Privacy Policy

This policy explains what personal data we collect through the PadelGod app and website, why we use it, and what rights you have. We aim for full transparency and collect strictly what is needed to provide you the service.

1. Who we are (the data controller)

PadelGod is operated by TRK WEB DESIGN SRL, a Romanian company with its registered office at 1 Decembrie 1918 Street no. 49, building D23, entrance 1, apartment 19, Craiova, Dolj County, Romania, unique registration code 46287403, Trade Register no. J16/1470/2022. For any matter related to your data, you can contact us at contact@padelgod.ro.

2. What data we collect

• Account: email, name, and (optionally) profile photo, provided directly or received when you sign in with Apple or Google.
• Player profile: city, game preferences, level, preferred time, added by you.
• Phone number: provided by you to complete your account and, if you enable the option, for friend discovery (see section 4). Access to the full value is restricted to your account and the secure operations that require it.
• Contacts (optional): only if you enable friend discovery, numbers from your phone address book are turned into irreversible codes directly on your device and are not uploaded in plain text (see section 4).
• Location (optional): only if you grant permission and only on your phone, to show you open matches nearby. It is not tracked in the background and we do not build a history of your locations.
• Matches and bookings: scores, match history (padel or tennis), partners, booked club and court, date, time, duration, price, currency and booking status.
• Booking payments: technical Stripe transaction identifiers, payment status, amounts paid or refunded, currency, the applicable cancellation policy and information needed for fraud prevention and dispute handling. PadelGod does not receive or store the full card number or security code.
• Ranking data: for Ranked matches confirmed by all players, we keep the match score and the rating derived from it (see section 6).
• Safety and conduct data: the reports you send or receive, match attendance (no-show / early leave) and the fair-play score derived from them (see section 6.1).
• Activity and health data (HealthKit, on iOS): only with your explicit permission, heart rate, calories, and pace during the match, including from Apple Watch (see section 5). Health Connect is not active on Android yet and we do not collect health data through it.
• Service activity and communications: the last day you used the app, the platform used, when you last played padel or tennis, and your aggregate match cadence. For optional communications we keep your consent choice, prompt display and response, recommendation eligibility and reason, deduplication, suppressions/unsubscribe, and technical delivery status. We do not use this data for advertising.
• Uploaded images: avatars and post photos, together with the technical identifiers required for ownership, replacement, and secure delivery.
• Technical data: device tokens for notifications, plus minimal operational and security data.

3. How we use the data

• to provide you with matchmaking, tournaments, and score keeping;
• to show you your own statistics and match history;
• to calculate the competitive ranking, exclusively from matches confirmed by all players;
• to connect you with friends and playing partners;
• to initiate and reconcile a booking payment, confirm the booking after payment and manage cancellations, refunds, fraud and disputes;
• to send functional notifications about your account, matches, tournaments and bookings and, only according to your settings and consent, personalised recommendations to return to play; lifecycle email is sent only after explicit opt-in and you can unsubscribe at any time;
• to maintain security and prevent abuse.

We do not sell your data. App data is not used for advertising; optional campaign measurement on the website takes place only in accordance with your cookie choice.

4. Contact discovery (via hashing, not in plain text)

Finding your friends on PadelGod is optional and protected by design. Numbers from your phone address book are converted locally, on the device, into irreversible codes before syncing. The number added to your own profile is sent over an encrypted connection and protected by strict access rules; a separate hashed representation is used for matching. You can disable the option at any time, which removes synced hashes and the discovery code associated with your account.

5. Health data and Apple Watch (HealthKit)

If you grant permission, we read activity data (heart rate, energy, pace) during the match to display your statistics and fitness analysis. Detailed heart rate (second by second) is used only on your device and never leaves your phone.

If you optionally enable "Save fitness statistics" in Settings (off by default), we save to your account only aggregate values per match: average and maximum heart rate, calories, intensity score, and duration. We never save detailed heart rate. These aggregate data:

• are private by default, only you see them (history, records, weekly load);
• become visible to other players (as a summary) only if you separately enable "Show on public profile";
• are not used for advertising, marketing, or commercial analysis;
• are not shared with third parties and are not sold;
• are handled in accordance with Apple HealthKit requirements. You can stop saving at any time from Settings → Fitness and health, and HealthKit access from Settings → Privacy → Health, on iPhone.

