Privacy Policy
Last updated 8 October 2026
This explains what we collect when you use The 3-Putt Fix, why, who else sees it, and what you can do about it. It is written to describe what the site actually does rather than to cover every eventuality, so if something here doesn't match your experience, tell us — that's a bug in one of the two.
Who we are
The 3-Putt Fix is a product of Feedback Golf, the trading name of Tom Devine, a sole trader based in the United Kingdom. For UK data protection law, Feedback Golf is the "controller" of the information described below — we decide what is collected and why.
You can reach us about anything in this policy at the email address at the end.
What we collect
Only what the product needs. Specifically:
- Your questionnaire answers. The six multiple-choice answers, your handicap, and — if you choose to fill it in — the optional free-text box. That box is genuinely optional and you can skip it by pressing Enter.
- Your email address, which we ask for at the end of the questionnaire. We also use it to tell you about new guides and to send the occasional putting tip, which you can stop at any time from a link in any of those emails.
- Your diagnosis, meaning which putting-leak categories your answers were matched to and the text written for your guide.
- Purchase records if you buy: what you paid, when, and whether it was refunded.
- Where you came from. If you arrived by clicking an advert, the tracking parameters in that link (things like `fbclid` and `utm_source`), so we can tell which adverts are worth running.
- A one-way hash of your IP address. Not your IP address itself — a scrambled version that cannot be reversed back into an address. It exists solely to stop one person generating thousands of diagnoses and running up our costs.
We never see or store your payment card number, at any point. We don't ask for your name, your address or your date of birth either — though if you buy, Stripe collects your cardholder name and billing country and postcode in order to take the payment, and we can see those in our Stripe account. That is described under "Who else sees it" below.
Please don't put sensitive personal information — health conditions, anything about other identifiable people — into the free-text box. It's there for a sentence about your putting.
Why we collect it, and our legal basis
UK law requires us to have a specific reason for each use. Ours are:
- To build and send your guide — your answers, diagnosis and email. Legal basis: performance of a contract, or steps taken at your request before entering one. Without this information there is no product to deliver.
- To resend your guide or answer a support question — the same information, kept so we can help you later without asking you to start again. Legal basis: performance of a contract.
- To email you your diagnosis — your answers, your diagnosis and your email address. About an hour after you finish the questionnaire, if you haven't bought, we send you one email with your diagnosis and what the audit would measure. Legal basis: our legitimate interest in following up a diagnosis you asked for. It carries a one-click unsubscribe, and it is sent once.
- To tell you about new guides and send the occasional putting tip — your email address. Legal basis: our legitimate interest in selling more of what we make to people who wanted the first one. You are told this when you give us the address, and every one of those emails carries a one-click unsubscribe. Stop them and we stop, permanently — it has no effect on your guide or on support.
- To keep records of sales for tax and accounting. Legal basis: legal obligation.
- To understand which adverts work — the tracking parameters above. Legal basis: our legitimate interest in not wasting money on advertising that doesn't work.
- To prevent abuse — the hashed IP address. Legal basis: our legitimate interest in protecting the service from automated abuse.
- To measure how the site is used — Google Analytics, described below. Legal basis: outside the United States, your consent, which we ask for before anything loads. In the United States, our legitimate interest in knowing whether our advertising works — which you can opt out of at any time, and which we stop immediately if your browser tells us to.
- To show you our adverts on Facebook and Instagram, and to see which of them lead to a sale — the Meta Pixel, described below. Legal basis: outside the United States, your consent, which we ask for before anything loads. In the United States, our legitimate interest in not paying for adverts that don't work — which you can opt out of at any time, and which we stop immediately if your browser tells us to.
Who else sees it
We do not sell your information, and we never will. With one exception, which you control: if you agree to advertising cookies, Meta receives the fact that you visited and what you did here, and uses it for its own advertising purposes as well as ours. Decline, and none of that happens.
