Privacy Policy

Account information

• Email address, used to sign you in and to send service messages.
• Full name, shown to other members of groups you join.
• Profile picture, if you upload one.
• Gender and preferred court side, used for display and for generating matches.
• Display preferences: language, date format, time format, light or dark appearance, and your profile banner colour.

How you sign in

You can sign in with an email address and password, with Google, or on iOS with Apple. When you use Google or Apple, we receive your email address and name from them so we can create your account. We never receive your password for those accounts. If you use Apple's private email relay, the relay address is all we ever see.

Group and gameplay data

• Which groups you belong to, your role in each, and the order you arrange them in.
• Your rating in each group, and the history of changes to it.
• Any per-group overrides you set, meaning a nickname and a preferred side that apply inside one group only.
• Sessions you sign up for, withdraw from, or join a waitlist for.
• Matches you play, who you played with and against, and reported scores.
• League and tournament entries, teams, fixtures, and results.
• Friend requests and friendships.
• Notifications created for you, and which ones you have read.
• Your notification mute settings for each group.

Mobile app data

• Push notification tokens. If you allow notifications, we store a token for each device along with the platform and device name, so we can send you session and match alerts. Signing out removes that device's token, and you can turn notifications off at any time in your device settings.
• Local storage. Your login session is kept on the device so you stay signed in.
• Crash reports. The apps send crashes and errors to Sentry so we can fix them. A report can include the type of error, where in the app it happened, your device model, your operating system version, and the app version. These reports are hosted in the European Union.

Payment data

If your group buys Wymatch Pro, Stripe processes the payment. We never see or store your card number.We keep a Stripe customer reference, the identifiers of the checkout session and payment, the amount and currency contributed, and which member contributed it, so the group's wallet balance and contribution history can be shown.

Technical data

Our hosting and database providers process standard technical information such as IP address, browser or device type, and request logs, in order to serve the application and protect it from abuse. We do not use any of this to build advertising or marketing profiles.

What we do not collect

• We do not collect your location. Location access is blocked at the browser level and the apps never request it.
• We do not use advertising or cross-site tracking, and we share nothing with advertisers.
• We do not store your payment card details.
• When you search for a venue, what you type goes to Google Places to fetch suggestions. We store only the resulting place identifier, never a street address or coordinates.

• Provide, maintain, and improve the service.
• Sign you in and keep you signed in.
• Generate balanced match pairings from skill ratings.
• Calculate and update ratings after matches, leagues, and tournaments.
• Show leaderboards, statistics, and history inside your groups.
• Send notifications you have opted into, including push notifications.
• Take payment for Wymatch Pro and keep a group's contribution history.
• Detect and prevent abuse, and apply rate limits.
• Diagnose crashes and errors.
• Answer your support requests.

Automated processing

Wymatch works out player ratings from reported results and uses them to suggest pairings. This is a convenience for organising recreational sport. It produces no legal effects and is not used to make decisions about you outside the app. A group administrator can adjust a rating by hand, and every change is recorded in your rating history.

If you are in the European Economic Area or the United Kingdom, we rely on these lawful bases under the GDPR.

• Performance of a contract. Running your account, group membership, sessions, matches, ratings, and payments for Pro.
• Legitimate interests. Keeping the service secure, preventing abuse, applying rate limits, diagnosing crashes, and improving the product. We weigh these against your rights.
• Consent. Push notifications, and access to your photo library or camera if you choose to upload a picture. You can withdraw consent at any time in your device or account settings.
• Legal obligation. Keeping transaction records where tax or accounting law requires it.

On the website we use two kinds of storage.

• Authentication cookies keep you signed in securely. These are set by Supabase.
• Preference storage remembers your cookie choice and your display settings.

We use no cookies for advertising, tracking, or analytics. Every cookie we set is needed for the service to work. In the mobile apps the same information lives in the app's own local storage rather than in cookies.

Inside a group

Members of a group can see your name, or your per-group nickname if you set one, your profile picture, your rating in that group, your sign-ups, and the matches and results you took part in. Administrators can also adjust your rating and remove you from the group.

