Privacy policy

Last updated: October 17, 2026. The French version, at /confidentialite, is the reference text.

In short

Solo play works without an account and without a network: until you have a backup account, everything stays on your iPhone.
The backup account keeps your progress, coins, diamonds and balls on our server, so you don't lose them and can get them back on another iPhone (Game Center or Sign in with Apple). It is private: other players can't see it.
Never your name, email, phone number or location. Your Game Center or Apple identifier is never stored in clear: only a fingerprint.
Our servers are run by Cloudflare and the data is stored in the European Union.
Only ads: rewarded videos you choose to watch (Google AdMob, with your consent). No analytics, no artificial intelligence. We sell no data.
You can export and erase everything from the app: Profile ▸ My data.

1. Who is responsible for your data

The data controller is Toni Bassil, publisher of the Golfasko app (individual, individual Apple developer account). Contact for any question and to exercise your rights: tonybassil292@gmail.com.

No data protection officer has been appointed (not required for this activity): the contact above handles all requests.

2. What stays on your iPhone

Without a backup account, your progress, records, coins and diamonds, balls and powers, settings and the local summary of your matches are stored only on your iPhone. With an account, the iPhone keeps a copy (to play offline) and records your offline earnings in a log, sent to the server when the network is back.

Also kept on your iPhone, in protected files: the list of Apple refunds already removed (transaction identifier, product, date), energy refills awaiting confirmation and the last known energy. Your sign-in token and the list of linked identities (Game Center, Apple) are stored in the iPhone's Keychain. All of this is erased by "Delete my data".

This data is part of your iPhone backups (iCloud or computer) if you have turned them on: Apple manages those backups according to your settings.

3. What our server processes

When an account is created. The backup account is created when you accept the online play terms, when you sign in with Apple (Profile ▸ Backup) or when you buy or restore a purchase. Before that, the app only reads the service status and public leaderboards, without sending any identifier; only a report you choose to send then reaches the server, without an author. The online profile (username, ELO, friends) is created separately, the first time you tap "Play online".

Game Center. If your iPhone is signed in to Game Center and you have accepted the online play terms, the app sends the server Apple's signed proof of your player identifier for this developer team. The server checks the signature and only keeps a fingerprint (HMAC-SHA-256 with a secret key): never the identifier itself, nor your Game Center nickname. You can unlink Game Center in Profile ▸ Backup.

Sign in with Apple. Optional. The app asks for neither your name nor your email. The server checks Apple's token and only keeps a fingerprint of the identifier provided by Apple.

