Privacy Policy

1. What ScoringX does

ScoringX helps organisers manage golf events, player entries, flights, scorecards, results and playing-history claims. Players can use a personal QR scorecard without creating an account. Organisers may enter a player’s information before the player visits the service. Each organiser is responsible for informing participants about its event-related collection, disclosures and competition rules.

2. Information we receive

• Account information: name, email address, password hash, email-verification status and account/session records. We do not store an email/password account’s password as readable text.
• Optional player profile: display name, phone, home club, city/region, playing handicap, biography, uploaded avatar and dashboard preference. Avatars are resized and re-encoded without original image metadata, stored privately and displayed only to the signed-in account owner. Profile phones are not automatically verified, and profile edits do not change original event entries.
• Event and player information: player names, phone numbers, entered playing handicaps, divisions, team/flight membership, start details, hole scores, penalties, submissions and result status. These may come from you or the organiser through manual entry or an uploaded player list.
• History claims: email-verification code hashes, round-link requests, organiser reviews, player decisions and links between a user account and selected event entries. Legacy phone-verification or claim records may remain where previously created.
• Access and operational records: session identifiers, access-grant records, score revisions, actor identifiers, correction reasons and security/error records. Hosting and email providers may also process IP addresses, request timestamps, browser/device information and delivery metadata.
• Support correspondence: information you choose to include when contacting us or an event organiser.

3. Google sign-in, when enabled

If you choose Google sign-in, we request basic identity permissions: OpenID, email and profile. Google may return your stable account identifier, name, email address, email-verification status and profile information such as a picture. ScoringX stores the Google account identifier and provider-to-account link, and uses name/email information to create or link your ScoringX account. The current application does not persist your Google profile picture or Google access/refresh tokens in its application database.

We use this information for authentication and account linking, not to access Gmail messages, Drive files, contacts or calendars. The current service does not use Google user data for advertising, sale of data or general-purpose AI training. Google passwords are entered with Google, not into ScoringX. Information is disclosed only as described in this policy; we do not make your Google account identifier or login email part of a public leaderboard.

An existing ScoringX account must be authenticated before a matching Google identity is linked; matching email alone does not silently merge accounts. Google sign-in is optional. You can review or revoke ScoringX’s connection through your Google Account connections. Revoking Google access does not automatically delete existing ScoringX records; contact us about deletion and ensure you have another way to access your account. Google also processes information under its own privacy policy.

4. How and why information is used

We use information to operate accounts; deliver verification, reset and service emails; set up events and flights; grant scoring access; save and calculate scores; publish organiser-selected results; review corrections and history claims; prevent misuse; resolve disputes; maintain backups; and provide support. We may retain or disclose relevant records where necessary to respond to a valid legal requirement or protect the service and its users.

Required fields are identified in the service. Organiser accounts require a name and email address. Normal player entries require a name and phone number, and the organiser chooses competition-related information. If required information is not provided, the related account, event entry or verification feature may not be available. Google sign-in and linking playing history are optional; choosing not to link history does not itself erase an event entry.

5. Who can see information

An event’s organiser can manage its player contacts, entries, flights and results, and export authorised event data. A personal scorecard pass allows its holder to access the relevant scoring features. Explicitly authorised flight scorers can score current members of that flight. A QR pass is a bearer credential: possession grants its permissions, and does not prove who the person holding it is.

If an organiser enables a leaderboard accessible by link, anyone with that link may see display names, handicaps, divisions, team/flight/start details, scores and result status. The public leaderboard does not display player phone numbers, account emails or writable scoring tokens. Organisers may print or share event material separately. Copies, exports and screenshots distributed outside ScoringX may remain with their recipients.

Authorised operator personnel may access information for operation, support, security and maintenance. Hostinger processes hosted application/database information and configured email delivery. Google processes sign-in when used. Account verification codes are delivered to the account email through the configured mail service. The current history-linking flow does not send SMS codes or use an SMS verification provider. Providers may process information in countries other than yours; hosting, routing and provider arrangements determine the actual locations.

6. Email verification and historical ownership

Email verification confirms access to the account inbox. We send a 6-digit code through email, store its hash rather than the readable code, and bind it to the account and current email address. Codes expire after 10 minutes, allow at most five attempts, can be used once and are replaced by a new request. Resends are limited to once per minute and five per hour. Verified identity information supplied by Google can also verify a newly created Google account.

Email access alone does not prove ownership of every historical round. A verified organiser or platform administrator reviews participation and proposes a specific event entry to an active, verified account email. The player must accept it from their account before linking. Proposals, decisions and review reasons are recorded. Matching names or phone numbers never automatically merge records or transfer another user's linked entry. Phone numbers remain contact information; phone OTP verification and phone-based discovery are not used in the current player interface.

7. Cookies, logs and security

ScoringX uses necessary cookies and server-side sessions for sign-in, CSRF protection and QR access. Blocking these cookies may prevent those features from working. The current application does not include third-party advertising or analytics tracking. Hosting/security systems may keep operational logs independently.

Controls include HTTPS, password hashing, scoped access, request limits and hashed stored scoring tokens. The original QR link necessarily contains a bearer token, and infrastructure logs may record the initial request URL. Keep personal passes private and ask the organiser to revoke a lost or shared pass. No system or transmission can be guaranteed completely secure.

8. Retention and deletion

We retain information for the operation of your account and events, result integrity, support, security, dispute handling and applicable obligations. There is no single automatic deletion period for every account, event, export or backup. Retention and deletion requests are reviewed according to the type of record, its purpose and any justified need to retain it.

We can review deletion, account closure and contact anonymisation requests. Removing a contact or account link may leave scores, results or audit facts needed for event integrity; we will explain relevant limits when responding. Backups and copies already shared by organisers may not be erased immediately. Google disconnection alone does not remove the ScoringX account or event history.

Player profile controls

You can create, edit or remove your optional player profile, and upload, replace or remove its avatar from your profile page. Profile removal deletes those profile fields and the active avatar file, while retaining the sign-in account, linked rounds and original event records. Account closure or broader erasure requests use the contact process below. Backup copies and minimal audit records may remain under the retention arrangements described above.

9. Your choices and requests

Contact us using the details below to request access to your information, corrections, deletion or anonymisation; ask about retention or transfers; withdraw consent where processing relies on it; or raise a privacy concern. We may need proportionate identity verification and coordination with the relevant organiser before acting. The outcome can depend on applicable law and legitimate retention needs. We do not require you to send a password, QR bearer token or one-time code by email.

Ask the organiser about inaccurate event entries, leaderboard visibility or an event’s own notices. You may also raise concerns with the relevant privacy authority, including Malaysia’s Personal Data Protection Commissioner, where applicable.

10. Participants needing guardian involvement

Organisers entering information about a child or a person who cannot provide the necessary authorisation must arrange appropriate notice and parent/guardian authorisation where required. Contact us if you believe such information was entered without appropriate authority.

11. Policy changes

We will update this page and its date when our practices change. Material changes will be communicated through the service or another appropriate channel. A new feature involving additional data or purposes must be described before that processing begins.

Contact us

Ontime Setup Sdn Bhd
ScoringX · score.techchefs.biz

Privacy, deletion requests and support: project.techchefs@gmail.com

For questions about a particular event or its results, contact that event’s organiser first. For questions about the ScoringX service or the operator’s handling of your information, use the contact details above.