Private by default, and we mean the default

Who sees what

The frame for this page draws a table of exactly who can see a round at five sharing levels. Two of those levels — sharing with just the golfers who played, or with a club or league — are not a ratified way to share a round today; the nearest real mechanism, flagging a round into a season, is ratified as a different thing entirely, not a visibility level. Publishing the table anyway would draw two levels that do not exist as if they did, so it waits on docs#500.

Private until you publish

Nothing in RoundCrew is public because somebody forgot to hide it. A round, a profile and a community each carry a posture, and the answer to may this person see this is no unless something explicitly says yes. Being signed in is not that something.

Something you are not entitled to see is answered exactly like something that does not exist. RoundCrew does not tell the two apart for you, because “this exists but is not for you” is itself a disclosure — it confirms a person, a round or a club is there.

Blocking someone overrides every posture, in both directions, and your block is yours: it does not depend on them keeping theirs. No response from RoundCrew ever states that a block exists. On some surfaces the person blocked can work it out anyway — sending a request that cannot land is one — and that is accepted rather than papered over, because the alternative is showing them a friendship that will never be accepted. What is never disclosed is who placed it, when, or why.

What a shared link carries

Publishing a round is a separate, explicit act, not a setting a default could drift into. Until its owner publishes it, a round has no public page at all — and the link stops working when they take it back.

The page a stranger opens shows the course, how many holes were recorded, the total number of strokes, and the owner's name, which is theirs to attach.

The preview of a round that travels into a chat or a timeline shows less: the course and the hole count. Never a name, never a score, never a date.

That difference is not fussiness. A page is fetched from RoundCrew every time somebody opens it, so unpublishing reaches it. A preview is fetched once by a messaging service and shown to a thread for as long as that service keeps its copy, and nothing RoundCrew does afterwards can reach into it. So the copy that outlives the decision is the one that carries least.

Neither carries a position. Where a course sits is not part of what publishing a round makes public, and RoundCrew keeps no history of where you have been — a position belongs to the round it was recorded for and to nothing else.

A published profile is the other kind of link, and it is deliberately not the same. Publishing a profile is attaching your name to it, so a preview of one does carry that name, and the club you play out of if you gave one. A round is an event; a profile is a person saying who they are.

Deleting your account

Deletion is immediate and irreversible. There is no grace period, no recovery window and no undo. That is a deliberate trade: an unambiguous promise, paid for with a real risk, which is that an accidental or hostile deletion cannot be taken back.

So it is not something a borrowed phone can do. Deleting asks you to authenticate again at that moment — an open session is not enough authority to destroy an account — and states what goes and what stays before it accepts.

Erased outright: your account, credentials, devices and sessions; your profile, avatar and handicap index; your notification inbox; and any round nobody else played in.

Kept: a round other people played in keeps its strokes, because the scorecard is their record too and removing a player would change a card nobody asked to change. Your seat in it becomes a marker that carries no name, no avatar, and nothing that leads back to you. Courses you contributed stay as well, with the attribution anonymised — deleting a course because the person who submitted it left would break every round ever played there.

The principle underneath both lists: you may erase your own data. You may not erase somebody else's record of an afternoon you both played.

One honest exception. A backup cannot be rewritten in place, so immediate means immediate in the live system. Backups expire on their own schedule, and restoring one re-applies every deletion completed after it was taken — a restore never brings somebody back.

Reporting somebody

You are told a report was recorded, and nothing after that — ever. Not because nobody reads it, but because an outcome is a fact about the person reported, and telling it to somebody else is a decision made about a third party. It would also turn a repeated report into a way of testing whether someone is under sanction.

Reporting is not blocking, and blocking never stops you reporting. The person most likely to need to report somebody is often the person who has already blocked them.

A report you file outlives your account. The reference back to you does not: it is anonymised, along with the record of any action an administrator took, so what remains is reviewable without being yours.

Where this actually stands

None of it is usable yet. There are no accounts, so there is nothing to publish, block or delete, and this page describes what is being built rather than what is running.

RoundCrew is being built in the open. What it does first is the shorter answer to what that means.