Friends and other players

Players can search by name or email to send a friend request. Your profile is visible to people you share a group with, and to people whose friend request you have accepted.

Anyone holding an invite link

We do not sell your personal information. These providers process it for us, and only for the purposes listed.

Stripe collects your card details directly and acts as its own controller for payment data. We may also disclose information where the law requires it, to enforce our terms, or to protect our users.

Everyone

• View and edit your profile in account settings.
• Change your notification settings for each group or each device.
• Leave any group at any time.
• Delete your account from the settings page in either app.

If you are in the EEA or the UK

• Access to your personal data.
• Correction of data that is wrong.
• Erasure, sometimes called the right to be forgotten.
• Portability of your data.
• Restriction of processing.
• Objection to processing based on legitimate interests.
• Withdrawal of consent, without affecting anything done before.

You can also complain to your local data protection supervisory authority.

If you live in California

• Know what personal information is collected and how it is used.
• Delete personal information.
• Correct personal information that is wrong.
• Opt out of sale or sharing, though we do neither.
• Not be treated differently for using these rights.

To use any of these rights, email privacy@wymatch.com. We reply within one month, as the GDPR requires, and will tell you if a complex request needs longer.

We keep your information for as long as your account is active.

• Notifications. Read notifications are deleted automatically after 60 days. Friend request notifications are kept, because they record a connection between two people.
• Payment records. Kept for as long as tax and accounting law requires, including after account deletion.
• Match and rating history. Kept with the group it belongs to, anonymised as described below.

When you delete your account

Deletion happens straight away rather than on a delay. We anonymise rather than fully erase, so that the shared history of groups you played in still makes sense for their other members.

We permanently delete:

• Your name and email address, which are replaced with placeholders.
• Your profile picture files, which are removed from storage.
• Your push notification tokens, so no device receives anything further.
• Your notifications.
• Your session sign-ups.
• Your friendships and friend requests.
• Any group where you were the only member.

We keep, no longer linked to anyone identifiable:

• Matches you played in and their results, shown against a placeholder name.
• Group membership and rating history, so other members' records stay intact.

We use appropriate technical and organisational measures to protect your information from unauthorised access, alteration, disclosure, or destruction.

Transport and network

• All traffic is encrypted with HTTPS. Strict Transport Security is set with a two-year max-age and preloading, so browsers always connect over HTTPS.
• A strict Content Security Policy limits which scripts, styles, and resources the browser will load, which reduces the risk of cross-site scripting.
• The referrer policy is set to strict-origin-when-cross-origin, so URL details do not leak to other sites.

Application

• Endpoints that change data check that the request came from the same host.
• The app cannot be embedded in a frame on another site.
• Browsers are told not to guess file types, which blocks MIME sniffing attacks.
• Camera, microphone, and location access are disabled at the HTTP header level.
• Sensitive endpoints are rate limited for each account.

Database

• Row Level Security is enforced inside the database, so an account can only read or write the records it is allowed to.
• Sensitive operations such as joining a group run through server-side functions that check permission, rather than trusting the app.
• Data is stored encrypted at rest.
• All database access is parameterised, which prevents SQL injection.

No system can be perfectly secure. If a breach affects your personal data, we will tell you and notify the relevant authority where the law requires it.

Children

Wymatch is not meant for children under 13, and we do not knowingly collect their information. In the European Economic Area and the United Kingdom you need to be at least 16, or the lower minimum age your country sets. If you are a parent or guardian and think your child has given us personal information, email us and we will delete it.

International transfers

Some providers are based outside your country, including in the United States. Where personal data leaves the European Economic Area or the United Kingdom, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses or an adequacy decision. Write to us if you want details of those safeguards.

Changes to this policy

We may update this policy. The updated version appears on this page with a new date at the top. If a change materially affects how we use your personal data, we will tell you in the app or by email before it takes effect.

Contact

For any question about this policy, our data practices, or your rights, write to William Hsia, [REGISTERED ADDRESS], or email privacy@wymatch.com.

See also our Terms and Conditions.