Privacy notice — Court Companion

Who is responsible

Court Companion is run by one person in the Netherlands rather than by a company. There is no legal form, no Chamber of Commerce registration and no VAT number, because there is no business to register. If that changes, this page changes with it.

That is the controller for everything described below, in the sense the General Data Protection Regulation gives the word. For anything to do with your data — a question, a request, a complaint — write to hello@courtcompanion.app. It reaches the one person who runs this. No postal address is published — the imprint says why, and how to ask for one.

No data protection officer has been appointed, and none is required. That obligation falls on public authorities and on organisations whose core activity is monitoring people on a large scale or handling special categories of data at scale. This is a tournament calendar, a trip planner and a shared-cost ledger, run by one person. If it ever stops being that, this line changes before the practice does.

What this notice covers

The Court Companion app on iOS and Android, the same app in a browser at courtcompanion.app, and the API behind both. That is the whole service. There is no separate marketing site, no second system holding a copy of anything, and no office network any of it passes through.

What we hold, and what it is for

Your email address and your name: So you can sign in, and so the players you travel with know who they are travelling with. Without these there is no account.
Your home town, and the point distances are measured from: Used to work out how far a tournament is from you and to sort a list by that. Setting up asks you for it: you search for your town or your address, and of an address only its town and its point are kept — the street is never kept. Before you search, the app offers the town Cloudflare’s network guesses from your connection, stored only if you pick it. Other players are shown your town and nothing more, and you can change it afterwards.
Your player page on itftennis.com, and what it says about you: Setting up asks you for the link to your page, because your ranking and your results come from there. Our server reads the page, not your device. From it and from the ITF’s answers about it we keep your name as the page writes it, whether it lists you as a man or a woman — which says whether you play men’s or women’s doubles — your beach tennis ranking and points, and how far you got in the tournaments of the past year. The partners and opponents it lists are never kept. Other players are shown your name and a link to your page.
The tournaments you enter and the entries you make: Which events you are going to, and the partner you entered with. Your partner sees the entry, because it is as much theirs as yours.
Your trips, and everything in them: Flights, stays, stops and dates. The players on a trip with you, whether you invited them or not, see its tournaments and the stays put there for everyone. Only you see your travel, your notes and a stay you put there for yourself alone.
Messages you send other players: Kept so a conversation is still there when you come back to it. We do not read them, unless a conversation is reported: then the last 20 messages the reported player sent in it are kept with the report, for us to read.
Players you block: Kept so that neither of you can write to the other, or see the other’s partner calls, requests or profile, until you unblock them. They are not notified, and their copy of their data does not say who blocked them. Blocking a player also removes her from your players, and you from hers, and removes any request to add one another.
Players you add, and requests to add you: The list of players you have added is kept, with how you came to be connected (a request they accepted, a code scanned on court, a link, or having played together) and the date. It is kept for as long as you both remain on the app and until either of you removes the other. Players who have played together, or have a partner request between them that was accepted, are connected without a further step. A request to add a player is kept until it is answered or taken back. If a player does not accept, she is not told: you keep seeing the request as waiting, and you can take it back. When you delete your account, or a player does, the connection and the requests between you are removed at once. A block removes the connection and any request between you. Your copy of your data lists the players you added and the requests you sent; it does not list the players who added you or the requests sent to you.
Your code and your link: When you open My code, a code is made that other players can scan, or open as an address, to be connected to you. It stops working after 15 minutes, and a new one is made when you open the page again. The link you can share instead works for 14 days and is the same each time you share it, until its last day, when a new one is made. Whoever opens either while signed in becomes one of your players; neither shows anything about you before it is opened but your name. They are removed when you delete your account.
Who can find you, and who sees your calls: You choose who can find your profile by name: everyone on the app, only the players you have added, or nobody. Your name, country and ranking show in search and in suggestions to those who may find you; a player you have blocked, or who has blocked you, never finds you. Searching for a name needs at least two letters, shows at most ten players and is limited to a number of searches a minute. You choose separately whether your new partner calls are shown to everyone who could answer them or only to the players you have added, and you can change that for each call when you post it. Being kept from search does not hide your calls, and keeping a call for your players does not hide your profile.
Players you report: Kept so that we can read it: the reason you gave, your own words if you wrote any, and when. A report made from a conversation keeps what is said under “Messages you send other players”. A report made from a player’s profile keeps what the profile showed you — the name, the home town and country, the side and languages, the link to the ITF page, the photo and which video — as it was when you reported. A moderator is shown that video for as long as its player keeps it. The reported player is not told, and their copy of their data does not hold the report. It is removed when either of the two accounts is deleted.
Expenses, splits and settlements: What a trip cost, who paid, and who still owes whom. Visible to the other members of that shared-cost group and to nobody else.
Payment handles — an IBAN, a Pix key, a UPI id, a PayPal, bunq or Revolut name: Shown to the other members of a shared-cost group so they can pay you back directly. Shown to no one else, and used by us for nothing.
Your IPIN licence number: Asked of every player when setting up, because it is what a partner needs to enter the two of you in a tournament. You can change it, not remove it. Only players you have partnered with or entered alongside can see it, and you can see that list and revoke any of it.
An avatar, if you upload one: Stored as a file in our own object storage and served from there.
A video of you playing, if you choose to add one: One clip of at most 30 seconds and a still from it, chosen and made smaller on your device before it is sent, kept as two files in our own object storage and served from there. The players who can open your profile can watch it: everyone when you let everyone on the app find you, and otherwise only the players you have added. You choose this under Privacy. It is on none of the web pages anyone can read without signing in, and a moderator can watch it when a report about your profile showed it. It is removed when you replace it, remove it or delete your account, and your copy of your data lists it.
Push notification tokens and your notification preferences: The token identifies a device, not a person, and exists so a notification can reach the right phone or browser.
Error reports: When something crashes, the stack trace and what the app was doing. Deliberately stripped of who it happened to — see below.
Your position, if you turn it on: When you turn on “Use my location on Today”, your phone tells Court Companion where it is while Today is open, to within about a hundred metres, so Today can tell when you are at the airport you fly from, the airport you landed at, or the venue you play at. The position is sent with the request for Today, used to decide what is next, and then dropped. We do not store it, we do not write it to logs, and we do not count it in our usage statistics. We never read your position in the background.

