Privacy Policy

The Penn Golf Clubhouse is a private, approval-gated community for the Penn Men’s Golf family. This policy explains what we collect, how we use it, where it’s stored, and your choices.

You stay in control of your information: you can edit or delete it any time by contacting us, we never sell it, and we don’t run ads or trackers.

This policy was prepared for informational purposes. It does not constitute legal advice. A qualified attorney should review it before formal public launch.

Who we are

The Clubhouse is operated by Ryan Chang (“the Operator,” “we,” “us”), an individual acting as the data controller for information you provide. Contact: [email protected].

Information we collect

• Profile information you add to your member card — name, class year, city and state, hometown, home course, handicap, contact preferences, bio, and how you want to help.
• Photos and videos you upload to your profile or to Moments.
• Messages and requests you send or receive inside the Clubhouse.
• Sign-in information from Google OAuth: your name, email address, and profile photo.
• Subscription state if you choose to support the Clubhouse (handled by Stripe).
• Technical and log data: IP address and basic request metadata (browser type, referring URL, timestamps) collected automatically by Vercel infrastructure and used by the Clubhouse for security, rate limiting, and abuse prevention.

Cookies & similar technologies

The Clubhouse uses only essential session cookies set by our authentication provider (NextAuth / Auth.js) to keep you signed in. These cookies are strictly necessary to operate the service. We do not use advertising cookies, cross-site tracking cookies, or third-party analytics pixels.

Public-facing forms (such as the profile claim form) are protected by a Cloudflare Turnstile bot challenge. Cloudflare may set its own cookies or use your IP address as part of its verification process; that processing is governed by Cloudflare’s Privacy Policy.

How we use your information

• To operate the Clubhouse, authenticate you, and display your profile to approved members.
• To send relevant notifications and transactional emails (approval decisions, new messages, digest updates).
• To process optional support contributions.
• To detect and prevent abuse, spam, and unauthorized access, including per-IP rate limiting on public endpoints.
• We do not use your information for advertising.

Legal bases

We process your information: (a) to provide the service you asked for (necessary to perform our agreement with you); (b) on the basis of your consent, where you have provided it; and (c) for our legitimate interest in operating, securing, and improving a private community. You may withdraw consent at any time by contacting us, though this will not affect processing that occurred before withdrawal.

Where your information is stored & who processes it

• Member profiles, requests, gatherings, and Moments are stored in Upstash (Vercel KV).
• Photos and videos are stored in Vercel Blob.
• Sign-in is handled by Google through NextAuth / Auth.js.
• Email is delivered by Resend.
• Payments are handled by Stripe — card details never reach our servers.
• The site is hosted on Vercel.
• Bot-challenge verification on public forms is handled by Cloudflare Turnstile.
• All data is processed and stored in the United States.

Security

• Connections are encrypted in transit with HTTPS/TLS.
• Sign-in uses Google OAuth, so the Clubhouse never sees or stores your password.
• All member content is restricted to approved members only.
• Administrative and data-management functions are restricted to the Operator.
• Public forms are protected by rate limiting and an automated bot challenge (Cloudflare Turnstile).
• The member database is backed up privately and is not publicly accessible.

No online service can be guaranteed 100% secure, but we take reasonable measures and review them regularly. If we become aware of a security breach that affects your personal information, we will notify affected members within a reasonable time.

Who can see what

• Only approved members of the Clubhouse can see member profiles, the Member Map, gatherings, Open Requests, Moments, and chat threads.
• The Member Book may list names, years, and hometowns from public roster and historical sources before a card is claimed.
• You decide how you want other members to reach you (email, intro through the captain, LinkedIn, or not available right now).
• Captain and Operator roles can see the admin queue (pending claims, roster edits). They cannot read your private chats.

Your rights & choices

• Edit anything on your member card at any time from your profile.
• Email [email protected] to access, correct, export, or request deletion of your personal data. We will honor these requests within a reasonable time.
• Request removal of a pre-claim Member Book entry by emailing us.
• Hide your contact information from other members at any time from your profile settings.
• Cancel optional support at any time from the Support page.
• We honor these rights regardless of where you live.
• California residents: We do not sell or share your personal information as those terms are defined under the California Consumer Privacy Act (CCPA/CPRA).

Categories of personal information (California)

Under the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA), we are required to disclose the categories of personal information we collect. The following categories apply to the Clubhouse, with examples mapped to what we actually collect:

• Identifiers. Name, email address, Google account ID (from Google OAuth sign-in).
• Customer records. Profile and member-card fields you fill in: class year, city and state, hometown, home course, handicap, contact preferences, and how you want to help.
• Internet or other electronic network activity. IP address, request logs (browser type, referring URL, timestamps) collected automatically for security and abuse prevention.
• Geolocation — approximate only. City, state, and hometown as entered on your member card. We do not collect or use precise GPS location.
• Visual information. Photos and videos you upload to your profile or to Moments.
• Commercial information. Optional subscription tier and status (e.g., Supporting Member), if you choose to support the Clubhouse.
• Professional or biographical information. Bio, class year, role (current player, alum, coach, family & affiliate), and how you want to be involved with the community.

We collect these categories for the purpose of operating the private community, authenticating members, and maintaining security. We do not sell or share these categories of personal information as those terms are defined under the CCPA/CPRA. Retention periods are described in the Data Retention section below.

Data retention

We keep your information while your account is active. If you request deletion of your account, we will remove your profile and associated content. Copies may remain in private backups for a limited period before they rotate out. Payment records held by Stripe are retained as required by financial and legal obligations. Technical log data is retained only as long as needed for security and operational purposes.

Children’s privacy

The Clubhouse is intended for adults 18 years of age or older. It is not directed to children under the age of 13. We do not knowingly collect personal information from children under 13. If we become aware that we have inadvertently received such information, we will delete it promptly. If you believe a child under 13 has provided us with personal information, please contact us at [email protected].

International users

The Clubhouse is operated from and stores data in the United States. If you are accessing it from outside the United States, please be aware that your information will be transferred to, stored, and processed in the U.S., where data protection laws may differ from those in your country. By using the Clubhouse, you understand and agree that your information is processed in the United States.

What we don’t do

• We don’t sell your information.
• We don’t use third-party advertising or tracking pixels.
• We don’t share member data with Penn Athletics unless you ask us to.
• We don’t require payment to join. Access is approval-based; support is optional.

Changes to this policy

We may update this Privacy Policy from time to time. We will note material changes on the site or by email. Continued use of the Clubhouse after an update constitutes acceptance of the revised policy.

Contact

Email [email protected]with questions, data requests, or anything that seems off. The Clubhouse is operated by Ryan Chang, Penn Men’s Golf, Class of 2028.