Privacy and security

Fairway keeps what it needs to run your rounds and your account, and nothing else. No ads, no tracking, no analytics, and nothing is sold or shared for marketing. No money moves through Fairway.

For each round, Fairway stores what you enter so the group can follow along:

• The round's name, course and scorecard, and the games and stakes.
• Each player's name, initials, handicap index and tees, and any payment handles (Venmo, Cash App, PayPal) added.
• Scores, hole-by-hole calls and a change log of edits.

Anyone with a round's link can see it, including names, scores and payment handles, so share links with your group only. Rounds aren't listed or searchable anywhere. Only people with the scorer code, or the accounts that own or score the round, can change it. Scorer codes are stored scrambled (hashed), never as written.

Your browser keeps the rounds you've opened, their scorer codes, scorecards you saved and scores waiting for signal. This stays on your device until you clear your browser's site data.

An account is optional. If you make one, Fairway stores:

• Your email address, and your name and photo if you sign in with Google or Apple.
• What you add to your profile: name, initials, handicap index and payment handles.
• The rounds you own or score.
• Your sign-ins: for each device, its network (the first part of its address, such as 203.0.113.0/24, never the full address) and its type (such as "iPhone · Safari").

There are no passwords. Sign-in codes are 6 digits, last 5 minutes, allow 3 tries and are stored scrambled. Google and Apple sign-in tokens are stored encrypted.

You can delete your account from Sign-in and security. That removes your profile, sign-ins and the list of your rounds right away. Rounds you played in keep your name as it was entered on the card, since they belong to the whole group.

To protect accounts and scorer codes, Fairway logs sign-ins, wrong scorer codes and similar events, with the network and device type only. Email addresses in the log are stored as a keyed hash, not as written. Entries are deleted after 90 days. You can see your own on the Sign-in and security page.

• Vercel hosts the site, and Neon hosts the database.
• Resend delivers sign-in codes by email.
• Google and Apple, only if you choose to sign in with them.
• Cloudflare Turnstile checks that a person, not a bot, is asking for a sign-in code.
• OpenGolfAPI provides course data. Course searches are sent to it from our server, never with your details.
• Payment links open Venmo, Cash App or PayPal; Fairway never sees a payment.

• Everything is served over HTTPS.
• A strict Content Security Policy only lets the site's own scripts run.
• Requests that change data are refused when they come from another site.
• Sign-in and scorer codes are rate-limited against guessing.
• Sessions are kept in cookies that page scripts can't read.