Privacy Policy

1. Who we are and how to reach us

The Fairway (also called Fairway AI) is a disc golf rules helper at thefairwayai.com. It is operated by Logan Anderson, sole proprietorship (operating as The Fairway / Fairway AI), based in Prince Edward Island, Canada (“we”, “us”).

Privacy Officer / legal contact: Logan Anderson, [email protected]. Use that address for privacy questions, access requests, and deletion requests.

2. What we collect

You can search PDGA Official Rules and Competition Manual content, chat with an AI that cites those sources, and optionally upload a photo of your lie for context. We are not affiliated with the PDGA.

You give us (voluntary). We only get these if you type, upload, or sign in:

• Account / sign-in. Phone number if you use SMS one-time passcode (Supabase Auth). Email address if you use the email magic-link form or Continue with Google. Google sign-in is through Supabase Auth, not Firebase. Account identifiers Supabase assigns to you. We do not ask for a password.
• Content. Questions, chat messages, search queries, optional photos of a lie (or disc, sign, scorecard) plus the file metadata needed to send them, and optional “was this helpful?” feedback (we store the question and answer with that rating).
• Share cards. If you create a public share link, we store a snapshot of that ruling (question, summary, citation) so anyone with the link can read it.

We collect automatically. When you use the site we also receive:

• Device/browser type, pages and features used, timestamps, IP address as seen by our host (and any approximate location a provider derives from it), and error/diagnostic data.
• Analytics events via PostHog (web and chat), including identifying signed-in users so we can tell signed-in usage from anonymous browsing. If you have an email on the account, PostHog may receive that email.
• Usage counts (chat, search, feedback, share) tied to your account when you are signed in.

Search of the rule book can be used without an account. We still see the query enough to run retrieval and apply rate limits.

We do not ask for payment card data on the service as currently operated. There is no billing in this version.

3. Why we use it

We use this information to:

• Provide and secure the service (sign-in, sessions, rate limits, abuse prevention).
• Answer rules questions and return citations; process photos you submit for that purpose.
• Improve accuracy, UX, and reliability (including analytics and feedback).
• Communicate about the service when needed (for example a security or major-change notice).
• Comply with law and enforce our Terms.

4. Consent and how to withdraw

We rely on your consent where required, and on the need to perform the service you request under Canadian privacy law (PIPEDA and applicable provincial rules). Signing in, sending a question, or uploading a photo is a request that we process that content.

You can withdraw consent going forward by:

• Signing out on Account (this does not delete data).
• Stopping use of the site.
• Emailing [email protected] to ask us to delete the account and associated personal information.

Withdrawing consent does not undo processing already done (for example an answer already generated, or a share card already published). Analytics is on for visitors; there is no in-app analytics opt-out yet. Blocking cookies may break sign-in.

AI processing

Your questions, chat context, and any photos you upload may be sent to third-party AI providers so we can generate answers. Those providers process data under their own terms as our service providers.

Production code sends those requests to OpenRouter (not a direct OpenAI or Anthropic SDK). Current model IDs selected in this repo:

• Chat: x-ai/grok-4.6 (xAI Grok, via OpenRouter).
• Search embeddings: openai/text-embedding-3-large (OpenAI model ID, via OpenRouter).
• Share-card summaries: openai/gpt-4.1-mini (OpenAI model ID, via OpenRouter).

We do not call the OpenAI API with our own OpenAI key, and we do not use consumer ChatGPT. Because traffic goes through OpenRouter to those models, we do not claim OpenAI’s “API data is not used for training” default — that promise applies to direct OpenAI API customers, which this app is not.

Do not upload photos of people (especially children) or anything you are not allowed to share. Prefer a photo of the lie without identifiable faces.

AI answers can be wrong, incomplete, or outdated. This is not an official PDGA ruling and not legal advice. See our Terms of Service.

5. Retention

We keep account data, chat history (including photos you send with a question), feedback, usage, and share cards while your account is active, and as needed to run and secure the service. We do not offer an in-app delete-account button, and we do not run an automatic deletion timer.

You can request deletion by emailing [email protected]. After we verify it is you, we will delete or anonymize your account data and associated chat and photo content where feasible, within a reasonable period.

Some copies may remain for a short time in:

• Backups and operational logs (hosting, error tracking, analytics) until those systems rotate.
• Share cards you already posted publicly, until we remove them as part of the request.
• AI providers’ own logs, under their API policies — we cannot erase those ourselves.

Signing out on Account does not delete your account.

6. Safeguards

We take reasonable steps appropriate to a small web app:

• Hosted over HTTPS on Vercel.
• Sign-in through Supabase Auth (Google, OTP, or magic link), with session cookies.
• Row-level security on application tables in Postgres (rules, usage, feedback, share cards).
• Rate limits on public search, share-link creation, and related APIs.

No method of transmission or storage is perfectly secure. Do not put secrets, other people’s personal information, or sensitive photos in a rules question.

7. Who we share with

We share personal information with service providers who help us run The Fairway. These are the processors actually wired into production code — not a generic vendor list:

• Supabase — authentication and Postgres (accounts, rules index, usage, feedback, shared cards). SMS one-time codes are sent through Supabase Auth; this repo does not name a separate SMS brand. If you choose Continue with Google, Google authenticates you and Supabase receives your Google account email and identifiers.
• Vercel — hosting and delivery of the website and functions.
• PostHog — product analytics (configured on PostHog’s US host in code).
• OpenRouter — AI API gateway. Prompts, chat context, and lie photos go here so a model can answer. Downstream model IDs currently selected: xAI Grok for chat; OpenAI model IDs for embeddings and share-card summaries (see AI processing above).
• Sentry — error tracking and diagnostics. Server-side assistant traces can include chat input and output. Browser session replay is sampled when an error occurs.

We do not sell your personal information. We may disclose information if required by law, to protect rights and safety, or in connection with a business transfer (with notice where appropriate).

8. International / cross-border transfers

Data may be processed in Canada, the United States, and other countries where our providers operate. Vercel, PostHog (US host), OpenRouter, Sentry, and typically Supabase process data outside PEI. Those places may have different privacy laws than Canada.

9. Access, correction, and complaints

Subject to applicable law, you may ask to:

• Access the personal information we hold about you.
• Correct inaccurate information.
• Withdraw consent where processing is consent-based (without affecting prior lawful use).
• Request deletion by emailing [email protected]. After we verify the request, we will delete or anonymize your account data and associated chat and photo content where feasible, within a reasonable period.

Email [email protected]. We may need to verify it is you (for example via the signed-in phone or email on the account).

If you are not satisfied, you may complain to the Office of the Privacy Commissioner of Canada or your provincial privacy commissioner.

Cookies and analytics

We and our providers use cookies, local storage, and similar technologies for:

• Sign-in and security (Supabase Auth cookies — required for Chat).
• Chat scroll position in the current tab (sessionStorage).
• Analytics (PostHog).

You can control cookies through your browser; blocking some cookies may break sign-in or features. We do not run a separate advertising pixel.

Children

The Fairway is not directed at children under 16. This app does not check age at sign-up. Do not create an account if you are under 16. If we learn we collected personal information from a child under that age, we will delete it.

10. Changes to this policy

We may update this Privacy Policy. We will post the new version with an updated “Last updated” date (currently September 17, 2026). Material changes may also be noted in-product when practical. Continued use after the effective date means you accept the updated policy.

Contact

Logan Anderson, sole proprietorship (operating as The Fairway / Fairway AI)
Prince Edward Island, Canada
Email: [email protected]
Website: https://www.thefairwayai.com/