Privacy Policy

THREEFORM STUDIOS. LIMITED (“Threeform”, “we”, “us”) operates threeformstudios.com, Caddie Eye (including caddieeye.threeformstudios.com), and our interactive golf course viewer. This notice explains how we handle personal information when you use those services, play as a guest, create an account, or contact us.

The website and course pages, Caddie Eye (with or without an account), the 3D course viewer, enquiry forms, and Privacy & Removal Requests. One account works across Threeform Studios and Caddie Eye. Cookies are described further in our Cookie Policy.

We do not sell personal information.

When you contact us

Forms may collect your name, email address, optional telephone number, organisation or golf club, venue and location details, a page link, the reason for the request, and any message you send. Those submissions are emailed to us.

When you create an account

• Email address and password (stored hashed), or name and email from a sign-in provider you choose (Google or Microsoft)
• A public handle you choose
• Optional name, self-entered handicap, member-club names, and profile photo

When you play Caddie Eye

• Signed-in play: guess coordinates, score, hint use, and play time, used to score the round, keep your stats, and place you on leaderboards
• Guest play: the same attempt details stay in this browser’s local storage until you sign in and save that round to your account

Friends and groups

Friend requests by handle, accept or decline status, group names, invite codes, and membership.

Automatically collected technical data

• Sign-in cookies on threeformstudios.com domains so you stay signed in across the site and Caddie Eye
• Technical data our hosting and security providers need to run and protect the services
• Optional analytics on the public marketing site (threeformstudios.com): after you accept, Google Analytics 4 may collect usage events (for example page views, course views, viewer interactions, and outbound booking-button clicks) and related technical data as provided by Google. Analytics are not loaded until you accept. They are not offered on private preview, local development, or localhost. The golf viewer iframe does not run a separate analytics tag. Booking click events mean outbound button clicks, not confirmed tee times or revenue
• Technical requests your browser makes to load maps and course imagery while you play or explore

Visible to anyone (including people who are not signed in)

• Your @handle on public daily and weekly Caddie Eye leaderboards, with score, rank, and related board stats. If you have no handle, the board shows “Player”, not your name or email

Visible to you and accepted friends

• Name, handicap, and member-club names
• Profile photo (shown only through a secure temporary link, not as a permanently public file)
• Friends-only leaderboards

Pending friend requests show the other person’s @handle only until accepted.

Visible only to you

• Email address
• Guess coordinates for a completed challenge (not published on public boards)
• Personal streak and stats that are not on a public board

You can play today’s Caddie Eye challenge without an account. That day’s attempt is stored in this browser only until you sign in and claim it. Clearing site data, another browser, or private browsing can lose it. Guests can view public leaderboards but do not appear on them until a claimed, signed-in score exists.

• Provide and secure accounts, sign-in, and Caddie Eye play
• Run leaderboards, streaks, friends, groups, and related game features
• Respond to enquiries and imagery privacy requests
• Show course experiences and related maps while you use them
• Understand how the public marketing site is used, when you have accepted optional analytics
• Keep the services secure and meet legal obligations

Under UK GDPR we rely on, as appropriate:

• Contract (or steps before a contract): accounts, scores, friends, groups, and the game features you use
• Legitimate interests: keeping the services secure, running fair public leaderboards (@handles and scores), and operating the site and game in a way that does not override your rights
• Consent: optional analytics cookies / similar technology, only after you Accept (Reject is equally available; you can change your mind via Cookie settings). We do not rely on a statistical-analytics exemption for standard Google Analytics 4 — PECR / UK GDPR consent route for counsel confirmation [TO CONFIRM]
• Legal obligation: responding to lawful requests

We use carefully chosen service providers so we can run these services. Depending on what you do, that can include providers that:

• Host the websites and help keep them secure and available
• Store account, profile, and game data
• Deliver forms and email form submissions to us
• Handle sign-in when you choose a third-party sign-in button (Google or Microsoft)
• Deliver maps, imagery, or related content your browser needs while you use the services
• Provide optional analytics (Google) when you have accepted analytics on the public marketing site

We name categories of recipients here rather than every supplier brand. Some providers may process data outside the United Kingdom. Where that happens, we rely on the transfer tools available for those services. International transfers for Google Analytics (including any IP controls or region settings available in GA Admin) are [TO CONFIRM] with counsel before relying on specific wording.

We use cookies to keep you signed in and to run and protect the site, and local storage in Caddie Eye for guest attempts and simple UI state. Optional analytics cookies are described in the Cookie Policy. Where offered, Accept / Reject / Manage are available from the cookie banner and Cookie settings in the footer. Blocking necessary cookies may sign you out or limit some features.

• Account and profile data: while the account is open, then until an erasure request is completed (allowing for backups and security logs to age out)
• Scores and leaderboard history: while those features form part of the product, or until the account is erased
• Guest local storage: until you clear it, claim the round, or the browser removes it
• Enquiry and imagery-request correspondence: as long as needed to handle the request and keep a minimal administrative record
• Analytics event data held by Google: retention period as configured in Google Analytics Admin [TO CONFIRM]

Under UK GDPR you can ask us to:

• Provide a copy of your personal information
• Correct inaccurate information
• Delete information where the law allows
• Restrict or object to certain processing
• Receive portable data where that right applies

While signed in, use the Security tab on your Account page to download a copy of your data or delete your account. You can also update profile fields there. For parental or other requests that the product cannot cover, email us using the contact details below.

For someone or something appearing in course imagery, use Privacy & Removal Requests. That form is for imagery review, not account deletion. We aim to review imagery requests within five working days. Statutory data-protection requests are handled within the time UK law allows (usually one month).

You can complain to the Information Commissioner’s Office (ICO) at ico.org.uk.

These services are not directed at children. We do not knowingly collect account data from under-13s. If you believe a child under 13 has created an account, contact us and we will delete it.

We may update this policy from time to time. The latest version will always appear on this page with an updated “Last updated” date.

Questions about privacy, access, or erasure: