Account privacy

Updated 12 September 2026. SimGolfer is an independent browser golf-course building game operated by Mattias Hindfelt. Contact: hindfelt@gmail.com.

Information used for your account

When you sign in, we receive your provider’s account identifier, display name and email address. We use these to create your player account, recognize you on later visits, and apply account access and abuse controls. We do not receive your Google, Apple, Microsoft or GitHub password. Google sign-in requests basic identity information, not access to your mailbox, files or contacts.

If email-code sign-in is available, your email address is used to deliver the requested code. We temporarily store hashed codes, browser verification challenges and attempt counts. Known disposable email domains are rejected to reduce account abuse.

Courses, cookies and service records

The browser stores local game saves separately for each player. Choosing Save course to cloud stores that course on our server under your player account. Older anonymous browser saves stay on that browser until you remove them; importing makes an account-specific copy.

A secure session cookie keeps you signed in for up to 30 days. Short-lived cookies protect sign-in requests. The service uses hashed IP-based rate-limit keys, and hosting infrastructure may process request and diagnostic logs for operation and security. Administration actions such as suspensions are recorded.

Service providers and access

Cloudflare hosts the game and account database. Your chosen identity provider handles authentication under its own privacy policy. Account administrators can access account details and suspend accounts. Cloud saves are private to your account through the application; they are not automatically published as multiplayer courses. Shared courses are visible to players the owner explicitly grants access to. Their course state is stored separately from personal cloud saves, and shared resorts continue running on the server while browsers are closed. Publishing a course explicitly makes a fixed copy of its layout, title and your display name available to all registered players. That copy excludes resort finances, visitors, staff and career data. Other players may retain downloaded or browser copies. Tournament registration names and rosters are visible to registered players. Each event retains its own fixed course copy. Earnings competition rosters and final financial totals are visible to registered players. Entrants build separate private courses on equal starting land; other players can view a course only if its owner grants access. Account information is not sold.

Retention and deletion

Expired sign-in and session records are removed during account-service cleanup. Account details and cloud saves remain until you delete the account. Account → Delete account removes your player record, linked identities, sessions, cloud saves, owned shared courses and your published course versions. Deleting an account also removes private tournament round states and open-registration entries, and cancels unfinished golf tournaments it organized. Running earnings competitions continue for other entrants; deleted entrants without a completed result remain as withdrawn under “Former player”. Completed tournament scorecards, earnings competition totals and placings remain under “Former player” with an opaque player ID; deleting an account does not erase or change final results. Entries in other organizers’ unfinished closed events remain as withdrawn records under “Former player”, retaining an opaque player ID so deletion cannot erase the competition. Event course copies remain for consistency, with the deleted author’s account identifier removed and attribution changed to “Former player”. Administration audit records containing opaque player IDs remain. Provider and infrastructure backups or logs follow their own retention schedules. Local browser copies are separate; clear browser site data to remove them. Contact the operator for help with account information or deletion.