Your data.
Clear answers.

Data controller

Clubhouse Holding GmbH, Mozartstraße 8, 61200 Wölfersheim, Germany. For privacy requests, contact kontakt@rangecheck.app.

Scope and operating status

This policy describes Range Check during technical testing. The public website and account service run at rangecheck.app, hosted by united-domains in Germany. Internal administration is separate at rangecheck.clubhouse-holding.de. Golfer registration is enabled during testing; real vouchers are not yet issued. The iPhone app has not yet been published in the App Store. Required contracts, operational safeguards and backup deletion periods will be reviewed and finalized before release to users.

Hosting at united-domains in Germany

Accounts, photos, reviews and reward data use the Webspace M package confirmed in the customer account with united-domains GmbH, Gautinger Straße 10, 82319 Starnberg, Germany. Servers are located in Germany. According to united-domains, the webspace service also uses IONOS SE, Elgendorfer Straße 57, 56410 Montabaur, with servers in Germany. Hosting provides and secures the app under Article 6(1)(b) and (f) GDPR. Processing by service providers under instructions is governed by an Article 28 GDPR agreement. The provider describes technical access data including time, requested file, device and software details and an anonymized IP address, retained by IONOS for eight weeks for security and stability. Technical hosting setup is complete. The processing agreement, operational safeguards and specific backup periods remain subject to final verification before public release.

Account and sign-in

During registration, we process your username, an internal account ID, creation time and a secure password derivative. Passwords are not stored in plain text. Username case is normalized for uniqueness. Account activation requires an email address, stored with its verification time. We send a verification link and store only a hash of its token. The link lasts 15 minutes and is replaced when resent. The address is verified only when you select Verify email. The app checks status using a separate random registration receipt and then signs you in automatically. This receipt is protected in Keychain and removed on completion or cancellation. Registrations started in older app versions may still use a six-digit one-time code; after five incorrect attempts a new code is required. Unverified registrations expire after at most 24 hours and are cleaned up on a subsequent registration. An account is created only after verification. Acknowledging this notice is not consent to advertising. Your real name and phone number are not required. Processing provides your account under Article 6(1)(b) GDPR. An account cannot be provided without the required details, but the directory works without an account. You also receive a random recovery code; only its hash is stored by the service. After registration, the code remains protected in this iPhone's Keychain until you confirm Saved securely and is accessible in Account before then. Profile setup and saving the code are not registration requirements. Recovery or a password change replaces the code and revokes old sessions. Save the code in your password manager; the server cannot show it again.

Reviews, photos and reward progress

Submitting a check stores its club association, time, selected photo, five ratings, ball brand and type, confirmed advertising and club markings, selected condition observations and optional price, ball count and comments with your account. At least 90% of relevant fields in each chosen review area must be answered. Explicit Not used or Unable to assess responses are stored separately from stars and do not affect averages. Optional photos, prices and notes do not count as incomplete rating fields. You may additionally rate the club, restaurant and pro shop from 1 to 5 stars. Clubs and restaurants can also be reviewed separately without a range photo. Club reviews may cover course condition after playing, atmosphere, friendliness and clubhouse. Club and range reviews at one venue count toward rewards only together when both are approved; indoor qualifies alone with an approved screen photo. Three different venues form a reward goal. We store venue and account associations, ratings, optional notes, review status and visit confirmation. Each reviewed area requires matching evidence: ball basket, dining receipt, screen or club logo at the venue. Location and visit duration are not required. Standalone dining checks do not earn vouchers. Both dining review routes share a three-month interval per restaurant and account. Additional food, service, value, selection, member friendliness, course and clubhouse ratings remain separate from range rankings and do not create another reward venue. Finally rejected reviews, related photos, review notes and rejection reasons are deleted ten days after rejection during the next automatic server cleanup. Pending reviews are excluded. The planned deletion date appears with the review. Comments remain private; approved numeric values are published as averages per category after reviews from three different accounts. Only the latest approved review per person and club counts. Upload only your own photos and avoid identifiable people or others' personal data. The iPhone app reduces images and creates a new JPEG for upload. The PHP service checks and decodes it again, saving a newly generated JPEG without inherited EXIF metadata outside the public web directory. We count distinct clubs, permit a new check at the same club after three calendar months and calculate progress in groups of three different clubs. A new verified visit is required for each check. The legal basis is Article 6(1)(b) GDPR. Photos, comments, usernames and individual reviews are not publicly accessible. Range rankings combine the five numeric ratings after operator review and approval, with at least three approved reviews from different accounts and verified visits. Public rankings show club, state, averages and review count. Review status, an internal reason and review time are stored for quality assurance. Rankings are recalculated after account deletion, excluding deleted contributions. Individual submissions are not automatically forwarded to clubs.