6. The competitive ranking and data visible to other users

The app includes a competitive ranking (rating per discipline and a tier visible from 1 to 7). The ranking includes only competitive matches in which all players have a PadelGod account and all confirm the score in the app. For these matches we process:

• the confirmed match score and the team composition;
• the rating derived from results and the tier calculated from it, per discipline (padel or tennis, singles or doubles).

Your tier and ranking position are visible to other users in the ranking and on your public profile, together with your name and profile photo. The scores of confirmed Ranked matches are visible to the match participants. The self-declared level in your profile does not influence the rating.

6.1. Safety, reporting and fair play

To keep the community safe and trustworthy, we process some conduct-related data:

• Reports: when you report a player from a match, we keep the category, the optional description and the time, tied to that match. The reporter's identity is not revealed to the reported player.
• Fair-play score: we compute a score and a tier (badge) from match attendance and confirmed reports. On other people's public profiles only the tier is shown, never raw numbers or who reported.
• Restrictions: if a restriction is applied, we keep its type, reason, duration and any appeals, so we can enforce it correctly and re-review it on request.

We use this data only for community safety and abuse prevention (legitimate interest). We do not sell it or use it for advertising. You can appeal any restriction from the app.

7. Legal basis (GDPR)

• Performance of the contract - for the operation of the service and processing bookings requested by you;
• Consent - for phone, contacts, location, HealthKit, notification permission, and optional lifecycle email;
• Legitimate interest - for security, abuse and fraud prevention, dispute handling (including in the ranking), and improving the app.

8. Who we share the data with

• Supabase - our database and authentication provider (data processor, secure hosting).
• Stripe - processes booking payments, club-account onboarding, refunds, fraud prevention and disputes. Card details are provided directly to Stripe, not to PadelGod.
• The selected club - receives the data needed to provide the booking and is identified before payment as the provider and merchant of the booked physical service.
• Apple / Google / Firebase - for authentication, app distribution and notifications.
• Cloudflare - for form anti-spam protection (Turnstile) and for processing, private R2 storage, and controlled delivery of avatars and post photos.
• Vercel and Sentry - for website hosting, error diagnostics and technical security; diagnostic data is limited to what is needed to operate the service.
• Google Analytics / Tag Manager, Meta and TikTok - on the website only and only after you accept optional cookies, to measure traffic and campaigns. You can refuse them without losing essential functionality.
• Resend and email providers - for account messages, authentication, replies to forms you submit and, only after explicit consent, personalised lifecycle email. We retain the technical statuses needed for delivery, bounces, complaints, suppression, and unsubscribe.

9. Security

Data is transmitted encrypted (HTTPS) and protected by row-level access rules (Row Level Security) in the database, so that each user sees only what they are entitled to.

10. Retention and account deletion

We keep your data as long as you have an active account, so we can provide you with your history, statistics, and ranking. You can request account deletion directly from the app or from the public Delete account page. The account enters a 30-day period during which it is deactivated and hidden; if you sign in again within this interval, the deletion is canceled. After 30 days, the account and associated data are permanently deleted, except for payment, refund, fraud, dispute and financial-accounting records that we must retain by law or to establish, exercise or defend legal claims.

11. Your rights

You have the right of access, rectification, erasure, restriction, portability, and objection. You can write to us at contact@padelgod.ro. You have the right to lodge a complaint with the National Supervisory Authority for Personal Data Processing (ANSPDCP).

12. Where the data is hosted

Primary data is hosted in the European Union: Supabase in the Europe (Ireland) region, Cloudflare R2 in the Europe region, and the email service configured in an EU region. Some global providers may process limited technical data in other jurisdictions; where this occurs, we rely on applicable safeguards such as standard contractual clauses.

13. Minors

The service is not intended for children under 16 without the consent of their legal guardian.

14. Changes

We may update this policy. We will mark the date of the last update, and important changes will be announced in the app.

15. Contact

For any question related to your data: contact@padelgod.ro.