athlopadel
Sign inRegister

Privacy Policy

Effective 26 July 2026 · athlopadel (www.athlopadel.com)

1. What this policy covers

How athlopadel collects, uses, shares and protects personal data of players, organizers, referees and visitors across both the website (www.athlopadel.com) and the Athlo mobile app for casual social play. The same account, profile and skill rating are shared across web and app. By using either you agree to this policy, which you accept explicitly at account creation.

2. Data we collect

  • Account data: name, email, phone (with country code), date of birth, nationality, city, profile photo, password (stored only as a secure hash by our authentication provider) or Google account linkage. Date of birth and phone are optional when you sign up. If you register for a tournament, an email address is required — it is how you claim and sign in to your profile, and how results and reminders reach you — and date of birth is required too, so organizers can verify age categories. A phone number stays optional, and organizers use it to reach you on the day. Your playing level is not something you tell us: it is earned from your results, as a skill rating.
  • Tournament data: registrations, teams and partners, match results, point-by-point scoring records, check-in times.
  • Sparring data: friendly club sessions you create or join — session name, club/side names, venue, date and time, an optional banner image, the participants, and match scores.
  • Casual play data (app): casual social sessions you create or join in the Athlo app — session name, format, players (including any guests you add), courts and match scores — and the social skill rating, rating history and aggregate stats those games build.
  • Details entered by an organizer: an organizer may add you to their tournament by hand or by importing a spreadsheet of entries, supplying your name and email address, and optionally your date of birth, phone and photo. This creates a guest profile with no login until you claim it. If the email or phone matches an existing account, the entry is linked to that account instead of creating a duplicate. Organizers must only submit details they are entitled to share, and you can ask us or the organizer to correct or remove them at any time.
  • Contacts (app, optional): if you choose to find friends from your phone’s contacts, the app converts each contact’s phone number and email into an irreversible one-way hash on your device and sends only those hashes for matching. We never receive, store or see your contacts’ names, numbers or email addresses, and the hashes are used only for that match.
  • Location (app, optional): if you allow it, your device location is used to find nearby venues and sessions and to attach a venue to a session you create. We store the venue you pick (name and coordinates) with that session — not a history of your movements. You can refuse or revoke this in your device settings and still use the app.
  • Subscription data (app): if you buy an optional in-app subscription, the purchase and billing are handled by the app store you bought it from (Apple App Store or Google Play) and managed through RevenueCat; we receive only your subscription status, never your card or payment details.
  • Verification documents (only when a tournament requires them): payment proof and identity document (KTP or passport).
  • Consent records: timestamp of terms acceptance and your newsletter choice.
  • Technical data: standard server logs needed to operate and secure the service. On the web, privacy-friendly cookieless usage analytics. In the app, a device push token (only if you allow notifications), plus crash/diagnostic data (Sentry) and privacy-friendly product analytics (PostHog) to keep the app working and improve it. We use no advertising cookies, build no advertising profiles, and do not track you across other sites.

3. What is public

Tournament pages and player profiles show: name, city, nationality, skill rating, profile photo, match results and aggregated statistics. Sparring session pages show the session and club/side names, participant names and the match scores. Never public: date of birth, nationality, phone, email, identity documents, payment information, check-in data.

4. Who else can see your data

  • The organizer of a tournament you registered for can see your contact details (email, phone), photo, and — where required — your payment proof and identity document, solely to verify and run that tournament. Documents are stored privately and opened through short-lived expiring links.
  • Other players in a session or tournament you join see your name, photo and results, as shown on the public pages described above.
  • The platform administrator can access data where needed to operate the service, resolve disputes or comply with law.
  • Service providers: Supabase (database, authentication, file storage), Vercel (web hosting and privacy-friendly, cookieless usage analytics), Resend (email delivery), Google and Apple (only if you sign in with them). For the app: the Apple App Store and Google Play with RevenueCat (optional subscriptions), the platform push services via Expo — Apple Push Notification service on iOS and Firebase Cloud Messaging on Android (notifications), Google Places (venue search, only when you use it), Sentry (crash diagnostics) and PostHog (product analytics). They process data on our behalf and cannot use it for their own purposes.
  • We never sell personal data.

5. Email and notifications

We send operational email: account verification, password reset, guest-profile invitations, registration and tournament notifications — email is the only channel for tournament and account notifications. In the Athlo app, if you allow them, we may also send push notifications for app events (session invites, a game starting, rating changes, club invites); you can turn these off any time in your device settings. Separately, we send occasional marketing email (athlopadel news) only if you opted in — either by ticking the newsletter box at signup, or via the Subscribe link in the site footer (you can subscribe without an account). Marketing email is sent from a separate sending address (news.athlopadel.com), is kept fully separate from operational email, and we store the email address you subscribed with only to send these updates. Every marketing email carries a one-click unsubscribe link; you can also unsubscribe at any time by contacting us.

6. Retention

Match results and statistics are kept indefinitely as the tournament archive — that permanence is a core feature players rely on. Identity documents and payment proofs are kept only as long as needed for the tournament they belong to and organizer dispute windows, after which they may be deleted on request. Account data is kept until you delete your account. A guest profile created for you by an organizer is kept so your results stay attached to you; you can claim it, or ask for it to be removed if you did not want to be entered.

7. Your rights

You can access and correct your data in your profile. You may request a copy, correction or deletion of your personal data via the contact page. Deleting an account removes personal contact data; anonymized match records may be retained to preserve other players’ results. We respond to requests within 30 days.

8. Security

Data is encrypted in transit and at rest. Access is restricted by row-level security rules: organizers see only their own tournaments’ participants, and sensitive documents are accessible only via authenticated, expiring links.

9. Children

The platform is intended for users aged 13 and over. Junior players below that age must be registered and managed by a parent or guardian.

10. Changes and contact

We may update this policy; the effective date above will change. For any privacy question or request: see the contact page.