The legal ground for each of those

Performing our contract with you (Article 6(1)(b)) covers your account, your entries, your trips, your messages and the shared-cost ledger, and what setting up asks of you: your player page and what it says about you, your IPIN and your home town. They are the service; without them there is nothing to use.
Your consent (Article 6(1)(a)) covers push notifications. They are offered, not required, and withdrawing your consent is a switch in the app rather than a request to us.
Your consent (Article 6(1)(a)) also covers your position. It is offered, not required: Court Companion works without it and Today then goes by the clock. You give it by allowing location on your phone or in your browser and turning on “Use my location on Today”, and you withdraw it by turning that switch off, or by blocking location for Court Companion in your phone’s or browser’s settings. Either stops it at once.
Our legitimate interests (Article 6(1)(f)) cover keeping the service standing up, preventing abuse of it, and fixing what crashes. We have weighed that against your interests by holding as little as the job allows: the error reports carry no identity, and the usage counts carry nothing that points at a person.

Cookies, and the banner you will not see

One cookie. It is called better-auth.session_token — prefixed __Secure- in production — it lasts 30 days, it is httpOnly so no script can read it, and it is SameSite=Lax so another site cannot make your browser send it. It carries your session and nothing else.

It is strictly necessary in the sense Article 5(3) of the ePrivacy Directive means — Article 11.7a of the Dutch Telecommunications Act, the Telecommunicatiewet — because it does nothing but deliver the thing you asked for, which is being signed in. A cookie like that needs no consent. So there is no consent banner on this service, because there is nothing to ask you about.

There is no analytics cookie, no advertising cookie and no consent cookie. There is no third-party script anywhere in the app, no tag manager, and no content delivery network in front of it. The typefaces the app uses are bundled inside it, and the front page loads its own from this site, so no font is fetched from Google or anyone else. Map tiles come from OpenStreetMap, but our server asks for them rather than your device, and keeps each for a week: OpenStreetMap learns which parts of the world were asked for, never who asked.

What we count

One row is written when a screen is built. It contains, in full: the word screen_view, which screen it was, which platform asked for it, which language it was rendered in, and which version of the app asked — plus how many milliseconds it took and how many database queries it cost.

One row is written when a device leaves the question about notifications unanswered. It contains, in full: the words push_prompt_unanswered, which platform it was, which language and which version of the app. It tells us when that question is being missed.

That is the whole of each row. There is no user id, no email address, no IP address and no session id in either, and nothing else is joined to them later. They can tell us that a screen is slow, that nobody opens it, or that a question goes unseen. They cannot be reassembled into one player’s path through the app, because the thing that would connect two rows to the same person is not written down.

Who else touches it

These are our processors: they act on our instructions and for no purpose of their own. Each is listed with what it actually receives, rather than with what it is capable of receiving.

