Only the services that run it: Railway hosts it, Cloudflare stores files, Resend sends email, and Google or Apple only if you sign in with one. A scorecard you photograph, a question you type into Ask and a round you describe in words go to Anthropic (Claude) to be read, and what you typed is kept with your account so we can see what people ask for. Passwords are stored only as a hash. The app emails only what it has to: password resets, confirmations, an email change, tee times, an organizer's event invitation, and a buddy's claim link. swilkin.com counts page reads with no cookie and nothing stored on your device.