Private round journal

When you add a round, we store the club, date played, holes, total strokes, confirmed hole-by-hole scores if provided, and optional club impression and note with your account. This provides your private journal across signed-in devices under Article 6(1)(b) GDPR. Rounds are not published in range rankings or counted toward vouchers. You can delete individual rounds; deleting your account removes all rounds. No official handicap submission is made. Optional scorecard scanning uses Apple's text recognition on your iPhone. The photo, full recognized text and other players' names are sent neither to our server nor OpenAI. You select your own row and confirm strokes before saving. The card and recognized rows remain in memory only while the scanner is open.

Operator interests and ball condition analysis

Clubhouse Holding GmbH also has commercial interests in Range Check, including golf ball product and sales planning. The operator may analyze submitted brands, conditions, visible advertising and club markings and range quality to understand practice conditions and potential improvements. Product and sales planning is an additional commercial purpose. Its legal basis, any necessary balancing of interests, scope and deletion periods must be finalized before public release; camera or GPS permission alone does not authorize it. Testing does not automatically share user photos, names, accounts or individual submissions with clubs or the CAPRI shop, and does not send individual direct advertising to users. Active reward promotions and their labeling will be displayed before participation.

Photo evidence and manual review

To review a visit, we store the cleaned photo of a ball basket, indoor screen, dining receipt or club logo with surroundings in private photo storage at united-domains in Germany. Cover customer or staff names, payment details and unnecessary personal information on receipts before photographing them. Metadata is removed, but visible content is not automatically redacted. Storage, account association and manual review provide the requested check and protect against abuse under Article 6(1)(b) and (f) GDPR. Only with separate consent do we send the photo and selected club or restaurant name and city to the OpenAI API, under the recipients and transfer conditions described below. After one-time consent on this device, checks start automatically when a photo is selected. Consent is account-specific. New photos are checked automatically first; there is no manual-review switch. Withdraw consent for future uploads under Privacy. Without consent, no new photo check is sent to OpenAI; the directory remains usable. AI provides a preliminary subject and venue match, not proof of authenticity or physical presence. We store image checksum, account, club, category, time, consent version and AI result separately from later operator decisions. Screen checks assess visible bulges, creases, impact marks and damage, not tension or functionality. Each new photo is analyzed once; repeated requests for the same photo do not trigger another AI analysis. Up to three different photos are permitted per subject and check. Clear, consistent results may automatically approve a review; after three unsuccessful different photos it remains pending manual review. Reused photos or conflicting venue matches are not automatically approved. Authorized staff may correct, reject, remove or restore reviews with reasons. Original versions, changes and decisions are logged. Changes trigger renewed review. Removed submissions do not count for rankings or new vouchers; issued vouchers are not automatically revoked. Abandoned uploads not assigned to a review are cleaned up after seven days on the next upload. Submitted evidence and change histories remain with the check and are deleted from active storage when the account is deleted. Photos and internal review data are not public.

Automatic photo checks with OpenAI

With your consent, automatic photo checks send the re-encoded visit photo without inherited EXIF metadata and review instructions through our server to the OpenAI API. Ball basket, receipt, club evidence and green checks also send the selected club or restaurant name and city for matching. We do not send account IDs, contact details or GPS coordinates. The image itself may contain readable names. Extended photo consent covers visible brands, advertising and club markings and clearly labeled ball types, proposed for your confirmation. Markings do not determine your actual visit location or prove a sponsorship agreement. Photograph only the balls. The purpose is a preliminary assessment of visible surfaces, not hidden balls or flight characteristics. The optional transfer relies on consent under Article 6(1)(a) GDPR. Consent applies to subsequent visit photos for this account on this device and can be withdrawn under Privacy before future transfers. Withdrawal cannot undo a completed transfer. We use store=false and no OpenAI file storage. According to OpenAI, API data is not used for model training by default; security logs may be retained for up to 30 days, longer under legal or security exceptions. store=false does not guarantee immediate deletion. Processing outside Germany, particularly in the USA, is possible; EU data residency is not configured. The processing agreement and safeguards for international transfers must be finalized or reviewed before public release. The photo is stored privately at united-domains before the first attempt. We also store image checksum, account, club, category, draft association, consent version, and each attempt's time, result and error category. Replaced photos in the same draft remain assigned to the submitted review. Unsubmitted drafts are cleaned up after seven days on the next upload. Submitted original results and your confirmed or corrected brand and marking details are stored separately with the check and removed on account deletion. Unconfirmed model suggestions are not treated as confirmed names. Internal analysis aggregates by club, region and period, distinguishing manual and photo-assisted ratings. Protected CSV exports contain club summaries without account identifiers, photos or GPS coordinates. Exported files must be separately updated after deletions. The confirmed photo assessment replaces only the ball rating; publication requires successful automatic or manual approval. Daily limits use a hashed account counter, cleaned up after expiry. Send consent withdrawals or deletion requests to kontakt@rangecheck.app.

Optional profile photo

After email verification, you may add, replace or remove a profile photo using the iOS photo picker. Range Check receives only the selected image. It is cropped to a 512-pixel square and re-encoded as JPEG without inherited location or camera metadata. The file is stored privately at united-domains in Germany and accessible only through your signed-in account. It is not published in rankings or shared with clubs or the shop. It provides your requested profile customization under Article 6(1)(b) GDPR. You may remove it independently of your account; account deletion also removes it.

Green photos and the fixed extra reward

With separate consent, you can submit your own green photo to OpenAI showing the hole or flag and a visible club name or logo in the same image. The recipients, transfer conditions and legal bases are those for automatic photo checks. The assessment describes only the visible turf. The club marking is compared with the selected club; a labeled card or pencil does not prove GPS presence. Cover personal details on scorecards before photographing them. On confirmed submission, we privately store the cleaned photo, analysis or manual review note, required hole number, club and account associations and review status. Green checks start automatically after consent. After three unsuccessful different photos, the photo and hole number are saved for manual review. An image hash prevents repeated submission of the same image. Clear photos are automatically reviewed; unclear photos are reviewed by authorized staff after three attempts. The green rating does not affect reward approval. Account deletion removes green photos and analysis from active storage. The planned program counts up to three approved green photos, one from each of three different qualifying range checks in a voucher goal. Three valid approved photos from those checks give a fixed €15 instead of €10; zero, one or two leave the amount at €10. There is no prize draw. We store eligible photo count, rule version and calculated amount with the voucher request; retrying does not create a second voucher. Club checks qualify only together with an approved range check at the same venue. Dining does not earn voucher progress. Reward processing is under Article 6(1)(b) GDPR. Voucher issuance remains disabled.

Dispenser photos and internal findings

With consent for automatic photo checks, a selected dispenser photo is immediately saved and analyzed with OpenAI. After three unclear photos, our team reviews it. The same recipients, transfer conditions and legal bases apply. Avoid people or personal details. Suggestions cover visible payment methods, clearly readable prices and ball counts, and exterior condition. Missing information stays unknown; functionality cannot be inferred from a photo. You report your own dispensing experience. Original assessment, confirmed or corrected details and field origins are stored with the check. The dispenser photo and individual results remain private with the range check, including replaced photos from the same draft. Unsubmitted photos are cleaned up after seven days; submitted images are removed on account deletion. Approved checks create internal recurring findings aggregated by club. Optional OpenAI prioritization receives only categories, counts, anonymous club identifiers and technical finding IDs, without names, comments, photos, account IDs or GPS data. It may select only findings already supported by evidence. Internal analysis relies on the legitimate interest described under Reviews and Article 6(1)(f) GDPR. Results are cached for up to 24 hours and hidden when source data changes; stale cache entries are removed on the next generation. This does not automatically contact clubs, publish information or decide voucher eligibility.

