CourtTable Privacy Policy

1. Who we are (data controller)

• Company: GAVA Group AB
• Swedish company registration number: 559427-5207
• Contact for privacy matters: support@padelfast.com
• Website and contact form: https://www.courttable.com/contact

We have not appointed a named Data Protection Officer. Please direct all privacy questions and requests to support@padelfast.com.

2. How CourtTable works, in short

• Organizers: when you finish the app's onboarding, CourtTable creates an anonymous account for you. There is no email address or password; the account lives on your device.
• Players: players are entries in the organizer's own player directory. They do not sign up, and we do not contact them.
• Public pages: every tournament and league has a public page (and a big-screen view) showing its title, date, venue, the players' names and photos, the pairings, scores and standings. Anyone with the link can see it.

3. The personal data we process

Organizer account

• An anonymous account identifier created by Firebase Authentication.
• The name you enter during onboarding, your preferred sport, and your country (taken from your device's region settings).
• Account metadata: when the account was created and last signed in, and whether you use iOS or Android.
• If you allow notifications: a push token for your device. The app uses notifications for match timers on your device; we do not currently send push messages.

Your player directory

• The players you add: name, gender (used by the mixed formats), country, and optionally a photo, email address, phone number and notes.
• The directory is private to your account. When you add a player to a tournament or a league, only their name, photo, country and gender are copied to it; the email address, phone number and notes stay in your directory.

Tournaments and leagues

• What you enter: titles, descriptions, dates, the venue, the sport, images, the format and its settings, the players and teams, scores and results.
• What CourtTable generates: pairings and rounds, standings, a results record for each finished tournament, and an activity log (for example who entered a score and when), which shows the name you entered during onboarding.
• This content is public: see "Public pages" below.

Plans and purchases

• Subscriptions and quick games are sold through the Apple App Store and Google Play and managed by RevenueCat, keyed to your anonymous account identifier. We receive which plans are active, the purchase and expiry dates, and transaction identifiers (to count quick games). We never receive card or payment details; Apple and Google process the payment.

Support requests

• When you contact us through the website's contact form or the app: your name, email address, subject, message, and any attachment you add.

Technical data

• The app looks up your approximate country from your IP address when it starts (see "Service providers"), to suggest a default country for new players. The result is kept on your device; only the country code you save with a player is stored.
• Our hosting providers keep standard server logs (IP address, request, time) for security and troubleshooting. When something fails on our server, an error report is emailed to us; it may contain your account identifier and the request that failed.
• On the website: usage and performance measurements, and, only if you accept analytics cookies, analytics as described under "Cookies and analytics".

4. Public pages

The point of CourtTable is that players and spectators can follow a tournament or league live. Tournament and league pages, and their big-screen views, are therefore public: anyone who has the link (or scans the QR code) can see them, and so can search engines if a link is published somewhere they crawl. They show the information listed under "Tournaments and leagues", including the players' names and photos.

As an organizer, only add players who agree to appear on a public page, and do not put information in titles, descriptions or player names that you would not want published. To take a page down, delete the tournament or league in the app, or email us.

5. Why we process your data (purposes and legal bases)

• Providing CourtTable to organizers — your account, directory, tournaments, leagues and plans: performance of a contract (GDPR Art. 6(1)(b)).
• Publishing tournament and league pages, including the players the organizer adds: the legitimate interests of the organizer, the players and spectators in following an event (Art. 6(1)(f)). Players can object at any time; see "Data about other people".
• Selling and honoring plans: performance of a contract (Art. 6(1)(b)), and legal obligations for accounting (Art. 6(1)(c)).
• Answering support requests: performance of a contract or legitimate interests (Art. 6(1)(b) and (f)).
• Security, abuse prevention and troubleshooting, including server logs and error reports: legitimate interests (Art. 6(1)(f)).
• Website usage and performance measurement without cookies (Vercel Analytics and Speed Insights): legitimate interests (Art. 6(1)(f)).
• Website analytics with cookies (Firebase Analytics, Hotjar): consent (Art. 6(1)(a)), which you can withdraw at any time in the cookie settings.
• Notifications on your device: your consent through the device permission (Art. 6(1)(a)).

We do not sell personal data, do not use it for advertising, and do not make automated decisions that have legal or similarly significant effects on anyone.

6. Service providers

We share personal data only with the providers below, who process it on our behalf or provide a service you use, and only as far as needed.

