← Ballzy
Security & Privacy
Last updated July 26, 2026 · Questions: hello@ballzygolf.com
Your rounds, friends, location on the course, and payments should stay yours — not open season for scrapers or ad networks.
You are safe to take this seriously
Ballzy is built by Family Farms Forever LLC. We treat cybersecurity and privacy as product requirements — not afterthoughts. Below is what we do in plain language, and how to reach us if something looks wrong.
Report a vulnerability
Email hello@ballzygolf.com with a description and steps to reproduce. Please do not post exploits publicly. Good-faith research is welcome. We aim to acknowledge within 2 business days.
Our baseline protections
- Encryption in transit — connections to our hosted sites and APIs use HTTPS (TLS), as provided by Firebase Hosting and Google Cloud.
- Encryption at rest — data stored in Firebase/Firestore is encrypted at rest by Google Cloud with Google-managed keys (standard Firebase platform protection).
- Signed-in access control — Firebase Authentication and Firestore security rules are used so private records are not left world-readable; access is limited by design to the account (or linked roles such as parent/teacher) that should see them.
- Secrets stay out of the app binary — server-side API keys and payment secrets are stored in Google Cloud Secret Manager (or equivalent cloud config) for Cloud Functions — not hardcoded into the public client apps.
- Payments by specialists — card payments are processed by Apple In-App Purchase, Google Play Billing, and/or Stripe Checkout/Elements. Our design is that full card numbers (PAN) are not stored in our application databases.
- No sale of personal data — we do not sell your information to data brokers or ad networks.
- Account deletion — available in-app or by request so you can leave cleanly.
- Metered public APIs — public machine-readable APIs include rate limits (and optional API keys with usage metering) so automated bulk access is constrained.
Specific to Ballzy
- Personal rounds & friends stay private — the public API is course discovery only. Scorecards and social graph are not on the open feed.
- Location — used for nearby courses, rangefinder, and shot tracking when you allow it. You can deny or revoke OS location permission anytime.
- Payments — Stripe (and platform stores where applicable) process cards; we do not store full card numbers.
- Public course API — rate-limited so agents and apps cannot bulk-download without a keyed quota.
Full legal detail: Privacy Policy · Terms.
What we do not claim (yet)
- We may not yet have a published SOC 2 letter for this product.
- We do not currently run a paid public bug-bounty program.
- When a third-party penetration test is completed, we will note it here.
We would rather be honest than over-promise. The engineering practices above are real and continuously maintained.
Related
Ballzy is developed by Family Farms Forever LLC. Security contact: hello@ballzygolf.com.