Privacy Policy

Draft — not yet in force

What we collect

Account. Your email address and a password (we store only a hash of the password), or, if you sign in with Google, the name and email address Google shares with us. Your account has a unique identifier we use internally.
Profile. Your first and last name, the positions you play, your skill level, and, only if you enter it, your phone number. Later, a profile photo if you upload one.
Games and bookings. The games you book, join a waitlist for, attend or cancel; the games and organizations you host and their rosters; the rinks you save.
Payments. When you pay for a game, Stripe collects your card details directly. We receive and keep only references: a Stripe customer identifier, a payment-method identifier with the card brand and last four digits so you can recognise a saved card, and the record of each charge and refund. We never see your full card number.
Location. If you allow it, your browser shares your device's location so we can show games near you. We use it for that search and do not keep a history of where you have been. Addresses you type into the rink finder are sent to our geocoding provider to be turned into map coordinates.
Consents. When you accept these policies or turn on text messages we record what you agreed to, when, and the version of the text you saw.
Technical. Server logs (the pages and API calls your browser made, your IP address, browser type and timestamps) kept for a short time to run and secure the Service.

How we use it

To run the Service: sign you in, show you games, take and refund payments, keep rosters, and tell hosts who is coming.
To send you messages you have asked for: booking confirmations, waitlist and seat-hold notices, cancellations and refunds by email, and by text message only if you opted in.
To keep the Service safe: detecting abuse, enforcing our Terms, and investigating problems.
To meet legal obligations, such as keeping payment records.

We do not sell your information and we do not use it for advertising.

We share information only with the providers that run parts of the Service, and only what each needs:

Stripe — payments, saved cards, refunds and host payouts.
Supabase — sign-in and the database that stores your account and bookings.
Render — the servers that run the Service.
Resend — sends our emails to you.
Twilio — sends text messages, only if you opted in.
Geoapify — turns addresses you type into map coordinates.
OpenFreeMap — serves the map tiles your browser displays; your browser requests them directly, so that provider sees your IP address.

Hosts and other players see your name, positions and skill level on the rosters of games you join, and hosts see whether you confirmed attendance. Your email address and phone number are never shown to other users.

We may also disclose information if the law requires it, or to protect the rights and safety of our users and the Service.

Cookies and local storage

We use only what is needed to keep you signed in and to make the pages work: a session stored by your browser and small settings such as your theme choice. We do not use advertising or analytics cookies, and no third-party tracking scripts run on the Service. Because of this there is no cookie banner to accept.

Your choices

Notification preferences. In Settings you choose whether to receive text messages and which kinds of notices you want. Text messages are off unless you turn them on; you can turn them off at any time, or reply STOP to any message.
Your profile and saved cards. You can change your profile, remove saved cards and remove saved rinks in Settings.
Connected sign-in. You can connect or disconnect Google sign-in in Settings, as long as you keep at least one way to sign in.
Deleting your account. You can delete your account from Settings. Deletion is immediate and cannot be undone. If you have an upcoming booking, or you are the only owner of an organization with an upcoming game, we ask you to cancel those first. When you delete your account we remove your name, email address, phone number and other profile details, your sign-in identities, your saved cards and rinks, and your notification preferences; we delete your sign-in at our identity provider and your customer record at Stripe. We keep records of past bookings, payments and refunds, roster entries and the fact that you accepted these policies, with your personal details removed, because hosts, Stripe and the law need them. Anywhere those records appear you are shown as "Deleted player".
Access and correction. Everything we hold about you that you can see is in Settings and your bookings. If you want a copy of your data or believe something is wrong that you cannot fix yourself, contact us.

Data retention

We keep your account information for as long as your account exists. Payment and booking records are kept for as long as accounting and tax rules require, including after you delete your account, without your personal details. Server logs are kept for a short period (weeks, not months) and then deleted. Consent records are kept for as long as we need to show that consent was given.

Children

The Service is for adults. You must be at least 18 to create an account, and we do not knowingly collect information from anyone younger. If you believe a child has created an account, contact us and we will delete it.

Changes

We may update this policy. When we do we change the version and effective date at the top of this page, and if the change is material we tell you by email or in the app before it takes effect.

Contact

Questions about privacy, or requests about your data, go to the support address on our Support page.