1. What Are Cookies
Cookies are small text files that a website stores on your device when you visit. They are widely used to make websites work correctly, remember your preferences, and in some cases track your behaviour across the web.
Not all cookies are the same. Strictly necessary cookies are essential for a website to function — without them you could not log in or submit forms securely. These are different from optional cookies used for analytics or advertising, which require your consent under UK law.
2. Cookies We Use
SQR1 Golf sets two first-party cookies, both strictly necessary and exempt from consent requirements under the UK Privacy and Electronic Communications Regulations (PECR):
| Name | Type | Purpose | Duration |
|---|---|---|---|
| Keeps you logged in to your SQR1 Golf account. Without this cookie you would be signed out every time you navigate to a new page. | 2 weeks (or until you sign out) | ||
| Security token that protects forms against Cross-Site Request Forgery (CSRF) attacks. Required on all form submissions including login, round recording, and account updates. | 1 year (refreshed on each visit) |
These two cookies contain no personal data — just anonymous identifiers that reference your session on our server. Analytics and advertising cookies are only ever set if you choose "Accept all" — see Section 4a.
In addition to these two cookies, your cookie consent choice ("essential", "functional" or "all") is remembered using your browser's localStorage under the key — this is not a cookie, and nothing is written to it until you make a choice on the banner. We use localStorage rather than a third cookie so the consent mechanism itself doesn't need consent. It persists until you clear your browser data or change your choice.
If you switch between Worst and Best on the hole-by-hole overview, that choice is also remembered in localStorage ( and ) so the page opens the way you left it. These hold no personal data, only the word "worst" or "best", and are only written when you make that choice.
On the dashboard and stats pages, the tab you last had open (for example Overview or Putting) is remembered in localStorage under , so the page opens on the same tab next time. It holds only the tab name and no personal data.
If you arrive through a link carrying campaign tags (for example , or the / added by Facebook and Google adverts), those tags are kept in your browser's sessionStorage under for that browser tab only, so they stay attached as you move from the landing page to sign-up. This is how we can save "how you found us" with your account (see Section 2 of our Privacy Policy). It holds only the tags from the link, is deleted when you close the tab, and is not sent to Google or Meta unless you choose "Accept all" (if you do, is also set in that tab so the tags are only passed on once).
3. Your Consent Choices
When you first visit SQR1 Golf, a banner appears at the bottom of the page explaining what cookies and third-party resources we use. You are given three choices:
- Essential only — only the strictly necessary cookies described above are active. The site works fully. No connections are made to Google's font servers, Cloudflare's CDN, Google Analytics, Meta, HeyCatch or any other third-party resource.
- Fonts & maps only — in addition to essential cookies, we load Google Fonts for typography, Leaflet.js for course maps, and Chart.js for performance visualisations (Section 4). Google Analytics, the Meta Pixel and HeyCatch are not loaded.
- Accept all — everything above, plus Google Analytics, the Meta Pixel and HeyCatch (Section 4a).
Your choice is saved in your browser's localStorage under the key and respected on all future visits. You can change it at any time with the button below, which reopens the banner. If you withdraw consent for analytics and advertising, we stop loading those scripts and delete their cookies from our domain.
Choosing "Essential only" does not affect your ability to use any feature of SQR1 Golf. The only difference is that fonts fall back to system defaults and maps and charts use locally available alternatives where possible.
4. Third-Party Resources (Loaded With Your Consent)
If you choose "Fonts & maps only" or "Accept all", SQR1 Golf loads the following third-party resources. These are only ever loaded after you give consent — they are never loaded automatically on your first visit or if you choose "Essential only".
| Resource | Provider | Purpose | Domain |
|---|---|---|---|
| Loads the Barlow Condensed, Barlow and DM Mono typefaces used throughout the app. A connection is made to Google's font servers when fonts are fetched. | fonts.googleapis.com | ||
| The open-source map library used to power the Smart Course Planner. Fetched from Cloudflare's CDN. Cloudflare's CDN does not set tracking cookies. | cdnjs.cloudflare.com | ||
| The charting library used for performance visualisations and stats dashboards. Fetched from Cloudflare's CDN alongside Leaflet. | cdnjs.cloudflare.com | ||
| Human verification widget on the registration page. hCaptcha may use browser storage and cookies as part of its bot detection process. Only active on the registration page. | hcaptcha.com |
Google's font service may log the IP address and browser details of requests as part of their standard server logging. This is governed by Google's Privacy Policy. Cloudflare's CDN is a content delivery network; requests to it do not result in tracking cookies being set on your device.
SQR1 Golf does not receive any data from these providers about your use of their services.
4a. Analytics & Advertising (Only With "Accept all")
If — and only if — you choose "Accept all", we also load Google Analytics, the Meta Pixel and HeyCatch. They are never loaded on your first visit, if you choose "Essential only" or "Fonts & maps only", or for SQR1 Golf staff accounts. HeyCatch's script is fetched from the esm.sh content delivery network at that point.
| Name | Provider | Purpose | Duration |
|---|---|---|---|
| , | Distinguishes visitors and visits so we can see how many people use SQR1 Golf, which pages they use and how they found us (for example, which advert or website they came from). | Up to 2 years | |
| , | Lets Meta (Facebook / Instagram) tell us which of our adverts led to visits and sign-ups, so we can measure and improve our ads and show them to people likely to be interested. | 90 days | |
| (cookie and local storage) | Remembers an anonymous visitor ID so HeyCatch can count visitors and see how they move through SQR1 Golf, which pages and buttons they use, and how they found us. | 1 year | |
| , (session storage) | Groups the pages you view in one browser tab into a single visit. | Until you close the tab | |
| (local storage) | Remembers which signed-in account HeyCatch has been told about, so we don't send it again on every page. Only set with "Accept all", and cleared when you sign out or withdraw consent. | Until you sign out |
Alongside page visits, we tell Google, Meta and HeyCatch when one of these happens: an account is created, a paid plan is chosen and the visitor goes to checkout, or a free trial or subscription starts. These events include only the plan type and its price. We never send your name, email address, golf data or any other account details to Google, Meta or HeyCatch.
HeyCatch also records which pages you visit and which buttons and links you click (not the text on them), and does not record your screen. If you are signed in, we give HeyCatch your SQR1 Golf user ID (a number), plan, account type and sign-up date, so we can see how people use the Service over time. HeyCatch stores this data in the United States and keeps it for up to 2 months after we stop using its service; see our Privacy Policy for details.
Google, Meta and HeyCatch receive technical information from your browser, such as your IP address, device and browser type, and the pages you visit. Google and Meta may combine it with other information they hold about you (for example, if you are logged in to Facebook or Instagram). They act under their own privacy policies: Google Privacy Policy · Meta Privacy Policy · HeyCatch Privacy Policy. All three may process data in the United States.
5. Stripe & Payment Processing
SQR1 Golf uses Stripe to handle all payments for point bundles and subscription plans. When you click through to a Stripe-hosted payment page, you are leaving the SQR1 Golf domain and visiting Stripe's secure checkout environment (checkout.stripe.com or payments.stripe.com).
On Stripe's pages, Stripe may set their own cookies for the following purposes:
- Fraud prevention — Stripe uses device fingerprinting and behavioural signals to detect and prevent fraudulent transactions. This is a legitimate interest processing activity on Stripe's part.
- Session management — to maintain your checkout session while you complete a payment.
- Compliance and security — to meet PCI DSS requirements and financial regulations.
| Cookie / Identifier | Type | Set By | Purpose |
|---|---|---|---|
| Stripe | Machine identifier used for fraud detection. Persists for 1 year. | ||
| Stripe | Session identifier used during an active payment session. Expires after 30 minutes. | ||
| Stripe | Maintains your checkout session state while completing a payment. |
These cookies are set and controlled entirely by Stripe on their own domain. SQR1 Golf has no access to them and cannot read or modify them. Stripe's use of cookies is governed by Stripe's Privacy Policy and Stripe's Cookie Settings.
Stripe is certified to PCI DSS Level 1 — the highest level of payment security certification. Their cookie and data practices are subject to audit by independent security assessors.
5a. hCaptcha
Our registration page uses hCaptcha, a human verification service operated by Intuition Machines Inc. hCaptcha helps us protect the Service from automated bot sign-ups and abuse.
hCaptcha may set cookies or use browser storage as part of its verification process. These are used solely to distinguish human users from automated bots and are not used for advertising or cross-site tracking. The hCaptcha widget is only active on the registration page — it is not loaded on any other page of SQR1 Golf.
hCaptcha's use of cookies and data is governed by their Privacy Policy and Terms of Service. SQR1 Golf does not receive any personal data from hCaptcha beyond the verification result (pass or fail).
5b. Drill Videos (YouTube & Vimeo)
Some coaching drills include a video hosted on YouTube or Vimeo. Nothing is loaded from either service until you press play on a video, whatever you chose on our cookie banner.
When you press play, the video loads in YouTube's privacy-enhanced (no-cookie) player or in Vimeo's player with tracking switched off. The provider receives your IP address and browser information, and its player may store data in your browser while the video plays. This is governed by Google's Privacy Policy and Vimeo's Cookie Policy.
6. What We Don't Use
Apart from Google Analytics, the Meta Pixel and HeyCatch (Section 4a, only with "Accept all") and any drill video you choose to play (Section 5b), SQR1 Golf does not use any of the following:
- Any other web analytics service
- Any other social media or advertising tracking scripts
- Heat mapping or session recording tools (e.g. Hotjar, FullStory)
- A/B testing cookies
- Any third-party marketing or data broker scripts
- Cookies that track you across other websites
The optional third-party resources described in Section 4 (Google Fonts, Leaflet, Chart.js) are functional resources only — they deliver fonts, maps and chart rendering. None of them are used for advertising, profiling or cross-site tracking.
We never sell your personal data or share your golf performance data with advertisers.
hCaptcha is used on the registration page for security purposes only. It is not used for advertising or cross-site tracking. Its data processing is governed by Intuition Machines Inc's privacy policy.
7. Managing Cookies
Blocking the strictly necessary cookies will prevent the site from working correctly. Specifically:
- Blocking the sessionid cookie will sign you out on every page navigation
- Blocking the csrftoken cookie will prevent you from submitting any forms, including logging in
To change your consent choice, use the "Change cookie settings" button below (or in Section 3) to reopen the banner. Clearing the key from your browser's localStorage has the same effect.
You can manage cookies through your browser settings. Most browsers allow you to block third-party cookies while allowing first-party cookies — this is the recommended setting and will not affect your use of SQR1 Golf.
For information on managing cookies in your browser:
8. Changes to This Policy
We may update this Cookie Policy if we introduce new features that require additional cookies or third-party resources. Any material changes would be reflected here and the date at the top of this page updated. Where changes are significant — for example, if we added analytics tracking — we would notify you before the change takes effect and reset your consent preference so you can make a fresh choice.
We recommend checking back periodically, particularly before and after any major updates to the service.
If you have any questions about how we use cookies or your rights under PECR and UK GDPR:
Email: privacy@sqr1golf.com
You can also contact the Information Commissioner's Office (ICO) at ico.org.uk if you have concerns about our use of cookies.