Effective August 31, 2026.
Pops is a small piece of software for running golf events. This page explains what it holds, why, and who else sees it. It is short because the software does not do much with your data, and it is specific because a vague privacy policy is a warning sign.
Pops is operated by POPS.golf (“we,” “us,” or “our”). If you want a human, write to hello@pops.golf — a person reads that.
A golf club’s organiser sets up an event and types in the field. Players open a link, type one shared password, and enter scores. Pops keeps the scores and the names. It does not ask players for anything about themselves, it has no player accounts, it sells nothing to anyone, and it shows no advertising.
Managers — the people who run a club. A manager signs in with a real account, using Google, Apple, or a one-time link sent to their email address. We hold their name, email address, profile picture (whatever the provider sends), which club or clubs they help run, and — if they choose to enter them — their Venmo, PayPal, or Zelle handle so players can settle up with them.
Players — everyone else. Players do not have accounts. One event has one shared password. Everybody at that event uses the same one.
That is worth saying plainly rather than in soft language, because of what follows from it: Pops cannot tell which player is using it. When a score is entered, the system knows the password was correct and which event it belongs to. It does not know, and structurally cannot know, which human typed it. When the scorecard shows a name next to “who’s scoring?,” that is a name somebody tapped on a screen — it is a convenience, not an identity, and anybody with the password can tap a different one. There is no login trail behind a player, because there is no player login.
The practical consequence: we cannot build a profile of you, because we do not know who you are.
About players — all of it typed in by their own club’s organiser, never collected from the player:
Handicaps arguably say something about a person — it is a performance measure attached to a name. We treat it as ordinary event data because that is what it is for, but you should know it is in there.
About managers: name, email, verified-email timestamp, profile image, which clubs they manage, whether they are a platform administrator, and any payment handles they entered. Signing in with Google or Apple also stores the authentication tokens those providers issue, which is how the sign-in works.
About devices: if a player turns on notifications, their browser’s push address is stored. (Nothing sends notifications yet — the receiving side is built, the sending side is not.)
About anyone who types into the help chat: the question text is saved. C.A.L.E.B. is not artificial intelligence — it is a deliberate joke, it reads canned replies from a table, and it sends nothing anywhere. But the questions are logged, so treat the help box as public and don’t type anything private into it.
POPS.golf runs no product analytics, no marketing analytics, and no behavioural tracking.
Pops does load one piece of measurement from its hosting provider, Vercel, called Speed Insights. It reports how quickly pages load — the standard web performance numbers, plus which page was loaded and rough device and connection information. It sets no cookie, stores nothing in your browser, and does not follow you to other sites. It exists so pages load fast on a phone in a cart barn with one bar of signal.
That is the whole of it. We would rather say “one performance beacon, here’s what it does” than claim zero and be wrong about it.
Two cookies, both essential, neither for tracking:
mahan_invitational_player), set when someone enters an event’s shared password. Encrypted, server-side-only, tied to a single site address, and it holds which event you’re in and nothing about who you are. Roughly 30 days.Neither is used for advertising or measurement, and there are no non-essential cookies at all — which is why you are not being asked to click a banner. There is nothing to consent to.
Pops also uses your own browser’s storage for its own convenience, never sent anywhere:
You can clear all of it by clearing site data in your browser. You’ll lose your theme choice and any un-sent scores.
We use a small number of companies to run the software. They are processors — they hold or move data on our instruction, and none of them get it for their own purposes:
Website fonts are served from Pops’ own domain, not fetched from Google at page load. Links to a course’s location open in your own maps app — at which point you’re dealing with Apple or Google directly, under their terms, not ours.
No money moves through Pops. There is no payment processor, no card handling, no wallet, no transfer, and no account holding funds. Pops has never touched a dollar and is not built to.
What it does is keep a record: who owes what, who has paid, what a skins pot or a marker ladder came to. A “Pay” button, where one appears, is a link that opens Venmo, PayPal or Zelle with an organiser’s own handle — the same as tapping a link in a text message. The transaction is between you and them, on their platform.
There is no scheduled deletion. Scores, names, league history, payment records, and audit records are kept until a club manager removes them by hand — the design intent is that a club’s history persists, because history is the point.
There is one exception worth naming: when a manager permanently removes a player, an audit record survives that deletion and keeps the player’s name as it was at the time, plus a summary of what the deletion touched. That is on purpose — a destructive action needs a trail — and it means a “delete everything” request leaves a name behind in an internal log.
Club requests submitted through the form on pops.golf are sent as an email and no record is stored in the system. They live in the recipient’s mailbox and nowhere else.
Your club’s manager can edit or permanently delete a player, including their scores. That is the fastest route and it is the one the software is actually built for.
If you would rather not go through your manager, write to hello@pops.golf. Understand the constraint: because players have no accounts, we cannot verify over email that you are who you say you are, so we will work with your club’s manager to action it rather than acting on an unverified request. Managers can have their own account and data removed by writing to the same address.
The one place Pops asks a stranger for anything. It takes your email address and, optionally, one line about what you run. Submitting it sends an email and creates no database record — the email is the only copy. The form also has a hidden field that only automated submissions fill in; if it’s filled, nothing is sent. Nothing you type is displayed back to you or to anyone else on the site.
Pops is built for adults organising adult golf events. It is not directed to children, we do not knowingly collect anything from anyone under 13, and we do not offer accounts to minors. If you believe a child’s information is in Pops, write to hello@pops.golf and it will be removed.
Note for managers: if you enter a minor into your roster, you are the one who collected that information and the responsibility for having the right to do so is yours. See the Terms.
Session cookies are encrypted and readable only by the server. Passwords are stored hashed, never in the clear. An event’s password works only at that event — the correct password for one club’s event fails at another’s, deliberately. Manager permissions are checked against the database on every request rather than trusted from a token, so revoking a manager takes effect immediately.
None of that makes it bulletproof. It is a small piece of software run by a small operation, and you should not put anything in it you would be badly hurt to see leak.
If it changes, the effective date at the top changes with it. For a change that materially affects what we collect or who receives it, we will email club managers before it takes effect and note it on this page. We won’t quietly rewrite it and rely on you re-reading.