Privacy Policy

Padelfish ("we", "us", "our") operates the Padelfish mobile application for iOS and Android and the website at padelfish.com (collectively, the "Service"). This Privacy Policy explains what personal data we collect, why we collect it, how we use and share it, and your rights regarding that data. It applies to all users of the Service across all platforms (web, iOS, and Android).

By using the Service you agree to the collection and use of information in accordance with this policy. If you do not agree, please do not use the Service.

1.1 Account & Profile Data

When you sign in via Google, Apple, or email, our authentication provider Auth0 supplies the following data from your identity provider:

• Email address
• Full name (first name, last name)
• Profile photo URL (from Google or Apple)
• Auth0 user identifier

1.2 User-Generated Content

• Groups you create or join (group name, description, member list)
• Tournaments and match results (scores, rounds, player assignments)
• Profile and group photos you upload (stored as compressed images)
• Player statistics computed from match results

1.3 Device & Technical Data

• Push notification token (Expo push token) and device platform (iOS/Android)
• IP address (collected automatically by our hosting provider and font services during normal web requests)
• Web performance metrics (page views, Web Vitals) via Vercel Analytics — web only, no personally identifiable information

1.4 Payment Data

Payments for Padelfish Pro subscriptions are processed entirely by the Apple App Store or Google Play Store. We never receive or store your credit card number, bank details, or billing address. Our subscription management provider (RevenueCat) receives your anonymised app user ID and entitlement status — not your payment instrument details.

We do not use your data for advertising, profiling, or selling to third parties.

We rely on the following trusted third-party services to operate Padelfish. Each service processes data only for its stated purpose and is subject to its own privacy policy.

We do not sell, rent, or trade your personal data to any third party. Data shared with the services above is limited to what is required for their stated function.

We do not use tracking cookies, advertising cookies, or any third-party cookies for analytics or remarketing.

• All app data is stored in AWS DynamoDB in the EU West (Paris, eu-west-3) region, encrypted at rest using AWS-managed encryption keys.
• All data in transit is encrypted via HTTPS/TLS.
• Authentication tokens are validated server-side against Auth0 on every API request.
• Mobile credentials are stored in the device's secure hardware (iOS Keychain / Android Keystore).
• We do not store passwords — authentication is delegated entirely to Auth0 and your identity provider (Google, Apple, or email/OTP).
• Uploaded images (profile photos, group photos) are compressed and stored directly in the database — not in a public bucket or CDN.

Depending on your jurisdiction (including rights under the EU/EEA GDPR, UK GDPR, California CCPA, and other applicable laws), you may have the following rights:

• Access — Request a copy of the personal data we hold about you.
• Rectification — Ask us to correct inaccurate data (you can also update your profile directly in the app).
• Erasure — Request deletion of your account and associated data. See our Account Deletion page for instructions.
• Data portability — Request your data in a structured, machine-readable format.
• Restriction / Objection — Ask us to limit or stop processing your data in certain circumstances.
• Withdraw consent — Where processing is based on consent, you may withdraw it at any time (e.g., disable push notifications in your device settings).

To exercise any of these rights, contact us at hello@padelfish.com. We will respond within 30 days.

You can request permanent deletion of your account and all associated data at any time. To do so, email hello@padelfish.com or visit our Account Deletion page.

Upon deletion: your profile, owned groups, tournaments, match history, memberships, push tokens, and subscription records will be permanently removed. Payment records may be retained by Apple, Google, or RevenueCat as required by law (see Section 6).

The Service is not directed at children under the age of 16. We do not knowingly collect personal data from anyone under 16. If you believe a child has provided us with personal data, please contact us at hello@padelfish.com and we will promptly delete it.

Your data is primarily stored in the EU (Paris, France) on AWS infrastructure. Some third-party services (Auth0, Vercel, RevenueCat, Expo, Google AI) may process data in the United States or other jurisdictions. Where data is transferred outside the EU/EEA, it is protected by appropriate safeguards, including Standard Contractual Clauses (SCCs) or the service provider's participation in recognised data transfer frameworks (e.g., the EU-U.S. Data Privacy Framework).

We may update this Privacy Policy from time to time. When we do, we will revise the "Last updated" date at the top of this page. For material changes, we will notify you via an in-app notification or email. Continued use of the Service after changes constitutes acceptance of the updated policy.

If you have any questions about this Privacy Policy or our data practices, please contact us:

• Email: hello@padelfish.com
• Website: padelfish.com
• Account deletion: padelfish.com/delete-account

If you are in the EU/EEA and believe your data protection rights have not been addressed, you have the right to lodge a complaint with your local Data Protection Authority.