Data processed by the server, purposes, legal bases and retention
Data	Why	Legal basis	How long
Backup account: random identifier, sign-in tokens per device (the server only keeps a hash), creation and last sign-in dates (to the day), fingerprints of the linked Game Center and Apple identities and link date	Back up your game and give it back to you on another iPhone; merge two accounts when the same identity is used	Performance of the contract (Art. 6(1)(b) GDPR)	Until the account is deleted; erased automatically after 24 months without sign-in
Account content: coins, diamonds (a balance can be negative after a refund), XP, level, courses, best scores, Daily Challenge, balls and their lives, powers, energy	Run the game economy and your progress	Performance of the contract	Lifetime of the account
Log of currency earnings and spending (date, item, amount) and batches of earnings sent from the iPhone (offline earnings recalculated and capped by the server)	Apply your earnings only once, apply the refund rule, show your spending in the export	Performance of the contract	Log: lifetime of the account (needed for refunds); batches: 30 days
In-app purchases: pseudonymised fingerprint (HMAC-SHA-256) of the Apple transaction, product, date, credited amounts, refund if any; a random identifier specific to your account sent to Apple with the purchase ("appAccountToken") to credit the right account	Deliver what you bought, only once; remove what was bought if Apple refunds	Performance of the contract; legitimate interest (prevent a purchase from being credited twice)	Fingerprint: as long as the service exists, detached from your account when it is deleted; the rest: lifetime of the account
One-time import of your game from the trial version (TestFlight), reserved for players registered before October 5, 2026: balances and progress, capped	Carry over your game from before the backup account	Performance of the contract	Once; the import date stays in the account
App Attest security keys: public key created in the iPhone's secure chip for your account, its counter, environment and app version (never a device identifier)	Check that sensitive requests (purchases, diamonds, ranked matches) come from the genuine app on a genuine iPhone	Legitimate interest (security, fraud prevention)	Lifetime of the account (10 keys at most); challenges: 5 minutes
Online profile: username, avatar (an animal picked from 12 predefined drawings), country (optional, chosen from a list, never inferred), level, XP, courses completed, ELO, results	Profile and leaderboards	Performance of the contract	Lifetime of the account
Opponent search: identifier, mode, versions, ELO	Find an opponent of similar level	Performance of the contract	For the search (60 seconds at most)
During a match: shots (angle, power), round state, preset reactions and phrases (never free text), equipped ball	Play the match, relay it, check the result	Performance of the contract	Erased 10 minutes after the end of the match
Match history: mode, dates, courses, shots, holes won, result, ELO before and after	ELO calculation, fight against cheating and fixed matches	Performance of the contract; legitimate interest (fair play)	90 days
Cheating suspicion score (0 to 100), end date of a set-aside period, and log of the latest decision (signals and values) — see § 9	Protect online play against cheating	Legitimate interest (fair play)	Log: 30 days; score and set-aside (7 days): lifetime of the account
Daily progress counters	Anti-cheat caps for leaderboards	Legitimate interest (fair play)	30 days
Friends, requests, head-to-head record, choice to show your presence (hidden until you turn it on), invitations, blocks	Play with friends, block a player	Performance of the contract	Unanswered request: 30 days; invitation: 30 seconds; the rest until removal, unblocking or deletion
Reports: author (none if sent without a profile), reported player, one of five reasons, reported username at the time, match concerned. No free text. Moderation decisions	Protect players, handle abuse	Legitimate interest (player safety)	12 months
Moderation notices about you (type, rule, automatic or not, duration, date, read or not), readable in the app (Profile)	Tell you why a decision was taken and how to contest it (Digital Services Act, Art. 17)	Legal obligation; legitimate interest	12 months, erased with the account
Online energy: debit log, diamond refill identifiers, daily counter	Manage energy and never debit or credit twice	Performance of the contract	Debits: 24 to 48 hours; refills: 30 days; counter: replaced daily
IP address, used for the request and never stored by our code; anti-abuse counters computed on a fingerprint of the IP or identifier, with a key destroyed every 24 hours; host's technical logs (a sample of requests)	Service security (limit abuse and attacks)	Legitimate interest (security)	Counters: 24 hours at most; host's logs: 3 days
Emails you send us (address, content, information you choose to add)	Reply to you, handle your requests	Legitimate interest; legal obligation for requests about your rights	12 months after the last reply

Purchases. Payment is handled by Apple: we never receive your Apple ID, payment method or address. The transaction signed by Apple goes through our server, which verifies it itself and then discards it: it is neither stored nor logged (only the fingerprint above remains). Apple also notifies us of a refund; we then remove what was bought, according to the terms of sale.

Server backups. The database keeps automatic backups, replaced within 30 days at most (7 days with the host's current plan).

Balancing of legitimate interest. Anti-cheat, moderation, security and anti-fraud keep the game fair and safe and protect everyone's purchases. The impact on you is low: pseudonymous data, no effect outside the game, short retention, human release possible. You can object by writing to the contact above or by deleting your account.

4. What other players see

The backup account is invisible to other players. Your username, your avatar, your country if you chose one, your level, XP, courses completed, ELO and results appear in leaderboards and on your online profile. In a match, your opponents and teammate also see your ball, powers, reactions and preset phrases. Accepted friends see whether you are online only if you turned it on. Choose a username that does not reveal your identity.

