Contractual Clauses approved for UK and EU transfers.

8. Security

We apply technical and organisational measures appropriate to the risk. Data is encrypted in transit and at rest. Access is enforced at database level by row-level security, so your records are reachable only by you and, where a feature requires it, by the users you have shared them with. Authentication tokens are stored in your device's secure keychain. No system is entirely secure, but where a breach is likely to result in a risk to your rights and freedoms we will notify you and the relevant supervisory authority within 72 hours.

9. Data stored on your device

Grip does not use advertising or tracking cookies. The app stores a small amount of data locally on your device: your authentication token, your app preferences and cached content for performance. This is cleared when you sign out or uninstall the app.

10. Children

Grip is intended for users aged 18 and over. We do not knowingly collect personal data from anyone under 18. If you believe we hold data relating to a person under 18, contact [email protected] and we will delete it promptly.

To help keep Grip adults-only, the app asks your device's app store for your age range. You can decline to share it. If the app store reports that an account belongs to someone under 18, the account is suspended while we review it. If this happens to you in error, contact [email protected].

11. Changes to this policy

We may update this policy from time to time. We will revise the date shown above and, where a change is material, notify you within the app.

12. Contact

Privacy enquiries and data rights requests: [email protected]. General support: [email protected].