Privacy Policy

Introduction

GoRacquet ("we," "our," or "us") respects your privacy and is committed to protecting your personal data. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use the GoRacquet mobile application and related services (collectively, the "Service").

GoRacquet is a marketplace for social racket-sport sessions — badminton, pickleball, tennis, squash and padel. Players use it to discover and join sessions near them; organisers use it to list sessions and manage attendance. Because the Service connects people who then meet in person, some of the information you provide is visible to other users by design. This policy explains exactly which.

Information We Collect

Personal Information You Provide

• Account Information: Email address, password, full name, phone number
• Profile Information: Profile picture (avatar), gender (optional), city, and whether you host sessions as an organiser
• Sporting Information: The racket sports you play, your self-declared skill level in each, and any external rating you choose to add (for example a UTR, DUPR, BWF or club ranking)
• Content Data: Sessions you create as an organiser — title, description, venue, court details, cost, date and time — along with any court photographs you upload
• Ratings and Feedback: Star ratings, tags and written comments you leave for an organiser after attending their session
• Participation Data: The sessions you join, waitlist, cancel or attend, and organiser check-in records
• Safety Reports: When you report a session, a review or a user — the reason you choose, anything you write, and what you reported
• Your Block List: The accounts you have blocked. The person blocked is never told, and never sees the list

Authentication and Account Creation

You can create a GoRacquet account using one of the following methods:

• Email/Password Registration: Sign-up with your email address and a password you create
• Sign in with Google: Authentication using your Google account. We receive your name, email address and profile picture from Google. We never receive your Google password

Authentication is handled by Supabase Auth. Passwords are stored only as salted cryptographic hashes and are never visible to us. Additional sign-in providers may be added over time, and this policy will be updated when they are.

Location Information

Location is central to the Service, so we are specific about it:

• Device location (not stored): With your permission, the app reads your device's position once in the foreground to centre the map on you or to pre-place a venue pin. This reading is used on your device and is never written to your profile, never stored on our servers, and never shared with other users. If you decline the permission, the app asks you to set a search area manually instead.
• Your discovery area (stored, private): You tell us where you want to search from, in one of two ways — by dragging a pin on a map and choosing a radius, or by selecting a suburb from our list and setting a maximum travel distance. Suburb matching measures from the suburb's centre point, not from you. We never ask for or store your home address, and we do not track your live position. Your discovery area is private to your account and is never shown to other users.
• Venue locations (public): Courts and venues are public places. Their addresses and map positions are visible to anyone browsing the Service.

Automatically Collected Information

• Device Information: Device type, operating system and version, app version, platform
• Push Notification Token: An Expo push token identifying your device installation, so we can deliver notifications you have opted into
• Technical Data: IP address, request logs, session information and error/crash reports generated when the app communicates with our servers
• Usage Data: Which features are used and how the Service performs, used in aggregate to fix bugs and prioritise improvements

How We Use Your Information

We use your personal data to:

• Provide the Service: Create and manage your account, show you sessions, and let you join, waitlist and cancel
• Match Sessions to You: Use your discovery area, chosen sports and skill levels to decide which sessions are relevant
• Enable Hosting: Let organisers publish sessions, manage capacity and waitlists, and record attendance
• Send Notifications: Alert you about new sessions in your area, waitlist promotions, session reminders, and — for organisers — joins, cancellations and daily recaps, all subject to the preferences you set
• Build Trust: Display organiser ratings so players can judge a session before joining
• Improve the Service: Analyse usage patterns, fix bugs, develop new features
• Communications: Send service-related emails such as sign-up confirmation, password reset and support responses
• Keep People Safe: Review reports of objectionable content, harassment or unsafe behaviour, act on them — including removing content and suspending or banning accounts — and enforce the blocks you set
• Security: Detect and prevent fraud, abuse and security threats
• Legal Compliance: Comply with applicable laws and regulations

What Other Users Can See

Some information is public by design, because the Service only works if players can see who is hosting and who is attending. The following is visible to other users of the Service:

