Privacy Policy

Last updated: June 27, 2026

This Privacy Policy explains what Calcutta Country Club, operated by Overweight Holdings LLC, collects, why, and what choices you have. We try to collect as little as possible to run a pool.

1. Information we collect

• Commissioners (organizers). Your email address, an optional display name, a securely hashed password, and your organization and role. We never store your password in plain text.
• Bidders. A display name only. Bidders have no account, and we do not collect a bidder’s email, password, or payment details.
• Tournament data. The configuration of your pool, golfers and lots, bids, team spend, and standings.
• Payment information. When you pay a fee, Stripe processes the payment. We do not receive or store your full card number; we retain a Stripe customer reference and your plan/billing status so we can manage your account.
• Technical data. Standard server logs and security signals (such as IP address and request metadata), which we use to operate the Service, diagnose errors, and prevent abuse through rate limiting, plus the cookies described in our Cookie Policy.

2. How we use information

• to provide, operate, and secure the Service;
• to run your auction, keep score, and compute pots, payouts, and the settlement ledger;
• to process payments and manage your plan, including Membership renewals;
• to respond to support requests and send essential service messages;
• to detect, prevent, and respond to abuse, fraud, and security incidents (including rate limiting and error monitoring); and
• to comply with law and enforce our Terms.

3. Settlement and payment apps

Calcutta Country Club never moves or holds prize money. When a commissioner uses a pre-filled Venmo link to settle up, that link is launched from their own device and the transaction happens entirely within Venmo. We do not collect, receive, or store any Venmo handles, balances, or transaction data. Venmo is an independent third party with its own privacy policy.

4. Service providers (sub-processors)

We share data with a small set of providers only as needed to run the Service. They process data on our behalf under their own security and privacy commitments:

• Stripe — payment and subscription processing.
• Neon — managed PostgreSQL database hosting.
• Vercel — application hosting and delivery, and privacy-friendly, cookieless usage analytics (no advertising or cross-site tracking).
• Google (Google Analytics 4) — product and funnel analytics, used only after you accept analytics cookies (see below).
• Cloudflare — a scheduled job that refreshes public golf reference data (rankings and odds).
• Resend — delivery of transactional email (password reset, payment receipts, and Membership notices).
• Sentry — application error monitoring and diagnostics, which may include technical data such as IP address and browser details captured when an error occurs.
• Upstash — a Redis service used for rate limiting and abuse prevention, which processes IP-derived request counters.

We will keep this list current as our infrastructure changes. We do not sell your personal information, and we do not share it for cross-context behavioral advertising.

Google Analytics 4. We use Google Analytics 4 as a processor to measure aggregate traffic, conversion funnels, and product usage. It runs only after you accept analytics cookies in our consent banner (Google Consent Mode v2; analytics storage is denied by default). IP addresses are anonymized and not stored by Google Analytics, ads personalization is turned off, and we do not send Google any personal information such as names, email addresses, or other identifying details — only opaque event data. You can manage your choice through the banner or opt out entirely with the Google Analytics Opt-out Browser Add-on; the cookies it sets are described in our Cookie Policy.

5. Data retention

We keep account and tournament data for as long as your account is active or as needed to provide the Service, then for a reasonable period to comply with legal, tax, and accounting obligations. You can ask us to delete your account data, subject to those obligations.

6. Your choices and rights

Depending on where you live, you may have rights to access, correct, delete, or export your personal information, or to object to certain processing. To make a request, email support@calcuttacc.com. We will not discriminate against you for exercising these rights.

7. Security

We use industry-standard measures — including hashed passwords, signed and HTTP-only session cookies, encrypted connections (HTTPS/HSTS), a Content-Security-Policy and related security headers, and rate limiting on sensitive endpoints — to protect your data. No method of transmission or storage is perfectly secure, but we work to protect your information and to address vulnerabilities promptly.

8. Children

The Service is not directed to children under 13 (or the minimum age in your jurisdiction), and we do not knowingly collect their personal information.

9. Changes to this policy

We may update this Privacy Policy from time to time. We will revise the “Last updated” date above and, for material changes, provide notice through the Service.

10. Contact

Questions about your privacy? Email support@calcuttacc.com or visit our contact page.