Privacy Policy

1. What we collect — and how long we keep it

Data category	What & why	Retention
🟢 Anonymous device ID	A random UUID generated locally (e.g. anon_3f2a-...). Lets us count your check-in once without knowing who you are.	Forever (until you uninstall or clear browser data)
🟢 Geolocation (precise)	Your phone's GPS, used only to detect "are you within 150m of a court right now?" Used in browser memory; never transmitted as raw lat/lng.	In-memory only, discarded after each read. Last-known stored on your device for fast app open.
🟢 Court check-in events	(court_id, anonymous_device_id, timestamp). Drives the live "X playing now" count.	90 minutes hard expire on our server. After that, only an aggregate count remains.
🟢 Aggregate stats	Per-court daily/hourly counts. ZERO identifiers — just (court, date/hour, count).	Indefinite (used for "busy times" trends)
🟡 IP address & device-type metadata	Captured by hosting providers (Netlify, Supabase) and Google Analytics in standard server logs. Used for spam protection and aggregate usage stats.	Netlify: ~30 days · Supabase: ~30 days · Google Analytics: anonymized at collection, expires per Google's defaults (~14 months)
🟡 Anonymous page-view counts	Google Analytics 4 with privacy-first config: IPs anonymized, ad personalization disabled, Google Signals disabled, cross-site tracking disabled.	14 months (GA4 default)
🔴 Things we explicitly DO NOT collect	Name · email · phone · photo · login credentials · contact list · location history · payment info · biometric data · health/fitness · browsing history · ad identifiers · in-app messages

2. CCPA / CPRA categories of personal information

Under California law, here's what we collect by category:

🟢 Identifiers	Anonymous device UUID + IP address (anonymized by GA4)
🟢 Geolocation data (SENSITIVE — see §4)	Precise GPS, used in-browser only for proximity check; never persisted
🟢 Internet/network activity	Anonymous page-view events via Google Analytics 4
🔴 All other CCPA categories	NOT COLLECTED (no name, contact, financial, biometric, health, professional, education, inferences, or sensitive demographic data)

3. Who we share with — and who we DON'T

🟢 We do NOT sell, rent, share, or trade your personal information. Ever. For any reason.

We use a small number of service providers ("processors") to make the app work. Each is bound by their own privacy policy and only processes the minimum data required:

Service	Purpose	What they see
🟢 Supabase	Stores anonymous check-ins for cross-device sync	Anonymous UUID, court ID, timestamp, IP (for spam protection)
🟢 Netlify	Web hosting	IP, browser type (standard server logs)
🟢 Google Analytics 4	Anonymous traffic counts	IP (anonymized), page URL, browser type. NO ad personalization, NO Google Signals, NO cross-site tracking.
🟢 Esri (satellite map tiles)	Loads map background imagery	IP (per-tile request — same as any web map)
🟢 OpenStreetMap	Place-name labels overlay	IP (per-tile request)

We do NOT use: ad networks, behavioral ad tech, social media SDKs, fingerprinting libraries, session-replay tools, CRM systems, or any service that re-identifies users across apps or websites.

3b. Map data attribution

The Pickleball NOW map is powered by satellite imagery and place-name labels licensed from third parties. Per their terms of use, we credit them here:

• 🟢 Satellite imagery: Powered by Esri. Tiles © Esri — Source: Esri, Maxar, Earthstar Geographics, and the GIS User Community.
• 🟢 Place-name labels: © OpenStreetMap contributors. Distributed under the Open Database License (openstreetmap.org/copyright).

We hide the in-map credit overlay to keep the map view clean. The required attribution lives here per Esri's data attribution guidelines and OSM's tile usage policy.

4. Sensitive personal information — geolocation

Under California's CPRA (and several other state laws), precise geolocation is classified as Sensitive Personal Information (SPI).

We collect precise geolocation only to provide the core service: detecting that you're physically at a public pickleball court so we can count you in the live "X playing now" total. We do NOT use your location to:

• 🔴 Build a movement profile
• 🔴 Infer demographics, health, religion, sexual orientation, or political affiliation
• 🔴 Make automated decisions about you
• 🔴 Sell, share, or transfer to data brokers
• 🔴 Train AI models
• 🔴 Target ads

You may limit our use of your sensitive personal information to only what's necessary to provide the service. → Limit Use of My Sensitive PI (or just turn off "Auto check-in" — same effect).

5. Do not sell or share my personal information

We do not sell your personal information for money, and we do not share it for cross-context behavioral advertising. There is nothing to opt out of — but California, Colorado, Connecticut, and several other states require us to provide the link anyway.

