Privacy Policy

Last updated: October 8, 2026

Who operates Stymie

Stymie Golf operates stymie.golf and the Stymie Golf AI plugin and MCP service. This policy covers both the website and that service. Contact us at [email protected] for privacy requests.

Information you provide

Accounts use your email address, authentication information and optional golf profile details. We store the Course Passport entries, scores, preferences, community posts and early-access requests you choose to submit. A guest Passport stays in your browser until you clear it or sync it to an account. Public profile and community features display the information you choose to publish.

If you choose to link a GHIN number, we send that number to the USGA to verify it and store the number with the Handicap Index and club details the USGA returns, so your profile can show a verified handicap. We only do this after you consent on the linking screen. You can unlink it from your profile at any time, which removes the stored GHIN details and returns you to a self-reported handicap.

We use this information to provide the requested features, authenticate you, keep your saved courses, respond to support requests and prevent abuse. We do not sell personal information. Some equipment links are affiliate links; opening one sends you to the merchant or affiliate network, whose own privacy policy applies.

AI plugin and MCP lookups

The Stymie Golf plugin searches our public golf directory. It does not require a Stymie account and cannot read your email, private Passport, payment details or account records. It cannot book, pay, subscribe or change records. Saving a course happens separately on our website after you choose to save it.

Your AI provider sends the tool arguments it selects for your request, such as a course name, town, station, ZIP, chosen destination coordinates, distance, access preference or hole count. We process those arguments to return matching public information to that provider. We do not need your full conversation, precise home address or live device location: a nearby town, station or ZIP is enough. Avoid including private information in lookup text.

For a place-name lookup, our website sends the destination text to OpenStreetMap Nominatim to resolve coordinates. The geocoding response can be cached for 24 hours and served stale for up to a further seven days. Our MCP application does not store prompt arguments or result bodies in its usage logs. Those logs record tool name, success or error type, duration, response size, timestamp, client user-agent, protocol and whether a session is present, without the session identifier. Hosting providers also process network information such as IP addresses and request URLs; geocoding URLs can include the destination query.

The course-card widget does not load analytics or use browser storage. Your AI provider separately controls its chat history, connected-app access and retention under its own policy. Disconnecting Stymie there stops future tool calls; it does not delete information already held by that provider.

Service providers and recipients

Vercel hosts the website, Railway hosts the MCP service, Neon stores application records, and Resend handles service email. OpenStreetMap Nominatim receives location queries. The AI provider you connect receives the public tool results. These providers process information needed to operate their services, which may involve processing outside your country. Information may also be disclosed where required by law or necessary to protect the service.

On the website we use Google Analytics, Microsoft Clarity, Vercel Web Analytics, Umami and Ahrefs Analytics to understand visits, referring sources, page use and completed actions. Clarity can collect interaction recordings and heatmaps. These providers receive browser and usage information; analytics is separate from the MCP course-card widget. We store an initial referring host, landing path and campaign tags for attribution, and can associate that attribution with a newly created account. We do not intentionally send account email addresses or passwords as analytics events.

If your browser is set to a UK or European time zone, none of this optional analytics loads until you choose Accept on the consent notice; Reject keeps it off. Everywhere else it loads by default and you can turn it off with the control below. We treat a Global Privacy Control signal from your browser as an opt-out everywhere.

Retention

Account and saved-course records remain while needed to provide your account, until you remove supported entries or request deletion. Support and early-access records remain while needed to handle your request. Legal, security and backup requirements may require some records to remain longer; ask us about a specific record.

Browser Passport data remains until you clear it or successfully sync it. Initial acquisition data is used for a 30-day attribution window and replaced on a later visit after that window; it is also cleared by the analytics opt-out below. Essential sign-in storage is separate.

Our current hosting plans make Railway operational logs available for 30 days and Vercel runtime logs for one day. These are dashboard availability windows, not guarantees that every provider backup or security log is erased then. Google Analytics is configured for two months of user/event retention, with user retention renewed on activity; aggregate reports can remain longer. Microsoft documents 30 days for ordinary Clarity playback and nine months for click/heatmap data and labeled or favorited sessions. Other providers apply their own service retention and deletion policies.

Provider details: Railway logs, Vercel logs, Google privacy, Clarity retention, Umami privacy and Ahrefs privacy.

Your choices and requests

You can use the directory and MCP lookups without creating an account. You can remove Passport entries, clear guest data using your browser settings, disconnect the plugin in your AI provider, and request access, correction or deletion by emailing us. We may need to verify that a request concerns your own account. Do not email passwords or payment details.

The control below stops optional website analytics and acquisition capture on this browser after reloading. It does not erase previously collected provider data, disable essential sign-in storage, remove your Passport or stop necessary hosting/security logs. Clearing browser storage resets this preference.

Children

Stymie is a general-audience golf site and is not directed to children under 13. Accounts are for people 13 and older (16 and older in the UK and European Union, where younger users need a parent’s consent). We do not knowingly collect personal information from children under 13. If you believe a child has given us personal information, email us and we will delete it.

Copyright

To report content that infringes your copyright, or to correct or remove a club logo, see our Copyright and DMCA Policy.

Contact

Questions about privacy: [email protected]