• Google Firebase (Authentication, Firestore, Realtime Database, Storage, Analytics) — our backend and database
• Fly.io — hosting for our server (Amsterdam region)
• Vercel — website hosting, Vercel Analytics, Speed Insights and bot protection
• RevenueCat — plans and purchases
• Apple App Store and Google Play — app distribution and payments
• Expo — issues the push token for your device
• geolocation-db.com — the app's approximate country lookup (receives your IP address)
• Google Workspace (Gmail) — our support mailbox
• Resend — delivers error reports from our server to us
• Hotjar — website behavior analytics, only after analytics consent

We may also disclose personal data where the law requires it, to enforce our terms, to protect the rights, safety or property of CourtTable or others, or as part of a merger or acquisition, subject to appropriate safeguards.

7. Cookies and analytics

The website asks for your choice in a cookie banner with two categories:

• Necessary — remembers your cookie choice and keeps the site secure. Always on.
• Analytics — Firebase Analytics and Hotjar load only if you accept analytics. Declining keeps them off and clears their cookies. You can change your choice at any time with "Cookies Settings" at the bottom of every page.

Vercel Analytics and Speed Insights measure page views and performance without cookies and run regardless of the banner. The apps use no analytics or advertising SDKs.

8. Your data-protection rights

Wherever you live, you have the right to access, correct, erase, restrict and receive a copy of your personal data, to object to processing based on legitimate interests, and to withdraw consent at any time.

Most of this you can do in the app: edit your profile, players, tournaments and leagues, or delete them. To delete your account, open the Menu tab, tap your name and choose Remove account (see https://www.courttable.com/delete-user). Because your account is anonymous, we can only identify it from its content — for example a link to one of your tournaments — so include one when you email support@padelfast.com about your data.

We answer within one month. If you are in the EU/EEA you may also complain to a supervisory authority; ours is the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY), and you can also contact the authority where you live.

• Integritetsskyddsmyndigheten (IMY)

9. US state privacy disclosures

For residents of California and other US states with comprehensive privacy laws: in the last 12 months we have collected identifiers (an anonymous account identifier, push token, IP address), the names and optional contact details organizers enter for their players, commercial information (plan status and purchase records), internet activity on the website, approximate location (country), and photos organizers upload. We use them for the purposes above and disclose them only to the service providers listed. We do not sell personal information or share it for cross-context behavioral advertising, so there is nothing to opt out of. You have the rights to know, delete, correct and port your data, and we will not treat you differently for using them. To make a request, email support@padelfast.com or use https://www.courttable.com/contact.

10. How long we keep data

• Account, directory, tournaments and leagues: until you delete them, or your account. Deleting your account removes your profile and sign-in straight away; tournaments, leagues and directory entries are removed when you delete them first, or when you ask us.
• Purchase records: as long as Swedish accounting law requires (7 years).
• Support emails: as long as needed to handle the request.
• Server logs and error reports: for a limited period, for security and troubleshooting.
• Website analytics: according to each provider's settings.

11. International data transfers

CourtTable is operated from Sweden. Our Realtime Database is hosted in the EU (europe-west1) and our server in the Netherlands. Some providers, including Google, Vercel, RevenueCat, Apple, Expo, Resend and Hotjar, may process data in the United States or elsewhere outside the EU/EEA. Where they do, we rely on the European Commission's Standard Contractual Clauses or an adequacy decision such as the EU–US Data Privacy Framework. You can ask us for a copy of the safeguards.

12. How we protect your data

Data is encrypted in transit, our database rules limit your account's data to your account, and only what public pages show (tournaments, leagues and their results) can be read without signing in. No system is perfectly secure; if a breach affects you, we will tell you as the law requires.

13. Data about other people

Organizers enter information about their players. If you do, you confirm that you may share it with us and that the players know their name and photo will appear on public tournament and league pages. We process this data to run the organizer's events, on the basis of the organizer's and the players' legitimate interests.

If you are a player and want your details removed from an organizer's tournaments or leagues, ask the organizer, or email support@padelfast.com with a link to the page and we will remove or anonymize them.

14. Children's privacy

The CourtTable app is for organizers aged 13 or older, or older where the law in your country sets a higher age for using online services. Organizers who add players under 16 to a public tournament or league should have a parent's or guardian's permission. If you believe a child's data is on CourtTable without that, email support@padelfast.com and we will remove it promptly.

15. Changes to this policy

We may update this policy. When we make material changes we will update the effective date above and, where appropriate, tell you in the app.

16. Contact us and governing law

• GAVA Group AB
• Email: support@padelfast.com
• Web: https://www.courttable.com/contact

This policy is governed by the laws of Sweden and applicable EU law, including the GDPR, without prejudice to any mandatory rights you have under the laws of your country of residence.