• Your name, profile picture, city and gender as shown on your profile
• The sports you play, your skill levels and any external ratings you have added
• Ratings and comments you leave, which are attributable to you rather than anonymous
• Sessions you host, including the description, venue, cost and photographs you upload
• Images you upload (avatars and court photographs), which are served from public URLs and can be viewed by anyone holding the link, including after they are removed from the app

Sessions You Join Are Not Public

Joining a session does not publish your name to the other players in it. Someone viewing a session sees how many people are attending and a row of avatars showing a single first initial each — and nothing else. Your full name, profile, sports, skill level and phone number are not attached to that list, and there is no identifier in it that can be used to look you up.

The organiser of that session is the exception: they can see the full roster of who has taken a place, because they have to run the session and check people in. See "Your Phone Number" below for the contact details that go with that.

The following is private to your account and is never shown to other users:

• Your email address and password
• Your discovery area — your pin, radius, suburb and travel distance
• Your notification preferences and notification inbox
• Your device push tokens
• Reports you file — the person or session reported is never told who reported them
• Your block list — someone you block is not notified and cannot tell that you have blocked them

Your Phone Number

Your phone number is treated separately from the rest of your profile and is not public. It is stored apart from your public profile details, and access is enforced by our database rather than by the app, so it cannot be read by simply querying our servers.

Exactly two parties can see it:

• You, at any time
• The organiser of a session you have taken a place in — so they can reach you about that session

An organiser sees your number only while you actually hold a place. Being on a waitlist is not enough, and if you cancel your place, the organiser loses access to your number again. No other player, no organiser you have not signed up with, and no unauthenticated visitor can retrieve it. Organisers can read your number but can never change it.

Organisers may use your number only to contact you about the session you joined — never for marketing or any other purpose. See our Terms of Service.

Data Storage and Security

Storage Locations

• Application Data: Stored in a managed PostgreSQL database hosted by Supabase in the Sydney, Australia region
• Images: Profile pictures and court photographs are stored in Supabase Storage buckets
• Authentication Data: Managed by Supabase Auth; passwords stored as salted hashes only

Security Measures

• All data transmissions are encrypted using industry-standard TLS
• Data is protected at the database level by row-level security policies, so each request can only reach the rows that account is entitled to
• Private tables — discovery areas, notification preferences, notifications and device tokens — are readable only by their owner
• Passwords are salted and hashed; we never store or transmit them in plain text
• Access to production systems is restricted and credentials are held outside the application code

No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

Data Sharing and Disclosure

We do not sell, rent, or trade your personal information. We may share your data only in these limited circumstances:

With Other Users

As described in "What Other Users Can See" above.

Service Providers

We rely on the following providers to operate the Service. Each processes data only as needed to provide their function:

• Supabase: Database, authentication, file storage and server-side functions (data hosted in Sydney, Australia)
• Expo: Push notification delivery and application build/update services
• Apple Push Notification service and Google Firebase Cloud Messaging: Underlying delivery of push notifications to your device
• Google Sign-In: Optional authentication, where you choose it
• Google Maps (Android) and Apple Maps (iOS): Rendering maps and displaying venue positions. Map providers may receive technical data such as your IP address when map tiles are loaded, under their own privacy policies
• Email delivery provider: Sending transactional email such as confirmations and password resets

Legal Requirements

We may disclose your information when required by law, legal process, or to protect the rights, property or safety of GoRacquet, our users, or the public.

Your Privacy Rights

All Users

• Access: Request copies of your personal data
• Correction: Update or correct inaccurate information, most of which you can edit directly in the app
• Deletion: Request deletion of your account and associated data
• Portability: Request your data in a portable format
• Objection: Object to certain data processing activities
• Notification Choices: Turn off any category of notification in the app's notification settings at any time, and revoke location or notification permissions in your device settings

To exercise any of these rights, contact us at the address in "Contact Us" below. We will respond within the timeframes required by applicable law.

