Privacy Policy

Company: Drop2Hittin3 LLC · App: Drop2Hittin3

Effective: June 12, 2026 · Last updated: June 12, 2026

1. Introduction

This Privacy Policy explains how Drop2Hittin3 LLC collects, uses, and protects your information when you use the Drop2Hittin3 golf-focused social media app (the “App”), the web app at app.drop2hittin3.com, and this marketing site at drop2hittin3.com (collectively, the “Service”). By creating an account or using the Service you agree to this policy.

2. Information We Collect

A. Information You Provide

Account info, profile details, posts, and messages, including:

Account info: your email address and a password (stored hashed by our authentication provider — we never see your password).
Profile info: username, first and last name (optional), bio (optional), profile photo (optional), privacy setting (public or private), GHIN handicap number (optional).
Post content: golf scorecards (course name, scores per hole, par per hole, tees, totals), captions, photos and videos you upload, hashtags, and tags of other users.
Social actions: who you follow, who follows you, likes, comments, follow requests, blocked users, and reports of objectionable content you submit.
Messages: direct messages and group messages you send and receive, including any posts you share via DM.

B. Automatically Collected

Device data, usage data, logs, and cookies, including:

Device and log data: when you use the Service, our backend (Google Firebase) records your IP address, device type, operating system version, app version, timestamps of requests, and crash diagnostics.
App Check tokens: the web app uses Google reCAPTCHA v3 to verify that requests come from a real browser and not a bot. reCAPTCHA may receive your IP address, browser fingerprint, and interaction signals on the pages where it loads.
Read receipts and unread state: when you open a conversation we record a timestamp so the sender can see “Read.” You can mark conversations unread at any time.

C. Location Information

Optional, for tagging golf courses. The course name and location attached to a post is whatever you type or pick from our course search list — we do not capture your physical GPS position or use background location.

D. Information We Do Not Collect

We do not use the device Advertising Identifier (IDFA).
We do not access your contacts, calendar, microphone, photos library beyond the items you explicitly pick to upload, HealthKit, motion data, or biometrics.
We do not sell your data and we do not share it with data brokers or information resellers.
We do not show advertising.

3. How We Use Information

To operate accounts, display posts, enable social features, improve performance, personalize content, and ensure safety. Specifically:

To operate the Service: sign you in, render your feed, store and display your posts, deliver your messages, and send notifications.
To compute the optional UOHC (Unofficial Handicap Calculator) from the rounds you post.
To enforce safety: detect abuse, respond to reports of objectionable content, block users, and remove content that violates our rules.
To improve the Service: aggregate and anonymized usage patterns (e.g., how many people post in a week) for product decisions. We do not profile individuals for targeting.
To comply with the law and respond to lawful requests.

4. How We Share Information

With service providers, with other users (public posts), and when required by law.

A. Other Users

Your username, name, photo, bio, posts, scorecards, comments, follower / following lists, and likes are visible to other signed-in users of the Service. If your account is set to private, only approved followers see your posts. Direct messages are visible only to the people in the conversation.

B. Service Providers (Sub-processors)

Google Firebase (Authentication, Realtime Database, Cloud Storage, App Check) — hosts our backend. Subject to Google’s privacy policy.
Google reCAPTCHA v3 (web only) — bot protection. Subject to Google’s privacy policy.
Cloudflare — DNS and content delivery for our web properties. Subject to Cloudflare’s privacy policy.
GolfCourseAPI (api.golfcourseapi.com) — when you search for a golf course, we send the text you typed to look it up. We do not send your identity or other account data. Subject to their privacy policy.
Apple (iOS app only) — Apple’s standard App Store data flows: device identifier for app installation, in-app crash logs, and Apple Push Notification tokens if you enable notifications.

C. Legal Disclosures and Business Transfers

We may disclose information to comply with a valid legal request (subpoena, court order, search warrant), to protect the rights, property, or safety of us or our users, or to address fraud or security issues. If Drop2Hittin3 is acquired or merges with another company, your information may be transferred to the new entity, and we will tell you in advance if your data will be subject to a different privacy policy.

5. Your Choices

Edit profile, change privacy settings, delete posts, disable location, and request account deletion.

Access and edit: in the app, open Profile → Settings to view and edit your name, username, bio, photo, and privacy state.
Delete your account: in the app, Profile → Settings → Delete Account. Deletion runs on a 30-day grace window: as soon as you request it, your profile is hidden from search, feeds, follower lists, and post pages, and you are signed out of every device. If you change your mind within 30 days you can sign back in and restore your account in full. After 30 days a scheduled process permanently erases your profile, posts, scorecards, photos, videos, comments, likes, follow relationships, messages you sent, notifications, and your authentication record. Group conversations remain for the other participants but your name is removed. See the Terms of Service for the complete flow.
Mark a conversation unread: in the inbox, swipe a conversation and tap Unread.
Block a user: on their profile, tap … → Block. They can no longer see your profile, posts, or send you messages.
Report objectionable content: on any post, comment, profile, or message, tap … → Report and pick a reason. We review reports and act within 24 hours.
Privacy rights under GDPR (EU/UK) and CCPA (California): you have the right to know what data we hold about you, to receive a copy of it, to correct it, to ask us to delete it, and to object to certain uses. Email hello@drop2hittin3.com with your request. We respond within 30 days.

6. Data Security

Industry-standard security measures are used. All connections between the app and our backend are encrypted with TLS (HTTPS). Your password is never stored in plaintext — Firebase Authentication uses an industry-standard salted hash. Sensitive operations on the backend are restricted by Firebase security rules so other users can never read or write data that isn’t theirs to touch. We use Firebase App Check to limit backend abuse from bots.

No system is perfectly secure. If we ever experience a data breach affecting your account, we will notify you and the relevant authorities in accordance with applicable law.

7. Children’s Privacy

Drop2Hittin3 is not intended for users under 13, and we do not knowingly collect information from anyone under 13. If you believe a user is under 13, please email us and we will remove the account. The App Store age rating for the iOS app is 17+ because of user-generated content.

8. International Users

Our backend is hosted in the United States. If you access the Service from outside the U.S., your information will be transferred to and processed in the U.S. The transfer mechanism is the standard contractual clauses with Google Cloud for users in regions that require them.

9. Changes to This Policy

We may update this policy as the Service evolves, and we will notify users of significant changes. When we make material changes we will update the “Last updated” date at the top and, if appropriate, surface a notice in the app. Continued use of the Service after an update means you accept the revised policy.

10. Contact Us

Email: hello@drop2hittin3.com
Company: Drop2Hittin3 LLC

We aim to respond within 5 business days.