Account privacy

Updated 11 September 2026. SimGolfer is an independent browser golf-course building game operated by Mattias Hindfelt. Contact: hindfelt@gmail.com.

Information used for your account

When you sign in, we receive your provider’s account identifier, display name and email address. We use these to create your player account, recognize you on later visits, and apply account access and abuse controls. We do not receive your Google, Apple, Microsoft or GitHub password. Google sign-in requests basic identity information, not access to your mailbox, files or contacts.

If email-code sign-in is available, your email address is used to deliver the requested code. We temporarily store hashed codes, browser verification challenges and attempt counts. Known disposable email domains are rejected to reduce account abuse.

Courses, cookies and service records

The browser stores local game saves separately for each player. Choosing Save course to cloud stores that course on our server under your player account. Older anonymous browser saves stay on that browser until you remove them; importing makes an account-specific copy.

A secure session cookie keeps you signed in for up to 30 days. Short-lived cookies protect sign-in requests. The service uses hashed IP-based rate-limit keys, and hosting infrastructure may process request and diagnostic logs for operation and security. Administration actions such as suspensions are recorded.

Service providers and access

Cloudflare hosts the game and account database. Your chosen identity provider handles authentication under its own privacy policy. Account administrators can access account details and suspend accounts. Cloud saves are private to your account through the application; they are not automatically published as multiplayer courses. Account information is not sold.

Retention and deletion

Expired sign-in and session records are removed during account-service cleanup. Account details and cloud saves remain until you delete the account. Account → Delete account removes your player record, linked identities, sessions and cloud saves. Administration audit records containing opaque player IDs remain. Provider and infrastructure backups or logs follow their own retention schedules. Local browser copies are separate; clear browser site data to remove them. Contact the operator for help with account information or deletion.