Privacy Policy

When you make an account: your name, email address, and date of birth. The birthday is used to confirm you're 18 or over and isn't shown to instructors or anyone else. Passwords are handled by our authentication provider and are stored hashed — we never see them.

When you book a lesson: the instructor, date and time, what you chose to focus on, and anything you enter in the optional intake — your goal for the session, a rough skill band, and any notes for the instructor. These are optional and go to the instructor so they arrive prepared.

When you teach: your bio, experience, stated certifications, specialties, teaching location, rates, and profile and lesson photos. This information is public on your listing by design.

When you use the platform: messages and any images you send through them, reviews you write, reports you file, and basic technical data such as your IP address, which we use to apply rate limits and block abuse.

Payments: card details go directly to Stripe and never touch our servers. We keep a record of the transaction — amount, date, and Stripe's reference — not your card number.

We use your information to:

• run bookings, payments, credits, and instructor payouts;
• show instructors who is booked with them and what they asked for;
• send transactional email — booking confirmations, cancellations, password changes, and club reports;
• screen lesson listings and messages for abuse, and enforce our Terms of Service;
• keep records we're legally required to keep, such as tax and payment records.

We do not sell your personal information, and we do not use it to serve you advertising.

This one deserves its own section. If you join a club or facility group using an access code, that club's administrators can see:

• your name and email address, as a member of their group;
• every member lesson you book with their instructors — the date, the instructor, and the instructor's rate for that session, which is how they bill you;
• whether you cancelled a member lesson at short notice, so they can apply their own policy.

This is delivered to club administrators in a weekly email report and shown on their dashboard. It covers member lessons only — lessons you book and pay for yourself, outside the club's arrangement, are never included, and neither is anything you write in a booking's intake notes or in messages with your instructor.

Leaving the group, or being removed from it, stops future lessons being reported. Sessions already reported remain in the club's records.

Instructors see your name, your booking, and the intake you chose to fill in.

Other users see whatever is public: your name on a review you write, and your name in a conversation you start.

Service providers that run parts of the platform for us, and are only permitted to use your data to do so:

• Supabase — database, accounts, and file storage
• Vercel — website hosting
• Stripe — payments and instructor payouts
• Resend — sending our email
• Cloudflare — bot protection on sign-in

We may also disclose information where the law requires it, or to protect someone's safety or our legal rights. If Scratch Shack is ever sold or merged, account data would transfer with the business, and we'd tell you before that happened.

We use cookies to keep you signed in and to keep the site secure. That's it — no advertising cookies, no third-party tracking pixels, no cross-site profiling. Blocking them will stop you being able to sign in.

Account and booking records are kept for as long as your account is open, and afterwards only where we need them — payment and tax records in particular, which we keep for seven years. Images sent in messages are deleted automatically once the conversation they belong to is gone.

Email scratchshackgolf@gmail.com to ask for a copy of your data, to correct something, or to have your account and personal information deleted. We'll respond within 30 days.

Depending on where you live you may have additional rights — for example under the California Consumer Privacy Act or the GDPR — to access, correct, delete, or port your data, and to object to certain processing. We apply the requests above to everyone regardless of location.

Some email is transactional and can't be turned off while your account is open, because it's how we tell you a lesson was booked, cancelled, or refunded.

Children don't have accounts here. You must be 18 to register, and we ask for your date of birth at signup to check it. We never collect information directly from a child, and a child never receives email from us.

A parent or guardian can book a lesson for their child on their own account. When they do, we record two things about the child and nothing else:

• a first name, so the instructor knows who they're meeting;
• an age in years, so the instructor can plan a lesson that suits them.

No surname, no date of birth, no contact details, no photograph, no login. That information is visible to the instructor teaching the lesson, and to nobody else. If the lesson is covered by a golf club, the club's report shows only that the session was for a junior and the child's age — never their name.

To have a child's details removed from a past booking, email us and we'll take care of it.

Data is encrypted in transit, access to production systems is limited, and payment details are handled entirely by Stripe. No system is perfectly secure, but if a breach ever affected your personal information we'd tell you and the relevant authorities as the law requires.

If this policy changes, the date at the top changes with it. For anything that materially affects how we handle your information, we'll make a reasonable effort to tell you directly rather than just editing this page.