Privacy notice

Last updated: 3 November 2026

This notice explains how Round to Range uses personal information when you use our website, installed web app, Android companion app and AI connections.

Who is responsible for your information?

White Label Developing Limited is the controller of personal information processed to operate Round to Range. Our company number is 11222417. Our registered office and postal contact address are on our contact and company details page. For privacy questions or requests, email support@roundtorange.com.

Information we use

• Account information: your name, email address, securely hashed password, golf tracking system, handicap and practice preferences.
• Golf information: rounds, scores, courses, shots, optional golfer-reported shot feedback, screenshots, imported files, extracted data, analysis, practice plans and results you provide or generate through the service. Screenshots may contain names or locations visible in the source app.
• Support information: feedback, reports and correspondence you send us.
• Technical information: IP addresses, browser/device information, request and error logs, sessions and AI connection permissions and activity.
• Product activity: visit times and limited records of successful imports, round and insight views, practice-plan use, recorded practice results and connected-assistant actions. These records may include the relevant internal record number, channel, import source and result count, but not passwords, tokens, screenshots, assistant prompts, full web addresses or shot-by-shot details.
• Campaign attribution: campaign labels from the first tagged link in your visit (UTM source, medium, campaign, term and content), the landing path and when those labels were captured. With analytics consent, we attach this information when you create an account or sign in to an existing account, so we can understand which campaigns bring new and returning users. Signing in with campaign information replaces the campaign details previously saved on your account; signing in without it leaves them unchanged.
• Billing information: payment-provider customer and subscription references, subscription status and billing periods. Card details are entered with Stripe; our application does not store your full card number.

Most information comes from you, your device or imports you initiate. Account credentials are needed to provide an account; golf information is needed for the corresponding analysis and practice features. Please avoid uploading unrelated personal information or other people's information without permission.

Optional shot feedback records your own observations about strike, start direction, curve and outcome. We use repeated feedback to refine future practice-plan suggestions. Unanswered fields remain unknown, and feedback is presented as golfer-reported context rather than a confirmed swing diagnosis.

Why we use it and our lawful bases

• Providing your service — contract: creating and managing your account, importing and analysing rounds, building practice plans, providing connections you request and sending essential account emails.
• Running and protecting the service — legitimate interests: investigating faults, answering enquiries, preventing abuse and keeping the service secure. Our interests are operating a reliable service and protecting users; these must be balanced against your rights.
• Understanding campaign performance — legitimate interests: reviewing aggregated campaign attribution to understand which campaigns bring new and returning users to Round to Range and improve how we promote the service.
• Improving the product — legitimate interests: understanding whether golfers complete useful actions and return around rounds and practice, diagnosing failed imports and improving the service. Administrator impersonation and explicitly marked owner, test and reviewer accounts are excluded from these usage metrics.
• Legal obligations: keeping required accounting records, responding to lawful requests and handling data-protection rights.
• Consent, where required: optional marketing or non-essential tracking. Creating an account does not itself provide consent for marketing.

Shot Scope imports

When you request a Shot Scope import, the email address and password you enter pass through our server to sign in to Shot Scope and retrieve your round data. They are used for that request; we do not save your Shot Scope password or sign-in cookies. You enter your login details each time you fetch rounds. The rounds you review and choose to import are saved in your Round to Range account for your history and analysis.

Garmin imports

When you request a Garmin import, you sign in on Garmin’s page. We do not receive or save your Garmin password. Garmin provides a temporary sign-in token, which is used for that request and then discarded. The returned Garmin round data is encrypted in our database and retained for up to 90 days to perform the import, diagnose incompatible Garmin formats and improve the importer. It is associated with your Round to Range account, accessible only to authorised support staff for those purposes, and deleted earlier if you delete your account.

Arccos import testing

During restricted Arccos integration testing, a consenting tester signs in on Arccos’s website through Arccos OAuth. We do not receive or save their Arccos password. Temporary access and identity tokens are used only to fetch the authorised diagnostic data and are then discarded. Returned rounds, detailed round responses, statistics and club data are encrypted and retained for up to 90 days to develop and validate the importer, then automatically deleted.

Screenshot extraction and AI connections

When you request AI screenshot extraction, the image is sent to OpenRouter and its model-serving provider to read the golf data. The current configured model is OpenAI GPT-4o mini via OpenRouter. We restrict these requests to endpoints that OpenRouter identifies as having zero data retention and disallow provider data collection. If no eligible endpoint is available, extraction fails rather than removing those restrictions. These controls concern model inputs and outputs, not all service records; OpenRouter may allow temporary in-memory caching. Check screenshots before submitting them and remove unrelated personal information. Review extracted results for mistakes. See OpenRouter's privacy information.

Android captures with on-device recognised text are processed from that text without sending the screenshot to an AI model. This is separate from AI screenshot extraction and from connecting your own assistant.

The Android app uses Google's ML Kit for on-device text recognition. Although recognition runs on your device, the ML Kit SDK sends diagnostic and usage information to Google over an encrypted connection, including device and app versions, installation identifiers, feature usage, processing performance and error information. This diagnostic collection is separate from your optional website analytics choice. See Google's ML Kit data disclosure. Captures you choose to import, together with recognised golf data, are uploaded to Round to Range for your round history and analysis.

If you connect an assistant such as ChatGPT or Claude through MCP, the assistant can request account data within the permissions you approve. Write access allows supported changes to plans and results. The assistant provider also handles data under its own privacy terms. Disconnect in your assistant's settings and contact us if you need server-side access revoked. Disconnecting does not remove information already copied into an assistant's conversation history.

Our analysis and practice suggestions are automated estimates for your review. They are not decisions about you with legal or similarly significant effects.

