Privacy Policy

CourtMate LLC ("Courtmate," "we," "us," or "our") operates the Courtmate platform — the website at courtmate.net, the player and facility-admin web and mobile apps, and related APIs and services (together, the "Services"). This Privacy Policy explains what information we collect, how we use and share it, and the choices you have.

Courtmate is a technology platform that connects players with independent sports facilities (the "Facilities"). When you book, pay, or join a program through Courtmate, the Facility is a separate business with its own privacy practices. This Policy covers Courtmate's handling of your information; it does not cover what a Facility does with information once we share it with them.

By using the Services, you agree to this Privacy Policy. If you do not agree, please do not use the Services.

1. Information We Collect

1.1 Information You Provide

• Account information: name, email address, phone number, a password (stored only as a salted bcrypt hash — never in readable form), and an optional profile photo and player tag
• Profile information: sport preferences, skill level, and similar details you choose to add
• Booking and activity information: reservations, program and event sign-ups, lesson bookings, tournament registrations, match results, and check-in records
• Membership and wallet information: Facility memberships, subscription status, prepaid credit balances, and promo codes you redeem
• Communications: in-app messages, waivers you accept, and the content of support requests and feedback

1.2 Payment Information

Payments are processed by Stripe, Inc. When you add a payment method or make a purchase, your card details are collected and processed directly by Stripe under Stripe's privacy policy. Courtmate never receives or stores your full card number. We retain only limited, non-sensitive billing references from Stripe (such as card brand, last four digits, a customer identifier, and charge records) to show your billing history and process refunds.

1.3 Information Collected Automatically

• Device and connection data: IP address, device type, operating system, and browser type
• Device identifier: we use FingerprintJS, a third-party service, to generate a device/visitor identifier on each request, which we use to detect and prevent fraud and abuse and to help keep accounts secure. We do not use it for advertising or cross-site behavioral tracking
• Usage data (product analytics): we use PostHog, a third-party analytics service, to collect information about how you use the Services — pages and screens viewed, features used, and in-app events such as starting a facility setup, viewing a checkout, or joining a waitlist. This may be associated with your account identifier and a first-party analytics identifier stored on your device. We use it solely to understand and improve the Services — not for advertising and not to profile you across other companies' sites or apps
• Error and diagnostic data: when something goes wrong, we send error reports to Sentry, our error-monitoring provider, which may include your account identifier and email so we can diagnose the problem
• Approximate location: inferred from your IP address

1.4 Precise Location (With Permission)

If you grant permission, the player app uses your device's location to show nearby Facilities and improve search. You can turn this off in your device settings; some location features may then be limited.

1.5 Cookies and Similar Technologies

Courtmate uses an essential session cookie — an httpOnly, SameSite=Lax cookie that keeps you signed in and is required for the Services to function — and a first-party analytics identifier (a cookie and/or browser local storage entry set for our PostHog analytics, described in Section 1.3) used to recognize your device across visits to our Services only. We do not use advertising cookies, web beacons, pixel trackers, or any analytics that profile you across other companies' sites. Because we do not perform cross-site tracking, our Services do not respond differently to browser "Do Not Track" signals.

1.6 Information From Facilities (Member Migration)

A Facility may import an existing member roster into Courtmate from a prior system (for example, a CSV of names and emails). We process that data on the Facility's behalf to create or invite member accounts. If you receive an invitation to claim a Courtmate account, the Facility provided your contact information; you control whether to claim it. We do not collect information from social-media accounts, and Courtmate does not offer social-media login.

2. How We Use Your Information

• Provide the Services: manage your account; process reservations, lessons, programs, and tournament registrations; facilitate payments, memberships, credits, and refunds; and deliver confirmations, reminders, and account notices
• Enable communication: route in-app messages and send transactional emails about your account and activity
• Maintain security and prevent fraud: authenticate you (including optional two-factor authentication), detect abuse, and protect the platform and its users
• Support you: respond to inquiries and resolve disputes
• Improve the Services: understand how features are used and develop new ones
• Send optional marketing: only where permitted; you can opt out at any time
• Comply with law: meet legal, tax, and accounting obligations and enforce our Terms

We do not sell your personal information, and we do not use it for third-party behavioral advertising.

2.1 SMS and Text Messaging

If you add your mobile phone number to your account and opt in, Courtmate may send you SMS text messages — including one-time account verification codes and tournament match notifications (for example, "you're up on Court 3 vs Jane Doe").

• Consent: You opt in by adding your mobile number in your Courtmate account settings and requesting a verification code ("Verify by text"). Tournament match alerts are sent only to participants who have added and verified a mobile number this way. We only text numbers that a user has entered themselves, and consent is not a condition of purchase. See our SMS Program page for full details.
• No sharing of mobile information: We do not sell, rent, or share your mobile phone number or your SMS opt-in consent with third parties or affiliates for their own marketing or promotional purposes. Your mobile number is used only to deliver the messages described above and is disclosed only to our SMS delivery provider (Twilio) for the sole purpose of sending those messages on our behalf.
• Message frequency: Message frequency varies based on your account activity and the tournaments you register for.
• Rates: Message and data rates may apply.
• Opt-out: You can opt out at any time by replying STOP to any message, or reply HELP for help. Opting out of SMS does not affect transactional emails or in-app notifications.