A small number of companies process it on our behalf, under contract, and only to provide their service to us:
- Stripe — takes your payment. You are handed to Stripe's own checkout page to pay, so your card details go to them and never pass through our site. They collect what they need to process the payment and to prevent fraud: your card details, your name as it appears on the card, your email address, your billing country and postcode, and technical information about the device you paid from. We can see the record of the payment in our Stripe account — the amount, the date, your email, your name and the last four digits of the card — but never your full card number. Stripe's privacy policy is at stripe.com/privacy.
- Google Analytics — measures how the site is used, unless it is switched off for you. If it is running, Google receives a randomly generated identifier for your browser, the pages you viewed, roughly where in the world you are, and — if you buy — the amount and the advert that brought you. Never your email address, your answers or your diagnosis. If it is switched off, nothing is sent to Google at all, including from our own servers. Google's privacy policy is at policies.google.com/privacy.
- Meta (Facebook and Instagram) — shows you our adverts and tells us which ones worked, unless it is switched off for you. If it is running, Meta receives the pages you viewed, whether you started the questionnaire, and whether you bought — together with the amount. Never your email address, your answers or your diagnosis. Meta is not simply working on our behalf here: it uses this information for its own purposes too, which is why turning it off stops the Pixel loading at all rather than merely asking Meta to behave.
- Supabase — stores our database and your generated guide file.
- Vercel — hosts the website itself.
- Google — delivers the email containing your guide, because we currently send through Gmail.
We will add to this list, and update this page, before introducing anyone new. One is already planned: Anthropic, whose Claude service will generate the written part of your diagnosis. It is not in use at the time of writing.
Where your information is held
Our service providers store data on servers in the United States. That means your information is transferred outside the United Kingdom.
Where that happens, the transfer is covered by the safeguards UK law requires — either the provider's certification under the UK Extension to the EU–US Data Privacy Framework, or the UK's International Data Transfer Addendum to the European Commission's standard contractual clauses. If you'd like the detail for a specific provider, ask and we'll tell you.
How long we keep it
Three years after your last interaction with us — your last purchase, or your last email to us, whichever is later. After that your answers, your diagnosis, your guide file and your email address are deleted.
Two exceptions. We keep basic records of sales for as long as tax law requires, which is longer than three years, but those are transaction records rather than your putting answers. And if you ask us to delete your information sooner, we will.
If you started the questionnaire but never gave us an email address, your answers are held against an anonymous session with no way to identify you, and are deleted after 12 months.
If you agreed to Google Analytics, Google keeps its own records of your visit separately from ours, for 14 months, after which they are deleted automatically. Those records contain a randomly generated identifier for your browser rather than anything that names you.
If you agreed to advertising cookies, Meta keeps its own records of your visit separately from ours, under its own policies rather than this one. You can see and change what Meta holds about you in your Facebook or Instagram settings.
Emails we send you
Two kinds, and they are not treated the same.
Your guide, and anything to do with it — delivery, a resend you asked for, a reply to a support question. These are part of what you bought and we will always send them.
New guides and putting tips — occasional, and entirely optional. Every one carries a one-click unsubscribe that works without logging in, and a postal address, because US law requires both. Unsubscribing takes effect immediately and permanently, and it does not affect your PDF, your refund rights, or our answering you if you write in.
If you gave us your address on or before 19 September 2026, you were told we would send you your diagnosis and nothing else. We meant it. You are excluded from the second kind entirely, and changing this page does not change that.
Your rights
Under UK data protection law you can ask us to:
- Give you a copy of everything we hold about you.
- Correct anything that's wrong.
- Delete it. We'll do this unless we're legally required to keep a record, in which case we'll say which part and why.
- Stop using it for a particular purpose, or restrict what we do with it.
- Object to any use we've based on our legitimate interests.
- Turn off Google Analytics and advertising cookies, at any time and as easily as they were turned on — use the Cookie preferences link at the bottom of any page. Where we asked for your consent first, withdrawing it is exactly as easy as giving it was. Either way, it doesn't affect anything done before.
- Hand it over to you or someone else in a portable format.
Email us and we'll do it, free, within one month. We won't ask you to explain why.
If you're unhappy with how we've handled a request, you can complain to the Information Commissioner's Office, the UK's data protection regulator, at ico.org.uk or on 0303 123 1113. We'd rather you came to us first so we can put it right.
If you're in the United States
Most of our customers are. Depending on your state — California, Colorado, Connecticut, Virginia and others have their own laws — you may have the right to know what we collect, to get a copy, to have it deleted, to correct it, and not to be discriminated against for exercising any of that.
We give every customer those rights regardless of where they live, so use the same email address below.
For California specifically: we have not sold personal information as that term is defined under the CCPA in the preceding twelve months. We do share it for cross-context behavioural advertising — that is what the Meta Pixel does — and in the United States we do that unless you tell us not to. Two things stop it, both straight away: the Cookie preferences link at the bottom of any page, which we treat as an opt-out of sharing, and a Global Privacy Control signal from your browser, which we honour automatically and which you never have to mention to us.
Cookies and similar technology
We set two cookies of our own, and neither requires your consent because the site cannot do what you asked without them. `tpf_session` identifies your session so the site knows which diagnosis is yours and nobody else can open it — it cannot be read by JavaScript, contains no personal information, and lasts 30 days. `tpf_region` holds the two-letter country code your connection appears to come from, so the site knows which of the two rules below applies to you — it lasts a day, holds nothing else, and is not linked to you.
We also store the advert tracking parameters described above in your browser. One copy goes in session storage: it is first-party, stays on your device, and is cleared when you close the tab. While Google Analytics and the Meta Pixel are switched on for you (the rules are below), a second copy goes in your browser's local storage for 30 days from your click, so that if you come back later we can still tell which advert brought you. It is first-party, stays on your device, and is deleted when you switch them off.
Whether we ask you first depends on where you are. Outside the United States we ask, and nothing described below loads until you press Accept — no cookie set, no request made. In the United States, where state privacy law treats advertising measurement as something you may switch off rather than something you must switch on, they load by default and the Cookie preferences link at the bottom of any page turns them off. If your browser sends a Global Privacy Control signal, we treat that as switching them off and you need do nothing else.
Google Analytics. We use it to see which adverts bring people here and where the site loses them. It sets cookies on your device. When it is switched off — because you declined, because you turned it off, or because your browser asked us to — nothing from Google is loaded and no Google cookie is set.
While it is running, Google sets cookies named `_ga` and `_ga_` followed by a code, which last up to two years and distinguish one visitor from another. We have turned off Google's advertising features, so this is not used to target ads at you, and we do not combine it with anything else.
You can change your mind at any time using the Cookie preferences link at the bottom of any page. That reopens the question, and your next page view follows whatever you choose.
The Meta Pixel. We use it so our adverts reach people like you on Facebook and Instagram, and so we can tell which advert led to a sale rather than guessing. It sets cookies on your device and sits behind exactly the same switch as Google Analytics. Turning it off costs you nothing on this site. It receives the pages you viewed, whether you started the questionnaire and whether you bought, with the amount. It never receives your email address, your answers or your diagnosis.
Whichever of the two applies to you, the same Cookie preferences link turns both of them off — and a choice you make there outranks the default for where you are.
Security
The site runs entirely over an encrypted connection. Your session identifier is signed and cannot be read or altered by anything running in your browser. Your IP address is stored only as an irreversible hash. Your guide file is held in private storage and can only be reached through a link that expires.
No system is perfectly secure, and we won't pretend otherwise. If we ever suffer a breach affecting your information, we will tell you and the Information Commissioner's Office as the law requires.
Children
This is a product for adult golfers. It isn't directed at children and we don't knowingly collect information from anyone under 16. If you believe a child has given us information, tell us and we'll delete it.
Changes to this policy
If we change it, we'll update the date at the top. If the change is significant — a new company handling your data, a new purpose — we'll email anyone affected rather than quietly editing the page.
Contact us
Feedback Golf, the trading name of Tom Devine, a sole trader based in the United Kingdom
Email: hello@feedbackgolf.com
Heswall, United Kingdom