Service providers and overseas processing

Information is handled by our hosting and backup infrastructure, Stackmail email service, OpenRouter and relevant model providers for screenshot extraction, and Stripe when you use paid features. Authorised support staff may access information when needed to operate the service or resolve a problem. We may also disclose information when legally required or necessary to handle legal claims.

Our website and application are hosted in the United Kingdom. External services, including AI and payment providers and assistants you connect, may process information outside the UK, including in the United States. Overseas transfers must meet applicable UK data-protection requirements; contact us for details of the locations and transfer safeguards applicable to your information.

OpenRouter and Stripe publish data-processing terms that include contractual provisions for UK international transfers. You can read OpenRouter's data-processing agreement and Stripe's data-processing agreement. Contact us at support@roundtorange.com to request information about the safeguards relevant to your data or a copy of the applicable safeguards.

Campaign totals

We count requests to tagged public pages in daily and hourly totals by campaign source, medium, campaign and ad label. This counter stores no visitor identifiers, IP addresses, browser details, individual visit records or account links and does not set or read cookies for counting. Refreshes can increase these totals. We use them internally to understand which links bring traffic. They are separate from consent-based Google Analytics and cannot be retrospectively linked to your identity. If you accept analytics, campaign labels may separately be attached to your account at signup or login.

If you accept analytics, we also store a random campaign-visit token in your browser that is valid for a fixed 30-minute window to avoid counting repeat campaign loads as new visits. Our server uses a temporary hash of this token for deduplication; it expires after 30 minutes and is not stored with account details. We also count registration-page visits and first form interactions once per browser in that window, without collecting form contents. Campaign visit and registration-stage totals are aggregated daily and are not linked to your account. Rejecting analytics removes the browser token and stops this measurement.

Cookies and your device

With your consent, we use Google Analytics on public information and registration pages to understand website visits and the registration funnel. With consent, we measure registration-page visits, the first interaction with the registration form, and successful account creation. We send no form values, names, email addresses, passwords or account identifiers. A separate, minimal confirmation frame measures completion without loading analytics on your dashboard. Google receives browser/device and connection information, including your IP address, and uses analytics identifiers to distinguish visits. We do not load analytics on other account, password-reset, verification or capture pages, or on pages with unrecognised query parameters or fragments. On public pages, we allow approved campaign labels (UTM parameters) to identify which posts and campaigns bring visitors to the site. Recognised advertising and social click identifiers are excluded from the page address we send. For external referrals, we send only the referring website’s origin (such as https://example.com), excluding its page path, query parameters and fragment. Advertising signals and personalisation remain disabled.

Analytics is optional and starts only after you select “Accept analytics”. Select “Reject analytics” to continue without it, or use “Cookie settings” to change your choice. We remember your choice on this device for 180 days. Analytics cookies named _ga and _ga_… are configured to expire after 180 days without automatic renewal. Rejecting analytics stops further collection and removes these cookies on this site; it does not erase information already received by Google.

Google may process analytics information outside the UK, including in the United States. See Google’s privacy policy and Google’s data-processing terms, including their international-transfer provisions. Contact us about applicable safeguards or requests concerning previously collected information.

We use session and security cookies to keep you signed in and protect forms. The normal session lifetime is two hours; choosing “Remember me” can keep you signed in longer. Browser settings let you remove cookies, but blocking necessary cookies can prevent sign-in.

We remember your install-reminder choice on this browser: choosing “Not now” hides it for seven days, and a confirmed installation hides reminders for up to a year. This preference is stored on your device and is not used for advertising.

The installed web app caches a generic offline page. The Android companion uses device permissions you grant to capture and upload screenshots. You can stop capture and manage permissions in Android settings. Uninstalling an app does not delete your website account.

Pages may load fonts from Bunny Fonts and, where drill videos are enabled, content from YouTube. These services receive connection information such as your IP address when content loads and apply their own privacy practices. Following other external links takes you to the provider's service.

Retention and deletion

Account and golf records are kept while your account needs them to provide your history and analysis, until you delete them or request deletion. Support and technical records are retained according to their continuing need for resolving enquiries, security investigations and legal claims. Financial records may need to be retained for statutory accounting requirements.

Optional drill feedback, including usefulness, issue categories and comments, is private to you and authorised administrators. It is linked to the relevant drill and practice attempt so catalogue issues can be reviewed, and is removed with your account.

Identifiable product-activity and visit records are retained for up to 24 months so seasonal golf usage and return patterns can be understood, then automatically deleted. They are deleted earlier when the associated account is deleted. Security audit records are separate and may follow a different retention period where needed to protect the service or meet legal requirements.

You can request deletion at any time by email, or use Delete account in your profile. Account deletion removes associated account data and uploaded files from the active service, subject to legal retention exceptions.

The hosting account has daily backups. Copies may remain in backups until those backups expire or are overwritten under the hosting provider's retention schedule; deletion from the active service is not immediate erasure from every backup. Contact us for the applicable backup retention period. Data already received by an independent AI assistant or payment provider is also subject to that provider's retention rules.

Your rights and complaints

Depending on the circumstances, you can request access, correction, deletion, restriction or a portable copy of your information, and object to processing based on legitimate interests. Where we rely on consent, you can withdraw it without affecting earlier lawful processing. We may need to verify your identity and explain any lawful limits to a request. Email support@roundtorange.com; we normally respond to rights requests within one month, subject to permitted extensions.

You can complain to us or to the UK Information Commissioner's Office at ico.org.uk/make-a-complaint or on 0303 123 1113.

Changes to this notice

We will update the date above when this notice changes and bring material changes to your attention where required. This notice describes our processing; it is not a request to waive your privacy rights.