Privacy Policy

Effective date: 2026-05-07. Version 1.0 (draft, pending counsel review).

MatchPickle (“MatchPickle,” “we,” “us”) operates the MatchPickle mobile application (the “App”) that helps adult pickleball players find local games. This Privacy Policy explains what information we collect, how we use it, who we share it with, and the choices you have about your data.

13+ only. The App is intended for users aged 13 and older. We verify age at signup using a date-of-birth gate. Because we do not knowingly collect personal information from children under 13, the U.S. Children’s Online Privacy Protection Act (COPPA) does not apply to us. If we learn that we have collected information from a child under 13, we will delete it promptly. See “Children’s policy” below for details.

1. Information we collect

1.1 Profile information you provide

Account credentials — email address and password (passwords are hashed; we never see them in plaintext).
Profile fields — handle, display name, optional pronouns, birthdate (used only for the 13+ age gate; the actual date is stored on your profile but never shown to other players), self-reported skill tier, optional DUPR ID.
Profile photo — uploaded image, resized client-side and stored in our private profile-photos bucket.

1.2 Activity information

Games you host or join, including court, format, time window, skill range, and roster slot status.
In-app chat messages sent on game threads you are a participant in.
Reports and blocks you submit through the trust & safety flows.

1.3 Location

Approximate device location — when you grant the OS-level location permission, we use your coarse coordinates to center the courts map and surface nearby games. We never write your precise GPS coordinates to our servers; the location stays on your device and is only used to query for courts within a radius.

1.4 Push tokens and device information

Expo push token — issued by Apple Push Notification service / Firebase Cloud Messaging through Expo Notifications, stored against your account so we can send game reminders and chat notifications.
Device + OS version — captured automatically with crash reports (e.g., “iPhone 15, iOS 18.1”) so engineers can reproduce bugs.
App version + build number sent with every API request so we can gate breaking changes.

1.5 Crash and analytics data

Unhandled crashes and JS errors — captured via Sentry. Stack traces, breadcrumbs from React Navigation, and device metadata are included; we strip personal identifiers before send.
Funnel events — six lightweight event counters (signup completed, profile created, game hosted, game joined, chat message sent, push notification opened). Payloads contain only opaque IDs; no email, no handle, no token, no message body.
Opt-out: Settings → Privacy → “Share crash + analytics” can be turned off at any time. When off, crash reports and event counters stop sending.

2. How we use your information

To operate the core MatchPickle features (showing courts, hosting and joining games, chat, notifications).
To verify that you are at least 13 years old.
To send transactional notifications (game reminders, roster changes, chat messages).
To diagnose and fix bugs and crashes.
To enforce our Terms of Service, including detecting abuse and acting on user reports.

We do not sell your personal information. We do not run third-party advertising inside the App. We do not use your data to train machine-learning models.

3. Data retention

Profile data — kept while your account is active. When you delete your account in Settings, your profile row, photo, and game-roster entries are deleted within 30 days.
Chat messages — kept for the lifetime of the game thread; deleted when the game itself is deleted, or anonymized to a tombstone if the sender deletes their account.
Push tokens — deleted when you sign out or revoke notification permission.
Crash and analytics data — retained by Sentry per their default 90-day window, then purged.
Backups — encrypted database backups are retained for 7 days, after which they roll off automatically.

4. Third-party processors

We rely on a small set of vendors to actually run the service. They process the data we send them, on our behalf, under data-processing agreements:

Supabase — Postgres database, authentication, file storage, realtime channels, edge functions. Hosts profile data, game data, chat messages, and profile photos.
Mapbox — map tiles for the courts map. Receives only the bounding box of the map view, not your exact coordinates.
Sentry — crash reporting and error tracking. Receives stack traces, breadcrumbs, and device metadata when a crash occurs and you have not opted out.
Expo Push Service (Apple Push Notification service / Firebase Cloud Messaging) — push notification delivery. Receives the push token and the notification body for messages we send to you.

5. Your rights and choices

Access and export — email privacy@matchpickle.app and we will send you a copy of the personal data on your account within 30 days.
Correction — edit your profile fields directly in the app.
Deletion — Settings → Delete account triggers a server-side delete that removes your profile, photo, push token, and game-roster entries. The action is confirmation-gated (you must type your handle to confirm).
Opt out of analytics — Settings → Privacy → “Share crash + analytics” toggle.
Notifications — Settings → Notifications, or revoke the OS-level permission at any time.

6. Children’s policy

MatchPickle is for users aged 13 and older. At signup we ask for your date of birth and block account creation if you are under 13. We do not knowingly collect personal information from children under 13, and we are therefore not subject to COPPA. If you believe a child under 13 has created an account, contact privacy@matchpickle.app and we will delete the account and associated data promptly.

A separate minors flow with parental consent is being designed for a future release; until it ships, the 13+ rule is enforced at signup with no exceptions.

7. Security

All traffic between the App and our servers is encrypted in transit (TLS 1.2+). Passwords are hashed using bcrypt by Supabase Auth. Profile photos are stored in private buckets with row-level security policies that restrict reads to authenticated participants of the relevant game. We follow the principle of least privilege for service credentials and rotate them on a regular schedule.

8. International users

MatchPickle is operated from and hosted in the United States. If you use the App from outside the U.S., your data will be transferred to and processed in the U.S. The pilot market for the App is the Salt Lake City metro area; expansion to additional regions will be reflected in a future version of this policy.

9. Changes to this policy

If we make material changes to this Privacy Policy, we will notify you in the App before the change takes effect. Non-material changes (typo fixes, vendor name updates) may be published without notice; the “Effective date” at the top of this page is always current.

10. Contact

Questions, requests, or complaints? privacy@matchpickle.app.