Privacy policy · Buddy Club

1. Who we are

Buddy Club operates the websites and apps at buddy-club.com and rally.buddy-club.com (together, the Service). For the data described in this policy we are the data controller, except for records that a club or group organiser adds about other people, which section 4 explains. You can reach us at hello@buddy-club.com.

This policy is written for the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. If you use the Service from elsewhere, we apply the same standards.

2. What we collect

Account and sign-in

Your email address, and a password if you choose one. Passwords are stored only as a salted hash by our authentication provider; we never see them.
The full name you type when you create an account, which becomes your initial display name.
If we later offer sign-in with Google or Apple and you use it, the name, email address and profile picture that provider shares with us. We use these only to create and sign you in to your account and do not request any other data from your provider account.
Sign-in events, including the time and the rough device and browser type.

Profile

Your display name, which you can change at any time.
A profile picture, if you upload one.
Interests and a locality you choose, used to suggest nearby groups and gatherings.
Your theme preference and Rally onboarding choices (sports, role).

Taking part

The clubs and groups you belong to, your role in them, and when you joined.
Gatherings and sessions you RSVP to, check in to, or attend, and the time of each.
Rally play records: court assignments, pairings, rotations, match results, scores, standings and league or tournament positions.
Content you add: group names and descriptions, gathering details, venue details, club names and notes.
Invitations and join codes you create or redeem, and who used them.

Technical data

Server logs with your IP address, request path, time, browser type and the result of the request. We use them to keep the Service running, to find faults and to stop abuse.
An audit trail of significant actions (for example who changed a result or removed a member), kept so organisers can resolve disputes.

We do not use advertising trackers or third-party analytics, and we do not collect precise location from your device. The locality you see is the one you type or pick.

3. Why we use it and our lawful basis

To provide the Service (performance of a contract): creating and signing in to your account, showing you groups and sessions, letting organisers run them, running rotations and leagues, and sending the emails needed to sign in or confirm an action.
To suggest things near you (our legitimate interest in making the Service useful, guided by the interests and locality you choose): ranking public groups and gatherings on the home and explore pages.
To keep the Service safe and working (legitimate interest): logs, rate limits, fraud and abuse prevention, backups, and the audit trail.
To meet legal obligations: responding to lawful requests and keeping records we are required to keep.
With your consent where we ask for it, for example before any product news emails. You can withdraw consent at any time.

We do not sell personal data and we do not use it for automated decisions with legal effect.

4. Data added by organisers about other people

Organisers can add people to a club or session who do not have an account, usually a walk-in or a regular player, by typing a name and optionally a contact detail. The organiser’s club decides whom to add and is responsible for having a good reason to do so and for telling the person. We process those records on the club’s behalf to run its sessions, leagues and results, and we apply this policy’s security and retention rules to them.

If someone has added you and you would rather not appear, contact the organiser first; if that does not resolve it, contact us at hello@buddy-club.com and we will help. A person without an account can later claim their record by proving to the organiser that it is theirs, after which the history stays attached to the same record.

Members of your clubs and groups see your display name, picture, attendance, pairings and results for that club or group. They do not see your email address unless you share it.
Organisers of a club or group you belong to can also see your email address and when you joined, so they can run it.
Anyone, when something is public. Public groups and gatherings appear in search and on the home and explore pages with the organiser’s chosen description and counts, not member lists. When an organiser turns on a public board for a session or meet, anyone with its link can see team names, courts, scores, standings and timers, and on social session court boards the display names of the players on court. Public boards never show contact or profile details.
Service providers listed in section 6, who act on our instructions.
Authorities, when the law requires it or to protect someone’s safety.
A successor, if the Service changes hands; we would tell you first and this policy would continue to apply.

6. Services we rely on and where data is stored

Supabase hosts our database, authentication and uploaded files in the European Union (Ireland). It sends the sign-in and confirmation emails.
Vercel hosts the websites and the API, with our server functions in the European Union (Dublin). Vercel’s global network serves static files and sees the IP address of each request, as any web host does.

Your data is stored in the UK or the European Economic Area. Where a provider processes data outside the UK, it does so under the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, or an adequacy decision.

7. Cookies and similar technology

We only set cookies the Service needs to work, so there is no cookie banner. None are used for advertising or cross-site tracking.

Sign-in session (set by our authentication provider): keeps you signed in across pages and both hosts. Cleared when you sign out, otherwise refreshed while you keep using the Service.
bc-theme: remembers whether you chose light, dark or system theme.
rally-onboarded, rally-sports, rally-role: remember that you finished Rally’s first-run steps and what you picked, so we do not ask again.
Local storage on your device may hold a draft or a recently viewed page so the app feels quick. It never leaves your device.

You can delete cookies in your browser at any time; you will be signed out.

8. How long we keep data

Your account and profile: until you delete your account or ask us to.
Club, group and play records: for as long as the club or group keeps them, because results, standings and attendance are the club’s record of what happened. When you delete your account your display name on those records is replaced by an anonymous label; the results themselves are not rewritten.
Participant records without an account: until the organiser removes them, or in any case after a period of inactivity we will set and publish here before the first full season.
Server logs: up to 30 days. Audit trail: up to two years, so disputes about a season can be settled.
Backups: database backups roll over within 30 days of a deletion.

9. Your rights

Under UK GDPR you can ask us to:

tell you what personal data we hold about you and give you a copy;
correct data that is wrong (you can edit your profile yourself);
delete your account and personal data, subject to section 8;
restrict or object to processing based on legitimate interests;
give you your data in a portable format;
withdraw consent where consent is the basis.

Email hello@buddy-club.com and we will respond within one month. We may ask you to confirm it is you, usually by replying from the address on the account. If you are not satisfied, you can complain to the Information Commissioner’s Office at ico.org.uk.

10. Children

You must be at least 16 to hold an account. Clubs may run sessions for younger players and record them as participants without an account; the club is responsible for the parent or guardian consent that this needs. Parent and toddler groups are listed and run by adults, and only the adult has an account.

11. Security

Data travels over HTTPS. Access to the database is restricted by row-level policies so that each person and club sees only what they are entitled to, and public pages are served from filtered copies that contain no contact or profile data. Sign-in links and guest links are single-purpose, expire, and are stored only as hashes. No system is perfectly secure; if we learn of a breach that affects you we will tell you and the regulator as the law requires.

12. Changes to this policy

We will update this page when the Service changes, and change the effective date at the top. For a change that materially affects you we will also tell you in the app or by email before it takes effect.

13. Contact

Buddy Club, hello@buddy-club.com. Our terms of use set out the rules for using the Service.