Weather at the club

When you open a club with verified coordinates, the app requests a forecast through our account service. Our server retrieves and caches data from MET Norway. It sends the public club coordinates to four decimal places, not your personal GPS location, account name or device IP. MET Norway sees our server's IP. Our server may technically associate your request with the selected club; the hosting log retention periods apply. No weather usage profile is created. The forecast provides requested club information under Article 6(1)(b) GDPR. Source: MET Norway, CC BY 4.0. Values are model forecasts, not measurements directly on the range.

Advertising partners and vouchers

The planned reward feature provides a €10 partner voucher for three different fully approved venues: club + range together, or indoor with an approved screen photo. CAPRI Golf is the current voucher partner. Actual voucher issuing is not yet active. When enabled, our server creates a discount code through the partner shop's Shopify interface. Shopify receives the random code, value, start, expiry and redemption conditions, but no account identifier, email, reviews, photos or GPS data. We store code, association, milestone, issuance time, validity and conditions. The account service does not send reviews, photos or account data to the shop. The shop's privacy notice also applies when you open it and redeem a code. Planned reward processing relies on Article 6(1)(b) GDPR. Vouchers cannot be combined. They are intended within 24 hours of the third fully approved venue and last exactly 48 hours from issuance. The expiry date and time appear in your account and are recorded in the shop. Expired codes are no longer served by the app; the retained association prevents duplicate issuance. Each code may be used once in total, without a minimum order, and cannot combine with product, order or shipping discounts. The Shopify connection and contractual privacy terms require final review before activation. Star ratings do not influence rewards.

Optional location search

postal code or city search works without permission to use your device location. We send the postal code or city and country to Apple's geocoding service and use the resulting center to search within 5 km in a straight line. At your request and after iOS permission, you can search around your current location; search area and terms are sent to Apple Maps. Reviews and vouchers do not require location permission. The app does not run continuous GPS visit verification or a visit timer. You can withdraw location permission in iOS Settings; photos and reviews remain available. Requested searches rely on Article 6(1)(b) GDPR. Apple processes data under its own privacy information and may use international infrastructure.

Camera and photo library

The camera is used only with your permission. Alternatively, choose your own image through the iOS photo picker; the app does not read your entire photo library. With automatic photo check consent enabled, your selected visit photo is immediately sent to the account service and stored privately. Withdrawing camera permission does not delete an uploaded photo. Submitted photos are processed to provide the check under Article 6(1)(b) GDPR.

Updating restaurant information

If you suggest restaurant details as an operator or visitor, we store the club association, proposed details, role, time and any evidence link. Contact name, email and review note are visible only to our team. Operators must provide a contact email; it is optional for guests. Information is checked before publication. Selecting Operator does not verify authority. Contact details and private notes are deleted after 90 days on the next service request. Public restaurant details and approval history remain for directory maintenance. The form uses a necessary session cookie lasting at most one hour and a hashed abuse counter. Suggestions do not create reviews or vouchers, and no email is sent automatically. Processing follows the bases described under retention and deletion. You may optionally photograph an opening-hours sign. Only after consent do we send it to OpenAI for text recognition under Article 6(1)(a) GDPR; you can enter hours without a photo. Metadata is removed before transfer. Photos and AI results remain private and are associated with the suggestion for manual review. Unsubmitted photos are removed after seven days and submitted photos after 90 days on the next request. Consent, association and analysis are stored with the photo. AI does not publish hours itself; you must check unclear details. The other OpenAI processing information also applies.

Calling a restaurant

For clubs with verified dining details, Reserve a table opens your iPhone's phone function with the restaurant number. A call starts only after your iOS confirmation. Range Check sends no account details, reviews or GPS positions and stores no reservation. Your phone provider's and the restaurant's terms and privacy notices apply to the call and any reservation. Normal call charges may apply.

Club logos and external links

Restaurant and indoor logos may be bundled with the app or loaded from rangecheck.app. Public club logos are cached in a limited device cache for faster display. When displayed, logos may load directly from the HTTPS sources listed in the directory, particularly api-v2.golf.de, www.golf.at and swissgolf.ch. Those operators receive necessary connection data such as your IP address, time and requested file, but no account ID, password or reviews. Logos help identify clubs, based on our legitimate interest under Article 6(1)(f) GDPR. Linked club websites, Apple Maps and any future shop apply their own privacy information when opened. Hosting and international transfer conditions for external recipients will be reviewed for the public release.