→ Do Not Sell or Share My Personal Information

6. Global Privacy Control (GPC) — universal opt-out signal

If your browser sends the Global Privacy Control (GPC) signal, we automatically treat that as a "do not sell or share" request — even though we don't sell or share anything. We also disable Google Analytics for that session.

Detecting your GPC signal …

GPC is recognized as a valid opt-out signal under California (CCPA/CPRA), Colorado (CPA), Connecticut (CTDPA), Texas (TIPA), and Oregon (OCPA) — among others. Learn more at globalprivacycontrol.org.

7. Your rights — by state

For all US residents (regardless of state), you can:

• 🟢 Access what we have about you (it's just a UUID + check-in timestamps — visible in your browser DevTools at localStorage.playlocal_anon_id_v1)
• 🟢 Delete all of it instantly: uninstall the app, or clear browser site data for playlocalgame.com
• 🟢 Opt out of "auto check-in" anytime via the toggle in the header. App still works as a court directory.
• 🟢 Submit a request to jeff@playlocalgame.com. Response within 45 days.
• 🟢 Non-discrimination — exercising any right does not affect your access to the app

🇺🇸 California (CCPA / CPRA)

You have the right to: know what we collect (§2 above), delete it, correct it, opt out of sale/share (we don't sell — see §5), limit use of sensitive PI (§4), data portability, and non-discrimination. We honor verifiable consumer requests within 45 days. Contact: jeff@playlocalgame.com.

Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), Utah (UCPA), Texas (TIPA), Oregon (OCPA), Iowa (ICDPA), Tennessee (TIPA), Indiana (INCDPA), Montana (MTCDPA), Delaware (DPDPA), New Jersey (NJDPA), New Hampshire (NHPA), Maryland (MODPA), Minnesota (MCDPA), Nebraska (NDPA), Rhode Island, Kentucky

If you're a resident of any of these states, you have the same core rights: access, delete, correct, portability, opt-out of sale/share/profiling/targeted-ads (we do none of these), and consent to use of sensitive data (geolocation — see §4). Email jeff@playlocalgame.com with your state and request type. We respond within 45 days (90 days if extension is needed under your state's law).

All other states

If your state has not yet passed a comprehensive privacy law, we voluntarily extend the same California-level rights to you. The contact and process are the same.

8. EU / EEA / UK residents (GDPR / UK-GDPR)

Pickleball NOW is currently distributed only in the United States and Canada. If you have installed via a workaround:

• 🔴 We are not yet GDPR-compliant for EU/EEA operation
• 🟡 We collect anonymous device IDs which under strict GDPR reading may be considered pseudonymous personal data
• 🟢 EU users should not use the app until v1.1, which will include a full EU consent flow
• 🟢 To request deletion of any local check-in record, email jeff@playlocalgame.com with your anonymous device ID (visible in DevTools → localStorage → playlocal_anon_id_v1)

9. Children's privacy

🟢 Pickleball NOW is intended for users age 13 and older.

We do not knowingly collect personal information from children under 13 (under COPPA in the US) or under 16 (under CPRA / VCDPA / GDPR). If you are a parent or guardian and believe your child has used the app, contact us at jeff@playlocalgame.com and we will delete any associated data within 30 days.

Note: because we collect no name, no email, no login, and no contact information, we have no practical way to identify a user as a child unless the parent contacts us. We rely on the 13+ age statement and parental supervision.

9b. User-submitted content (court corrections)

The "Submit a correction" feature lets you email us about courts that need updates (added, removed, fixed). Submissions go directly to our email — they are NOT posted publicly inside the app. We manually review every submission within 24 hours before any change is made to the court database. We do not host any user-generated comments, posts, photos, or chat — there is no community feed and no public messaging.

10. Security

All data in transit is encrypted via HTTPS / TLS 1.2+. Supabase enforces row-level security so anonymous users can only modify their own check-in rows. We do not store passwords because we do not have logins. We do not store payment information because the app is free.

No security system is perfect. If you discover a vulnerability, please report it responsibly to jeff@playlocalgame.com.

11. Changes to this policy

If we make material changes (collecting new types of data, adding new processors, or changing how data is shared), we will:

• 🟢 Update the "Effective date" at the top of this page
• 🟢 Bump the version number
• 🟢 For significant changes, post an in-app banner for at least 7 days before the change takes effect

12. Contact us

Data controller: PlayLocal Sports LLC, a Delaware limited liability company

Email: jeff@playlocalgame.com

Postal mail: Available upon email request

For California residents: you may also designate an authorized agent to make a request on your behalf. We will verify the agent's authorization before responding.