Privacy Policy

This Privacy Policy explains how RankedCourt ("we", "us") collects, uses, stores, and shares personal data when you use RankedCourt (the "Service") — including our website at www.rankedcourt.com and any native mobile apps that load the Service.

We are the data controller for personal data processed through the Service. If you have questions, contact us at contact@rankedcourt.com.

This policy is written for users in the United Kingdom and the European Economic Area (EEA). It describes your rights under UK GDPR and EU GDPR where they apply to you.

RankedCourt helps recreational racket-sport clubs (such as badminton and padel) run sessions, track matches, skill ratings, and related statistics. Features may include club membership, live scoring, session history, optionally adding your heart rate from Apple Health to the sessions you play, an optional Apple Watch app, optional AI insights about your sessions, and optional paid subscriptions (Player Plus and Organiser).

Some features are only available to signed-in members of a club. Club administrators and moderators can access additional operational data about their club as described below.

Account and profile: email address; password (stored by our authentication provider as a secure hash); display name; optional bio; language preference; profile photo (uploaded by you or from Google sign-in); account creation and sign-in timestamps. If you sign in with Apple, we receive the name and email address Apple shares (which may be an Apple private relay address).

Club membership and play data: clubs you join; your role (member, moderator, session manager, admin); player profile linked to your account; match results, skill rating changes, games played and sat out; session dates, notes, and optional community recap text; session sign-up responses; club announcements you read or that moderators publish.

Data visible to other club members: within a club, other members typically see your display name, avatar, bio, and statistics derived from matches (for example wins, losses, skill rating). Moderators and admins see additional roster and operational information needed to run the club.

Club administration: club name and description; invite codes; venue names and coordinates entered by admins (not continuous GPS tracking of your device).

Subscriptions (only if you subscribe to Player Plus or Organiser): the plan, where you bought it (App Store or web), when it renews or ends, and whether it will renew. We also keep a count of the AI insights generated for your account, to apply its allowance.

Cookies and similar technologies: authentication session cookies; a cookie remembering your selected club; a language cookie for guests; a short-lived cookie used during Google sign-in. See the Cookies section below.

Analytics (production website only): aggregated page views and web performance metrics via Vercel Analytics and Speed Insights. Our custom analytics events are designed not to include your name, email, user id, or club identifiers.

In-app activity log (signed-in members): when you use the app while signed in, we record which pages you open and which buttons or links you tap (the button's visible label, for example "Start session"), with the time, your account, and whether you used the website or the iOS app. We never record what you type into fields. This log is kept for 30 days and is visible only to the Service operator.

Optional heart rate from Apple Health: if you use the iPhone app and add your heart rate to a session, we store for that session the part of your workout that falls within it: its start and end, heart rate readings (thinned to about one every 30 seconds), active time, energy burned, the type of workout, an identifier of the workout, and the average, highest and lowest heart rate for the session and for each game you played. We do not store anything from before or after the session, the name of your watch, or distance. This data is visible only to you in the Service.

Optional AI insights: only after you allow it in the app, we send your session results and skill rating numbers to OpenAI so its AI can write short insights about your play, which we save with the session. We never send your name, other players' names, your email or any health data — other players appear only as placeholders, and we fill their names back in on our own servers. You can withdraw this permission at any time under Your profile → AI insights. You can still see all factual stats without using this feature.

Help & support: if you contact us through Help & support in the app, we keep your messages and any screenshots you attach so we can answer you.

Device location: only when you ask for something nearby (for example "Use my location" on Discover, or searching for a venue while setting up a club) and only with your device's permission, we use your device's approximate location for that search. It is sent with the search — to us, and to Mapbox for venue search — and is not stored with your account or used to track you. Venue coordinates are entered by club admins.

Notifications on your phone (iOS app, only if you allow them): we keep the address Apple gives your phone for notifications, and the app's language on that phone, so we can tell you about things like a club answering you or posting a note, a place on a session being taken or freed, a session being cancelled, or your turn to book. The notification is delivered by Apple. We remove the address when you sign out on that phone or delete your account, or when Apple tells us the app is no longer on it. You can turn notifications off at any time in your phone's Settings.