Cloudflare: Hosts the whole service: the code, the databases, the files and the email that carries your sign-in code. Its network also supplies the rough location we offer you at sign-up, worked out from your connection rather than from your device. If you turn on “Use my location on Today”, your position reaches our servers there for the length of that one request, and is passed on to nobody else.
Sentry: Receives the app’s error reports. Configured not to attach personal data to them — no email, no IP address, no request body — so a report says what broke and not who it broke for.
AeroDataBox, through RapidAPI: Receives a flight number and a date when you add a flight to a trip. Nothing else, and nothing about you.
Firebase Cloud Messaging, by Google: Delivers the notifications you turn on, to a phone and to a browser alike. Turning them on for a device registers it with Google, and from then on Google receives that device's token and the text of each notification we send there. Your device's own push service carries it the last step: Apple's for an iPhone and Safari, Mozilla's for Firefox, Microsoft's for Edge, and Google's again for Chrome and Android. Nothing reaches Google from a device where you have not turned notifications on.
Frankfurter: Gathers the exchange rates central banks publish, which we use to show a shared cost in your own currency. Our server asks it which rates were published on which days, and nothing else, so it receives nothing about anyone.
OpenStreetMap: Draws the maps. Our server asks it for the squares of map on your screen, by their place and zoom, and keeps each for a week, so it receives which parts of the world were looked at and nothing about who looked.

Booking a hotel or a flight

When you book a hotel or a flight in the app, we send your name, email address and phone number (and for a flight your date of birth, gender, nationality and, if you give it, travel document details) to Nuitée Connect (LiteAPI), which makes the booking with the hotel or airline and takes your payment. We never see or store your card details. We keep the booking, its price and its confirmation for as long as the trip. Your travel document is not stored by us.

When you contact Nuitée Connect or a hotel about a booking, they handle what you send them under their own privacy policies.

Data leaving the European Economic Area

Some of the providers above sit outside the EEA, or are owned by a company that does. Rather than say so in general, here is which is which, and what each transfer rests on.

Frankfurter: Nothing about anyone is sent to it, so nothing leaves.
Cloudflare: A United States company running a global network. Covered by Cloudflare’s data processing addendum, which incorporates the European Commission’s standard contractual clauses. The databases behind this service are not pinned to one region, so assume the data they hold may be processed outside the EEA.
Sentry: Keeps the app’s error reports in its EU region, in Frankfurt, Germany. Sentry is a United States company, so its data processing addendum and the same standard contractual clauses cover what its staff reach from there. What travels is an error report with no email address, no IP address and no request body in it.
AeroDataBox, through RapidAPI: United States. Covered by RapidAPI’s terms and the same standard contractual clauses. What travels is a flight number and a date.
OpenStreetMap: Nothing about anyone is sent to it, so nothing leaves.

How long any of it is kept

Your account and everything attached to it: for as long as the account exists.
After you ask for your account to be deleted: removed within 30 days.
Your players, the requests to add one another, and your code and your link: removed on the day you ask for your account to be deleted.
An account that never says whether it is 16 or older: removed after 7 days.
Expenses in a shared-cost group outlive your account, because they are also other people’s records of what they paid. Your name is replaced in them.
A trip you share with other players is handed to one of them on the day you ask for your account to be deleted, with its tournaments and the stays you put there for everyone, and you leave the other trips you are on. What is only yours on those trips, such as your travel, your notes and the stays you put there for yourself alone, is removed that day. A trip nobody else is on is removed with your account. Your half of an entry is taken off it that day and your name on it is replaced; the player you entered with stays on it.
Error reports: at most 90 days, the longest Sentry keeps an error event on any of its plans, and less on the free one. They carry nothing that identifies you.

Your rights, and where they are in the app

The GDPR gives you the right to see what we hold, to correct it, to have it erased, to restrict or object to what we do with it, to take it elsewhere in a usable format, and to withdraw any consent you gave. Two of those are buttons rather than requests.

Take a copy of everything: The profile screen has an export. It is a single file containing everything this service holds about you, served from /api/profiles/me/export.
Have it erased: The profile screen has a delete. Your account stops working immediately and what we hold is removed within 30 days.
Everything else: Write to the address at the top of this page. We answer within a month, as the Regulation requires.

Because your position is never stored, there is nothing about it to export, correct or delete. What we do keep is one fact about the suggestion on Today: whether you said “No thanks” to it. It sits on your profile, is in your copy of your data, and goes when your account does.

If you think we have got this wrong, you can complain to the Dutch supervisory authority, the Autoriteit Persoonsgegevens, or to the authority where you live. You do not have to come to us first, although we would rather you did.

Children

Court Companion is for players aged 16 and over. Once the code we email you has shown the address is yours, and before anything else is asked of you, you say whether you are 16 or older. If you are younger, your account and your email address are removed there and then; an account that never answers is removed after 7 days. We do not knowingly hold data about anyone younger; if you believe we do, write to the address above and it will be removed.

When this notice changes

The date at the top changes with it. Where a change affects what we do with data you have already given us, we will say so in the app rather than relying on you to come back and read this page.