Caddie — Privacy Policy
Last updated: 31 August 2026
Caddie is a Chrome extension that shows whether a person on LinkedIn carries a USGA
Handicap Index, looked up through your own GHIN account, from your own browser.
This policy describes exactly what the extension handles. Where something is a
trade-off rather than a guarantee, it says so.
What is stored on your device
| Data | Where | Why |
|---|---|---|
| Your GHIN username | chrome.storage.local | To sign in to GHIN as you |
| Your GHIN password | chrome.storage.local, encrypted | GHIN issues only a 12-hour session and offers no refresh token, so the extension must re-authenticate roughly twice a day |
| Your GHIN session token | chrome.storage.local | Avoids re-authenticating on every lookup |
| Lookup results | chrome.storage.local, 7 days, max 500 profiles | So revisiting a profile costs no new request, and so known golfers can be marked in your feed |
| Your confirm / dismiss clicks | chrome.storage.local | Corrects the badge, and measures how often the extension is right |
| A random client id | chrome.storage.local | Distinguishes your votes in the shared index; not tied to your identity |
None of this is synced. It uses storage.local, never storage.sync, so nothing
is uploaded to Google or copied between your devices.
About the password
Your password is encrypted with an AES-GCM key generated as non-extractable, held
in the extension's IndexedDB. The raw key cannot be exported by any code, including
Caddie's own. Only the ciphertext is written to extension storage.
What this protects against: anything that reads extension storage — another
extension with storage permissions, a profile backup, someone with access to the
machine's files.
What it does not protect against: code running inside Caddie itself can ask the
key to decrypt, because the extension has to be able to log in to GHIN. No design can
avoid that while also avoiding a twice-daily login prompt. This raises the bar from
"plaintext on disk" to "requires code execution in the extension's context"; it is not
a claim that the password is unrecoverable.
If you would rather not store it at all, use Clear credentials in the extension
popup when you finish a session. That erases the encryption key as well as the data.
What leaves your device
To GHIN (api2.ghin.com)
Your GHIN credentials, to sign in; and the name and US state of the person you are
looking at, to search. This is the same request the official GHIN app makes when you
type a name into it. Caddie does not proxy these calls — they go from your browser
straight to GHIN under your own membership, and are subject to
To Google (firebaseinstallations.googleapis.com)
One anonymous app-attestation request, required by GHIN's own login flow. It carries
no personal data.
To the shared index
Opening a profile sends nothing to the shared index. Caddie downloads the whole
known set periodically (see The downloaded list below) and answers every profile
lookup from that local copy. So the index is never told which profiles you view — the
server has no per-profile record of your browsing at all.
Contributing (opt-in). The only time the index receives anything is when you
confirm, dismiss, or self-verify a match — and only if Contribute my confirmations
is ticked. Then it receives:
- the LinkedIn profile slug,
- the GHIN number involved,
- your random client id,
- whether it was a confirmation, a dismissal, or a claim about yourself.
For a profile someone else confirmed, that is all it holds. It receives no
name, no handicap index, and no club. Each viewer resolves the actual index live
with their own GHIN session.
Publishing your own record
There is one exception, and it is yours to make. If you visit your own LinkedIn
profile while signed in and press Verify me — publish my handicap, Caddie also
publishes your name, Handicap Index, club and association to the shared index.
That is what lets other people see you as verified without spending a lookup, and
what lets Caddie show a handicap to someone who has not signed in to GHIN at all.
This only ever happens for your own record, only when you press the button, and
never for a profile a third party confirmed. Pressing remove from shared index on
your profile — or emailing dhulser@gmail.com — deletes it, and the tombstone stops
it being re-added.
The downloaded list
So that badges work without a GHIN session, the extension periodically downloads
the shared index: the published records of golfers who opted in, plus the
profile-to-GHIN-number mapping for community-confirmed profiles. It is stored on
your device and refreshed roughly twice a day. Removals propagate on the next
refresh.
You can look people up without contributing: untick Contribute my confirmations in
the popup. You can disable the index entirely by clearing the index URL.
What is never collected
- No analytics, telemetry, tracking pixels, or advertising identifiers.
- No browsing history. Caddie reads only the LinkedIn profile page you are on.
- No LinkedIn credentials — Caddie never sees or asks for them.
- No email addresses or phone numbers. GHIN returns a masked email in search results;
Caddie discards it.
- Nothing is sold, rented, or shared with third parties.
Children
GHIN contains records for junior golfers. Caddie always filters out
junior-program records (First Tee, Youth on Course, school and academy clubs) and
records with no established Handicap Index, before anything is displayed or written
to the shared index. This filter cannot be turned off.
If you believe a minor's record is reachable through Caddie, please write to
dhulser@gmail.com and it will be removed.
Getting yourself out of the shared index
Any profile present in the shared index shows a remove from shared index link in
the extension. That deletes every vote for the profile and tombstones it, so later
confirmations cannot put it back.
You do not need to install Caddie to be removed. Write to dhulser@gmail.com with the
LinkedIn profile URL and it will be removed.
Deleting your data
Clear credentials & cache in the popup erases everything on your device,
including the encryption key. Removing the extension does the same.
Votes you have already contributed to the shared index are not tied to your identity
— only to a random client id — so they cannot be traced back to you. To have a
specific profile's entry deleted, use the removal link or the email above.
Not affiliated with the USGA
Caddie is an independent personal tool. It is not affiliated with, endorsed by, or
connected to the USGA or GHIN. Handicap Index®, GHIN® and USGA® are trademarks of the
United States Golf Association.
Changes
Material changes to this policy will be noted here with a new date, and in the
extension's release notes.