Privacy Policy

1. Who we are (the data controller)

PadelGod is operated by TRK WEB DESIGN SRL, a Romanian company with its registered office at 1 Decembrie 1918 Street no. 49, building D23, entrance 1, apartment 19, Craiova, Dolj County, Romania, unique registration code 46287403, Trade Register no. J16/1470/2022. For any matter related to your data, you can contact us at contact@padelgod.ro.

2. What data we collect

• Account: email, name, and (optionally) profile photo, provided directly or received when you sign in with Apple or Google.
• Player profile: city, game preferences, optional gender, Ranked sporting category (Men or Women), and preferred time, added by you. Ranked category is separate from gender and locks after your first ranked match; any later correction is audited.
• Phone number: provided by you to complete your account and, if you enable the option, for friend discovery (see section 4). Access to the full value is restricted to your account and the secure operations that require it.
• Contacts (optional): only if you enable friend discovery, numbers from your phone address book are turned into irreversible codes directly on your device and are not uploaded in plain text (see section 4).
• Location (optional): only if you grant permission and only on your phone, to show you open matches nearby. It is not tracked in the background and we do not build a history of your locations.
• Matches and bookings: scores, match history (padel or tennis), partners, booked club and court, date, time, duration, price, currency and booking status.
• Booking payments: when you pay at the club, PadelGod does not process the payment and keeps only its status, as the club marks it. Online payment for bookings is coming soon; once it starts, we will keep technical Stripe transaction identifiers, payment status, amounts paid or refunded, currency, the applicable cancellation policy and information needed for fraud prevention and dispute handling. PadelGod does not receive or store the full card number or security code.
• Ranking data: for Ranked matches confirmed by all players, we keep the score, Ranked sporting category and rating derived from the result (see section 6).
• Safety and conduct data: the reports you send or receive, match attendance (no-show / early leave) and the fair-play score derived from them (see section 6.1).
• Activity and health data (optional): on iOS, HealthKit can provide heart rate, calories, and pace during the match, including from Apple Watch. On Android, PadelGod does not request or read Health Connect. The PadelGod Wear OS app is not public yet; once it is available and you start fitness recording in it, the watch can provide the PadelGod session interval, duration, heart rate, and calories when its sensors make them available (see section 5). Recording starts only after your explicit action and the watch permissions you grant.
• Strava (optional): only if you connect it, we keep your Strava account identifier, your access tokens (encrypted) and the status of your shares. Details in section 5.1.
• Service activity and communications: the last day you used the app, the platform used, when you last played padel or tennis, and your aggregate match cadence. For optional communications we keep your consent choice, prompt display and response, recommendation eligibility and reason, deduplication, suppressions/unsubscribe, and technical delivery status. We do not use this data for advertising.
• Uploaded images: avatars and post photos, together with the technical identifiers required for ownership, replacement, and secure delivery.
• Technical data: device tokens for notifications, plus minimal operational and security data.

3. How we use the data

• to provide you with matchmaking, tournaments, and score keeping;
• to show you your own statistics and match history;
• to calculate the competitive ranking, exclusively from matches confirmed by all players;
• to connect you with friends and playing partners;
• to confirm and manage bookings: those paid at the club are confirmed at once, and for online payment, which is coming soon, we will initiate and reconcile the payment, confirm the booking after payment and manage cancellations, refunds, fraud and disputes;
• to send functional notifications about your account, matches, tournaments and bookings and, only according to your settings and consent, personalised recommendations to return to play; lifecycle email is sent only after explicit opt-in and you can unsubscribe at any time;
• to maintain security and prevent abuse.

We do not sell your data. App data is not used for advertising; optional campaign measurement on the website takes place only in accordance with your cookie choice.

4. Contact discovery (via hashing, not in plain text)

Finding your friends on PadelGod is optional and protected by design. Numbers from your phone address book are converted locally, on the device, into irreversible codes before syncing. The number added to your own profile is sent over an encrypted connection and protected by strict access rules; a separate hashed representation is used for matching. You can disable the option at any time, which removes synced hashes and the discovery code associated with your account.

5. Activity and health data (HealthKit and PadelGod on Wear OS)

On iOS, if you grant HealthKit permission, we read activity data (heart rate, energy, pace) during the match to display your statistics and fitness analysis. Detailed heart rate (second by second) is used only on your device and never leaves your phone.

If you optionally enable "Save fitness stats" in Settings → Connected apps → Apple Health (off by default), we save to your account only aggregate values per match: average and maximum heart rate, calories, intensity score, and duration. We never save detailed heart rate. These aggregate data:

• are private by default, only you see them (history, records, weekly load);
• become visible to other players (as a summary) only if you separately enable "Show fitness on my public profile";
• are not used for advertising, marketing, or commercial analysis;
• are not shared with third parties and are not sold;
• are handled in accordance with Apple HealthKit requirements. You can stop saving at any time from Settings → Connected apps → Apple Health, and HealthKit access from Settings → Privacy → Health, on iPhone.

On Android, PadelGod does not request or read Health Connect and does not import workouts from other phone apps. Fitness recording on Android will be available only through the first-party PadelGod Wear OS app, which is not public yet: after you start a session and grant the watch permissions, Health Services can provide duration and, when available, heart-rate and calorie measurements. The session is linked to your signed-in PadelGod account and is saved only when you explicitly choose to save it; you can also discard it. Any historical record already stored with a Health Connect source label remains labelled by its original source, but the current Android app does not import new Health Connect sessions. You can revoke the watch sensor permissions from the watch settings.

