Privacy Policy

1. Who we are

Courting ("Courting", "we", "us", "our") is operated by Sjoerd Geistdorfer, a sole trader based in London, United Kingdom, trading as Courting.

• Correspondence address: 9 Falkland Avenue, London N3 1QR, United Kingdom
• Privacy contact: privacy@gocourting.app
• General support: support@gocourting.app

For the purposes of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, Sjoerd Geistdorfer is the data controller for the personal data processed through Courting.

We are registered with the UK Information Commissioner's Office (ICO) under registration number pending registration.

2. What this policy covers

This policy explains what personal data Courting collects when you use the Courting iOS app, the Courting web app at gocourting.app, and any related services (together, the "Service"). It also explains how we use that data, who we share it with, how long we keep it, and what rights you have.

If you do not agree with this policy, please do not use the Service.

3. The data we collect and why

We only collect data we actually need to run the Service.

3.1 Data you give us directly

3.2 Data generated by using the Service

3.3 Data we deliberately do not collect

For transparency, here is what Courting does not collect:

• Precise location data. The MVP has no geolocation features. If we add location-based check-in later, it will be explicit opt-in and processed in real time without persistent storage.
• Advertising identifiers. Courting is ad-free on every tier and we do not integrate any advertising SDKs or networks.
• Third-party analytics. The MVP does not run Mixpanel, Amplitude, Google Analytics, Segment, or any similar tool. If we introduce analytics later, we will update this policy and, where required, ask for your consent first.
• Health or biometric data. We do not read Apple Health, Google Fit, or any wearable data.
• Payment card details. When subscriptions launch, payments will be processed by Apple (in-app purchase) or Google (Play Billing). Your card details never touch our servers.

4. How we use your data

We use your data only for the purposes listed in section 3 and specifically to:

1. Create and maintain your account and sign you in.
2. Calculate and update your Form based on match results.
3. Match you with other players for doubles and singles sessions.
4. Show your profile, level badge, and match history to other members of clubs you have joined.
5. Send transactional messages (sign-in links, RSVP confirmations, session reminders, match results, account notifications).
6. Detect and prevent abuse, fraud, and rating manipulation.
7. Respond to your support and data protection requests.
8. Comply with legal obligations.

We do not sell your personal data. We do not use your data to train machine learning models. We do not profile you for advertising.

5. What other players can see

Courting is a social product, so some of your data is visible to other members of clubs you join.

Visible to all players in the same club or session

• Your display name and profile photo
• Your playing gender and dominant hand (if set)
• Your level badge (for example, "Social", "Rally", "Match")
• A trend indicator showing whether your rating is going up or down
• Match history for matches you played together

Visible only to you

• Your exact numerical Form
• Your date of birth
• Your email address
• Your self-assessment answers
• Your friendships and partner preferences
• Your private notification settings

Visible to club admins

• Member lists for their club
• Check-in history and session participation records for their club
• Basic account status

Club admins cannot see your exact Form, your password, your email, or your match history from other clubs. You can leave a club at any time from your settings, which revokes that club's visibility of your future activity.

6. Who we share data with

We use a small set of carefully chosen third-party services to run Courting. Each of these acts as a data processor on our behalf under a written data processing agreement. They may only process your data on our instructions and for the purposes listed below.

International transfers from the UK to these providers rely on the UK Extension to the EU-US Data Privacy Frameworkand, where applicable, the European Commission's Standard Contractual Clauses. You can request a copy of the safeguards in place for any specific transfer by emailing privacy@gocourting.app.

We do not share your personal data with any party not listed above except:

• When another Courting player can see it per section 5.
• When required by law, a valid court order, or to respond to a legitimate legal request.
• When necessary to protect the safety of our users or the integrity of the Service.
• If Courting is ever acquired or merged, in which case we will notify you at least 30 days in advance and give you the option to delete your account before any transfer.

7. How long we keep your data

If you do not sign in for 24 consecutive months, we will email you a re-engagement notice. If you do not respond within 30 days, we will archive and then delete your account.

8. Account deletion

You can delete your account at any time from the in-app settings. Deletion is immediate. There is no 30-day recovery window.