Reports and blocks: if you report a person, club, note or message, we keep your report — what you reported, a copy of it as it was, your reason and note — to review it and act on it. The person you report is not told who reported them. If you block someone, we keep that so their content stays hidden from you. If we suspend an account for breaking the Terms, we keep the reason.

We do not operate a marketing email list or browser localStorage-based tracking.

We process personal data for the following purposes and legal bases under UK GDPR / EU GDPR:

Providing the Service (contract / steps at your request): creating and managing your account; authenticating you; operating club features you use; storing match and session data; displaying your profile and stats to your club.

Player Plus (contract / legal obligation): selling and renewing your subscription through RevenueCat and the store you buy from, unlocking the Plus features on your account, and keeping the records tax and accounting law requires.

Security and abuse prevention (legitimate interests): protecting accounts, investigating misuse, and maintaining service integrity, balanced against your rights.

Analytics and product improvement (legitimate interests): understanding how the Service is used in aggregate in production, without identifying you in custom event properties.

In-app activity log (legitimate interests): helping you when you contact support, finding where members get stuck, and fixing broken flows. It is never used for advertising, never sold, and never shown to other members or club admins. You can object at any time by contacting us.

Heart rate from Apple Health (your explicit consent): we read and store it only when you tap Add my heart rate on a session, or after you turn on Add it after every session. With that setting on, the app reads the workout for a session from Apple Health each time you open a session you played, until you turn it off; we record when you turned it on. You can withdraw consent at any time under Your profile → Heart rate, where you can also delete what is stored.

AI insights (consent): sending your session results and skill rating numbers to OpenAI to write non-binding insights, only after you allow it in the app. You can withdraw consent at any time under Your profile → AI insights. These do not replace human decisions about membership or play.

Help & support (contract / legitimate interests): answering your messages, and alerting the Service operator that a new message is waiting.

Legal compliance: where we must retain or disclose data to comply with law or respond to valid requests from authorities.

Clubs on the Service are shared spaces. Information you add to your player profile or that is generated from matches in a club is generally visible to other members of that club according to the product design.

Club moderators and admins can manage rosters, sessions, venues, announcements, and membership. They should only use member data for legitimate club administration.

If you leave a club or delete your account, visibility and retention are handled as described in the Data retention section.

Strictly necessary cookies: Supabase authentication cookies keep you signed in. The active club cookie remembers which club you are viewing. The auth-intent cookie briefly supports Google sign-in registration vs login.

Preference cookies: the NEXT_LOCALE cookie stores the language chosen in the language menu by guests.

Analytics: on our production deployment only, Vercel Analytics and Speed Insights may set or rely on cookies or similar technologies to collect usage and performance data. See Vercel's privacy documentation for details.

You can control cookies through your browser settings. Blocking strictly necessary cookies may prevent you from signing in or using core features.

Workout and heart-rate data are special category data under UK/EU law. We process them only with your explicit consent, given in the app as described above, and only to show you your own effort in the sessions you play. We read Apple Health (HealthKit) only inside the app while you are using it, and we ask Apple Health for workouts, heart rate and energy burned and nothing else.

The data is stored in our database with access restricted so that only your account can read it. Other members and your club's organisers cannot see it in the Service.

With your permission, the Apple Watch app records the sessions you play as workouts in Apple Health, reading your heart rate during the session. These workouts stay in Apple Health on your devices unless you add your heart rate to a session as described above.

We never use health data for advertising, marketing or data mining, never sell it, never store it in iCloud, and never share it with other members or third parties, including AI providers.

You can stop at any time: turn off Add it after every session under Your profile → Heart rate, or stop the app reading Apple Health altogether in your iPhone's Settings → Health → Data Access & Devices. You can delete your heart rate from one session on that session's page, or from every session under Your profile → Heart rate; deleting your account deletes it too. Deleting it in the Service does not remove your workouts from Apple Health.

App store listings may require additional disclosures; this policy is the canonical description of how we handle health-related data in the Service.

Player Plus and Organiser are optional subscriptions for your own account, and one subscription covers every sport in RankedCourt. Everything needed to take part in club sessions stays free.

Purchases are managed by RevenueCat. In the iOS app you pay Apple through your App Store account; on the website you pay by card through Stripe. Card details are collected and stored by the payment provider, never on our servers.

RevenueCat identifies your purchase by your account's internal id (not your name or email), so a subscription bought on the web also works in the app and the other way round. On the web, Stripe asks for your email address for the receipt.