5.1. Strava (optional)

Strava is an optional integration. PadelGod sends nothing to Strava until you connect it yourself, from Settings → Connected apps → Strava. Without a connection, there is no link between your PadelGod account and Strava.

If you connect it, we send to Strava, for every match you share (manually or automatically):

• the activity title and sport type (padel or tennis);
• the start time and the duration of the match;
• the result and the score per set;
• your PGR rating, for Ranked matches, only if the option is on;
• average and maximum heart rate and calories, only if the option is on and you saved fitness data for that match;
• the club name, only if the option is on.

We never send the names of other players, contact details or locations other than the club name.

Strava access tokens are encrypted on our servers.

You can disconnect Strava at any time from Settings → Connected apps → Strava. Disconnecting revokes PadelGod's access to your Strava account and deletes the Strava tokens and identifiers we store. Activities already shared stay in your Strava account, where you manage them yourself.

Data received from Strava (activity identifiers, used for the "View on Strava" links) is kept for at most 7 days.

On Strava, Strava's privacy policy applies.

6. The competitive ranking and data visible to other users

The app includes an Overall skill and three distinct competitive ladders (Men, Women and Mixed), with a rating per discipline, a 1.0-7.0 PGR level and visible named levels. A match updates only its competitive context; Overall supports the estimate but never determines public position. It includes only competitive matches in which every player has an account, a Ranked sporting division and confirms the score. For these matches we process:

• the confirmed match score and the team composition;
• the rating derived from results, PGR level, named level and Ranked sporting category, per discipline (padel or tennis, singles or doubles).

Your PGR level, named level, Ranked sporting category and position are visible to other users in the ranking and on your public profile, together with your name and profile photo. Confirmed Ranked match scores are visible to participants. Optional profile gender is distinct and does not automatically set the category after it has been selected.

6.1. Safety, reporting and fair play

To keep the community safe and trustworthy, we process some conduct-related data:

• Reports: when you report a player from a match, we keep the category, the optional description and the time, tied to that match. The reporter's identity is not revealed to the reported player.
• Fair-play score: we compute a score and a level (badge) from match attendance and confirmed reports. On other people's public profiles only the level is shown, never raw numbers or who reported.
• Restrictions: if a restriction is applied, we keep its type, reason, duration and any appeals, so we can enforce it correctly and re-review it on request.

We use this data only for community safety and abuse prevention (legitimate interest). We do not sell it or use it for advertising. You can appeal any restriction from the app.

7. Legal basis (GDPR)

• Performance of the contract - for the operation of the service and processing bookings requested by you;
• Consent - for phone, contacts, location, HealthKit, optional fitness recording in the PadelGod Wear OS app (once it is available), notification permission, and optional lifecycle email;
• Legitimate interest - for security, abuse and fraud prevention, dispute handling (including in the ranking), and improving the app.

8. Who we share the data with

• Supabase - our database and authentication provider (data processor, secure hosting).
• Stripe - will process online booking payments, which are coming soon, together with club-account onboarding, refunds, fraud prevention and disputes. Card details will be provided directly to Stripe, not to PadelGod.
• The selected club - receives the data needed to provide the booking and is identified before you confirm the booking as the provider and merchant of the booked physical service.
• Apple / Google / Firebase - for authentication, app distribution and notifications.
• Cloudflare - for form anti-spam protection (Turnstile) and for processing, private R2 storage, and controlled delivery of avatars and post photos.
• Vercel and Sentry - for website hosting, error diagnostics and technical security; diagnostic data is limited to what is needed to operate the service.
• Google Analytics / Tag Manager, Meta and TikTok - on the website only and only after you accept optional cookies, to measure traffic and campaigns. You can refuse them without losing essential functionality.
• Apple Ads - in the iOS app, at the first launch, we ask Apple whether the install came from an Apple Ads ad and, if so, from which campaign, ad group and keyword. Apple answers without the advertising identifier and without cross-app tracking. We link the answer to your account only to measure which campaigns bring players; we look at the numbers only in aggregate.
• Resend and email providers - for account messages, authentication, replies to forms you submit and, only after explicit consent, personalised lifecycle email. We retain the technical statuses needed for delivery, bounces, complaints, suppression, and unsubscribe.
• Strava - only after you connect it yourself: it receives the activities you choose to share, with the data listed in section 5.1. Strava's own privacy policy applies on Strava.

9. Security

Data is transmitted encrypted (HTTPS) and protected by row-level access rules (Row Level Security) in the database, so that each user sees only what they are entitled to.

10. Retention and account deletion

We keep your data as long as you have an active account, so we can provide you with your history, statistics, and ranking. You can request account deletion directly from the app or from the public Delete account page. The account enters a 30-day period during which it is deactivated and hidden; if you sign in again within this interval, the deletion is canceled. After 30 days, the account and associated data are permanently deleted, except for payment, refund, fraud, dispute and financial-accounting records that we must retain by law or to establish, exercise or defend legal claims.

11. Your rights

You have the right of access, rectification, erasure, restriction, portability, and objection. You can write to us at contact@padelgod.ro. You have the right to lodge a complaint with the National Supervisory Authority for Personal Data Processing (ANSPDCP).

12. Where the data is hosted

Primary data is hosted in the European Union: Supabase in the Europe (Ireland) region, Cloudflare R2 in the Europe region, and the email service configured in an EU region. Some global providers may process limited technical data in other jurisdictions; where this occurs, we rely on applicable safeguards such as standard contractual clauses.

13. Minors

The service is not intended for children under 16 without the consent of their legal guardian.

14. Changes

We may update this policy. We will mark the date of the last update, and important changes will be announced in the app.

15. Contact

For any question related to your data: contact@padelgod.ro.