Current club check-in

When you confirm I'm here, we store the selected venue and confirmation time in your account so checks are assigned correctly across devices. Check-in does not use GPS and does not replace photo evidence. You can change or end it; account deletion removes it. Only the current check-in is stored, not a history. This supports your requested review feature under Article 6(1)(b) GDPR. The device caches it for display and removes it on sign-out.

Sessions, security and on-device storage

A random session token keeps you signed in. It is protected in the iPhone Keychain; the database stores only its hash. Sessions do not expire automatically. Signing out removes the active token and ends the session when the service is reachable. Otherwise, the pending-revocation token remains protected in Keychain and revocation is retried on reconnection. Changing a password revokes all previous sessions. Abuse limits store hashed connection-address or username identifiers and counters for 15-minute windows. Expired counters are cleared during later checks. Service protection relies on Article 6(1)(f) GDPR. The app also caches account profile, reviews, personal rounds and retrieved photos for poor connectivity. These active caches are removed on sign-out or account deletion. Separate administration uses a necessary Secure, HttpOnly, SameSite Strict session cookie with a one-hour inactivity limit. Authorized operators can view submissions and account progress. The cookie only authenticates and secures administration.

Retention and deletion

You have two options. Delete account and reviews removes your account, reviews, photos, receipts, personal rounds and reward goals. Close account · keep star ratings removes the same personal data, while retaining only approved stars without profile, comments or photos for rankings. These use a new technical author identifier with no link to the former account. Full deletion is available directly in the app. Administrative account deletion removes all associated reviews.

Your rights

Subject to applicable legal requirements, you may request access, correction, deletion, restriction and portability. You may object to processing based on legitimate interests on grounds relating to your situation. You may withdraw consent for future processing at any time. Contact kontakt@rangecheck.app. You may complain to a competent data protection authority, particularly the Hessian Commissioner for Data Protection and Freedom of Information. Rights under any additional applicable privacy laws remain unaffected.

Profile region and advertising

We request country and postal code during registration and store them privately with your account. We map them to an approximate postal-code center using locally stored GeoNames data. For regional ads, our server checks whether that center falls within the booked radius. The app sends its existing sign-in token only to our account service; advertisers receive no account ID, postal code, photos, reviews or GPS data. Turn off regional offers under Account → Edit profile → Your region; broader ads may still appear. Regional selection relies on our legitimate interest in relevant local offers under Article 6(1)(f) GDPR; the switch lets you object to this advertising use. Your postal code is not public, can be changed in your profile and is removed on account deletion. Without a saved region, no regional ads are delivered. We use no advertising ID, external ad network or personal click or impression statistics. Technical access data is described under Hosting. The partner's website and privacy notice apply only after you tap its ad.

Postal-code data: GeoNames, Creative Commons Attribution 4.0. Postal-code centers are approximate.

No external analytics or advertising SDKs

The current app contains no advertising SDKs, analytics SDKs, newsletter registration or address-book access. It makes no solely automated decisions with legal or similarly significant effects. Reward progress counts approved club + range combinations or indoor checks with approved screen photos. The fixed green-photo reward is calculated as described above; actual voucher issuance is not enabled.

Drafts & password help

Reviews in progress and their photos are stored as protected drafts on this iPhone, separately per account and excluded from device backups. Resume or delete them under My Golf → Drafts. The local draft is removed after successful submission. Deleting an account also removes that account's drafts from this device. Images already uploaded for photo checks are stored on the server under the photo check rules, independently of the local draft. On request, password recovery sends a single-use link valid for 15 minutes to the account's verified email address. Only its hash is stored on the server. Resetting a password ends all existing sessions and invalidates any previous recovery code.

Home clubs & push notifications

Home clubs are optional and visible only in your account. We store up to three selected venues. Notifications about new approved reviews are off by default and can be enabled or withdrawn in your profile. For enabled push notifications, we store the device identifier assigned by Apple, app environment and account association. Apple receives the identifier and notification text with the club name and review type, but no photos, receipts, email address or password. We remove device registrations when you sign out, turn notifications off or delete your account. Device identifiers no longer confirmed are removed after 90 days. Nothing is sent without Apple's permission. Push processing relies on your consent; your home club selection provides the feature you requested.

Changes

If hosting, review publication, voucher issuance or other services change, we will update this notice before the relevant processing starts. Test version dated October 16, 2026.