You can change or cancel an App Store subscription in your Apple ID's subscription settings, and a web subscription from Manage subscription in the app. Their privacy policies apply to the payment itself: https://www.revenuecat.com/privacy, https://www.apple.com/legal/privacy, https://stripe.com/privacy

We use trusted processors who handle data on our instructions:

Supabase (authentication, database, file storage, realtime) — hosts and processes account and club data.

Vercel — website hosting, analytics, and speed insights in production.

Google — OAuth sign-in when you choose "Sign in with Google".

Apple — sign-in when you choose "Sign in with Apple", and maps shown in the Service (Apple MapKit).

Apple (Apple Push Notification service) — delivers notifications to your phone if you allow them; receives the notification's text and your phone's notification address.

Mapbox — maps and venue search; receives your search text and, if you allow location for that search, your approximate location.

Cloudflare (Turnstile) — checking that sign-ups and sign-ins come from a person, not a bot.

OpenAI — writes AI insights from your session results and skill rating numbers (no names, email or health data), only after you allow it.

RevenueCat, Apple (App Store) and Stripe — Player Plus and Organiser subscriptions, depending on where you buy.

Resend — delivering emails the Service operator sends you about your account or club.

Discord — private notifications to the Service operator about events such as a new account, a new club, or a new support message, which may include your display name, email address, club name, and the start of your message.

Apple — Apple Health (HealthKit) on your iPhone; we receive only the data you allow, through Apple's interface.

Some providers may process data in the United States or other countries outside the UK/EEA. Where required, we rely on appropriate safeguards such as the UK International Data Transfer Agreement, EU Standard Contractual Clauses, or adequacy decisions. You may request more information about transfers by contacting us.

We keep personal data for as long as needed to provide the Service and for legitimate business purposes thereafter.

Account data: retained while your account is active. If you delete your account or ask us to erase data, we will delete or anonymize personal data within a reasonable period, except where we must retain it for legal, security, or dispute reasons.

Club and match history: may remain visible to the club until removed by club admins or until account/club deletion processes apply.

Heart rate and AI summary data: retained until you delete it, delete your account, or we no longer need it for the purpose collected.

Player Plus records: kept while the subscription is active and afterwards for as long as tax and accounting law requires.

Server logs and analytics: kept for limited periods according to our hosting and analytics providers' defaults.

In-app activity log: deleted automatically after 30 days, and at once when your account is deleted.

We use industry-standard measures including encryption in transit (HTTPS), access controls, and row-level security in our database so users can only access data permitted by their club role.

Payment card data is handled by Apple or Stripe. We never store card numbers.

No method of transmission or storage is completely secure. If you believe your account has been compromised, contact us promptly.

Depending on where you live, you may have the following rights regarding your personal data: access; rectification; erasure; restriction of processing; data portability; object to processing based on legitimate interests; withdraw consent where processing is based on consent (without affecting prior lawful processing).

To exercise your rights, email contact@rankedcourt.com. We may need to verify your identity before responding. We aim to respond within one month, or longer where permitted by law for complex requests.

You may also use in-product account settings to update your display name, bio, language, and avatar where available.

If you are in the UK, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) at https://ico.org.uk.

If you are in the EEA, you have the right to lodge a complaint with a supervisory authority in your country of residence, place of work, or where an alleged infringement occurred.

The Service calculates skill ratings and statistics from match results using defined rules. These outputs affect in-app statistics only and do not have legal or similarly significant effects on you outside the Service.

Optional AI-generated session explanations are descriptive text based on match facts. They are not used as the sole basis for decisions about your legal rights or club membership.

The Service is not directed at children under 16. We do not knowingly collect personal data from children under 16 without appropriate parental authority.

If you believe a child has provided us personal data without consent, contact us and we will take steps to delete it.

We may update this Privacy Policy from time to time. We will post the new version on this page and update the "Last updated" date.

For material changes, we may provide additional notice (for example in the app or by email where appropriate). Continued use of the Service after changes take effect means you accept the updated policy, subject to your rights under applicable law.

Data controller: RankedCourt.

Privacy enquiries and data subject requests: contact@rankedcourt.com.

Postal address: available on request — email us if you need it for a formal request.