5. Recipients and processors

Cloudflare, Inc. (United States), processor: hosts the game server, its database and this site. The database and the objects holding game state are created in Cloudflare's European Union jurisdiction; server code runs at the Cloudflare location closest to you.
Apple, independent controller: app distribution, payment, refunds, Game Center, Sign in with Apple, crash reports if you share them in iOS, and App Attest. Our server contacts Apple to check a Game Center proof (Apple's public certificate) and a Sign in with Apple token (Apple's public keys), without sending anything about you. We send Apple no data about your purchases: if Apple asks us about a refund, we do not answer. See Apple's privacy policy.
Google Ireland Limited (AdMob), independent controller: shows rewarded ads and verifies they were watched, with your consent (see "Ads").
Google (Gmail): receives the emails you send to our contact address.
Other players, for the public data described above only.

No data is sold or rented. The only data used for advertising is what Google processes for rewarded ads, with your consent.

6. Transfers outside the European Union

Game data is stored in the European Union. Cloudflare, Inc. and Google LLC are however US companies: access from the United States (support, maintenance) and code running near players outside the Union remain possible. These transfers are covered by these companies' certification under the EU–US Data Privacy Framework and by the European Commission's standard contractual clauses. Information sent to Apple (see § 5) is covered by Apple's safeguards. You can get a copy of the safeguards at tonybassil292@gmail.com.

Golfasko offers rewarded video ads, only if you choose to watch one (for example to earn a Common Box or one unit of energy). There are no banners, no forced ads and no purchase to remove them. Ads are provided by Google AdMob (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland).

Your age, on your device. The first time you tap an ad, the app asks your age. The answer stays on your iPhone only: it is never sent to our server. You can change it in Settings ▸ "Mon âge pour les pubs" (age for ads).
Under 15: ads are non-personalized, no tracking consent is requested and Apple's tracking prompt is never shown.
15 and over: a Google consent form (IAB TCF v2 certified) asks for your choice before any ad, then iOS asks for tracking permission (App Tracking Transparency). Refusing is as easy as accepting: the app stays fully usable and non-personalized ads may be shown.
Data processed by Google: device identifier (advertising identifier if you allow it), IP address (approximate location), ad interactions, technical and diagnostic data. No Golfasko account identifier is sent to Google.
Reward: to prevent fraud, the app attaches a random one-time code to the ad request. Google confirms to our server that the video was watched, and the server grants the reward. This code is not linked to your identity on Google's side; our server keeps it for 90 days with your account (technical reward log), then deletes it. It is included in the export and deletion of your data.
Legal basis: your consent (GDPR art. 6(1)(a) and art. 82 of the French Data Protection Act). Google acts as an independent controller for its advertising processing. Data may be transferred to the United States (Google LLC), under the EU-US Data Privacy Framework and standard contractual clauses.
Change your mind at any time: Settings ▸ "Gérer mes choix de confidentialité" (Google) and iOS Settings ▸ Privacy & Security ▸ Tracking.

Google's policy: policies.google.com/technologies/partner-sites.

7. Trackers and cookies

The app uses no trackers and no analytics. Only rewarded ads may use the advertising identifier and cross-app tracking, only if you are 15 or over and accept (see "Ads"). The only items kept are your sign-in token and the list of linked identities (iPhone Keychain) and a few app settings: they are strictly necessary for the service you request.

This site sets no cookies and uses no scripts, fonts, external resources or analytics.

8. Your rights and how to exercise them

You have the right to access your data, have it corrected or erased, restrict its processing, object to processing based on legitimate interest, withdraw your consent at any time, receive your data in a readable format (portability) and give instructions about it after your death.

