Legal
Privacy Policy
Last updated: 26 September 2026
This policy explains what personal data ForeWay collects, why we collect it, who we share it with and how long we keep it. We have written it to describe what the product actually does, rather than to cover every eventuality.
1. Who we are
ForeWay is operated by ForeWay Ltd, a company registered in England and Wales (company number [COMPANY NUMBER]), registered office [REGISTERED ADDRESS].
ForeWay Ltd is the data controller for the personal data described here. If you have a question about this policy, or want to exercise any of the rights in section 8, contact us at privacy@foreway.co.uk.
2. What we collect
Information you give us
- Account details — email address, display name, and a profile photo if you add one.
- Phone number — only if you choose to provide one.
- Golf profile — handicap, and any notes you record.
- Payment details — handled by Stripe or OpenNode. We store a customer reference and your subscription status. We never see or store your card number.
Information created when you play
- Precise location data. When you record a round, we store GPS coordinates for individual shots. This is the most sensitive data we hold, and it is collected only while you are actively recording a round.
- Scoring and performance data — scores, shot distances, clubs, and the statistics derived from them.
- Events and tours — events you create or join, votes you cast on dates and times, and who you play with.
- Social connections — the players you follow.
Information collected automatically
- Device and browser information, including user agent, for security and troubleshooting.
- Push notification tokens, if you enable notifications.
- Usage analytics, only if you consent — see our Cookie Policy.
3. Why we use it, and our lawful basis
| Purpose | Lawful basis |
|---|---|
| Creating and running your account | Performance of a contract |
| Recording rounds, scores and location data | Performance of a contract |
| Running events, tours and leaderboards | Performance of a contract |
| Taking payment and managing subscriptions | Performance of a contract |
| AI performance analysis and coaching insights | Performance of a contract |
| Sending service messages about your account or rounds | Legitimate interests |
| Keeping the service secure and preventing abuse | Legitimate interests |
| Website analytics | Consent |
| Push notifications | Consent |
| Keeping accounting records | Legal obligation |
4. AI analysis
If you use our AI insights or coaching features, the round and shot data for the round being analysed is sent to Anthropic, which provides the AI model, and the results are returned to you. Anthropic processes this data on our instructions as a processor. We do not send your email address, name or payment details as part of this.
5. Who we share data with
We do not sell your personal data. We share it only with the service providers below, who process it on our instructions:
| Provider | Purpose | Data involved |
|---|---|---|
| Google (Firebase Authentication) | Account sign-in and identity | Email, name, profile photo |
| Supabase | Database and file storage | All account, round and event data |
| Render | API hosting | All data passing through the API |
| Netlify | Website hosting | IP address, request logs |
| Stripe | Card payments and subscriptions | Email, billing details, payment records |
| OpenNode | Bitcoin and Lightning payments | Payment records |
| Anthropic | AI performance analysis and coaching notes | Round and shot data submitted for analysis |
| golfapi.io | Golf course reference data | Course identifiers only, no personal data |
| OpenStreetMap and OSRM | Geocoding and routing for course data | Course locations only, no personal data |
| Google, Apple and Mozilla push services | Delivering notifications | Device push tokens |
| Google Analytics | Website usage measurement | Usage events, approximate location, device type |
We may also disclose data where we are legally required to, or to establish or defend legal claims.
What other players can see
ForeWay is partly social. If you join an event, tour or round with other players, your display name, profile photo, scores and round statistics for that event are visible to the other participants. Your precise shot-by-shot GPS data is not shared with other players.
6. International transfers
Some of our providers process data outside the UK, including in the United States. Where that happens, transfers are made under the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or an adequacy decision, as appropriate.
7. How long we keep it
- While your account is open — we keep your account, round, event and performance data for as long as your account exists, because that history is the product.
- If you delete your account — we hard-delete your personal data after a 30-day grace period, which exists so an accidental deletion can be reversed.
- Backups — deleted data may persist in encrypted backups for up to a further 35 days before those backups rotate out.
- Billing records — UK company law requires us to keep accounting records for six years. These are retained after account deletion and cannot be erased on request.
- Inactive accounts — if you do not sign in for three years, we will email you and delete the account if you do not respond.
- Anonymised data — we may keep aggregated, anonymised course and performance statistics that can no longer identify you.
8. Your rights
Under UK data protection law you have the right to:
- Access a copy of the personal data we hold about you
- Have inaccurate data corrected
- Have your data erased, subject to the billing-records exception above
- Receive your data in a portable, machine-readable format
- Object to, or ask us to restrict, processing based on legitimate interests
- Withdraw consent at any time, where we rely on consent
You can export or delete your data from your account settings, or email privacy@foreway.co.uk. We will respond within one month.
If you are unhappy with how we have handled your data, you can complain to the Information Commissioner’s Office at ico.org.uk.
9. Children
ForeWay is not intended for children under 13. We do not knowingly collect data from under-13s. If you believe a child under 13 has created an account, contact us and we will delete it.
10. Security
Data is encrypted in transit. Access to production systems is restricted, and credentials are held in our hosting providers’ secret stores rather than in code. No system is perfectly secure, but if a breach affects your rights we will notify you and the ICO as required.
11. Changes
We will update this page when our processing changes, and revise the date at the top. If a change materially affects your rights we will tell you directly.
12. Contact
privacy@foreway.co.uk
ForeWay Ltd, [REGISTERED ADDRESS]