Australian Residents (Privacy Act 1988)

• We handle personal information in accordance with the Australian Privacy Principles
• You may request access to, and correction of, the personal information we hold about you
• If you believe we have breached the Australian Privacy Principles, you may complain to us using the contact details below. If you are not satisfied with our response, you may complain to the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au

EU and UK Residents (GDPR)

• Legal Basis: We process data to perform our contract with you (providing the Service), on the basis of your consent (location access, push notifications, optional profile fields), and for our legitimate interests (security, abuse prevention, service improvement)
• Withdrawal: Withdraw consent at any time where processing is based on consent
• Supervisory Authority: Right to lodge a complaint with your local data protection authority

California Residents (CCPA/CPRA)

• Categories of Data: See "Information We Collect" above
• Right to Know: Details about data collection, use and sharing practices
• Right to Delete: Request deletion of personal information
• No Sale or Sharing: We do not sell or share personal information as those terms are defined under the CCPA/CPRA
• Non-Discrimination: We will not discriminate against you for exercising your rights

Data Retention

You can delete your account at any time from Profile → Delete my account in the app, which takes effect immediately, or by emailing privacy@goracquet.app if you have uninstalled the app or cannot sign in. Deletion is permanent — we do not retain a copy that can be restored.

• Account Data: Retained while your account is active. In-app deletion removes it immediately; an emailed request is actioned within 30 days of us verifying it
• Session and Participation Data: Your registrations, and every session you hosted — past and upcoming — are deleted with your account. Deleting the sessions you hosted also removes the attendance records attached to them, so they stop counting towards other players' session totals
• Sessions You Host: Any upcoming session you host is cancelled as part of the deletion, and the players holding a place or waiting on one are notified. Those cancellation notices are kept so they still arrive after your account is gone
• Ratings and Comments: Ratings you left for organisers are deleted with your account
• Safety Reports: Reports you filed are deleted with your account. Reports other people filed about you are kept, no longer linked to your account, so that a moderation decision does not disappear when the account behind it does
• Your Block List: Blocks are deleted as soon as either account is deleted
• Images: Avatars and court photographs are deleted with your account. Copies previously downloaded or cached by others are outside our control
• Notification Data: Push tokens are removed when you sign out of a device or delete your account
• Technical Logs: Server and error logs are retained for a limited period for security and debugging
• Legal Requirements: Some data may be retained longer where required by law

Full detail, including how to request deletion without the app, is on our Account Deletion page.

Children's Privacy

GoRacquet is not intended for children under 16 years of age. We do not knowingly collect personal information from children under 16. If you believe we have collected information from a child under 16, please contact us immediately and we will delete it.

International Data Transfers

Your data is stored in Australia. Some of our service providers — including push notification, authentication and map providers — operate internationally, so your information may be processed in other countries. Where that happens, we take reasonable steps to ensure appropriate safeguards are in place to protect your data.

Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by:

• Posting the updated policy at our published policy address
• Sending notification through the Service
• Email notification for significant changes

Your continued use of the Service after changes become effective constitutes acceptance of the updated policy.

Contact Us

For questions, concerns, or requests regarding this Privacy Policy or your personal data:

Email: privacy@goracquet.app

Support: support@goracquet.app

Operated by: Oscar Lau (sole trader), Victoria, Australia

Additional Information

Cookies and Tracking

The GoRacquet mobile app does not use advertising or tracking cookies, and does not use third-party advertising identifiers or cross-app tracking. Authentication tokens are stored locally on your device so you stay signed in.

Third-Party Links

The Service may contain links to third-party websites, including venue websites. This Privacy Policy does not apply to third-party sites, and we are not responsible for their privacy practices.

Business Transfers

In the event of a merger, acquisition, or sale of assets, your personal information may be transferred as part of the transaction, subject to the same privacy protections.

This Privacy Policy is effective as of the date stated above and applies to all information collected by GoRacquet.