Erasure, in the app: Profile ▸ Delete my data. Your account is deleted on the server (backup account and online profile), then your data is erased from the iPhone. If the server does not respond, nothing is erased and a message tells you so.
Rectification: you can change your username in the app (once every 30 days; immediately if it was hidden). If your username reveals personal information, write to us: we change it right away.
Access and portability, in the app: Profile ▸ My data ▸ Export my data. The app produces a readable JSON file: the local part and, if you have an account, its server data (balances, balls and lives, powers, progress, earnings and spending log, purchases by date, linked identities — their type and date, never the identifier —, signed-in devices by date, online profile, friends, matches, reports sent, notices). The file is created on your iPhone and sent nowhere. Not included: reports received and blocks targeting you, to protect their authors (GDPR Art. 15(4)), and App Attest security keys (technical data with no content for you); you can ask for these items or your suspicion score by email.
Objection, restriction and any other right: write to tonybassil292@gmail.com from your email app.

We reply within one month. We may ask for additional information if we have reasonable doubts about your identity.

What deleting your account does

Erased immediately: backup account (balances, progress, balls, powers, spending log, batches, consent), sign-ins on all your devices, fingerprints of Game Center and Apple identities, App Attest keys, online profile (username, country, scores, suspicion score), friends and requests, blocks, energy, counters, connection state. Balances and purchases already delivered are lost, without refund.
Anonymised: in match history (90 days at most), your seat becomes "deleted player"; reports you sent lose their author; a purchase fingerprint loses any link with your account (it only prevents the same purchase from being credited twice).
Reports received: detached from your account, they keep the reported username until the end of their 12-month period, as evidence of repeated abuse.
Database backups: replaced within 30 days at most (see § 3).
Sign in with Apple: the fingerprint of your identifier is erased. To also remove Golfasko from your list at Apple: iPhone Settings ▸ your name ▸ Sign-In & Security ▸ Sign in with Apple.

Uninstalling the app does not delete your account: use "Delete my data" first, or your account will be erased automatically after 24 months without sign-in.

If you believe your rights are not respected, you can lodge a complaint with the CNIL (French data protection authority), 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France — www.cnil.fr, or with the authority of your country of residence.

9. Automated decisions

Reported username. When three different players with an established account (created more than 24 hours ago, with at least one finished match) report the same username as offensive, it is hidden automatically (replaced by "Player" and removed from leaderboards) pending a human review within 48 hours. You can change your username immediately and contest the decision by writing to tonybassil292@gmail.com. You receive a notice in the app (Profile).

Players suspected of cheating. At the end of each online match, the server computes a suspicion score (0 to 100) from signals measured over the last 14 or 30 days: implausible shot results detected by the server, disputes over a result, "cheating" reports upheld by moderation, and, only if there are already at least two anomalies measured by the server, a very high win rate or accuracy. No signal is enough on its own. From 60, the account is set aside for 7 days: it only meets other set-aside accounts and does not appear in leaderboards. Nothing else changes: your earnings, purchases and account stay intact, and the set-aside ends by itself when the score goes down. You can ask whether your account is set aside, request a human review and contest by writing to tonybassil292@gmail.com: a manual release clears earlier signals.

ELO calculation and unranking a suspicious match are also automatic. These decisions only have effects within the game: none has legal effects for you.

10. Minors

Golfasko is rated 13+ on the App Store. We offer no free chat and the country stays optional. Your age is asked only the first time you tap an ad and stays on your iPhone. Ads are never personalized under 15. If you are under 15, talk to your parents before playing online. Purchases by minors require their parents' agreement; Apple's Ask to Buy lets parents approve them.

11. Security

Exchanges with the server are encrypted (HTTPS and secure WebSocket, TLS 1.2 or later). Sign-in tokens are stored in the iPhone's Keychain and the server only keeps a hash; Game Center and Apple identifiers are only kept as a fingerprint with a secret key. The server can require an Apple App Attest attestation for sensitive requests. The app has no administrative access. We only collect what the game needs.

In the event of a data breach that poses a risk to you, we notify the CNIL within 72 hours and, if the risk is high, we inform you with a message in the app.

12. Changes

This policy may change as the game evolves. The update date is shown at the top of the page; a significant change will be announced in the app before it applies.