3. How We Share Your Information

3.1 With Facilities

When you book with, register at, or join a Facility, we share the information that Facility needs to provide the service — typically your name, contact details, relevant booking and registration details, payment status, waiver status, and check-in records. The Facility uses that information under its own privacy practices.

3.2 With Service Providers (Sub-processors)

We share information with vendors who process it on our behalf, under contracts limiting them to providing services to us:

• Stripe — payment processing, payouts, subscriptions (payment method, billing and transaction data)
• MongoDB Atlas — database hosting (stored account and activity data)
• DigitalOcean — application and server hosting
• Sentry — error monitoring and diagnostics (account identifier, email, error context)
• PostHog — first-party product analytics (usage events, pages/screens viewed, account identifier, device/browser type)
• FingerprintJS — device identifier for fraud and security (device/browser signals)
• Email delivery provider — transactional and optional marketing email (email address, message content)

3.3 With Other Users

If you participate in shared activities — group programs, open play, or tournaments — your name, and where relevant your skill level and results, may be visible to other participants and to the Facility. Messages you send are visible to their recipients.

3.4 For Legal Reasons

We may disclose information when we believe in good faith it is necessary to comply with law, regulation, legal process, or a government request; to enforce our Terms; to detect or prevent fraud or security issues; or to protect the rights, property, or safety of Courtmate, our users, or the public.

3.5 Business Transfers

If Courtmate is involved in a merger, acquisition, financing, or sale of assets, your information may be transferred as part of that transaction. We will require the recipient to honor this Policy or notify you of any material change.

4. Calendar Feeds

If you enable a calendar feed, we generate a private iCalendar (.ics) URL containing a secret token. Anyone with that URL can view the associated schedule, so treat it like a password. You can regenerate or disable the feed in your settings.

5. Data Retention

We keep your personal information for as long as your account is active and as needed to provide the Services. After your account is closed, we delete or de-identify your personal information within a reasonable period, except where we must keep it longer to comply with legal, tax, or accounting obligations (financial and transaction records are typically retained for the period required by law), resolve disputes, enforce our agreements, or maintain security and prevent fraud. You can request deletion at any time.

6. Security

We use administrative, technical, and physical safeguards designed to protect your information, including:

• Encryption in transit: all data transmission is encrypted using TLS
• Password protection: bcrypt hashing — we never store readable passwords
• Two-factor secrets: encrypted at rest where enabled
• Access controls: employee and contractor access to personal data is limited
• Payment security: card processing is delegated to Stripe, a PCI-DSS Level 1 certified provider, so raw card data never touches our servers

No method of transmission or storage is perfectly secure, so we cannot guarantee absolute security. If we become aware of a breach affecting your personal information, we will notify you and the appropriate authorities as required by law.

7. Your Choices and Rights

• Access and update: view and edit most profile information in the app's settings (some changes, such as legal-name changes, are subject to limits described in the Terms)
• Delete your account: request deletion in-app or by contacting us, subject to the retention exceptions above
• Marketing communications: opt out of promotional emails via the unsubscribe link or notification settings; you cannot opt out of transactional messages while you have an account
• Location: control precise location via your device settings
• Notifications: control in-app and email notification preferences in settings

7.1 U.S. State Privacy Rights

Depending on your state of residence (for example, California, Virginia, Colorado, Connecticut, and Utah), you may have the right to know and access the personal information we collect, correct inaccurate information, delete your information, obtain a portable copy, and not be discriminated against for exercising these rights.

We do not "sell" your personal information and we do not "share" it for cross-context behavioral advertising as those terms are defined under the California Consumer Privacy Act (as amended by the CPRA) or similar laws, so there is no need to opt out of such activity. To exercise any of these rights, contact us at privacy@courtmate.net. We will verify your request (typically by confirming control of your account email) and respond within the time required by law (generally 45 days). You may use an authorized agent where the law allows.

8. Children's Privacy

The Services are not directed to children under 13, and we do not knowingly collect their personal information. If you believe a child under 13 has provided us information, contact us at privacy@courtmate.net and we will delete it. Users between 13 and the age of majority should use the Services only with the involvement of a parent or guardian, and a Facility may require a parent or guardian to sign a waiver for a minor to participate.

9. International Users

Courtmate operates in the United States, and we store and process information in the United States. The Services are intended for users in the United States. If you access them from elsewhere, you do so on your own initiative and understand your information will be processed in the United States.

10. Third-Party Links and Services

The Services may link to third-party sites or services (including Facilities' own sites and Stripe) that we do not control. This Policy does not apply to them; review their privacy policies before providing information.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will post the updated version with a new "Last Updated" date and, for material changes, provide additional notice (such as an in-app notice or email). Your continued use of the Services after an update takes effect means you accept the revised Policy.

12. Contact Us

Questions, concerns, or requests about this Policy or your information: