Privacy Policy

1. Introduction & Overview

Welcome to Tennis Club (the "Application", "App", "Service", or "we/us/our"). This Privacy Policy explains how the Tennis Club Team collects, uses, stores, and protects personal data provided by users ("you" or "User") when accessing or interacting with our mobile application and related online services.

We are committed to full compliance with the General Data Protection Regulation (EU) 2016/679 ("GDPR"), the Spanish Organic Law 3/2018 on Personal Data Protection and Guarantee of Digital Rights ("LOPDGDD"), and the privacy guidelines established by Apple (App Store) and Google (Google Play Store).

2. Personal Data We Collect

We only collect information strictly necessary to provide tennis matchmaking, skill tracking, and community features:

A. Account & Authentication Information

• Email Address & Password: When you register via email and password, your credentials are securely hashed and managed through our backend authentication service (Supabase Auth).
• Third-Party Sign-In (Google / Apple): If you authenticate via Google Sign-In or Apple Sign-In, we receive your email address, unique third-party identifier, and name associated with your provider account. We do not receive or store your Google or Apple account passwords.

B. Player Profile Information

• Username & Display Name: To identify you to other tennis players in leaderboards and challenge requests.
• City & Country: To place you in your local geographic tennis rankings and facilitate nearby match discovery.
• Profile Picture / Avatar: If you upload a profile photo, the image is stored in a secure cloud bucket (Supabase Storage) and associated with your public player profile.
• Biography ("About Me") & Initial Skill Level: Optional descriptions you provide regarding your playing style, tennis background, or preferred courts.

C. Matchmaking, Gameplay & Rating Data

• Challenges & Matches: Details of match invitations sent or received, including opponent ID, designated match date, scheduled time, court/city location, and match status (pending, accepted, declined, in-progress, completed, cancelled).
• Match Scores & Results: User-submitted game scores, match outcomes (win/loss/cancelled), and verification statuses.
• ELO Ratings & Historical Records: Dynamically computed skill rating points, historical rating progression, and city ranking positions.
• Fair Play Points & Scores: Numerical consistency points (0–6+) and corresponding letter grades (A, B, C, D) calculated based on consensus versus conflicting match outcome submissions.

D. In-App Communications & Social Interactions

• Direct Chat Messages: Private messages and timestamps exchanged between matched players to coordinate match logistics (e.g., court bookings, arrival times, weather changes).
• User Relations & Safety Records: Blocked user identifiers (blocked_users) and safety or dispute reports submitted to our moderation system.

E. Technical & Device Data

• Device & Network Data: IP address, operating system type/version, application build version, network connectivity status, and server request timestamps required for API routing, security logging, and rate limiting.

3. Device Permissions

The Tennis Club mobile app requests only minimal operating system permissions:

4. Legal Bases for Processing (GDPR Article 6)

Under European data protection law, we process your personal data under the following legal bases:

• Performance of a Contract (Art. 6(1)(b) GDPR): Processing is necessary to deliver the core services you signed up for—such as creating your account, organizing challenges, calculating ELO ratings, publishing local rankings, and routing in-app messages.
• Legitimate Interests (Art. 6(1)(f) GDPR): To protect community integrity, detect fraudulent score submissions, enforce Fair Play standards, prevent harassment, and secure our backend infrastructure.
• Consent (Art. 6(1)(a) GDPR): When you choose to upload optional profile photos or add optional biographical descriptions. You can withdraw your consent at any time by editing your profile.
• Legal Obligations (Art. 6(1)(c) GDPR): To comply with mandatory statutory, tax, or legal law enforcement requirements if applicable.

5. Data Sharing & Third-Party Processors

We do NOT sell, rent, or trade your personal data to advertisers or third-party data brokers.

We share data only with trusted infrastructure subprocessors bound by strict data processing agreements:

• Supabase Inc.: Cloud-hosted PostgreSQL database, user authentication (Supabase Auth), storage buckets (avatars), and serverless Edge Functions (rating computation). Enforces industry-standard encryption at rest (AES-256) and in transit (TLS 1.3).
• Google LLC: Facilitates OAuth Google Sign-In authentication and serves open-source web typography (Google Fonts).
• Apple Inc.: Facilitates iOS application distribution and Apple Sign-In authentication.
• Cloudflare Inc.: Global edge content delivery network, SSL certificates, and security protection.

6. Security Measures

We implement robust technical and organizational security controls to safeguard your data:

• End-to-End Encryption in Transit: All communications between the mobile application and backend servers use encrypted HTTPS/TLS connections.
• Row Level Security (RLS): Database-level policies enforce that only authenticated users can access and modify their authorized data records.
• Database Protection Triggers: Critical ranking columns (such as ELO ratings, Fair Play scores, and ban statuses) are protected against client-side tampering via database triggers and server-side Edge Functions.
• No Cleartext Passwords: Passwords are never stored in cleartext and are securely hashed using state-of-the-art cryptographic algorithms.

7. Data Retention & Permanent Account Deletion

We retain your personal data for as long as your account remains active. You maintain full control over your data:

For detailed instructions or to submit an external erasure request, visit our dedicated Account Deletion & Data Erasure Portal.

8. Your Rights Under the GDPR

If you reside in the European Union / European Economic Area, you hold the following rights under Chapter III of the GDPR:

• Right of Access (Art. 15): You have the right to request a copy of the personal data we hold about you.
• Right to Rectification (Art. 16): You have the right to correct inaccurate or incomplete profile data directly in the app.
• Right to Erasure / Right to be Forgotten (Art. 17): You have the right to have your account and all associated personal data permanently removed.
• Right to Restriction of Processing (Art. 18): You have the right to restrict processing under certain legal circumstances.
• Right to Data Portability (Art. 20): You have the right to receive your personal data in a structured, commonly used, and machine-readable format.
• Right to Object (Art. 21): You have the right to object to the processing of your data based on legitimate interests.

To exercise any of these rights, email us at support@tennis-club.org. We respond to all verified requests within 30 days free of charge.

You also have the right to lodge a formal complaint with the Spanish Data Protection Authority:

9. Children's Privacy

Tennis Club is not directed toward children under the age of 16 (or under 13 where local law permits with parental consent). We do not knowingly collect personal data from minors. If you believe that a minor has registered an account without appropriate parental consent, please contact us immediately at support@tennis-club.org, and we will promptly delete the account.

10. Updates to this Policy

We may update this Privacy Policy periodically to reflect changes in our features, backend architecture, or applicable legal standards. When updates occur, the "Effective Date" at the top of this page will be revised.

11. Contact & Inquiries

For any questions, concerns, or requests regarding this Privacy Policy or our data handling practices, please contact:

Tennis Club Team
Email: support@tennis-club.org
Website: https://tennis-club.org
Location: Spain / European Union