thadwi studio
gaho

Privacy Policy

1. Controller

Thomas Wittek
Buchenweg 38, 66424 Homburg, Germany
Email: hello@thadwi.studio

2. Hosting of this website

This website is hosted via Cloudflare (Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA; served from Cloudflare data centres in the EU). When you access it, server log files are processed automatically (IP address, timestamp, pages requested, volume of data transferred, browser and operating-system identifier). The legal basis is our legitimate interest in the secure and trouble-free operation of the site, Art. 6(1)(f) GDPR.

Retention: We do not store these log files and have no access to the raw data. Cloudflare processes them solely to operate the site securely and deletes them according to its own retention scheme, usually within a few days. We carry out no further analysis.

Transfer to the USA: Cloudflare, Inc. is based in the USA. Cloudflare is certified under the EU-U.S. Data Privacy Framework; in addition, a data processing agreement incorporating the EU Commission's Standard Contractual Clauses is in place (Art. 46(2)(c) GDPR). Cloudflare's privacy policy is available at cloudflare.com/privacypolicy.

3. gaho — data processing in the app

gaho is available for iPhone (Apple App Store) and for Android (Google Play). gaho was deliberately built without any server infrastructure of its own. There is no user account, no sign-in and no automatic transfer of data to us or to third parties. By default, your rounds stay exclusively on your device. The Android version additionally has no internet permission and therefore cannot send any data over the network on its own.

What the app processes: your golf rounds — course, date, place, the fellow players in the flight, the strokes per hole, par and stroke index of the holes, your handicap (golf-private, on the device only), the scoring (gross/net/Stableford), notes, plus a photo of the day and optional photos per hole. When you create the club record of a round, the app additionally processes the signatures drawn on the device (yours and the marker's).

Text recognition (scorecard scan): You can photograph a course's paper scorecard; gaho reads par and stroke index per hole from it. This text recognition runs entirely on your device, with no cloud processing — on iOS via Apple's Vision framework, on Android via Google ML Kit (the recognition model is bundled inside the app). To capture and crop the card, the Android version uses the document scanner of Google Play services (a Google component; processing happens on the device). Google's privacy policy applies additionally to Play services.

Storage location: Exclusively local on your device. On iOS, without the optional iCloud backup (see section 4) there is no sync and no transfer to any server. On Android there is no app-managed cloud backup; however, the Android system backup may apply (see section 4).

Camera access: Used exclusively within the app — for the photo of the day, optional hole photos and the scorecard scan. The images are stored with your round.

Photo library: You can import photos from your photo library into gaho (e.g. for the photo of the day, or instead of the camera for the scorecard scan). gaho only reads the image you select and does not create a copy in your library.

Fellow players / people: You can record who you played with by creating them as a person and selecting them. gaho does not access your address book/contacts for this. These names are personal data you enter yourself; they are stored exclusively on your device (on iOS additionally in your iCloud if you enable the backup; on Android possibly in the system backup, see section 4). If you also use the sister app ritrovo (indulgence) on the same device, the people list is shared between both apps via a common, device-internal store, so you only create a person once. This too stays exclusively on your device — nothing is transferred to a server.

Location data: gaho can use your location to suggest a nearby saved course and to record the place of a round. On iOS, to show a readable place name, coordinates or place names are sent to the operating system's geocoding service (Apple) and converted. The Android version uses only a coarse location and does not resolve a place name over the network (no internet permission). Location access is optional; without it gaho still works, just without the location convenience features.

Course search: On iOS, "search course online" retrieves course data from the public directory handicap.report. Your search text and, for technical reasons, your IP address are transmitted to that directory's provider so that the matching course data can be delivered; the provider's privacy terms apply. After import, the course lives locally on your device. The Android version searches exclusively in a bundled, offline-stored OpenStreetMap extract — nothing is transmitted. Some of the hole data comes from OpenStreetMap (© OpenStreetMap contributors, ODbL) and is embedded in the app.

Sharing / export: When you actively use the share or export function, an image (the scorecard) or a round file leaves your device only to the destination you choose yourself, via your device's share menu (e.g. another app, AirDrop or "Share"/"Nearby", email). A round file shared by someone else that you adopt is processed exclusively locally. All of this happens only at your instruction.

Legal basis: Art. 6(1)(b) GDPR (performance of a contract / use of the app function). Optional features (location, iCloud backup) are enabled by you via the respective permission or setting.

4. Data backup

iOS — optional iCloud backup: On iOS, gaho offers an optional iCloud backup. It is off by default and must be actively enabled by you. When enabled, your rounds and courses (including photos, details, places and fellow-player names) are stored in your own, private iCloud container at Apple and synchronised between your devices. The data lives in the private iCloud area linked to your Apple ID; we have no access to it and do not read it. It is processed by Apple as a technical service provider; Apple's privacy terms apply additionally. You can switch the backup off again at any time and delete the app's iCloud data via your device's iCloud settings. Legal basis: Art. 6(1)(a) GDPR (your consent by enabling the feature).

Android — system backup: There is no app-managed cloud backup on Android. However, the Android system backup may include the app's data in your own, private Google Drive backup of your device if you have enabled device backup in your Android settings. This is a feature of your operating system in your own Google account; it is controlled by your device settings, we have no access to it, and Google's privacy terms apply additionally. You can disable device backup in your Android settings.

5. Obtaining the app via the App Store or Google Play

gaho is distributed via the Apple App Store (iOS) and via Google Play (Android). When downloading, updating and paying, Apple and Google respectively process personal data under their own responsibility — such as your Apple ID or Google account, the time of download, device information and payment data. We have no influence over this and do not receive that data. Apple's or Google's privacy terms apply.

In-app purchase (gaho Pro): The statistics feature can be unlocked via a one-time in-app purchase. Payment is handled by Apple (App Store) or Google (Google Play); we receive no payment data and do not store any. Whether the purchase exists is checked only locally or via the respective store account.

6. Your rights

You have the right to access, rectification, erasure, restriction of processing, data portability and objection. Since all app data resides exclusively on your device (and, if you enabled it or the system backed it up, in your own iCloud or Google Drive backup), you can view, edit or delete it yourself at any time — e.g. via the delete function in the app, by uninstalling, or via your device's iCloud/backup settings. For questions, contact hello@thadwi.studio. You also have the right to lodge a complaint with the competent data protection supervisory authority.

7. Cookies

This website uses no cookies.

Last updated: August 2026