Deleted immediately

All personally identifiable information is permanently erased from our active systems within minutes, and from backups within 90 days:

• Your name, email, profile photo, bio, phone number
• Your settings, friendships, partner preferences
• Your device tokens, notifications, RSVPs, check-ins, queue entries
• Your authentication records

Retained in anonymised form

The following is anonymised and retained:

• Match records you played with other people. Matches are shared data. They involve other players whose rights we also have to respect. Your identity in every match is replaced with "Deleted Player" and no personal data remains linked to the match.
• Your final rating values (numerical rating parameters and level at the moment of deletion) and match count, stored under a tombstone record.
• A one-way hash (SHA-256) of your email, Apple ID, or Google ID, used solely to reconnect your previous rating if you ever re-register with the same sign-in method. The hash cannot be reversed to recover your identifier.

Why we retain the tombstone

We retain the tombstone for two reasons:

1. Fair play integrity. Without it, a player could delete their account after a calibration period and re-register to reset an unfavourable rating. This would harm every other player. Tombstone-based rating restoration makes deletion neutral from a competitive standpoint.
2. Statistical integrity. Anonymised match records are analogous to sports federation records. Retention is justified under UK GDPR Art. 17(3)(d) for statistical purposes and Art. 6(1)(f) as a legitimate interest in fair play.

If you ever re-register with the same email, Apple ID, or Google account, your previous rating will be automatically restored. Your old (anonymised) match history is not re-linked.

What deletion does not do

Deleting your Courting account does not cancel any subscription you may have with Apple or Google. You must manage that separately in iOS Settings or the Play Store. We will remind you about this during the deletion confirmation flow.

If you own a club

If you own a club and you delete your account, the club does not disappear. It becomes ownerless. The next member to join can claim ownership. This protects other members from losing their community.

9. International data transfers

Courting's infrastructure is primarily hosted in the United States. When your personal data leaves the UK or EEA, we rely on the UK Extension to the EU-US Data Privacy Framework and, where applicable, Standard Contractual Clauses approved by the European Commission, to ensure your data continues to receive an equivalent level of protection.

10. Your rights under UK GDPR

You have the following rights over your personal data:

1. Right of access. Request a copy of the personal data we hold about you.
2. Right to rectification. Ask us to correct inaccurate or incomplete data.
3. Right to erasure ("right to be forgotten"). Ask us to delete your data, subject to the tombstone exceptions in section 8.
4. Right to restriction. Ask us to pause processing of your data while we investigate a concern.
5. Right to data portability. Receive your data in a machine-readable format (JSON export) so you can move it elsewhere.
6. Right to object. Object to processing based on legitimate interests, including for fraud prevention.
7. Right to withdraw consent. Where processing is based on consent, you can withdraw it at any time without affecting the lawfulness of prior processing.
8. Right not to be subject to solely automated decision-making. Form calculation is automated, but it does not produce legal or similarly significant effects (it determines which friendly matches you play, not any legal right), so Article 22 does not apply. You can still ask a human to review your rating by contacting support.

To exercise any of these rights, email privacy@gocourting.app. We will respond within one calendar month. We will not charge you for a request unless it is manifestly unfounded or excessive.

11. Complaints

If you believe we have mishandled your personal data, please contact us first at privacy@gocourting.app so we can try to fix it. You also have the right to complain to the UK Information Commissioner's Office:

12. Security

We protect your data with industry-standard security measures:

• All traffic between your device and Courting is encrypted in transit with TLS.
• Data at rest is encrypted by our infrastructure providers.
• Authentication uses short-lived session tokens. We never store passwords in plain text.
• Access to production systems is restricted to named operators and logged.
• We follow the principle of least privilege for all data access.

No service can guarantee perfect security, but we take the protection of your data seriously. In the unlikely event of a data breach that poses a risk to your rights and freedoms, we will notify the ICO within 72 hours and, where required, notify you directly without undue delay.

13. Children

Courting is for people aged 16 and over. We verify age at signup by requiring a date of birth and refusing accounts where the user is under 16. We do not knowingly collect personal data from children under 16. If we discover we have accidentally collected data from a child under 16, we will delete it immediately. If you believe a child under 16 has created an account, please email privacy@gocourting.app.

14. Changes to this policy

We may update this policy as Courting evolves. For example, when we add new features, change sub-processors, or launch subscriptions. When we make a material change, we will:

• Update the "Effective date" at the top.
• Post a notice in the app and on gocourting.app.
• Email registered users at least 14 days before the change takes effect, where possible.

Minor clarifications (typos, rewording) may be published without notice. Every version is archived, and the change log is available on request.

15. Contact us

• Privacy questions and data rights requests: privacy@gocourting.app
• Security disclosures: security@gocourting.app
• General support: support@gocourting.app
• Postal: Sjoerd Geistdorfer, trading as Courting, 9 Falkland Avenue, London N3 1QR, United Kingdom