Privacy Policy

We collect the following personal data when you use MatchPoint:

• Account data: name, email address, username
• Phone number: your mobile number, verified with a one-time SMS code before your first court booking. It is never shown on your profile or to other players.
• Profile data: sport preferences, skill level, bio, city
• Location data: GPS coordinates (only when you enable nearby player search)
• Match data: challenge history, results, ELO ratings
• Booking data: court reservations and payment confirmations
• Messages: direct messages and match chat with other players
• Lessons and coaching: lesson requests, lesson chats and the lessons you schedule with a coach; if you coach on MatchPoint, your coach profile, teaching hours, students and calendar, and any documents you send us to be verified (see section 4)
• Training records: what a coach records about the lessons they give you: drills, minutes, results, goals, a player card with ratings, and the coach's own notes (see section 4)
• Device data: FCM push token for notifications
• Usage data: app interactions for improving the service

Your data is used exclusively to provide the MatchPoint service:

• Matchmaking: helping you find and challenge nearby players
• Rankings: calculating and displaying ELO ratings
• Court booking: processing reservations, sending confirmations, and giving the club a number to reach you about your booking
• Lessons: letting you ask a coach for a lesson and agree a time, and letting coaches plan, schedule and record their lessons, send their students a plan or a recap, and keep their phone's calendar up to date
• Notifications: alerting you to challenges, messages, bookings and lessons, and reminding a coach to record a lesson after it ends
• Safety: enforcing community guidelines, resolving disputes, and preventing fake bookings: a court can only be booked from an account with a verified mobile number

We do not use your data for advertising or sell it to third parties.

We share limited data only as required to provide the service:

• Other players: your name, ELO rating, and city are visible based on your privacy settings. Match results are shared with your opponents. Your phone number is never shown to other players.
• Clubs: when you book a court, the club receives your name and verified mobile number so it can contact you about that booking. Where a club manages its courts in its own booking system (for example Book+Play), we enter these details into that system as part of your reservation. The club handles them under its own privacy policy.
• BulkGate (TOPefekt s.r.o., Czech Republic, EU): sends the SMS containing your verification code. It receives only your phone number and that message.
• Supabase: our database and auth provider (servers in EU region).
• Firebase: push notification delivery via Google Firebase Cloud Messaging.
• Stripe: payment processing for court bookings (we never store card data).
• AppsFlyer: attribution for invite links, so the coach or club who introduced you to MatchPoint is credited. It receives a device identifier and app install/open events — never your name, email address or phone number. It is not used for advertising, and we do not collect an advertising ID.

We never sell your personal data to third parties.

Coaching on MatchPoint is optional. It starts when you ask a coach for a lesson, accept a coach's invitation, or join a coach's group session.

• What your coach sees: your name and profile, your lessons with them and your lesson chat. Your match history and ratings only if you accept the coach's request to see them, which you can withdraw at any time.
• What your coach records: a coach can write down the lessons they give you: drills, minutes and results, goals, a player card with ratings, and private observations. You see the results, goals and player card in the app when your coach shares them with you. The coach's private observations are seen only by the coach.
• Plans, recaps and reports: a coach can send you the plan for your next lesson or a recap of a lesson in your lesson chat. A recap includes your results only if your coach shares results with you, and never the coach's private notes. A coach can also share a monthly report as a link: it shows your first name only, never your opponents, and only the matches you agreed to share. The coach can withdraw the link.
• Group sessions: the coach sees who joined. Other players see only how many places are taken.
• Your notes after a match: what you note about a match you played is seen by the coaches you have accepted.
• Reviews: a review you write about a coach is shown on the coach's card with your first name.
• A coach's calendar: a coach can link their phone's calendar (for example Google or Apple Calendar) to their lessons through a private link. Their calendar app then holds their lesson times and their students' names. The coach can reset the link at any time.
• Coach verification: a coach who asks for the verified badge sends us a photo or PDF of their coaching diploma or licence, and may add a licence number and a note. The files are kept in private storage that only that coach and the MatchPoint team can open, and we delete them as soon as we approve or turn down the request, or the coach withdraws it. We keep only the outcome, its date and any reason we gave. The badge means we have seen the qualification; it is not a rating of the coaching.
• People who are not on MatchPoint: a coach can add a lesson with someone who has no MatchPoint account. We store only what the coach types (a name, the time and the place) in that coach's calendar, where nobody else sees it. Coaches should add only people who agree to it, and anyone can ask us to delete such an entry by writing to privacy@matchpointapp.gr.

When you delete your account, your lessons, lesson chats and everything a coach recorded about you are deleted with it. When a coach deletes their account, their students list, calendar, records and any verification documents are deleted too.

Your data is stored on Supabase servers with:

• Encryption at rest and in transit (TLS 1.3)
• EU-region hosting by default
• Row-level security policies restricting access
• Regular automated backups
• SOC 2 Type II certified infrastructure

Your phone number is kept in a separate table that only your own account can read. Verification codes are stored only in hashed form, and the record of codes we have sent, which we keep to prevent SMS abuse, is deleted after 40 days.

Location access is entirely optional and controlled by you:

• Only requested when you tap "Find nearby players"
• Used to surface players within your chosen radius
• Never shared with other users — they only see your city, not coordinates
• Can be revoked at any time in your device settings

As a user in the European Union or EEA, you have the following rights:

• Access: request a copy of all personal data we hold about you
• Rectification: correct any inaccurate information
• Erasure: delete your account and all associated data
• Portability: export your data in a machine-readable format
• Restriction: limit how we process your data
• Objection: object to specific processing activities
• Complaint: lodge a complaint with your local data protection authority

Exercise these rights by emailing privacy@matchpointapp.gr.

MatchPoint is intended for users aged 16 and over. We do not knowingly collect personal data from children under 16. If you believe a child has created an account, please contact us immediately at privacy@matchpointapp.gr and we will delete the account.

A coach may add lessons with junior players who have no MatchPoint account. As section 4 explains, we then store only the name the coach types, the time and the place, in that coach's calendar.

The MatchPoint mobile app does not use cookies. On the web version, we use only technically necessary session tokens. We do not use advertising cookies, and we do not collect an advertising ID on either platform.

The app does use one attribution tool, AppsFlyer, for a single purpose: recognising which invite link brought you to MatchPoint, so that the coach or club who invited you is credited. It is never used to profile you or to target advertising.

If we make material changes to this policy, we will notify you via push notification and/or email at least 14 days before the changes take effect. Continued use of MatchPoint after that date constitutes acceptance of the updated policy.

MatchPoint is operated from Athens, Greece (EU).

For privacy requests or questions about your personal data, contact privacy@matchpointapp.gr.

• Response time: within 30 days (GDPR requirement)